Triminus

Technical facts for legal decisions

Investigations

A technical expert at your side: tailored to the case, one direct line.

Technical complexity, turned into facts you can act on.As simple as the evidence allows, not simpler.

Who it is for

Law firms and in-house legal teams in Switzerland. Typical areas:

  • Disputes
  • IP & trade secrets
  • White-collar crime
  • Employment law
  • Corporate investigations

When something technical comes up in a case, call. The explanation and reasoning your case needs: what the evidence shows, how certain that is, and where it stops. You get the answer, not a lecture on operating systems. The technical detail goes into the exhibits, for when you or the court need it.

You deal with one person, from the first call to the report and, where needed, the hearing. Instruction goes through counsel, and every engagement starts with a conflict check.

Bring what you have

Most questions start vague, and that is fine. No technical terms needed, and no certainty that evidence exists. A suspicion is enough to call. Then you and Triminus sort it out together. Questions often sound like this:

  • “I want to follow up on an insider, an employee or an external partner, who knew things they should not have known.”
  • “Data was definitely taken, but the client’s IT team says there is nothing in the logs. How could it have happened?”

Triminus turns these into questions answerable by evidence as far as the case permits. Then you hear plainly what it shows and does not show.

Matter types

People and data

  • Departing employees taking data (trade secrets, client lists, source code) What was copied, when, and where it went.
  • Data exfiltration What left, when, and by which route.

Fraud

  • Payment diversion and CEO fraud How the payment instruction came about, and from where.
  • Fraud with a synthetic voice or video What the records of the call or meeting can establish, and what they cannot.
  • Business email compromise Whether the mailbox was taken over, since when, and what was read or sent from it.

Accounts and systems

  • Compromised accounts in Microsoft 365 and other cloud services Who signed in, from where, and what they did.
  • Malware in a disputed incident What the code did, and what it could not have done.

A second opinion

  • An incident analysis by the internal IT team or provider To be verified independently: whether it is sound, complete, and supported by the evidence.
  • Technical assertions you cannot evaluate, including the other side's expert report Whether they hold up.

Limits

  • Triminus is not a court-appointed expert unless and until appointed. A party report is presented as a party report.
  • No evidence is processed without the client’s demonstrable authority over the systems concerned.
  • No Investigations mandate for a client whose security operations are run by Triminus.
  • No mandate touching the founder’s former employer.
  • Every independent verification starts with a conflict check, including any tie to your IT provider.
  • No legal advice.

Packages

Most engagements start with one matter. Each package is a starting point. Scope and terms are shaped to your matter before the work starts. The retainer and the consultation hour keep the same contact for the next matter.

For one matter Start where your matter is; each package also stands alone.

  1. Technical Triage

    Two working days to know what evidence exists, what it can show, and what it takes to preserve it.

    Structured intake with counsel. Evidence sources and custodians identified, a feasibility assessment, preservation instructions and the scope of a full investigation. In short: the technical side of an early case assessment.

    Deliverable A scoping memorandum.

  2. Evidence Preservation

    Forensically sound collection per custodian and per source: devices, mailboxes, Microsoft 365 audit and sign-in logs, and cloud records. Forensic images rather than self-collection. Hashing on acquisition, a chain-of-custody register, encrypted storage in Switzerland.

    Deliverable An acquisition record and custody log.

  3. Investigation Mandate

    What happened, established from the preserved evidence.

    Endpoint, email, cloud and identity analysis. Log analysis, timeline reconstruction, exfiltration assessment, account-compromise analysis, and file analysis where relevant.

    Deliverable A findings report with exhibits.

  4. Technical Expert Report

    A report written to be filed as a party expert report (Parteigutachten).

    Methodology, limitations, exhibits. On request: a review of the other side's expert report, a written rebuttal, and attendance at the hearing.

    Deliverable A party expert report.

For the next matter

Beyond one matter

  • Counsel Readiness Retainer

    For a law firm that wants a forensic expert in place before the next matter arrives.

    A named contact who also does the work. Terms agreed in advance, a set route for conflict checks, priority scheduling, and advisory time.

  • Counsel Consultation Hour

    Someone to ask when something technical comes up in your cases: one hour a month, matter or not.

    A log extract, a claim in the other side's submission, a device that may be worth preserving, the technical meaning of a client's incident. Questions about a specific matter go through a conflict check first. Technical answers, no legal advice.

Getting started

It starts with a call, not a form.

  1. A first call to see whether Triminus fits the matter. Bring what you have, however vague, in your own words. No technical preparation needed.
  2. A conflict check, before any detail of the matter is shared.
  3. Scoping with you: the question to be answered, the evidence that may exist, the deadlines that matter.
  4. You agree the details in an engagement letter: the package, the scope, and anything else your matter needs.
  5. The work starts. The same person handles it throughout, from preservation to the report. Questions in between are welcome: you get an answer, not a ticket number.

Suspicious file analysis on request

For counsel, SOCs and incident-response firms. You send a suspicious file, or a defined set of files, and get back a fixed-scope report. Typically: whether it is malicious, what it does, how it persists and communicates, and the indicators to hunt for.

Files are analysed in Triminus’s own environment in Switzerland and are not uploaded to public analysis services. Where a file is already publicly known, published analyses are consulted by its hash.

Swiss data residency

Evidence, samples and case data held by Triminus stay in Switzerland across their whole lifecycle, from acquisition to analysis and storage. No US cloud services are used for them. This covers Triminus’s own systems; where the work happens inside your own tenant, your platform choice applies. Ask for the details and how they match your data protection needs.