Outsourcing internal forensics investigations
We currently conduct in-house forensics from time to time, typically involves checking to see if a user had stored any business-related documents on external media and if so when was the last time they accessed them. We also use ShellBags to look for the presence of business-related folders on external media. We occasionally look at MFT and USN Journal to cross-check whether files may have existed on the local drive. Basically building a picture.
We might want to out-source this operation in future, I appreciate that 3rd parties wouldn't be able to make any value judgements so would expect a deliverable to state factually what was where and when.
Does anyone know any 3rd parties who could take on this type of work in Connecticut and/or Texas, and UK. We would send the computer together with decryption key (currently McAfee WDE but moving to Bitlocker with Intune) to the 3rd party. I also appreciate that the configuration of the internal drive may affect things as may the presence or quantity of VSCs, but assume 500GB SSDs and 2 VSCs (which is what I've seen mostly recently).
Also, we don't do currently any forensics on mobile devices (skills and tools), but I can't see that this is not an area we wouldn't want to explore in future so would be good if 3rd parties also had that capability.
If anyone has a feel for pricing too that would be great!
PM me if that's better for you.
Look forward to hearing from some folks