Defensible by design, not by discipline.
The integrity of the record should come from how the software works, not from remembering to do the right thing under pressure.
The folder on a shared drive workflow is where chain of custody quietly dies: a renamed file, an overwritten original, a gap no one can explain. EMP makes the chain automatic, so it isn't left to memory or a forgotten SOP.
Step by step, the evidence holds.
Intake
Every file is recorded the moment it enters the case. Source, custodian, and arrival time are captured before anything is touched.
Hash the original
SHA-256 is computed at intake and the original is preserved and hash-verified. The fingerprint is the file’s identity for the life of the case.
Build the case
Build the case with the case-management tools: intake notes first, then the people, assets, and places involved.
Write the audit log
Who did what, and when, appended continuously. The log is part of the record, not an afterthought bolted on at export.
Map the entities
People, places, devices, and accounts are linked within the case as you go, so the relationships are reconstructable later instead of reassembled from memory.
Export a verifiable package
The export carries every hash and the manifest. Counsel, or the opposing expert, can verify it without EMP installed.
When the evidence holds, the sequence speaks for itself.
Integrity isn't only about a single file surviving. It's about independent sources agreeing once they're on one clock. Drag the playhead across a sample incident and watch the CCTV, the badge reader, the alarm panel, and the motion sensor converge on the same second.
Verifiable end to end, without EMP.
You watched one file hold. Here’s the whole case: one click produces a package where every exhibit carries its own SHA-256 and a single package checksum covers them all. Click any exhibit to alter it and watch the recomputed hash break. That's the same check counsel runs on a real package.
Questions about defensibility
What does “defensible by design” actually mean?
It means integrity is structural, not a feature you remember to turn on. Files are hashed at intake, originals are preserved, documented material case, evidence, custody, administrative, and export events are logged, and the export package is independently verifiable.
Which NIST guidance does EMP align to?
EMP’s handling maps to NIST SP 800-86 and NIST SP 800-101, as set out on the trust page. The 800-101 alignment covers handling and exporting mobile-device evidence acquired elsewhere, not on-device extraction. That alignment is a design target, not a certification claim.
Can someone verify an export without your software?
The EMP Export Package documents its format and ships the SHA-256 manifest, so a third party can recompute hashes and confirm nothing changed. Standard tools, no EMP license required.
Does this apply to EMP Intake Workstation and EMP Teams?
Both. Defensible-by-design is the shared foundation. WS runs it on one licensed Windows workstation, used by one investigator or shared locally by authorized users; Teams runs the same model multi-user on infrastructure you control.
See the integrity model on your own files.
EMP Intake Workstation is a 14-day trial, no card, no sales call. Bring a real case and watch it stay defensible.