Frequently asked questions

Software for forensic acquisition of digital evidence on live systems: it records the full session, hashes and timestamps every artifact, verifies and stores it immutably, and leaves the result checkable by a third party via a link or QR code — no account required.

Manually selected files from the desktop client; photos, video, audio, screenshots, email, SMS, exported WhatsApp chats and (on Android) call logs from the mobile app; browsing sessions from the browser extension; and, with no operator involved, automatically certified incoming email and scheduled website captures.

The desktop client runs on Windows, macOS and Linux; the mobile app on iOS and Android; the browser extension on Chrome, Edge and Firefox.

No. The desktop client is a self-contained executable that runs from a USB drive — nothing gets installed on the examined machine.

Every artifact is hashed (SHA-256) and stamped (RFC 3161) on the client before upload; the server recalculates the hash on receipt and rejects it if it doesn't match, obtains its own independent second timestamp, and chains the hash with the previous artifact in the session. The accepted blob is marked read-only at the filesystem level.

The desktop client falls back to an offline mode: it stores the case, session and artifacts locally (with its own local hash chain), and syncs against the server as soon as connectivity returns, reusing the same identifiers generated at the moment of extraction.

No — and no software could be. The standard itself clarifies that certifying software tools isn't its purpose (what could be accredited, if one wanted to, is the laboratory, not the tool). What we do is structure the custody mechanism to follow what the standard asks for live-system acquisition (§7.2).

No, and it isn't meant to. Forensica's evidence is technical evidence, freely assessed by a judge — it doesn't carry public faith. If its authenticity is challenged, what sustains it is the expert report backed by the mechanism's technical guarantees (verified hash, dual timestamp, chained hash). A notary provides something different and stronger against a challenge (public faith, full legal proof), and can in fact attest to evidence already captured with Forensica without having been present at the extraction.

Yes. Every session and every case carry a public verification identifier, independent from the internal ID — with the link or the QR code, anyone (another examiner, a court, a lawyer) can check hashes and timestamps and download the evidence, no account required.

No, deliberately. Forensica covers the acquisition and custody of live systems — later analysis (recovering deleted data, studying the operating system, indexing artifacts) remains the examiner's own work, with their own tools.