When the worst happens, every minute matters.
Macksofy's DFIR team responds to ransomware, business email compromise, insider threats and APT intrusions across India and the GCC. Court-admissible chain of custody, structured Velociraptor + KAPE collection, expert reporting for regulators, insurers and law enforcement.
What is DFIR?
DFIR (Digital Forensics and Incident Response) is the discipline of containing a live cyberattack, investigating how it happened, and recovering safely — covering ransomware, business email compromise, and Active Directory compromise. Macksofy's GCFA/GREM/CHFI-certified team responds across India, preserves evidence, and files CERT-In incident reports.
T+0 → T+7d. Every minute documented.
Anonymised composite from the typical Macksofy ransomware engagement — what happens at each clock-tick from the moment your CISO hits the hotline.
- Contain incidents in hours, not weeks
- Preserve evidence for legal / regulatory action
- Satisfy CERT-In incident reporting requirements (6-hour rule)
- Reduce insurance claim disputes via proper documentation
Triage call
T+030-min bridge · scope · isolate · engagement letter
Evidence collection
T+2hVelociraptor agents · KAPE offline · cloud log preservation
Live analysis
T+8hVolatility 3 memory · Plaso timeline · IOC extraction
Containment
T+24hAttacker eviction · persistence removal · cred reset
CERT-In report
T+72h6-hour-rule compliant · insurance · legal-ready
Recovery + lessons
T+7dHardening plan · detection upgrades · tabletop replay
Evidence that survives court.
Every forensic artifact gets a SHA-256, a custodian signature and an encrypted storage chain — accepted by Indian courts, RBI investigations, CERT-In and cyber-insurance arbitrators.
FTK Imager · write-blocker · SHA-256 captured
Volatility 3 memory · network state · open handles
Encrypted storage · access log · custodian signed
Air-gapped lab · Autopsy · Plaso timeline
Chain log · expert testimony · CERT-In format
Ransomware · BEC · insider threat.
Ransomware (LockBit variant)
Root cause · Initial access via exposed RDP + leaked creds; lateral movement via PsExec
Containment in 11h; 80% of systems restored from backups within 72h
Volatility · Plaso. Real DFIR tools.
Every hour accounted for.
- Phase 01
1 · Triage call
- 30-minute bridge call to scope the incident
- Initial containment guidance (network isolation, etc.)
- Engagement letter + RoE for forensic work
01Station 0101Phase 011 · Triage call
- 30-minute bridge call to scope the incident
- Initial containment guidance (network isolation, etc.)
- Engagement letter + RoE for forensic work
- Phase 02
2 · Evidence collection
- Velociraptor agents deployed (or KAPE for offline)
- Memory + disk imaging where required
- Cloud log preservation (CloudTrail, Activity Log, Audit Log)
02Station 0202Phase 022 · Evidence collection
- Velociraptor agents deployed (or KAPE for offline)
- Memory + disk imaging where required
- Cloud log preservation (CloudTrail, Activity Log, Audit Log)
- Phase 03
3 · Analysis
- Timeline construction (Plaso / log2timeline)
- Memory analysis (Volatility 3)
- Malware triage + IOC extraction
- Lateral movement reconstruction
03Station 0303Phase 033 · Analysis
- Timeline construction (Plaso / log2timeline)
- Memory analysis (Volatility 3)
- Malware triage + IOC extraction
- Lateral movement reconstruction
- Phase 04
4 · Containment + eradication
- Attacker eviction plan
- Persistence mechanism removal
- Credential reset orchestration
04Station 0404Phase 044 · Containment + eradication
- Attacker eviction plan
- Persistence mechanism removal
- Credential reset orchestration
- Phase 05
5 · Reporting
- Executive incident summary
- Technical forensic report
- CERT-In incident report (6-hour rule compliance)
- Insurance + legal-ready documentation
05Station 0505Phase 055 · Reporting
- Executive incident summary
- Technical forensic report
- CERT-In incident report (6-hour rule compliance)
- Insurance + legal-ready documentation
- Phase 06
6 · Recovery + lessons
- Hardening recommendations
- Detection improvements
- Tabletop exercise replay (optional)
06Station 0606Phase 066 · Recovery + lessons
- Hardening recommendations
- Detection improvements
- Tabletop exercise replay (optional)
What you get when the incident closes
- Executive incident summary
- Detailed forensic report (court-admissible)
- CERT-In incident report (6-hour timeline)
- Insurance documentation
- Eradication + recovery plan
- Tabletop exercise (post-incident)
Sectors we operate in
See the full evidence trail.
These anonymised records preserve the engagement scope, approach, findings, outcomes and reported metrics without publishing the client's identity.
LockBit variant contained in 11 hours — manufacturer back to 80% production within 72h of first encrypted file
A 1,400-employee manufacturer in Pune called Macksofy at 02:14 IST after a LockBit variant began encrypting file shares. Forensic team on-site by 06:30. Containment achieved at hour 11. Eighty per cent of production systems back online within 72 hours from clean backups.
Pharma ransomware containment under the CERT-In 6-hour clock — Ahmedabad plant + Mumbai HQ recovered with USFDA-inspection-ready evidence
An Ahmedabad-headquartered listed pharma manufacturer detected ransomware activity on the corporate-network at 03:42 IST. By 09:30 the CERT-In incident report was filed. By hour 72, containment was complete, the Ahmedabad plant had resumed batch operations from clean backups, and the evidence pack was assembled to USFDA Pre-Approval Inspection standard. Initial-access was traced to a vendor-portal credential reuse from a 2024 third-party breach.
Empanelled by CERT-In. Accredited by EC-Council.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
When the call comes in.
Where Macksofy delivers DFIR.
On-site engagements across India's BFSI, fintech, government and SaaS metros plus the UAE. Senior consultants fly from Mumbai BKC for kickoff, key reviews and exit briefings; remote weeks run through the rest of the engagement.
Before you commission DFIR.
How to Choose a DFIR Provider in India — Before You Need One
Most Indian organisations choose an incident-response provider while the incident is running, which is the worst possible moment. What to check, what a retainer should contain, and how evidence handling decides whether your findings survive a regulator or a court.
Read guide ComplianceTelecom Cyber Security Rules 2024: What India's Telecom Entities Must Do
India's Telecom Cyber Security Rules, 2024 put a six-hour incident-reporting clock, a mandatory Chief Telecommunication Security Officer, and standing SOC and testing duties on every telecom entity. Who must comply, the timelines, and the compliance checklist.
Read guide RegulatoryDPDP Rules 2025 — Every India Compliance Deadline, and What to Do in Each Window
India's Digital Personal Data Protection Rules, 2025 turned a two-year-old Act into a dated compliance programme. Here is the phased commencement calendar, who each phase binds, and why an eighteen-month runway is not eighteen months of preparation time.
Read guide OT SecurityOT / ICS Security Playbook for India 2026 — Protecting SCADA & Critical Infrastructure
A practical OT/ICS security playbook for Indian critical-infrastructure operators — power, manufacturing, oil & gas and utilities. The Purdue model, IEC 62443, the India regulatory stack (NCIIPC, CEA, CERT-In) and a 30/60/90-day readiness path built around safety and uptime, not just data.
Read guideMacksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC
- Thousands of professionals trained
- India + UAE engagements