OUR SERVICES
From investigating an active compromise to identifying security weaknesses before an incident occurs, Sandpiper Forensics provides specialist, evidence-led support with clear findings and practical next steps.
WHEN SOMETHING HAS HAPPENED
Investigate
Establish what happened, when it happened, what was accessed and the extent of the compromise.
BEFORE SOMETHING HAPPENS
Strengthen
Review your Microsoft 365 environment, identify security weaknesses and receive clear, prioritised recommendations.
Business Email Compromise
Investigation of account compromise, fraudulent emails, payment diversion and attacker activity.
EXAMPLE AREAS COVERED
✓ Account & sign-in activity
✓ Mailbox & email activity
✓ Inbox rules & forwarding
✓ Attacker persistence
✓ Fraudulent communications
✓ Fraud & payment timelines
EXAMPLE AREAS COVERED
✓ Entra ID & audit logs
✓ Mailbox & email access
✓ MFA & authentication
✓ Permissions & applications
✓ Inbox rules & forwarding
✓ Investigation timelines
Microsoft 365 Investigations
Detailed analysis of Microsoft 365 activity to establish what happened and determine the scope of suspicious or unauthorised activity.
Digital Forensics
Forensic examination of computers, accounts and digital evidence to establish activity, timelines and impact.
EXAMPLE AREAS COVERED
✓ Endpoint examination
✓ User & file activity
✓ Timeline reconstruction
✓ Evidence preservation
EXAMPLE AREAS COVERED
✓ Identity & MFA
✓ Conditional Access
✓ Privileged accounts
✓ Mailbox, sharing & audit
✓ Application permissions
✓ Prioritised recommendations
Microsoft 365 Security Review
Review of your Microsoft 365 security configuration to identify weaknesses and provide clear, prioritised recommendations.
Incident Response
Support to contain an incident, establish its scope and determine the appropriate next steps.
EXAMPLE AREAS COVERED
✓ Initial assessment
✓ Scoping & preservation
✓ Containment guidance
✓ Recovery recommendations
EXAMPLE AREAS COVERED
✓ Clear findings
✓ Evidence timelines
✓ Technical analysis
✓ Plain-English recommendations
Forensic Reporting
Clear, evidence-based reporting explaining what happened, the supporting evidence and recommended next steps.
SPECIALIST SUPPORT
Need additional specialist capacity?
Sandpiper Forensics is also available for contract and subcontract engagements, supporting MSPs, cybersecurity providers and internal teams that need additional digital investigation, incident response or Microsoft 365 expertise.
Discuss a contract engagement
STARTING A CONVERSATION
Not sure what you need?
You don’t need to diagnose the problem before contacting us. Tell us what’s happened or what you’re concerned about, and we’ll help determine the appropriate next steps.
CONTACT
Speak to an investigator.
Tell us what’s happened or what you’re concerned about. We’ll help determine the appropriate next steps.
Speak to an Investigator