Skip to content

A digital chain of custody, verifiable end to end

Turn any digital evidence extraction into proof that holds up to scrutiny.

Forensica records, stamps and certifies every acquisition session — from a USB drive, a phone, a browser, or fully automatically — so anyone with the link can verify it, no account required.

Server-verified SHA-256Dual RFC 3161 timestampWORM storagePublic QR verificationStructured after UNE 71506

The problem

Digital evidence gets challenged over how it was obtained, not just what it contains

On a running system, bit-by-bit cloning simply isn't possible: the proof that nothing was altered lies in the procedure, not just the file. UNE 71506 says as much for «live systems» — which is why Forensica records the full session, stamps every artifact before upload, and leaves the result independently verifiable, without relying on the examiner's word alone.

How it works

One chain-of-custody mechanism, for any source

Desktop USB drive, mobile app, browser extension, automatically certified incoming email, or scheduled website monitoring — everything goes through the same path.

  1. 01

    The full session gets recorded

    The entire screen, from start to close of the acquisition — not just the resulting file, but the procedure that produced it.

  2. 02

    Every artifact is stamped on the spot

    Local SHA-256 hash and an RFC 3161 timestamp before anything is uploaded — the stamp proves the acquisition moment even if the upload fails.

  3. 03

    The server verifies and stamps again

    The hash is recalculated on receipt, a second independent timestamp is obtained, and it's chained to the previous artifact in the session.

  4. 04

    Anyone can verify it, no account needed

    A link or a QR code lead to a public portal: hashes, timestamps and download, for another examiner, a court or a lawyer.

The product, on screen

Real screenshots of the panel, the public portal and the acquisition apps

PanelManagement panel — overview of the organization's cases.
Management panel — overview of the organization's cases.
PanelCase list with its associated chain of custody.
Case list with its associated chain of custody.
PanelCase detail: sessions, artifacts, hash and RFC 3161 timestamp.
Case detail: sessions, artifacts, hash and RFC 3161 timestamp.
DesktopUSB-drive app — acquisition session recording in progress.
USB-drive app — acquisition session recording in progress.
MobileMobile app (Android) — closed session with a certified artifact.
Mobile app (Android) — closed session with a certified artifact.
MobileMobile app (iOS) — capturing the acquisition point via GPS.
Mobile app (iOS) — capturing the acquisition point via GPS.
ExtensionBrowser extension — login and case selection.
Browser extension — login and case selection.
ExtensionRecording a browsing session in progress.
Recording a browsing session in progress.
Public portalPublic verification portal — no account required.
Public verification portal — no account required.
Public portalSession verification: hash, timestamp and download.
Session verification: hash, timestamp and download.
Public portalFull case verification, with all of its sessions.
Full case verification, with all of its sessions.

Who it's for

Built for whoever needs evidence that holds up

See all solutions →

Why Forensica

One case, any source, a single chain of custody

  • Genuinely cross-platform

    Windows, macOS and Linux on the desktop client; iOS and Android on the mobile app; Chrome, Edge and Firefox on the browser extension.

  • Records the whole system, not just a browser

    The session captures the entire desktop or device — any application —, not an isolated browser window: the same mechanism works for an email, a desktop chat or a local file, not only for web pages.

  • Centralized on one platform, not scattered across USB drives

    Cases, sessions and artifacts from any source live in a single system accessible to the whole team — not on the examiner's own USB drive, or spread across loose folders. Finding, sharing or auditing a piece of evidence stops depending on locating the right device.

  • Public verification, no account

    A link or a QR code are enough for a third party to check the hash, the timestamp and the content — for one session, or a full case.

  • Even without an operator

    Incoming email and scheduled website monitoring certify themselves, with the same rigor as a manual extraction.

Let's start

Show us your current workflow and we'll show you where Forensica fits

A 30-minute demo, no strings attached, using your own use case.