CYBER CENTAURS F.A.Q.
Questions Before an Engagement.
Answers to common questions about Cyber Centaurs' incident response, digital forensics, investigations, security testing, evidence handling, and engagement process.
For questions specific to a particular service or matter, contact Cyber Centaurs to discuss the circumstances directly.
Contact Cyber Centaurs →GETTING STARTED
Working With
Cyber Centaurs.
Cyber Centaurs assists organizations, legal teams, and other authorized clients with cybersecurity incidents, digital forensic investigations, disputed digital evidence, and proactive security testing.
What types of matters does Cyber Centaurs handle?
Cyber Centaurs provides incident response, digital forensics, insider and trade secret investigations, mobile forensics, expert-witness and litigation support, penetration testing, threat hunting, and related cybersecurity investigative services.
How do we know which service we need?
You do not need to determine the exact technical scope before contacting Cyber Centaurs. Describe what occurred, the systems or evidence involved, and the questions you need answered. The initial discussion can help determine the appropriate investigative or security-testing approach.
Can Cyber Centaurs work with organizations outside Florida?
Cyber Centaurs is based in Florida and has historically described its work as having national reach. Whether a matter is handled remotely, on site, or through another collection approach depends on the engagement, evidence, and authorization involved.
Can an investigation begin remotely?
Many engagements can begin remotely through secure collection of endpoint data, cloud records, email, logs, security telemetry, or other authorized evidence. Some matters require devices to be shipped or an examiner to perform on-site collection depending on the evidence and circumstances.
How quickly can Cyber Centaurs begin?
Timing depends on the type of matter, urgency, scope, evidence involved, and resource requirements. Active cybersecurity incidents should be identified as urgent when contacting Cyber Centaurs so immediate priorities can be evaluated.
INCIDENT RESPONSE
Responding to a
Cyber Incident.
Incident-response questions often begin before the full facts are known. The priority is to reduce risk while preserving the evidence needed to understand what happened.
When should we contact an incident-response firm?
Contact Cyber Centaurs when a suspected compromise may require investigation, evidence preservation, containment, or coordinated response. You do not need to know the full scope before seeking assistance.
Should we shut down a compromised computer or server?
Not automatically. Shutting down, rebooting, reimaging, or otherwise modifying a system can alter useful evidence. If immediate containment is required, take reasonable steps to reduce ongoing risk while avoiding unnecessary changes until preservation considerations have been evaluated.
What should we preserve after discovering a cyber incident?
Relevant evidence may include affected endpoints and servers, identity and authentication logs, cloud audit records, email, firewall and VPN logs, EDR or security telemetry, file-access records, and other systems associated with the incident.
Can Cyber Centaurs investigate ransomware?
Yes. Cyber Centaurs can investigate ransomware and cyber-extortion incidents, including threat-actor activity, affected systems and accounts, persistence, potential data access or exfiltration, and other evidence relevant to containment, recovery, and breach-impact decisions.
Can you investigate Microsoft 365 or business email compromise?
Yes. Investigations may include Microsoft 365, Entra ID, Exchange Online, authentication activity, mailbox audit records, forwarding rules, cloud storage, application activity, endpoints, and other evidence relevant to the compromise.
Can you determine whether data was stolen?
Cyber Centaurs evaluates available evidence for file access, staging, archive creation, cloud transfers, external sharing, removable-media activity, and other potential exfiltration behavior. Whether data removal can be conclusively established depends on the evidence retained by the affected environment.
DIGITAL FORENSICS & INVESTIGATIONS
Understanding
Digital Evidence.
Digital forensic work focuses on preserving and interpreting available evidence so findings can be tied back to the record, not assumption.
What is a computer forensic investigation?
A computer forensic investigation preserves, collects, examines, and interprets digital evidence from computers and related systems to help establish relevant activity, timelines, data access, communications, or other facts associated with a matter.
Can deleted files or messages be recovered?
Sometimes. Recovery depends on the device, storage technology, operating system, application, encryption, subsequent activity, backups, cloud sources, and other technical factors. Deleted-data recovery cannot be guaranteed.
Can you determine whether an employee copied company files?
In some matters, forensic artifacts may provide evidence of file access, copying, downloads, cloud synchronization, email forwarding, archive creation, removable media, or other data movement. Whether specific copying can be conclusively established depends on the evidence available.
Can you determine whether a USB drive was used?
Computer forensic artifacts may identify connected USB or external storage devices and provide information concerning device history and relevant file activity. The ability to establish exactly what was transferred depends on the artifacts retained by the computer, storage device, and other evidence sources.
Can Cyber Centaurs examine mobile phones?
Yes. Mobile forensic work may involve iPhones, Android devices, communications, applications, media, browser activity, backups, cloud sources, and other available evidence. Data availability varies substantially by device and technical circumstances.
Do you work with attorneys and litigation teams?
Yes. Cyber Centaurs supports in-house and outside counsel in matters involving digital evidence, forensic investigation, litigation support, expert consultation, expert-report review, deposition support, and expert testimony where appropriate.
PROACTIVE SECURITY
Testing Before
the Incident.
Proactive security work evaluates risk before an incident, but the findings still depend on scope, available visibility, and the evidence produced during testing or hunting.
What is the difference between penetration testing and vulnerability scanning?
Vulnerability scanning primarily identifies potential weaknesses through automated testing and known signatures. Penetration testing evaluates whether selected weaknesses can actually be exploited and what access or impact they may enable within an authorized scope.
What is threat hunting?
Threat hunting is a proactive investigative process that searches available security telemetry for suspicious or malicious activity that may not have triggered existing security controls.
Does penetration testing prove our network is secure?
No. Penetration testing evaluates the defined scope, attack surface, testing period, and techniques used during the engagement. It can identify and validate meaningful weaknesses but cannot prove that no vulnerabilities or attack paths exist.
Does threat hunting prove our environment is clean?
No. A threat hunt can identify suspicious activity within the systems, telemetry, time period, and investigative scope available for analysis. It cannot establish that no compromise exists anywhere in or outside the available visibility.
Can penetration testing disrupt production systems?
Testing is performed under defined rules of engagement intended to control operational risk. Scope, exclusions, testing windows, communication procedures, and potentially disruptive actions should be addressed before testing begins.
ENGAGEMENT & EVIDENCE
Protecting the
Investigative Record.
Evidence handling, confidentiality, and communication procedures should be matched to the matter rather than improvised through public website channels.
Should we send evidence through the public contact form?
No. Do not submit forensic images, credentials, privileged materials, sensitive files, regulated data, or other evidence through the public contact form. After an engagement is established, Cyber Centaurs will provide appropriate secure methods for information and evidence transfer.
How should we preserve a computer that may contain evidence?
Avoid unnecessary use, deletion, software installation, reimaging, operating-system resets, or other changes that may alter relevant evidence. Contact Cyber Centaurs to discuss preservation and collection options appropriate to the device and matter.
Can Cyber Centaurs work directly with legal counsel?
Yes. Cyber Centaurs can coordinate investigative and forensic work with internal or outside counsel according to the requirements and authorized scope of the matter.
Will our inquiry be treated confidentially?
Cyber Centaurs handles investigative inquiries and client matters with appropriate confidentiality. However, sensitive evidence, passwords, credentials, privileged materials, or protected files should not be submitted through the public website form.
How is evidence transferred after an engagement begins?
After an engagement is established, Cyber Centaurs will coordinate an appropriate evidence-transfer method for the matter. Public pages should not be used to transmit sensitive evidence, credentials, privileged material, or protected files.
Do you provide written reports?
Many forensic, incident-response, expert, and security-testing engagements can include written findings or reports appropriate to the scope of the work. The specific deliverables depend on the engagement and investigative objectives.
STILL HAVE A QUESTION?
Start With a
Confidential Conversation.
If your question depends on the circumstances of a specific incident, investigation, or security need, contact Cyber Centaurs to discuss the matter directly.