Evidence handled as evidence.

What you will use

• Evidence mode. Bytes leave only under a recorded reason, with dual control where you want it; a document in evidence cannot be moved, trashed or disposed of without an approved release.
• A custody record that verifies offline. Append-only, hash-chained, pinned into the audit chain, exportable with a verifier you keep.
• Trusted timestamps. RFC 3161 tokens on the chain's anchors and the custody record's milestones, verifiable with OpenSSL alone.
• Eleven analysers with validation packs. PDF structure and signatures, office documents, email authentication, picture metadata and signal, credentials, media containers, YARA, bulk features, the operator's own detectors — each a method with its limits, run and kept by the instance.
• Forensic images and hash sets. Images read in place with timelines; notable and restricted hash sets with quarantine; nothing ships that is not ours to ship.
• Comparison with calibration, or none. Voice and face comparison reports a calibrated likelihood ratio or says plainly that a similarity is not an identification; each is a regulated feature behind a signed notice.

modules: Legal forensics, Provenance (included) · roles: reader, examiner, evidence custodian, designated officer · reports as PDF/A-3u with the facts embedded