No evidence without a hash
The evidence record and its first hash are created in one transaction, with format and length checks per algorithm. A truncated value therefore shows up at intake rather than years later at comparison time.
Security operations
Forensics & evidence handling
The module manages the evidence, not the tool
After an incident, whether a piece of evidence holds up later is rarely decided by the analysis but by the documentation of the first hour. This module provides the control layer: it creates no disk images, reads no media and analyses nothing. That stays with your own or your provider’s forensic tooling. The module holds metadata, hashes and supporting documents, in a form that cannot be altered afterwards. That covers the management duties of BSI IT-Grundschutz DER.2.2, ISO/IEC 27037 and ISO 27001:2022 A.5.28.
BSI IT-Grundschutz DER.2.2ISO/IEC 27037ISO 27001
Features
Your benefits
A witness for the original, with no opt-out
Taking an original into custody requires a second person, and that cannot be switched off, because DER.2.2.A10 leaves no discretion here. For working copies the witness requirement is configurable and off by default.
Sealed immediately, on every path
Origin, time, custodian, witness, seal number and acquisition method are immutable from intake onwards. A sealed investigation stays sealed via the console, the API and the AI tools too, and every rejected write attempt is logged.
Open at night, justify later
The work order, legal basis and purpose become mandatory from the status "running"; in draft they may be missing. That lets an investigation be opened at three in the morning, before legal is reachable, without leaving a gap in the file later.
Capabilities
All capabilities at a glance
- Investigation with work order, legal basis and purpose limitation as the anchor of the file
- Parties with the DEFR, DES and witness roles per ISO/IEC 27037, externals as a name snapshot
- Documented involvement of data protection and the works or staff council
- Evidence with a mandatory hash, seal number and acquisition method
- Hash sets are append-only; a correction is only ever a new set
- Chain of custody: every handover an immutable link
- Storage location and retention period per item of evidence
- File hashes in the evidence bundle and details for a criminal complaint
- Shipped switched off, permissions closed by default
Result
A file that still holds up when someone asks two years later who had the medium in their hands, and when.
Experience Forensics & evidence handling live
Schedule a no-obligation demo – we will show you the module with your own use cases.