The documented sequence of who handled a piece of evidence, when, where, and why.
The documented record of every transition of a piece of evidence, physical or digital, from collection to hand-off. In EMP: the software covers the digital half (hash on intake, audit trail, preserved originals). The physical-handling half still needs a contemporaneous intake record. The court decides admissibility, not the tool.
SOURCE · Federal Rules of Evidence, Rule 901; NIST SP 800-86.
Verify a package in your browser →Read the chain of custody guideA 256-bit cryptographic hash function used to detect file tampering.
A cryptographic hash that turns any file into a 64-character fingerprint. The same bytes always give the same fingerprint; changing one byte changes it completely. In EMP: a SHA-256 hash is computed on every file at intake, so anyone with a standard hashing tool can later check for tampering. Necessary for chain of custody, not sufficient on its own.
SOURCE · NIST FIPS 180-4 (Secure Hash Standard).
Hash a file yourself →The schema describing how an evidence object’s state is tracked over its lifecycle.
The controls EMP uses to preserve evidence integrity across intake, casework, audit records, and export. EMP hashes evidence at intake and preserves the original. Working material, maps, statements, reconstruction sources, and export artifacts retain the provenance supported by their specific workflows. EMP does not claim that every edit creates a new hashed object or participates in one universal derivation graph.
See the live integrity check →An append-only log of operations performed on a record.
An append-only record of the material case, evidence, custody, administrative, and export events supported by EMP's documented audit event set. Entries record the timestamp and, where the workflow supports attribution, the acting user. EMP does not claim that every screen view or UI action creates an audit entry.
See the integrity model →A separately stored derivation of an original evidence file, with its own hash.
EMP hashes evidence originals at intake and preserves them as the reference point. Working material is kept separate where the applicable workflow provides that behavior, with its own integrity and provenance data where supported. The original remains the baseline used for later verification.
See the live integrity check →A self-contained bundle of evidence, manifest, and a SHA-256 package checksum, verifiable without the originating software.
A self-contained bundle of evidence, reports, and manifests that a recipient can verify without EMP installed. The manifest records hashes for packaged files. After the ZIP is complete, EMP calculates a separate SHA-256 hash over the exact ZIP bytes and records that container hash outside the archive in the package and export audit records.
Verify a package in your browser →Read the export package format specEMP’s architectural principle: operations produce a defensible trail by default.
An architecture where evidence intake, preserved originals, documented audit events, and export verification produce a checkable record by default. It does not mean that every UI action is logged or that software decides admissibility.
See the model end to end →Federal guide to integrating forensic techniques into incident response.
A NIST Special Publication describing a four-phase forensic process: collection, examination, analysis, reporting. In EMP: handling is designed to align with this lifecycle, and the export package lets a third party verify the result. Alignment is a design target, not a certification claim.
SOURCE · NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response (2006).
See how EMP aligns with NIST SP 800-86Federal guidelines on mobile-device forensics.
A NIST Special Publication covering the acquisition, examination, and analysis of mobile-device data. In EMP: the design references its chain-of-custody requirements for handling and exporting mobile-device evidence acquired elsewhere, not for on-device extraction, with hash-verify on import, a manifest checksum, and an audit trail from intake through export. As with SP 800-86, this is design-target alignment, not a certification.
SOURCE · NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics (2014).
See EMP Intake WS security and NIST alignmentThe moment a file enters a case, where chain of custody is established or lost.
The point at which a file becomes evidence: its source, custodian, and arrival time are recorded before anything is touched, and its SHA-256 fingerprint is captured. In EMP: the whole product is built around this moment, because it is where chain of custody most often quietly fails. A file dropped on a shared drive, unhashed and unlogged, cannot be defended later no matter how good the downstream work is.
See intake, step by step →Read the evidence workstation guideStandalone, defensible evidence management for solo investigators and small practices.
A Windows workstation app for solo investigators and small practices, designed to align with NIST SP 800-86: SHA-256 on intake, an audit trail of case operations, preserved originals kept separate from working copies, and an export package counsel can verify without EMP installed. Evidence stays local on the workstation. Available today with a 14-day trial; tiers are Core, Standard, and Professional, each with one workstation activation.
See EMP Intake WorkstationMulti-user evidence management deployed on infrastructure the customer controls.
The multi-user edition of EMP, PostgreSQL-backed and role-scoped, designed to run on the customer's own infrastructure rather than ours. It carries the same integrity model as EMP Intake Workstation, plus concurrent multi-user attribution, role-based case visibility, and per-team audit semantics. The EMP Intake Teams pilot is planned for 2027, with a small founding cohort onboarded directly by the founders.
See EMP Intake Teams