Incidents andforensic investigation
What actually happened?
We reconstruct events, connect available facts and traces, identify causes and recommend practical measures to prevent recurrence.
MOVE THE POINTER OVER THE TRACES TO CONNECT THEM
Incident investigation at a glance
Six answers to the questions most often asked after an event.
- A reconstructed sequence of events
- Identified causes and contributing factors
- Lessons and measures
- Documented findings
The next step is a 30-minute discussion. The topic is preselected — you can change it in the form.
Book a discussion →Organisations following an incident or disputed event.
When you need to establish exactly what happened, in what sequence and why — and what measures should follow.
Traces and information, a timeline, key decisions, deviations and failures, causes and contributing factors, lessons and measures.
An initial 30-minute discussion, online or in person. You describe the situation; together, we define the approach.
These depend on the engagement, the size of the organisation and the number of locations. They are agreed after the initial discussion.
The incident ends. The investigation is just beginning.
After an incident, knowing what happened is not enough. You need to understand the sequence, causes, failures and opportunities to respond.
From an event to the complete sequence.
Event
What was observed, when, and under which circumstances.
Traces and information
Records, logs and data that can be verified.
Timeline
The sequence from the first signal to the consequence.
Key decisions
Moments when events could have taken a different course.
Deviations and failures
Where actions departed from the intended process and why.
Causes and contributing factors
The immediate cause and the underlying factors that enabled it.
Lessons and measures
What must change to prevent the same failure recurring.
Documented findings
Established facts, sources and conclusions remain documented and verifiable.
An incident does not begin when we notice it.
Analysis also looks at what preceded the event — signals, changes, deviations and missed opportunities to respond.
A deviation existed and could have been noticed.
The signal was not recognised as a reason to act.
The situation develops without corrective action.
The event becomes visible and consequences arise.
Why did this happen?
An incident rarely has just one cause. We distinguish the immediate cause from the underlying factors that enabled it.
An incident rarely has a single cause.
Where did the system have an opportunity to respond?
Facts before assumptions.
Formal court expert evidence and laboratory findings are not automatically included in this service; they involve separate professional procedures.
The aim is not to find someone to blame. It is to understand the event.
Analysis is based on facts, the sequence of events and the factors that enabled the incident.
What the incident revealed may have existed long before the event itself.
Explore blind spots →Not only what happened. What we change now.
A finding becomes useful when it has an owner, a deadline and a check of its effect.
What the investigation established.
A point where the system could have responded.
A change that removes the enabling condition, not just the symptom.
The person or function implementing the measure.
When the measure must be implemented.
Confirmation that the measure has the intended effect.
When does forensic incident investigation make sense?
SCOPE DEPENDS ON THE INCIDENT
Frequently asked questions
{{ f.a }}
The incident is over. The learning need not be.
If you need to understand the sequence, causes and points where the system could have responded differently, we can define an appropriate scope of investigation together.
FROM TRACE TO A CLEARER PICTURE. FROM FINDING TO CHANGE.