Case Studies

1Problem

A small consulting firm discovered that an attacker had taken control of an employee’s workstation through a remote-desktop tool. While connected, the attacker viewed passwords stored on the computer and used them to make several fund transfers.

The firm needed to know how far the intrusion went: whether client personal data had been exposed, whether the attacker still had a way in, and what had happened on the machine. It also needed documentation strong enough to support an insurance claim.

2Approach

EDG collected the affected workstation under a documented chain of custody and made a forensic image of it, so the original evidence was preserved untouched.

We worked onsite and remotely in parallel:

• Network and penetration scans of the firm’s environment to look for other weaknesses or signs of continued access
• Analysis of remote-access, firewall, endpoint protection and shared-folder logs to reconstruct the attacker’s activity
• A search of the workstation for remnants of remote-access tools, a review of system event logs, and recovery of deleted files

We then produced two documents: a full forensic report detailing our methods and findings, and a concise summary for the firm’s insurer, which we refined together with the firm’s attorney.

1Problem

A client suspected that malware had spread across several of their devices and their network, but had no way to confirm it or to know which devices, if any, were affected.

They needed a thorough, independent answer for each device without having to bring everything into an office.

2Approach

EDG shipped the client a secure evidence collection kit so devices could be sent to us safely and with chain of custody intact.

At the same time, we examined the client’s environment remotely:

• A remote network and penetration scan to identify vulnerabilities and suspicious activity
• A review of network logs

Our examiners then carried out full forensic examinations of each device: two computers running different operating systems, and a smartphone.

1Problem

A high-profile business leader attracts a constant volume of online attention. Most of it is routine, but some of it can be hostile, and the leader’s security team needed to know, every day, whether anything being said or shared online pointed to a threat, an impersonation attempt or exposed personal information.

Searching social media, news, forums and the dark web by hand every day was not practical for the security team, and raw keyword alerts produced too much noise to act on with confidence.

2Approach

EDG began by agreeing the scope with the client’s security team: who and what to monitor, which kinds of findings matter most, and who should be contacted, and how, when something urgent comes up.

Our analysts now monitor every day across:

• Social media platforms
• News and online publications
• Forums and message boards
• Dark web sources

Every finding is reviewed and verified by an analyst before it is reported, so the security team receives confirmed, relevant information rather than raw search results.

The security team receives a daily briefing. Between briefings, urgent alerts go out for:

• Threatening or hostile content
• Impersonation accounts
• Exposed personal information

1Problem

A forged check was presented against a client’s account. The check was tied to a package that had been stolen.

The client needed help establishing what had happened and dealing with the bank and the shipping carrier.

2Approach

EDG reviewed the check image and examined the signature.

We then coordinated with the client’s bank and with the shipping carrier.

1Problem

A growing professional organization with several offices had outgrown its patchwork approach to IT. Accounts, devices and security tools were managed inconsistently, support depended on whoever was available, and leadership had no clear view of risk or of what technology would cost from one year to the next.

They wanted one accountable partner to run IT and security, with predictable costs.

2Approach

The organization moved to EDG’s flat-rate managed IT service. EDG took responsibility for:

• The cloud email and productivity suite, including user accounts, multi-factor authentication and email security
• Next-generation endpoint protection, deployed and monitored on every device
• Firewalls and other security appliances
• Regular patching of operating systems and applications
• Monitored backups, with routine test restores
• Around-the-clock monitoring of systems and security alerts
• A help desk with remote support for staff in every office and on the road
• Documentation of systems, accounts and procedures

EDG also serves as the organization’s virtual CIO, maintaining a technology roadmap and helping leadership plan upgrades and budgets.