After more than ten years delivering DFIR services as Incident Handlers and Forensic Analysts, we have been progressively developing our own DFIR analysis system known as SKY.
The SKY platform has been designed to automate most of the usual orchestration work needed to manage a DF/IR/CTI infrastructure, being an automated analysis system that is able to process evidence with specific tools and to integrate the results in a centralized analysis environment to be reviewed by the designated investigators.
SKY has been a key player in several massive investigations ranging thousands of systems and Terabytes of data where traditional investigation methodologies and techniques were unable to provide fast and efficient answers.
We have also successfully deployed several of the mentioned components for DF/IR/CTI teams in law enforcement and the private sector (financial) and they have been able to greatly increase the bandwidth of the team by decreasing the number of cases in their pipeline and focusing them on the complex investigations that need human intervention to provide value.
SKY architecture easily integrates third-party DFIR tools on its workflow, making use of the most advanced forensic software, such as Guidance Software Encase, Cellebrite’s Physical Analyzer or Magnet IEF/AXIOM by automating their execution and output processing to identify the most relevant results.
SKY has a flexible plugin framework that allows new workflows to be developed and facilitate the integration of open-source and commercial tools, whether if they have an API or not, based on the understanding of GUI automation.