Digital forensics.
Evidence that holds up.

The compromise was cloud-side: a password-spray attack against a mailbox that had no multi-factor authentication. The attacker logged in from overseas IPs and ran mailbox automation from the cloud — never from a company computer. The “scripts” in the alerts were server-side mail commands, not malware on a laptop.

The disk image we were first handed turned out to be an empty rebuild scaffold — no user data at all. We proved it three independent ways rather than trust the label, then located the actual machine and acquired it properly.

The endpoint was a modern Apple-Silicon Mac that can’t be imaged the usual way. We triaged it live and read-only over an isolated, air-gapped link — collecting persistence, processes, remote-access config and indicators without altering the scene, then removing every artifact afterward.

The laptop was clean: no malware, no unauthorised remote access, no rogue admin, every startup item a legitimate vendor. We confirmed the breach lived entirely in the cloud account, closed the endpoint question, and handed over a remediation runbook — starting with MFA everywhere.

Participated in investigating a cyber breach to determine whether protected data had been exposed and to bound the affected systems.

Leveraged forensic tools and techniques to establish the breach’s depth and scope across the environment.

Delivered a containment and exposure report that let the institution act on a clear, evidence-backed picture.

Evaluated possible data exfiltration from former employees for a banking client.

Used forensic tools to perform an in-depth analysis of access, movement, and handling of sensitive data.

Reported findings that ensured the client’s data protection posture and informed next steps.

Investigated possible data exfiltration arising from a cyber-attack on a healthcare environment.

Applied forensic tools and techniques to trace attacker activity and assess data movement.

Provided the client with a clear read on what the attack did and did not reach.

Championed a team providing incident response and investigation into a municipality’s suspected breach.

Investigated the client’s systems to identify potentially exposed data and information.

Gave the municipality a coordinated response and a clear account of exposure.

Contributed to a team investigation pursuing an online offender in a harassment matter.

Applied digital investigation and correlation techniques to surface and confirm identifying signals.

The work supported an outcome that resulted in an arrest.

Investigated a coordinated harassment and defamation campaign against a public-figure client run through fake accounts.

Correlated multiple fake social-media accounts to identify the source of the attack.

Identified those responsible; the engagement resulted in an arrest.

Investigated significant corporate espionage targeting a client’s intellectual property.

Identified the actors who gained access to steal the client’s IP and built the supporting picture.

The work led to a large settlement and destruction of the stolen IP.

Aided a class-action lawsuit over alleged overcharging of interest and processing fees.

Led a team performing validation, analysis, and reporting on a problematic data set provided by the opposing party.

Supported the client’s strategy and analysis through the trial and settlement process.