Digital Forensics Case Studies

A Brickell investment adviser discovered that a $4.2M outbound wire had been redirected after a compromised email thread with a Latin American counterparty. GDF Miami imaged the adviser's Microsoft 365 tenant and four endpoints within 36 hours and reconstructed the mailbox rules and inbox-forwarding artifacts showing how long the attacker had been reading the thread.

Header routing data was correlated against the correspondent-bank timeline to fix the window between compromise and transmission. The analysis supported an emergency application in the Southern District of Florida and a parallel financial-institution referral. The examiner declaration described acquisition and analysis methodology only; the fraud conclusions were left to counsel.

Counsel defending a passenger injury claim brought under the federal court's admiralty jurisdiction needed the shipboard record before the vessel returned to foreign service. GDF Miami examiners boarded during a PortMiami turnaround and acquired CCTV segments, deck access-control logs, and bridge navigational data within the port call window.

AIS and ECDIS records were correlated against the CCTV timeline to establish sea state, heading and speed at the reported time of the incident, and to identify a two-minute gap in one camera's recording attributable to a documented scheduled retention purge rather than deletion. Exhibits were delivered hash-verified with certification addressed to FRE 902(13).

A general contractor's on-premises NAS spent two days in standing water after storm surge entered a Fort Lauderdale office park. The array held the daily site photographs, inspection reports and RFI correspondence at the center of a construction-defect claim, and no offsite backup had completed since the week before landfall.

The four drives were transported wet and stabilized in a Class 100 enclosure, then ultrasonically de-ionized, vacuum dried and imaged individually before RAID parameters were rebuilt in software rather than on the original controller. Approximately 2.1 TB was recovered, including the photograph set, with hash sets supporting authentication of the business records under Fla. Stat. § 90.803(6).

A unit-owner board pursuing a turnover and official-records dispute under Chapter 718 needed a decade of association email and accounting records that had passed through three successive management companies on three different platforms. Counsel had received a partial production and no explanation for the gaps.

GDF Miami mapped the sources, collected from two surviving cloud tenants and one archived on-premises store, and carved the property-management database transaction logs for entries created or modified outside their nominal accounting period. The mapping identified which custodial gaps were the product of platform migration and which were not — a distinction that reframed the association's spoliation argument before the Eleventh Judicial Circuit.

A carrier defending a cluster of related personal injury protection claims in Broward County retained GDF Miami to examine the vehicles rather than the claim files. Three of the involved vehicles retained event data recorder modules, and two had connected infotainment systems with paired handset records.

Imaging the modules produced pre-crash speed, brake application, throttle position and delta-V values inconsistent with the claimed low-speed impact sequence, and the infotainment pairing history placed two nominally unrelated claimants in the same vehicle three weeks earlier. The report documented acquisition method, module firmware versions and the known limits of the data, and the examiner was deposed on that record.

Counsel for a respondent before the Miami Immigration Court held a physically damaged Android handset said to contain two years of threatening messages. Government counsel had signalled an authentication challenge, and the phone would not boot.

The device was repaired to a bootable state without altering user partitions, and a physical extraction recovered live and deleted records from the messaging application's write-ahead logs and unallocated space. The examination established sender numbers, transmission timestamps and delivery receipts across the claimed period, and EXIF data on photographs of a summons matched the coordinates and capture times asserted. The report was prepared for translation and addressed the corroboration standard at INA § 208(b)(1)(B)(ii).

A hotel group operating four South Florida properties received a common-point-of-purchase notification from its acquirer and had to determine, quickly, whether Fla. Stat. § 501.171 notification was triggered. GDF Miami deployed the same day to capture volatile memory from the point-of-sale estate before any remediation touched the terminals.

Memory analysis recovered a scraping process resident on six terminals at two properties, and reverse engineering of the binary established that it targeted track data in the clear. Terminal-level configuration review showed the affected outlets had been running point-to-point encryption, so the harvested buffers held no recoverable primary account numbers — a finding counsel used to make the notification determination on evidence.

A 130-foot motor yacht grounded on a reef off Key Largo at speed. The captain's account attributed the casualty to a mechanical steering failure, and the owner's underwriters retained counsel who needed the vessel's own record of the run-up.

Examiners performed physical memory acquisition on the chartplotter and pulled logged NMEA 2000 bus traffic and ECDIS waypoint audit entries. The telemetry showed continuous rudder response to helm input through the final four minutes, no fault codes on the steering gear, and a route deviation entered manually eleven minutes before contact. The reconstruction was submitted in a Limitation of Liability proceeding under 46 U.S.C. § 30501.

An applicant seeking discovery in aid of a foreign arbitration under 28 U.S.C. § 1782 obtained authorization to take documents from a Miami-based affiliate of a Brazilian group. The responsive population ran to roughly 1.2 TB across Portuguese and Spanish email, corporate messaging groups and a regional ERP export.

GDF Miami built diacritic-normalized search terms with the retaining firm, staffed bilingual first-pass review, and applied a masking workflow scoped with counsel against Brazil's data protection statute before anything left the collection environment. Production was delivered to FRCP 34 specifications with a declaration authenticating the foreign business records under FRE 902(12).

A title agency discovered that $1.8M in closing funds had been wired to an account controlled by a third party after wiring instructions were altered in a reply thread. The agency's counsel needed a factual record fast enough to support emergency relief.

Tenant forensics identified a malicious inbox rule created eleven days earlier that had been silently diverting the closing thread, together with the sign-in telemetry and consent grant that established initial access. Message gateway routing showed where the spoofed instruction entered the chain. The examiner declaration supported an emergency motion in the Eleventh Judicial Circuit and a freeze request to the receiving institution.

A Miami record label found three unreleased masters circulating online eleven days before a scheduled release. Access to the session files had been limited to a small production team working across a shared cloud drive and two studio workstations.

Examiners reconstructed cloud synchronization audit logs and workstation file system timestamps to identify a bulk download to an unmanaged device, then matched project file and stem hashes against the leaked audio to confirm the specific session revision that had escaped. The findings supported claims for breach of a nondisclosure agreement and misappropriation under Florida's trade secrets statute; attribution beyond the device was left to counsel.

In a Miami-Dade dissolution matter, financial disclosures did not reconcile with the lifestyle the parties had maintained, and counsel had a court-authorized examination of two devices and a laptop belonging to the responding spouse.

Browser artifacts, password manager metadata and application remnants identified accounts at four exchanges and evidence of two hardware wallets not listed in the disclosure. On-chain analysis of the identified addresses established balances and transfer history sufficient for the equitable distribution analysis under Fla. Stat. § 61.075. No audio recordings were examined; material captured outside Florida's two-party consent rule at Fla. Stat. § 934.03 was quarantined and excluded from the report at the outset.

A fashion brand holding federal trademark and design registrations retained outside counsel after discovering counterfeit versions of its signature garments moving through unlicensed distributors in several major markets. Counsel obtained a civil seizure order and assembled a team including GDF Miami examiners, private examiners, and U.S. Marshals for coordinated execution.

At the primary target location, GDF Miami examiners performed on-site forensic acquisition of laptops, point-of-sale terminals, and a network-attached storage device. EnCase-based file system analysis revealed vendor contact records, production photographs, and order histories spanning nearly two years. Metadata extracted from design files embedded in the NAS pointed to a second warehouse not named in the original complaint. That address was relayed to counsel, who obtained a same-day amendment to the seizure order.

At the second location, examiners acquired three additional systems and preserved approximately 40,000 files, including shipping manifests, reorder communications, and decrypted messaging data recovered from local application caches. The resulting evidence gave attorneys a documented, multi-tier supply chain map traceable back to overseas production sources. The matter resolved with a consent judgment, disgorgement of profits, and an injunction against further sales activity.

The manufacturer of a well-known consumer healthcare product line discovered counterfeit versions of its goods being sold through discount retail outlets in Miami, Orlando, and Tampa. After a federal judge signed a civil seizure order, counsel coordinated a simultaneous 8:00 AM EST execution across five locations in Coral Gables, Fort Lauderdale, West Palm Beach, Tampa, and Orlando, with GDF Miami deployed to all sites.

Over the course of the operation, GDF Miami imaged approximately 30 computers across the five locations, along with mobile phones, fax machine memory, and voicemail systems. Forensic analysis of the collected data uncovered email communications with counterfeit product sources in China, including pricing negotiations, artwork files matching the genuine product packaging, and shipping manifests for inbound container loads. Three additional storage facilities not covered by the original order were identified from logistics records found on-site.

Counsel obtained supplemental seizure orders for those locations within 48 hours. The combined evidence documented the full importation and distribution chain, identified the overseas manufacturing source, and provided the damages calculation support needed for the civil action. A parallel criminal referral was made to federal authorities based on the volume and organization of the operation. The civil matter concluded with a permanent injunction and a multi-million dollar judgment.

A specialty chemical manufacturing company with offices in Miami, New Jersey, Texas, Brazil, and Argentina retained outside counsel after discovering that two employees and their direct manager had been systematically emailing confidential business data to personal accounts over an extended period. The stolen material included full customer databases, invoicing records, financial statements, and proprietary product formulations.

The subjects had deleted sent items and cleared local application caches before the matter came to light. When home computers were subsequently seized under court order, GDF Miami performed forensic imaging and analysis. Deleted email data was recovered from Lotus Notes local mail files using unallocated space carving and database journal reconstruction. CRM export files and PeopleSoft financial reports were found in shadow copies and temporary file remnants on all three machines, confirming that the deletions had not eliminated the evidentiary record.

Cross-referencing email timestamps across the domestic and international office servers established a coordinated pattern of exfiltration activity spanning multiple time zones. The analysis documented which specific customer records, pricing files, and formulation documents had been accessed and transferred from each employee's system. Armed with the forensic findings, counsel filed in multiple jurisdictions. The matter resulted in civil judgments against all three defendants and criminal referrals in two of the five countries where the company operated.

A mid-size specialty chemicals manufacturer suspected that a departing senior engineer had copied proprietary formulation data before accepting a role at a direct competitor. Outside counsel engaged GDF Miami to examine the employee's assigned workstation, company-issued laptop, and corporate email account.

FTK Imager was used to create verified forensic images of both storage devices. Windows registry analysis of the MountedDevices and USBSTOR keys confirmed that a personal USB drive had been connected on two separate occasions during the final week of employment, with a unique device serial number appearing for the first time on that date. LNK file artifacts documented that 14 formulation spreadsheets and a customer price list had been accessed within a 90-minute window on the last day in the office. The same filenames appeared in the USB device's write sequence reconstructed from USBSTOR registry artifacts, SetupAPI logs, and NTFS file system timestamps, with Prefetch records corroborating the timing of program execution during the transfer window.

Email header analysis showed two attachments totaling over 80 MB were sent from the corporate account to a personal Gmail address three days before resignation. The attachment filenames matched the spreadsheets identified in the LNK artifacts. GDF's report documented each access and transfer event with precise timestamps, providing the evidentiary foundation attorneys used to obtain a temporary restraining order. The matter settled under a confidentiality agreement requiring certified destruction of all copied materials.

A major pharmaceutical manufacturer retained counsel after identifying significant inventory discrepancies suggesting that branded prescription drugs were being diverted from authorized distribution channels in Europe and Canada and reintroduced into U.S. markets through smaller, unlicensed distributors. Initial estimates placed annual losses near $13 million. Federal law enforcement was involved, and GDF Miami was brought in to support the digital evidence component of the inquiry.

On-site processing through a Mobile Forensic Laboratory at each location preserved the evidentiary chain of custody that would have been compromised by transporting media offsite. Several systems at target locations were encrypted; examiners used live-system acquisition techniques and bootable forensic tools to capture memory and decrypt storage volumes prior to shutdown. Analysis of the recovered data uncovered more than ten years of diversion activity documented in procurement records, repackaging instructions, and internal financial ledgers.

Particularly significant was the discovery of records showing that vitamins and nutritional supplements were being repackaged in authentic-appearing prescription drug containers and shipped into Asian markets, a separate fraud layered on top of the core diversion scheme. Shipping manifests and payment records identified unlicensed pharmacy recipients in the United States. The forensic findings supported criminal convictions in the United States and triggered parallel enforcement actions in five countries. The Mobile Forensic Lab's ability to process systems on-site without network exposure was critical to preserving the integrity of evidence across all locations.

A state insurance regulatory body retained GDF Miami to provide digital forensics support during an examination of a domestic insurance carrier. The company had adopted what regulators internally described as a "cooperatively uncooperative" posture, producing documents slowly, in incomplete formats, and with recurring claims that relevant data was unavailable or had been purged in the ordinary course of business. After nine months of the formal examination, the regulator's technical team had made limited progress on the core questions about the company's reserve calculations and claims payment practices.

GDF Miami was granted direct access to the company's servers under the examination authority. Within the first week, examiners identified a parallel filing system maintained on a standalone server not disclosed in the company's initial system inventory. The server contained unprocessed claims queues, internal communications about reserve methodology decisions, and batch-processing logs that contradicted the company's representations about its data retention schedule. Deleted database records were recovered from unallocated space on the primary claims system, restoring transaction histories the company had characterized as unavailable.

In nine days, the forensic examination surfaced more relevant evidence than the prior nine months of document review had produced. The recovered data provided regulators with a technically grounded basis to challenge the company's reserve adequacy and claims payment timelines. The findings supported a formal regulatory action and a consent order requiring remediation of the identified practices and enhanced data preservation obligations going forward.

A large accounting firm auditing a publicly traded bank engaged GDF Miami to provide digital forensics support during its review of director-level loan transactions. The audit team had identified anomalies in loan origination records suggesting that proper approval procedures had been bypassed and that certain transactions had been modified after the fact. The bank's IT environment spanned Sun Solaris and Windows NT banking systems alongside Exchange email servers and executive workstations.

GDF Miami performed forensic acquisition of laptops and desktop computers belonging to the executives under review, along with Exchange email archives and voicemail systems. Analysis of the banking platform transaction logs on the Solaris servers revealed modification events with timestamps that fell outside normal business processing windows, with operator credentials used in sequences inconsistent with standard loan workflow. Cross-referencing those timestamps with the Exchange email archives surfaced internal communications discussing specific transactions in terms that aligned with the audit team's anomaly findings.

Voicemail forensics produced recovered messages between relevant parties discussing loan approvals in terms inconsistent with the bank's documented governance process. The digital artifacts identified by GDF Miami provided the accounting firm's audit team with technically grounded corroboration for their financial findings. The combined audit and forensic report was submitted to the bank's board and regulators, supporting a regulatory action and a civil recovery proceeding.

A regional construction company's external auditors flagged irregularities in vendor disbursements spanning nearly seven years. The controller held sole approval authority for payments under $50,000, and cumulative losses were estimated near $2.1 million. Forensic accountants retained outside counsel, who engaged GDF Miami to support the digital evidence component of the matter.

FTK Imager was used to create verified forensic images of the controller's workstation, the accounting server, and backup tapes supplied by IT. Examiners using Autopsy and targeted keyword searches recovered deleted QuickBooks export files and spreadsheets that had been emptied from the Recycle Bin but remained intact in unallocated disk space. The recovered spreadsheets documented fictitious vendors, with payment routing numbers matching personal accounts held by the controller and a family member.

Browser history and cached webmail data showed repeated logins to online banking portals associated with the fictitious vendor accounts, consistently occurring during normal business hours from the controller's office workstation. GDF's timeline documentation was coordinated with the forensic accounting team's financial analysis. The combined report supported a criminal referral, and the subject subsequently entered a guilty plea. Civil recovery proceedings produced a judgment that included the full misappropriated amount plus interest.

Two terabytes of raw financial data on a legacy IBM IMS mainframe stood at the center of a class action handled by a major Miami law firm against a large financial institution. The case involved millions of individual transactions, and counsel needed to demonstrate that systematic processing errors had caused quantifiable financial harm to a class of account holders. No commercial off-the-shelf tool could parse the proprietary data format.

The original IMS source code was obtained through discovery, and examiners undertook a full reconstruction of the transaction processing system, rebuilding the processing logic in a modern environment that could execute against the raw data extracts. Rebuilding the processing logic in a modern environment allowed examiners to reproduce the exact output that the mainframe would have produced under correct operating conditions and to compare that output against the actual transaction records, isolating the specific processing errors and their downstream effects on individual account balances.

The reconstruction produced a structured, searchable dataset of millions of transaction records with error flags attributable to specific processing defects. That dataset became the foundation for the damages expert's calculations. The matter resolved in a class settlement; the forensic reconstruction of the mainframe processing environment was cited by both parties as technically authoritative, allowing damages calculations to proceed without a contested battle of experts over data interpretation.

Federal and state authorities, including the SEC, NASD, and the Office of the State Attorney for the Eleventh Judicial Circuit, were jointly examining a stock fraud operation with offices in Miami and Fort Lauderdale. The operation involved market manipulation across multiple thinly traded securities, and accurate damage calculations required reconstructing complete trading records from a clearing firm whose data systems had been partially corrupted during the period under review.

GDF Miami was retained to recover and reconstruct the clearing firm's electronic trading records from fragmented database files, backup media, and partially overwritten storage. Using specialized database forensics techniques, examiners rebuilt the transaction history table for the relevant securities and time periods, restoring records that had been lost due to both intentional deletion and storage system failures. The reconstructed dataset was reconciled against partial records held by broker-dealer counterparties and regulatory filings to verify completeness.

The recovered trading data provided examiners and damages experts with a complete picture of trading volume, pricing patterns, and transaction sequences across the relevant period. Analytical correlations visible in the reconstructed data supported the fraud theory being pursued by regulators. The forensic reconstruction was introduced as evidence supporting the damages calculation in the civil enforcement proceeding, which concluded with disgorgement orders and permanent bars against the principals involved.

A large publicly traded financial institution faced regulatory scrutiny and civil litigation arising from allegations that undisclosed fees had been systematically applied to customer accounts over multiple years. The data volume involved was substantial: terabytes of account transaction records, fee calculation engine outputs, and customer communication logs. Counsel needed a technically defensible methodology for extracting and analyzing the data to support an overcharge calculation across millions of affected accounts.

Working directly with the institution's IT department, the forensic team identified all systems contributing to the fee calculation and application workflow and guided the collection and structuring of each data set. The collection process produced a complete provenance record for each data source, addressing the chain-of-custody questions that would arise in both regulatory and civil proceedings. Once collected, the structured data was made available to damages experts who used it to calculate the overcharge totals at the individual account level.

The forensic team's methodology documentation addressed questions about completeness, accuracy, and the integrity of the extraction process, allowing damages experts to rely on the dataset without independent validation of the underlying collection. The structured analysis supported both the regulatory settlement and the class action resolution. The total overcharge amount ultimately identified across the affected account population exceeded several hundred million dollars.

Proceedings in a federal business dispute stalled when one party introduced a video recording allegedly documenting a private meeting between two executives. Opposing counsel challenged the exhibit's authenticity, noting visible frame-rate inconsistencies and suspecting the footage had been synthetically altered or partially generated. The court ordered authentication analysis before the exhibit would be admitted.

Analysis proceeded in layers, beginning at the file container level. MP4 atom analysis revealed two distinct encoding signatures, indicating the file had been re-rendered after original capture. Frame-level PRNU (Photo Response Non-Uniformity) noise pattern comparison showed that a 47-second segment did not share the sensor noise signature of the surrounding footage, consistent with the insertion of synthetically generated content. Facial landmark consistency analysis identified micro-expression artifacts in the disputed segment that were inconsistent with natural human movement at the frame rates present in the recording. A separate C2PA provenance review confirmed the file carried no valid cryptographic content credentials from any known capture device.

The written report documented each analytical method, the standards applied, and the specific technical observations, without asserting a categorical authenticity conclusion. The report gave the court a technically grounded factual record on which to base its admissibility ruling. The disputed 47-second segment was excluded under FRE 901. The case resolved in favor of the challenging party shortly after that ruling.

Following a nighttime collision between two commercial vessels in a busy shipping lane, attorneys representing the cargo owner retained GDF Miami to analyze the electronic records from the vessel alleged to have been at fault. The vessel's Voyage Data Recorder (VDR) and Electronic Chart Display and Information System (ECDIS) had been preserved by the flag state authority pending the admiralty inquiry.

The VDR capsule contained 48 hours of recorded data as required under the current IMO standard (MSC.333(90)), including bridge audio, radar image captures, AIS transponder traffic, and navigation sensor feeds including GPS position, heading, and speed over ground at one-second intervals. GDF Miami extracted the data using manufacturer-specific decoding tools and correlated the on-board record against AIS broadcasts independently archived by a third-party maritime data service, providing an external reference to verify the integrity of the vessel's own recordings. The ECDIS track log showed the vessel had deviated from its declared route without logging a course alteration or posting a lookout entry in the electronic log. Engine control system data confirmed the vessel was operating at full ahead throughout the approach.

The reconstruction documented that the at-fault vessel had failed to take early and substantial action to keep well clear, as required under COLREGS Rule 16, in the minutes before the collision. Those technical findings supported the admiralty inquiry panel's analysis and provided maritime counsel with a forensically documented basis for the fault determination. The matter concluded with a significant cargo damage settlement favorable to the cargo owner.

A U.S.-based semiconductor design firm noticed that proprietary chip architecture documentation was appearing in patent filings by a foreign competitor approximately eight months after each internal design cycle concluded. The company retained outside counsel and engaged GDF Miami to determine forensically whether any internal actor had provided unauthorized access to design files.

Network log analysis using Splunk and Wireshark-captured packet data identified repeated large-volume data transfers from an internal engineering workstation to an unsanctioned encrypted file-sharing application. SIEM event correlation showed these transfers consistently occurred late on Friday evenings. DLP log review revealed that the workstation's endpoint agent had been deliberately disabled on three occasions, each immediately preceding a transfer session. The workstation belonged to a senior engineer with elevated access to the proprietary design repository.

Forensic imaging with X-Ways Forensics uncovered an encrypted container in a temporary folder; its creation date corresponded exactly to the first unauthorized transfer session. Browser artifacts showed repeated use of a translation service converting English-language technical terms to Mandarin. The documented timeline and data flow mapping were provided to counsel, who referred the findings to federal law enforcement. The matter resulted in a criminal arrest under the Economic Espionage Act.

A regional health system covering four hospitals received notification from a security researcher that a subset of patient records was accessible via an unsecured Amazon S3 bucket. The exposure involved over 180,000 patients and included diagnostic codes, insurance information, and demographic data. Privacy counsel retained GDF Miami to determine scope, origin, and access history, as required under the HHS Breach Notification Rule.

AWS CloudTrail access logs had been preserved for a 90-day window. Parsing those logs identified 23 distinct external IP addresses that had accessed the bucket following the misconfiguration, with automated crawlers accounting for the majority of access events and three addresses consistent with human-directed browsing. The misconfiguration was traced to a DevOps script deployed during a routine infrastructure update that inadvertently removed bucket-level access control policies. Examination of the health system's internal EHR export pipeline showed the bucket had been provisioned as a temporary staging location for a vendor data migration project, with no formal security review on record.

The forensic record documented the full timeline from misconfiguration to discovery, identified all data elements present in the exposed files, and provided counsel with a technically grounded account of access events sufficient to complete the 60-day HIPAA breach notification. The health system filed timely notifications to HHS, affected patients, and prominent media outlets in the affected states, as required under 45 CFR 164.406 for breaches involving more than 500 individuals in a given jurisdiction. Regulatory review focused on the absence of a security review process, and the resulting corrective action plan included a mandatory pre-deployment review for all infrastructure changes touching systems containing PHI.

A municipal water utility serving approximately 80,000 residents detected anomalous commands being sent to chemical dosing controllers at its primary treatment plant. Operations staff manually halted the automated process and notified state environmental regulators. The utility's general counsel retained GDF Miami to conduct forensic analysis supporting the regulatory response and a potential civil action against the threat actor.

The OT forensics team examined the plant's historian server, HMI workstations, and network switch logs. Historian data showed an authenticated session opened at 3:14 AM from an IP address not associated with any authorized operator. That session accessed the chlorine dosing PLC and issued a series of setpoint commands that, if sustained, would have raised residual chlorine levels above EPA action thresholds. The historian preserved the full command sequence with millisecond-precision timestamps. Network log analysis traced the intrusion to a remote-access gateway that had not been updated since its initial deployment and was exposed directly to the internet on a non-standard port. Firmware analysis confirmed a publicly disclosed vulnerability in the vendor's authentication module that had been unpatched for over three years.

Attorneys and regulators received a documented timeline, the complete command sequence, and a technical description of the access pathway sufficient for regulatory disclosure and law enforcement referral. The vulnerability was remediated, and the matter was referred to the FBI's Cyber Division. The forensic record also served as the technical foundation for the utility's incident disclosures to the EPA, state environmental regulators, and CISA.

Encrypted file systems across an entire Windows domain greeted employees at a privately held logistics company with 14 domestic terminals when they arrived the morning of the attack. Encryptors had executed on all domain-joined endpoints and the primary file server at approximately 2:45 AM. The company's cyber liability insurer retained GDF Miami to conduct forensic triage and produce a documented attack timeline as a condition of the coverage claim.

Initial triage on preserved memory images from two unencrypted domain controllers using Volatility identified the ransomware family as a variant of LockBit 3.0. Windows Event Log analysis across domain controllers showed lateral movement beginning 11 days before the encryption event, with the threat actor using a compromised service account to traverse the network. The initial access vector was a phishing email with an LNK-based loader opened by an accounts payable employee, as confirmed by Prefetch artifacts and Amcache registry entries on the employee's workstation. Examiners documented each lateral movement hop, privilege escalation step, and reconnaissance command in sequence, producing a complete attack timeline from first access to detonation.

Backup infrastructure triage verified which backup sets predated the lateral movement window and were therefore uncontaminated, directly supporting the insurer's determination of the clean restoration point. The company resumed operations from verified backups within 72 hours of retaining GDF. The forensic timeline was submitted to the insurer to support the business interruption claim, and the documented attack path informed the security remediation plan that counsel required as a condition of continued coverage.