One example of the kind of work The BioChain Advisory does: helping organisations work out whether their systems can actually prove what they claim, before a regulator, investor, customer or incident forces the question. Here is how that played out.
An organisation had experienced a cyber incident that disrupted critical systems. The immediate priority was restoration: bring systems back online, recover data from backups, restore access and resume operations. Once the immediate crisis had passed, a more difficult question emerged.
Could the organisation still trust and reconstruct the evidence contained in those systems?
A backup had restored the database, but the organisation did not know whether all associated logs, attachments or audit records had been recovered with it. Some records had been recreated manually during the outage. Systems restored at different points in time now contained inconsistent versions of the same information. The security incident had compromised credentials, raising real questions about which changes could still be confidently attributed to authorised users.
We examined the evidence environment after recovery: which systems and records were affected, whether critical evidence chains remained intact, what had been restored from backup, what had been recreated manually, whether audit records had survived, and where the organisation could no longer make the same claims with the same degree of confidence. We tested representative evidence chains to determine whether results generated before, during and after the incident remained distinguishable and reconstructable.
The engagement also examined whether the organisation’s backup and recovery arrangements preserved evidential value, rather than simply restoring technical availability — an important distinction. A system can be operational again while still having lost the records needed to demonstrate how a critical result was produced.
This was not a forensic investigation, and it did not replace incident-response specialists. It helped the organisation understand the integrity of the evidence environment that remained after the incident, and identify which weaknesses needed to be addressed before normal assurance claims could safely resume.
The resulting report separated immediate evidential risks from longer-term improvements, helping management understand what could still be proven, what required qualification, and what needed strengthening before the next incident occurred.
Once systems are stable and normal operations have resumed. Assessing evidential integrity mid-recovery usually just adds confusion.
No. A forensic investigation asks what happened during the incident. This asks a narrower, practical question: what can you still prove now that recovery is complete.
Yes, once their work is largely complete. John Henderson, our CTO, is a security-cleared IT professional and leads this engagement directly, so the handover is technical to technical.
That is a legitimate, common outcome, and better to know precisely than to assume. The report separates what still needs qualifying from what has genuinely been lost, so you can communicate that honestly to regulators or customers if needed.
The BioChain Advisory helps organisations understand how evidence actually moves through their existing systems, independent of whether they ever deploy The BioChain platform itself. Engagements typically take one of two forms: a Data Integrity Audit, tracing representative evidence chains from source to conclusion to establish what can genuinely be demonstrated, or a Regulatory & Cross-Border Readiness Review, examining whether an organisation's systems and records can support the claims a new jurisdiction or regulation requires.