When to call us

RansomwareFiles encrypted, a ransom note on a server, systems down.
Signs of intrusion on a server or websiteDefacement, unknown files, a warning from your hosting or cloud provider.
A vendor reports a breachYou need to know whether your data or systems were affected.
A customer or partner raised it firstSuspicious contact in your name, or your data found where it should not be.
Suspected insider activityYou need an objective record of what a device or account did.
Handled internally, report still neededFor the regulator, your insurer, head office or counsel.

What we cover

  • First response: stop the spread, preserve evidence, set recovery priorities. We work alongside your IT staff or vendor, not around them.
  • Log analysis: Microsoft 365, firewalls and VPN appliances, Windows and Linux servers, web servers, AWS and Azure, combined into one timeline.
  • Endpoint forensics: disk imaging and analysis of PCs and servers for remote-access tools, data staging and anti-forensic cleanup.
  • Independent verification: a second opinion on a vendor's or a previous firm's incident report, checked against the raw logs.
  • Notification support: the factual basis for the Personal Information Protection Commission report, customer and partner notices, and the insurer's file.

Preserve before you rebuild. Re-imaging machines or letting logs roll over to restore service quickly makes the incident impossible to prove later. We give you the preservation steps before recovery starts.

How an engagement runs

  1. Triage (same day)Understand the situation, direct containment, name the logs and machines to preserve. By phone and online, in English or Japanese.
  2. Preserve and collectLog exports, disk images, network device configurations. Original data is never altered.
  3. AnalyseCorrelate the sources, rebuild the timeline, establish the entry path, the scope and whether data left. Confirmed facts and inferences are labelled as such.
  4. ReportA report in English and Japanese: executive summary, technical detail, affected assets, the basis for notification decisions, remediation.
  5. PreventVPN and exposed-server hardening, backup isolation, MFA, log retention, and continuous monitoring through SecureWatch if you want it.

Deliverables

  • Investigation report in English, Japanese or both, written to be handed to counsel or an insurer, with facts and inferences separated.
  • Timeline from entry to discovery, with the source of every finding stated.
  • List of affected systems, accounts and data.
  • Supporting material for notices and regulatory reports.
  • Prioritised remediation list.

For companies in Japan with a foreign head office we report in English to the parent and in Japanese to the regulator and local partners, from the same evidence.

Indicative pricing

Starting pointFrom about JPY 350,000Indicative for triage and a limited log analysis. The price depends on the number of systems, log volume, whether endpoint forensics is needed and the report languages. Multi-site, long-running or litigation-support engagements can reach several million yen and are quoted individually. Scope and price are fixed before work starts.

Frequently asked questions

What does it cost?

Triage and a limited log analysis start at about JPY 350,000. The price depends on the number of systems, log volume, whether endpoint forensics is needed and the report languages; large engagements can reach several million yen. Scope and price are fixed before work starts.

We need to restore service first. Can the investigation wait?

Recovery and investigation can run together, but the order matters. Before anything is re-imaged or overwritten we tell you what to preserve. Preservation usually takes a few hours, after which recovery can proceed.

We have IT staff and a vendor. Who does what?

Your staff or vendor carry out containment and recovery; CS2 decides what to preserve, what to examine and what the evidence supports. We also take engagements limited to independently verifying a vendor's incident report.

Can you work in English with our head office?

Yes. Investigations, meetings and reports are available in English and Japanese, so the parent company, counsel and the Japanese regulator can each work from the same findings.

Which systems and logs do you cover?

Microsoft 365, firewalls and VPN appliances, Windows and Linux servers, web servers and CMS platforms, AWS and Azure, and disk images of Windows PCs. Ask us about anything else before the engagement.

Who can the report be given to?

It is written so it can go to counsel, an insurer, and serve as the factual basis for a Personal Information Protection Commission report and for customer or partner notices, with facts and inferences kept separate.

Let's talk before someone else does.

Tell us what you are seeing and we will tell you what to preserve today and what the investigation would cover.

Contact