AuditTrace Labs offers commercial forensic review and system-state preservation: examining authorized digital evidence, preserving the state surrounding meaningful change, and preparing a record another reviewer can follow later.
Each engagement is defined before it begins. Which systems, accounts, devices, records or evidence are in scope. Who authorized the work. What will be preserved, what will be produced, and what the engagement will not attempt.
Consulting and technical advisory are part of this work. They exist as capabilities attached to forensics and preservation — reviewing configuration, advising on evidence readiness, validating a remediation — rather than as the identity of the company. The laboratory work comes first; the advisory work follows from it.
A single matter can draw on more than one of them.
Examination of authorized digital evidence — storage media, logs and event context, packet evidence, configuration and system artifacts — with attention to chronology, provenance and the relationships between artifacts.
Review of how evidence was acquired, handled and described, and whether its provenance is documented well enough to carry the conclusions drawn from it. A checksum is one input to that question, not the answer.
Fragmented material assembled into an ordered, described set: what each item is, where it came from, how the items relate, and which questions the set cannot address.
Artifacts, manifests, acquisition context, chronology and documented limitations, structured so a reviewer who was not present can follow the work.
Capture of the relevant condition of a system around an authorized, meaningful event, so later review does not rest on memory or a single surviving log.
What a system looked like before an event, what remained afterward, and the recorded difference between them — to the extent the available evidence supports it.
Review of configuration, relationships and effective state: what a system was actually set to do, compared with what it was believed to do.
Whether the evidence a system currently produces would support reconstruction later, and where the gaps sit, before an incident makes the question urgent.
Preservation of the record around a decision — what was known, what changed, what was approved — so the reasoning stays reviewable later, where the available source evidence and chosen retention scope support it.
Independent review of whether a remediation or recovery did what it was intended to do, read from the preserved state rather than from the assertion that it worked.
Scoped security-boundary testing in support of a forensic or preservation objective, where appropriate and where the systems involved are owned or can be authorized. Written scope and human approval come first.
Advisory related to forensic and preservation work: preservation design, evidence handling, retention scope, and the technical questions that surface before and after an examination.
A bounded engagement answering one defined technical question — a second read of existing findings, a scoping opinion, or a view on whether deeper examination is warranted.
You describe what happened and what you need to understand. The initial inquiry is deliberately brief — please do not send credentials or sensitive evidence through it.
We discuss the matter, the systems and evidence involved, who is able to authorize the work, and whether this is the right laboratory for the question. An inquiry does not guarantee acceptance.
Before work begins: scope, authorization, protected assets, allowed and forbidden actions, safety controls, stop conditions, and what the final report will contain.
Work proceeds inside that scope. Findings are human-reviewed. Software prepares the record; a person decides what the record means.
Scope does not expand quietly.
If a new question appears mid-engagement, it is raised, scoped and authorized before it is pursued. Additional access, additional systems and additional collection are decisions for the person who authorized the work — never side effects of it.
AuditTrace Labs maintains a separate inquiry path for people who believe meaningful digital evidence deserves technical review, but whose matter falls below the engagement thresholds normally associated with a large forensic firm.
It is a distinct path with its own scope, its own limits and its own review — not a smaller version of a commercial engagement, and not a substitute for one. Which path fits is part of the first conversation. Either way, an inquiry is not an acceptance.
These limits are published because they shape what an engagement can honestly deliver. AuditTrace Labs claims no certifications, licenses or accreditations, and does not predict how any reader of a record will interpret it.
If someone is in immediate danger
Contact local emergency services. AuditTrace Labs is not an emergency service and cannot respond as one.
There is no standard package here and no published figure. What an engagement requires depends on the systems and records in question, the evidence that still exists and its condition, the authorization needed to reach it, and the depth of documentation and review the matter calls for.
Scope and cost are established together, in writing, before work begins. That also means we will say when a matter does not need what a forensic laboratory offers, or when the surviving evidence will not support the question being asked. Saying so at the start is more useful than discovering it at the end.
A first message needs only the question you are trying to answer and the systems or records it concerns. Please send no credentials and no sensitive evidence.
