What services does Nokta Guard offer?

Nokta Guard offers penetration testing and other offensive security tests, digital forensics, vulnerability and exposure management, risk and compliance consulting, and training and awareness services. You can engage us for a single service or combine several into a programme.

Where is Nokta Guard based and which regions do you serve?

We are headquartered in Kartal, Istanbul. We serve organisations across Turkey both on site and remotely, and organisations abroad remotely. Work that requires an on-site presence is planned during scoping.

What size of organisations do you work with?

We work at different scales, from small businesses testing a single web application to large organisations with many systems. We set the scope and testing depth according to your organisation's size and risk level.

What certifications does your team hold?

Our penetration testing team holds national and international certifications: OSCP, OSEP, CRTO, CEH, eMAPT, eCPTXv2, eWPTX / eWPTXv2, plus TSE Senior Penetration Tester and TSE Certified Penetration Tester personnel certificates. On request, we can share the CVs of the assigned specialists with the proposal.

Do you offer ongoing services beyond one-off tests?

Yes. Through vulnerability management, a CTEM programme and patch validation, we can track your weaknesses on a weekly or monthly basis. This also gives you visibility of new risks that appear between two penetration tests.

What is penetration testing?

Penetration testing is a controlled test of your systems by authorised specialists using real attacker techniques. The aim is to find vulnerabilities before an attacker does, prove that they can be exploited and report how to fix them.

What is the difference between vulnerability scanning and penetration testing?

Vulnerability scanning lists known weaknesses with automated tools and often includes false positives. In a penetration test, specialists validate findings manually, look for business logic flaws and show how far an attacker could get by chaining vulnerabilities.

How often should a penetration test be performed?

The general recommendation is at least once a year and after every major system or application change. For organisations subject to BDDK, SPK, EPDK or PCI DSS, frequency may also be set by the relevant regulation.

What is the difference between black-box, grey-box and white-box testing?

In a black-box test, the team receives no information about the target and simulates an external attacker. In a grey-box test, limited information such as a user account is shared, while a white-box test provides architecture documents or source code. The more information provided, the deeper the review possible in the same time.

How long does a penetration test take?

Duration depends on scope. We confirm the timeline in the proposal after scoping.

What happens if a critical vulnerability is found during testing?

When we identify a critical vulnerability, we notify the contact named in the rules of engagement immediately, without waiting for the report. This lets you act on urgent risks before testing ends.

What is a digital forensic examination and when is it needed?

A digital forensic examination is the analysis and reporting of digital traces on computers, phones, storage media or servers while preserving evidence integrity. Common cases include internal investigations, data leaks, commercial disputes, employment and family law matters.

Can your forensic report be used as evidence in court?

Our reports are prepared in an auditable way, including methods, tools and hash values. Whether a report is admitted as evidence and how much weight it carries is at the discretion of the relevant authority. Nokta Guard is not a court-appointed expert witness; we provide expert opinion and technical consultancy.

Can you review an existing court expert report?

Yes. Through our expert opinion service, we can review the technical methods of an existing expert report, its findings on evidence integrity and the basis of its conclusions. We present our assessment as a technical expert opinion.

Do you accept requests from individuals?

Yes. In addition to organisations, we assess requests from individuals who have lost data, are involved in legal proceedings or need digital evidence examined. Call us or fill in the contact form for an initial assessment.

How does a project get started?

Once you reach us via the contact form, email or phone, we hold a short initial call. We then complete the scoping form together, prepare a proposal and, with your approval, sign the contract and authorisation documents.

Do you sign non-disclosure agreements (NDAs)?

Yes. An NDA can be signed before any scope details are shared. All project information, findings and reports are kept in environments accessible only to the team members assigned to the project.

What authorisation is needed before testing starts?

Before testing begins, the system owner's written authorisation and rules of engagement defining the limits of the test are signed. If you use cloud or hosting services, the provider's testing policies are also followed. Testing does not start without these documents.

How are our data and test findings stored?

Reports, evidence and forensic images are stored in encrypted environments with access limited to authorised team members. Data is either not retained at all or kept for 3 or 6 months, as you prefer, and then securely destroyed.

Can tests be run outside business hours?

Yes. Tests that could affect live services can be scheduled at night, at weekends or in maintenance windows. Testing times are set out in writing in the rules of engagement.

How is the price of a penetration test determined?

Pricing depends on the number of applications, IP addresses and user roles in scope, the type of test (web, mobile, internal network, etc.), the testing approach and reporting requirements. These factors determine the specialist effort required and therefore the proposal.

How is the fee for a forensic examination determined?

The fee depends on the number and type of devices, storage capacity, the physical and encryption status of the devices, the depth of examination required and the type of report. Cases requiring advanced methods such as chip-off are assessed separately.

What information should I share to get a quote?

For a penetration test, share the list of systems to be tested, their approximate size, the test type and any regulatory requirement. For forensics, a brief description of the devices, their condition and the purpose of the examination is enough for an initial assessment.

Is the retest included in the proposal?

The scope of the retest and the period within which it will be performed are stated clearly in the proposal. That way you know from the start under what conditions retesting will take place after you fix the findings.

What does a penetration test report include?

The report includes an executive summary, scope and method, a risk matrix and, for each finding, impact, CVSS score, evidence, reproduction steps and remediation guidance. A separate retest report is delivered after fixes are made.

When and how is the report delivered?

The delivery time is stated in the proposal according to the size of the scope. Reports are delivered encrypted, with the password sent through a separate channel. We then review the results with your team in a presentation meeting.

Can the report be prepared in English?

Yes. Reports can be prepared in Turkish or English on request. Simply let us know your language preference during scoping.

Can we present the report to an auditor or regulator?

Our reports present scope, method, findings and retest results in a format suitable for audits. Whether a report is accepted in a specific audit depends on that regulation's requirements for the testing firm and the report. We review those requirements with you during scoping.

Penetration Testing & Forensics FAQ

The drive won't mount. Can it still be examined?

If there is a physical fault, a data recovery assessment comes first; once an image can be acquired, the examination continues.

Can anything be found if browsing history was deleted?

Often partially. The cache, system records and file slack can still be assessed.

Can private (incognito) browsing be detected?

No history is stored directly, but some system and network traces may allow an indirect assessment. The result depends on the device and its configuration.

Can I have an employee's internet activity examined?

Examining company-owned devices is possible, but employee privacy and Turkish data protection law (KVKK, Law No. 6698) must be respected. We recommend planning the process with your legal team.

Is deleted data always recoverable?

No, we make no guarantees. Recoverability depends on technical factors; we share a realistic assessment after a preliminary review.

Can you prove that data was deleted?

In many cases, deletion traces and file system records can show that deletion took place and roughly when. What can be established depends on the records available.

I kept using the device. Have my chances dropped?

Yes. The longer the device is used, the more likely deleted data is to be overwritten. Stop using it straight away.

What if data-wiping software was used?

Overwritten data generally cannot be recovered. However, traces showing that a wiping tool was used can often be detected, and that is a significant finding in itself.

Can you examine someone else's account?

No. The work is limited to accounts you are legally authorised to access and to publicly available content.

The content has been deleted. Can it still be captured?

Public archive records and traces on devices can be assessed, but capturing deleted content is not always possible.

My account was taken over. What should I do?

Secure the account first and contact us without deleting session records. Access traces are kept for a limited time, so acting quickly matters.

How is a forensic capture different from a notarised capture?

A forensic capture records the technical context of the content in detail: URL, timestamps, metadata and hash values. We recommend deciding which method to use together with your legal adviser.

Should we shut the server down if we suspect an incident?

No. Shutting down can destroy volatile evidence in memory. Contact us first and we will guide you through the initial steps by phone.

Our logs are kept only for a short time. Are we too late?

Acting as quickly as possible matters. Even if logs have been deleted, some traces can still be obtained from the file system and backups.

Can the findings support a KVKK breach notification?

The report contains technical findings that help determine the scope of the breach and the categories of data affected. The notification itself should be handled together with your legal team.

What is the difference between an expert opinion and a court-appointed expert report?

A court-appointed expert report is prepared by an expert the court appoints. An expert opinion is a technical assessment prepared at a party's request that may be submitted to the court; its weight is at the court's discretion.

Can you help challenge a court-appointed expert report?

Yes. We review the report's method and findings and give your legal team the technical grounds for challenge, with reasons. The legal framing of the challenge is decided by your lawyer.

At what stage of a case should I contact you?

As early as possible. When the evidence strategy is set up correctly from the start, many technical objections can be avoided later on.

Can you attend hearings?

Technical support can be provided to the extent the request and procedural rules allow. We agree the scope with you during the initial discussion.

Do I pay if the data cannot be recovered?

The pricing model depends on the type of work. Terms are shared in writing after the preliminary review, and no work begins without your approval.

I had my device opened or formatted. Is there still a chance?

It depends. Data can sometimes be recovered after formatting, but if the device has been used since, the data may have been overwritten. A preliminary review will clarify the situation.

How long does data recovery take?

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment. Physically damaged or encrypted drives may take longer;

How is the confidentiality of my data protected?

A non-disclosure agreement is signed, the material is kept in an access-restricted environment, and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

My USB drive isn't recognised. Is there any hope?

Often, yes. With controller failures the device may not appear, but the data on the memory chip is usually intact and can be read directly.

My card says it needs to be formatted. What should I do?

Do not format it. Remove the card and stop using it; formatting lowers the chance of recovery.

Can a physically broken card be recovered?

If the memory chip is intact, chip-level recovery can be considered. A preliminary review is needed first.

My drive is making noises. What should I do?

Power it down immediately and do not switch it on again. With a mechanical fault, every power-up can add damage and reduce the chance of recovery.

Can deleted data be recovered from an SSD?

Because of TRIM, recovery prospects on SSDs are generally lower than on HDDs. Depending on the drive's configuration, results may still be possible.

I already tried recovery software. Is that a problem?

Those attempts may have overwritten data. We will still carry out a preliminary review to assess the current situation.

Can you recover data from a RAID array?

Depending on the RAID level and the number of failed disks, rebuilding the array can be assessed. Contact us without changing the disk order or trying to rebuild the array.