Incident response · Digital forensics · Retainers
Digital Forensics and Incident Response (DFIR) Services
When a cyber attack hits, we help you contain it, find out exactly what happened, and get back to business. Our team preserves the evidence, traces the attacker’s steps, restores your systems and gives you a report you can take to your board, insurer, regulator or the police.
- 23+ years in UAE cybersecurity
- 500+ clients
- 99% client satisfaction
What is DFIR?
Digital forensics and incident response (DFIR) is the work of responding to a cyber attack and investigating it. Incident response contains the attack, removes the attacker and restores systems. Digital forensics collects and analyses evidence to show how the attacker got in, what they did and which data they reached, in a way that can support legal, insurance and regulatory decisions.
| Typical incidents | Ransomware, business email compromise and payment fraud, data theft and extortion, account takeover, insider misuse, crypto wallet theft |
|---|---|
| What we analyse | Laptops and servers, memory, network traffic, firewall and VPN logs, Microsoft 365 and Google Workspace, cloud platforms and mobile devices |
| Response method | Aligned to NIST SP 800-61 Revision 3 (April 2025), the US standard for incident response, built on the NIST Cybersecurity Framework 2.0 |
| Evidence handling | Collected and preserved in line with ISO/IEC 27037, with chain-of-custody records for every item |
| UAE reporting duties | Depend on your sector: for example the UAE PDPL for personal data breaches, VARA’s 72-hour rule for virtual asset firms, and DoH and CBUAE rules for healthcare and banking |
| Ways to engage | Emergency response, a pre-agreed retainer, or a compromise assessment if you suspect an attacker is already inside |
When should you call a DFIR team?
Call us straight away if any of these are happening:
- Files are encrypted or a ransom note has appeared
- A supplier or client was asked to pay into new bank details by email
- Someone claims to have your data, or it has appeared online
- You see unexpected admin accounts, logins from strange locations or security alerts you cannot explain
- Your insurer, regulator, lawyer or board needs an independent forensic report
- You need to investigate a suspected insider, such as a departing employee copying data
Until we speak: disconnect affected machines from the network but do not switch them off, and do not wipe, reinstall or restore anything yet. Powering off and rebuilding destroy the evidence that shows what happened.
What our DFIR service covers
One team handles the incident from the first call to the final report.
Triage and scoping
We establish what is affected, how serious it is and what must happen in the next few hours, and agree priorities with your leadership.
Containment
Isolating affected systems and accounts, blocking attacker access and stopping the spread, while keeping critical services running where we can.
Evidence preservation
Forensic images, memory captures and log exports, collected and documented with chain-of-custody records so they can be relied on later.
Forensic investigation
Analysis of endpoints, servers, cloud and email logs and network data to find the entry point, the attacker’s actions and the data they accessed.
Ransomware and extortion
Assessing what was encrypted and what was stolen, your recovery options and the facts your legal team and insurer need to make decisions.
Eradication and recovery
Removing backdoors and persistence, resetting credentials, rebuilding systems safely and watching closely for the attacker’s return.
Reporting and notifications
Clear findings for regulator, insurer and police reports, and support with notifications under the UAE PDPL, VARA, CBUAE or DoH rules that apply to you.
Lessons learned
A review of what failed and a prioritised plan to close the gaps, so the same attack does not work twice.
How we respond to an incident
Every incident is different, but the order of work stays the same.
- 1
First call
We ask the questions that matter, tell you what to isolate and what not to touch, and agree the scope and engagement terms.
Immediately
- 2
Mobilise
We deploy remote collection and monitoring tools and, where needed, send our team on site.
Same day
- 3
Contain and preserve
We stop the spread and capture evidence before it is lost or overwritten.
Day 1
- 4
Investigate
Forensic analysis to establish the entry point, timeline, affected systems and data, and whether the attacker is still present.
Days 1–5
- 5
Eradicate and recover
We remove the attacker’s access and restore systems in a controlled order, starting with the services you need most.
Alongside the investigation
- 6
Report and improve
A technical report, an executive summary and a timeline ready for regulators and insurers, followed by a lessons-learned session.
After recovery
Timings depend on the size of the incident. Containment usually happens in the first day; a full investigation of a large incident can take several weeks.
What you get
- Incident timeline from first access to containment
- Root cause analysis: how the attacker got in
- Scope of compromise and data impact assessment
- Indicators of compromise for your security tools
- Forensic evidence with chain-of-custody records
- Log of containment and recovery actions
- Incident report ready for regulators, insurers and police
- Executive briefing for your board
- Remediation and hardening plan
- Lessons-learned workshop with your team
Choose how we work with you
Emergency incident response
ImmediateBest for: An attack happening now
- · Containment and recovery
- · Forensic investigation
- · Incident report
DFIR retainer
AnnualBest for: Help on pre-agreed terms when you need it
- · Agreed response times
- · Pre-approved contract and scope
- · Readiness work such as tabletop exercises
Compromise assessment
2–4 weeksBest for: Checking whether you are already breached
- · Threat hunt across endpoints and cloud
- · Evidence review
- · Findings and fixes
Don’t wait for an attack to find a response team
A retainer means the contract, contacts and access are agreed in advance, so the first hours of an incident are spent responding, not negotiating.
Incident response planning vs DFIR
The two services work together: incident response planning prepares you, DFIR responds when something happens.
| Incident response planning | DFIR (this service) | |
|---|---|---|
| When | Before an incident | During and after an incident |
| Goal | Be ready: plans, roles and practice | Contain, investigate and recover |
| Main outputs | Response plan, playbooks, tabletop exercises | Containment, forensic evidence, incident report |
| Typical trigger | Audit, regulator or board request | Attack, breach or suspicious activity |
What affects cost and timeline
For emergencies we agree terms on the first call. For retainers and assessments you get a written scope and quote. These are the factors that move it:
- Size of the incident
- The number of affected systems, users, sites and accounts.
- Environment
- On-premises, cloud, operational technology or a mix of all three.
- Data to analyse
- The volume of logs, disk images and email that has to be reviewed.
- On-site work
- Remote response is faster to start; some incidents need our team on site.
- Reporting needs
- Regulator, insurer or court-ready reporting needs more documentation.
- Retainer or emergency
- Pre-agreed retainer terms cost less per hour than an unplanned engagement.
Why organisations call Intello
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
One team from first call to final report. The people who contain the incident also investigate it and write the report.
Backed by our SOC and SIEM teams. We can extend monitoring during recovery and watch for the attacker’s return.
UAE reporting know-how. We know what the UAE PDPL, VARA, CBUAE and DoH expect after an incident.
Dubai-based team. We can be on site with you across the UAE when an incident needs hands-on work.
Frequently asked questions
What is DFIR?
DFIR stands for digital forensics and incident response. Incident response contains a cyber attack and restores normal operations; digital forensics collects and analyses evidence to show how the attack happened, what the attacker did and what data was affected.
What should we do first after a ransomware attack?
Disconnect affected machines from the network but leave them switched on, so memory evidence is not lost. Do not wipe, reinstall or restore systems yet, do not contact the attackers without advice, and keep all logs. Then call an incident response team and tell your insurer.
How quickly can you respond?
We start triage on the first call. Remote evidence collection and monitoring can usually begin the same day, and our team can come on site when the incident needs it. Retainer clients get pre-agreed response times.
Do we have to report a cyber incident in the UAE?
Often, yes, depending on your sector and the data involved. Under the UAE PDPL, a breach affecting personal data must be reported to the regulator and the people affected. VARA-licensed firms must report material cyber events within 72 hours, and banks and healthcare providers have their own CBUAE and DoH rules. Cybercrimes can also be reported to the police. We help you work out which duties apply.
What is an incident response retainer?
A retainer is an agreement made before an incident. Terms, contacts and access are settled in advance, so we can start work immediately when you call, with agreed response times. Retainers usually include readiness work such as tabletop exercises.
Can your forensic findings be used in legal proceedings?
We collect and preserve evidence in line with ISO/IEC 27037 and keep chain-of-custody records for every item, so the evidence and findings can support legal, insurance and regulatory processes. Your legal counsel decides how they are used.
What is the difference between incident response planning and DFIR?
Incident response planning prepares you before an attack with plans, roles and exercises. DFIR is the hands-on response during and after an attack. Most organisations need both, and a retainer links them.
Can you check whether we have already been breached?
Yes. A compromise assessment hunts across your endpoints, servers, cloud and email for signs of an attacker who is already inside, and reviews evidence such as logs and alerts. It usually takes 2 to 4 weeks.
Related services
Get help with an incident, or be ready for the next one
For an active incident, call us now. For a retainer or compromise assessment, leave your details and we will set up a call.
What happens next
- 1We reply within one business day, or immediately by phone for active incidents
- 2A call to understand your environment and needs
- 3A written scope, terms and quote
Prefer to talk now? Call +971 55 355 6787
Last reviewed: October 2026. This page is general guidance, not legal advice.
Sources: NIST SP 800-61 Rev. 3, Incident Response Recommendations (April 2025) · ISO/IEC 27037:2012, Guidelines for identification, collection, acquisition and preservation of digital evidence (IEC Webstore)