Digital forensics workflow software

Between the seizure
and the lab.

Extraction and analysis are already well served. The hours before them are not — so DEVI runs your agency’s approved procedure at the counter, on the phone already in the officer’s hand, while the answers are still knowable.

  • At the point of seizure
  • Your workflow, versioned
  • iPhone, no new hardware

Where DEVI fits

Seizure to examination

Nothing here reaches into a forensic tool, and nothing here touches evidence. DEVI covers the procedure either side of the examination — the part that happens at a counter, on a phone, before anyone opens a case.

In the field

A device is seized

It comes across the counter, often in the middle of a shift, and its state is changing while it sits there.

DEVI

Before you handle it

The agency’s own approved preservation instruction, shown while it can still change the outcome.

DEVI

Guided intake

The device’s condition and details, captured at the counter while somebody still knows the answers.

DEVI

Handoff to the unit

What the assigned workflow determines applies, and the notification to the examining unit, drafted in your own mail.

Your lab, your tools

Extraction and examination

The examiner works in the tools the agency already owns. DEVI keeps the run and its dates until the work is marked complete.

Product · iPhone

Released

DEVI Digital Operations

An organization is assigned an approved, versioned workflow. DEVI walks the user through it on the phone already in their hand, shows the step that applies, and prepares the request that has to go to another team as a draft in the user’s own mail client — ready to read and send in their own name.

When the intake is finished, DEVI records that the workflow ran — which workflow, when it started, its due date and its status — and keeps that run in view until it is marked complete. Working content stays on the device.

Accounts are created by an administrator at a licensed organization, and access is arranged per organization. Ask for a demo and we will walk your team through it.

Specification

At a glance

What an organization is signing up for, in plain terms.

Platform
iPhone. No new hardware, no kiosk, no desktop install. Your administrator sends the install link.
Access
Named accounts, by invitation. An administrator at a licensed organization creates the account and can withdraw it the same way.
Procedure
Your workflow, versioned. The organization approves a version; the app follows exactly that version and records which one ran.
Working data
Stays on the device. What DEVI keeps of a run is its reference, the workflow, its dates and its status.
Requests
Drafted for you. The message to the next team is prepared in your own mail client, in your own name.
Security
Encrypted in transit and at rest, with administrator-managed sign-in. Full detail on the Security page.

Field notes

Search by the thing you remember

A library of field findings, written up by the examiners who ran into them — indexed once, searchable by whoever hits it next.

Search runs in your browser. Terms travel in the address fragment browsers never send to a server, so what you type stays on your machine.

Browse everything Learning

Methodology

How entries are written

Experience is worth writing down, and it is still one examiner’s experience. An entry carries the conditions it came from, and says which part is observation and which part is judgment.

01

The conditions are recorded

Platform, operating system version, application, tool, database, table and artifact are structured fields — so you can see what it was observed in before you read a word of it.

02

Paths and identifiers are written out

Full filesystem paths, database and table names, and the specific columns a conclusion rests on. Enough to go to the same place in your own extraction.

03

The limits are stated with it

Behavior changes between OS versions, application versions, extraction methods and tool versions. Each entry carries that caveat rather than leaving it to be assumed.

What gets written down

Four rules

What keeps a note useful to somebody who was not there.

Say which part is observation

What was seen, what was tested, and what is being concluded from it are separable.

Written so someone can check it

Enough conditions and identifiers that a second examiner can attempt the same thing — including reaching a different answer.

Never read in isolation

One artifact rarely settles a question. An entry says what a record shows and, where it matters, what it does not.

Dated, because it will change

An OS update, an app update or a different extraction method can change the answer.

Independent and educational. DEVI Digital Forensics is an independent educational project created by digital forensic practitioners outside of their official employment. It is not sponsored, reviewed, approved, or endorsed by any contributor’s employing agency, and nothing here is agency policy. Validate every entry against your own data, and do not interpret an artifact in isolation.

Read the full statement and methodology

Contact

Request a demo, or send a correction

The same address takes a demo request, a finding you think belongs in the field notes, and a correction when an entry is wrong on your data.

Request a demo

contact@deviops.app

Please leave case information, evidence detail and anything your organization treats as sensitive out of it. Support says what to include instead.