what we are not

we are not

• not chain-of-custody software. a case binder or session export is not admissible evidence on its own. it does not satisfy federal rules of evidence without a process around it.
• not a siem. no centralized log store, no correlation at enterprise scale, no 90-day retention pipeline. you bring the exports.
• not an edr. no agent on endpoints, no live telemetry, no remote isolation. we parse what you already extracted.
• not a replacement for cellebrite, axiom, encase, magnet, or velociraptor. those are vendor-of-record platforms with validated workflows. we are a browser toolbox for first-pass triage.
• not a managed incident response service. no retainer, no on-call analyst, no negotiation desk. hand outputs to someone who does that for a living.
• not attribution or legal advice. we surface artifacts and patterns. we do not name operators, predict court outcomes, or tell you whether to pay a ransom.
• not a cloud evidence processor. files never leave your device. if a tool needs network access for something other than loading the page, that is a bug — report it.

what we are

it produces fast, honest, local-only analysis you can verify in your browser, and that you can hand to someone who does this for a living.

the coverage map at /forensics/coverage groups every investigation hub by lane — vertical entry points, artifact families, and flagship case-type playbooks with live tool counts.

reference investigations live at /forensics/proof — 36 synthetic scenarios with published goldens, downloadable fixture packs, and local case-binder exports you can replay without uploading evidence.

case-type methodology guides live at /forensics/methodology — evidence preservation order, recommended tool paths, honest limits, and links back to each proof page.

open devtools. network tab. drop your file. watch what we send. you'll see nothing leaving your machine. that's the contract.