About Forensica

Why Forensica exists

Digital evidence rarely waits. A message gets deleted, a post gets taken down, a chat gets edited, a page changes, a state gets replaced — and the window to capture it with real guarantees is often measured in hours, not days. A notary attests with an authority no software can match, but is rarely available with the immediacy the moment demands: booking an appointment, traveling there, waiting in line — and by then the evidence may be gone. Forensica exists to cover exactly that gap: capturing and preserving the evidence while it still exists. It doesn't replace a notary, a lawyer or an expert — it arrives before them, while there's still time to act, and leaves the evidence ready for any of them to pick up afterwards.

And because it's acquired from a live system — unable to clone it bit by bit, unable to repeat the process exactly the same way twice — proof that nothing was altered can't live only in the final file: it has to live in the procedure. That's why we record the full session, stamp every artifact on the spot, verify it server-side, and leave it checkable by anyone with the link — without the examiner's word being the only guarantee.

What we do, and what we don't

Forensica covers the acquisition and custody of digital evidence: a desktop USB drive, a mobile app, a browser extension, automatically certified incoming email, scheduled website monitoring. We deliberately don't do forensic cloning of powered-off devices, mobile device extraction, or later forensic analysis (recovering deleted data, studying the operating system, indexing artifacts) — that remains the examiner's own work, with their own tools. This boundary isn't a technical limit — it's a product decision. We'd rather do one thing rigorously than cover everything halfway.

How we think about security

Every guarantee in the mechanism is checkable, not a promise: the hash can be recomputed, the timestamp can be validated against the issuing authority, the access log can be consulted. We also document what we haven't solved yet — local WORM storage, for instance, isn't real immutability against an OS administrator with sufficient permissions; that arrives with the move to cloud storage with Object Lock, still on our roadmap.

Where it fits against the standard

UNE 71506:2013 distinguishes the acquisition of live systems (§7.2, Forensica's scenario) from that of powered-off systems and from later forensic analysis. The standard itself acknowledges that, on a live system, what holds up the validity of the result is how the procedure is justified — not an identical hash a third party could reproduce, which doesn't exist in this scenario. No software can be certified against this standard (it says so itself); what we do is structure the mechanism to follow that same reasoning.