Digital forensics workflow software
Extraction and analysis are already well served. The hours before them are not — so DEVI runs your agency’s approved procedure at the counter, on the phone already in the officer’s hand, while the answers are still knowable.
Where DEVI fits
Nothing here reaches into a forensic tool, and nothing here touches evidence. DEVI covers the procedure either side of the examination — the part that happens at a counter, on a phone, before anyone opens a case.
In the field
It comes across the counter, often in the middle of a shift, and its state is changing while it sits there.
DEVI
The agency’s own approved preservation instruction, shown while it can still change the outcome.
DEVI
The device’s condition and details, captured at the counter while somebody still knows the answers.
DEVI
What the assigned workflow determines applies, and the notification to the examining unit, drafted in your own mail.
Your lab, your tools
The examiner works in the tools the agency already owns. DEVI keeps the run and its dates until the work is marked complete.
Product · iPhone
ReleasedAn organization is assigned an approved, versioned workflow. DEVI walks the user through it on the phone already in their hand, shows the step that applies, and prepares the request that has to go to another team as a draft in the user’s own mail client — ready to read and send in their own name.
When the intake is finished, DEVI records that the workflow ran — which workflow, when it started, its due date and its status — and keeps that run in view until it is marked complete. Working content stays on the device.
Accounts are created by an administrator at a licensed organization, and access is arranged per organization. Ask for a demo and we will walk your team through it.
Specification
What an organization is signing up for, in plain terms.
Field notes
A library of field findings, written up by the examiners who ran into them — indexed once, searchable by whoever hits it next.
Search runs in your browser. Terms travel in the address fragment browsers never send to a server, so what you type stays on your machine.
Methodology
Experience is worth writing down, and it is still one examiner’s experience. An entry carries the conditions it came from, and says which part is observation and which part is judgment.
Platform, operating system version, application, tool, database, table and artifact are structured fields — so you can see what it was observed in before you read a word of it.
Full filesystem paths, database and table names, and the specific columns a conclusion rests on. Enough to go to the same place in your own extraction.
Behavior changes between OS versions, application versions, extraction methods and tool versions. Each entry carries that caveat rather than leaving it to be assumed.
What gets written down
What keeps a note useful to somebody who was not there.
What was seen, what was tested, and what is being concluded from it are separable.
Enough conditions and identifiers that a second examiner can attempt the same thing — including reaching a different answer.
One artifact rarely settles a question. An entry says what a record shows and, where it matters, what it does not.
An OS update, an app update or a different extraction method can change the answer.
Independent and educational. DEVI Digital Forensics is an independent educational project created by digital forensic practitioners outside of their official employment. It is not sponsored, reviewed, approved, or endorsed by any contributor’s employing agency, and nothing here is agency policy. Validate every entry against your own data, and do not interpret an artifact in isolation.
Contact
The same address takes a demo request, a finding you think belongs in the field notes, and a correction when an entry is wrong on your data.
Please leave case information, evidence detail and anything your organization treats as sensitive out of it. Support says what to include instead.