Overview#
Digital Evidence Management handles the full lifecycle of digital evidence, from forensically sound acquisition through analysis and chain-of-custody documentation to court-ready disclosure.
A detective seizes three smartphones, a laptop, and a cloud-synced tablet from a suspect's premises. Each device needs to be imaged without altering a single bit, hashed immediately to establish integrity, and linked to the warrant and case record in a way that will survive challenge in court months later. This module covers that journey end to end: collection, preservation, analysis, and chain-of-custody documentation.
Criminal investigation units, military intelligence teams, and corporate fraud investigators all share the same fundamental requirement: evidence that has not been tampered with, documented at every step, and exportable in formats their legal teams can work with. This module is built to that standard.
The module also covers agency recording evidence. Footage from body-worn cameras, in-car systems, and facility cameras becomes first-class evidence that can be organised into dedicated evidence cases, automatically correlated with related incidents, officers, and devices, and assembled into court packages through a guided hub built for evidence units, with every action classified and audited.
Key Features#
Multi-Platform Digital Forensics#
Comprehensive support for mobile devices, computers, cloud services, and IoT devices. A unified analysis workspace enables correlation of evidence across a subject's complete digital ecosystem regardless of platform or source.
Forensically Sound Acquisition#
Write-blocking, hash verification (SHA-256 and MD5), and bit-level imaging for legal admissibility. Automated integrity verification at every processing stage confirms evidence has not been modified during collection or analysis.
Advanced Analysis Suite#
File carving, deleted data recovery, encryption detection, and steganography analysis. Extract hidden data, recover deleted content, and identify deliberate attempts to conceal information within digital evidence.
Timeline Reconstruction#
Automated correlation of digital artefacts across multiple devices and platforms. Builds comprehensive chronological views of user activity, communications, and data access spanning all evidence sources for prosecution narrative construction.
Artefact Correlation#
Cross-reference evidence from mobile applications, computer files, cloud backups, and network logs to build complete pictures of digital activity. Identifies connections between devices, accounts, and communications across the evidence set.
Chain of Custody Automation#
Cryptographic verification with strong hashing and digital signatures. Every evidence interaction is logged with timestamp, user identification, and action description, producing court-defensible documentation for each item in the evidence chain.
Evidence Case Hub#
A dedicated hub brings camera footage, cases, and court preparation into one workspace. A cockpit landing page presents launch tiles for the most common evidence workflows, a swimlane case board tracks evidence cases through their stages, and a full case workspace gathers recordings, linked records, and court preparation together, with a point-and-click recording picker for attaching footage to a case.
Agency Recording Cases#
Recordings from body-worn cameras, in-car systems, and facility cameras are managed as first-class evidence objects within cases that link recordings, incidents, officers, and devices. Storage is organisation-scoped with classification levels, and every case action is written to the audit trail.
Guided Source and Court Package Wizards#
Step-by-step wizards connect a video provider, connect standards-based ONVIF cameras, ingest offline media, and assemble a court package with standards-compliant export. Universal camera ingest produces export profiles suitable for evidential playback, so footage from any connected source can be prepared for court in the same guided flow.
Cross-Domain Correlation and Link Resolution#
A correlation engine suggests connections between recordings and related platform records, exposed through a strongly-typed API and surfaced inside the case workspace. From any recording, a unified link resolver navigates to its related cases, incidents, officer, and device, and a facility-context service ties recordings to the site they came from through a read-only bridge to the workforce directory. Case data is also mirrored into the platform's link-analysis views for visual exploration of connections.
Dock and Offline Media Intake#
Physically delivered media follows a dedicated path: a dock and USB upload facility feeds a court-evidence case pipeline, so SD cards and hand-delivered drives enter the same classified, audited case structure as networked sources.
Governed Retention and Deletion#
A retention panel supports reviewing and managing evidence retention, and deleting a recording is never a one-click destructive act: a deletion must be requested, is blocked outright while any legal hold applies, requires approval by a second person, and executes as a recoverable soft-delete with every transition audited. The Evidence Retention Automation module describes this lifecycle in detail.
Body-Worn Camera Bridge#
The body-worn camera application includes a Digital Evidence section that bridges directly into the shared hub, so footage review and evidence case assembly happen in one place. Hub controls carry screen-reader labels and the experience is localised across supported languages.
Use Cases#
- Criminal Investigation: Acquire and analyse digital evidence from suspect devices including smartphones, computers, and cloud accounts for prosecution
- Incident Response: Collect and preserve digital evidence from compromised systems during security incidents with forensic soundness for potential legal proceedings
- eDiscovery: Process and review digital evidence for civil litigation with defensible collection, processing, and production workflows
- Corporate Investigation: Investigate policy violations, data theft, and insider misconduct through analysis of corporate devices, email, and cloud services
- Evidence Unit Court Preparation: Build a court-ready evidence case from body-camera footage, dock uploads, and CCTV clips, connecting sources and assembling the final package through guided wizards
- Recording Triage: Open any recording and immediately see the incident, officer, and device it relates to before deciding whether it belongs in a case
- Retention Governance: Process end-of-retention footage with a defensible two-person approval trail, while legal holds placed by counsel freeze deletion of related recordings
Integration#
Connects with case management, evidence management, and forensic laboratory systems. Supports standard forensic image formats and exports to common analysis tools including Autopsy and DFIR-ORC. Integrates with court filing and eDiscovery platforms for downstream legal workflows. Within the platform, the evidence hub bridges the body-worn camera application, ties recordings to facilities through a read-only workforce directory bridge, and connects standards-based cameras as covered by the ONVIF Standards Integration module; the governed deletion lifecycle is covered in depth by the Evidence Retention Automation module.
Open Standards#
- W3C Verifiable Credentials Data Model v2.0: Verifiable Credentials signed with Ed25519 are issued at the moment of evidence collection and for every chain-of-custody transfer, providing a cryptographically verifiable provenance chain from seizure to court disclosure.
- RFC 6962 (Certificate Transparency): The append-only evidence Merkle ledger applies RFC 6962 domain-separation tags to distinguish leaf hashes from internal node hashes, preventing second-preimage collisions and enabling Merkle inclusion proofs for any evidence item.
- ISO/IEC 27037:2012: Evidence identification, collection, acquisition, and preservation workflows are aligned with this standard, which is explicitly cited in JSON export templates as the governing guideline for digital evidence packaging.
- FIPS 180-4 (SHA-256): SHA-256 is the mandatory hash algorithm for evidence integrity sealing; hashes are recorded before and after every custodial action and used as the leaf values in the Merkle ledger.
- ISO 19005 (PDF/A): Court-ready disclosure packages are rendered as PDF/A-1B, PDF/A-2B, or PDF/A-3 archives, with an embedded evidence manifest and Merkle root, ensuring long-term bit-for-bit reproducibility required for legal proceedings.
- RFC 3161 (Internet X.509 PKI Time-Stamp Protocol): Trusted timestamp authority receipts can be bound to PDF/A export packages, linking the SHA-256 digest to an auditable trusted clock and satisfying chain-of-custody temporal requirements.
- NIST SP 800-101r1: Mobile device forensics evidence packaging follows the NIST guidelines for mobile forensics, referenced explicitly in JSON export templates covering device acquisition and artefact preservation.
- RFC 8032 / Ed25519: All chain-of-custody log entries and Verifiable Credential proofs are signed with Ed25519 keys, providing compact, high-assurance digital signatures that are verifiable against the platform's published DID document.
- ONVIF: Standards-based surveillance cameras are connected to the evidence hub through a guided wizard, so conformant devices from any vendor can feed recordings into evidence cases; profile-level support is described in the ONVIF Standards Integration module.
Last Reviewed: 2026-07-16 Last Updated: 2026-07-16