Case workspace and entity tracking for evidence-driven investigations
Case workspace for evidence-driven investigations
EMP Intake Workstation gives every case a structured workspace: evidence, people, vehicles, places, assets, loss and impact, comments, notes, tasks, and findings in one local case file. Objects can link back to the evidence that supports them, and case actions are logged for export.
What it is
A structured case workspace around evidence integrity
The case workspace is the local case file where an investigation comes together. You build it from case objects: the evidence itself, plus the people, vehicles, places, assets, and losses that the evidence describes. Each object is its own record with its own fields, and each one links back to the hashed evidence that supports it.
Because the objects share one model, the same case can be read as a timeline, plotted on a map, or laid out as a link chart without re-entering anything. The case file stays on your machine, and changes are written to an audit log you can export.
What it is not
Deliberate scope
EMP Intake Workstation is deliberately narrow and we are not trying to replace giant enterprise solutions.
Not a hotline or intake platform
It is not a whistleblower or anonymous-reporting front end. It is the workspace where an investigator works a case that already exists.
Not an enterprise GRC platform
It does not run governance, risk, and compliance programs across an organization. It is a local case file, not a company-wide system of record.
Not a forensic acquisition tool
It does not image drives or pull data off devices. It takes in files you have already acquired and keeps them defensible from there.
Investigation case management, centered on the evidence
Is EMP investigation case management software?
Yes, EMP Intake is investigation case management built around the evidence file: the case workspace, people, vehicles, places, assets, notes, tasks, findings, and a verifiable export. It is not an enterprise platform for intake queues, approvals, hotline workflows, or org-wide reporting.
How is EMP different from case management software?
Most case management software focuses on workflow, routing, approvals, dashboards, and collaboration. EMP focuses on evidence integrity and the structured case record around the evidence: preserved files, SHA-256 at intake, case objects such as people, vehicles, places, and assets, plus timelines, maps, link analysis, timeline reconstruction, an audit log, and a verifier-ready export package.
Case objects in practice
Every kind of record, one model
Each object type captures what an investigation actually tracks: people, vehicle, place, and asset tracking for case objects, all linked back to the evidence that supports them.
People and parties
Subjects, witnesses, reporters, and contacts, with the role each plays and the evidence that names them.
Vehicles
Plates, makes, and descriptions tied to sightings, footage, and the places they appear.
Assets and devices
Phones, laptops, badges, and property, recorded with the files and identifiers that connect them to the case.
Places and scenes
Locations with coordinates, so the same record drives the map and the timeline.
Loss and impact
Quantified loss, damage, and impact lines, attached to the exhibits that substantiate them.
Statements
Build and track witness statements separately in their own interface. Apply templates and case data.
Reuse across views
One case file, read from every angle
Because the views read the same objects and the same hashed evidence, you build the case once and look at it from whichever angle the question needs.
Timeline reconstruction
Order events from the same objects to see how the incident unfolded using multiple log files, video and incident maps.
Incident maps
Plot places and scenes from their coordinates, with moving-pin playback to recreate the scene.
Heat maps
See where activity concentrates across the mapped objects.
Link analysis
Chart how people, vehicles, and assets connect through the evidence.
Export package output
The case leaves as a package anyone can verify
When the work is done, the case workspace exports a self-contained package: the evidence files, the audit log of case actions taken, a manifest of SHA-256 hashes, and the case context that ties the objects together. The recipient checks it without EMP installed, using the included file verifier tool in each export so a reviewer, prosecutor, or opposing party can confirm nothing changed since export.
Tamper-evident, not tamper-proof: the package surfaces any change so a reviewer can see it. Whether evidence is admissible is for the court to decide.
Build your next case in the workspace
Take one real case from intake through a verifiable export. The 14-day trial runs at the Professional tier, so every view and export is available.