The four reconstruction surfaces from EMP Intake Workstation (Case Workspace, Timeline, Incident Map, and Link Analysis) are now built by the whole investigation team on one case, with changes attributed to their author. The EMP Intake Teams pilot is planned for 2027. Multiple investigators can work on the shared case, with supported changes attributed to the acting user. It runs on a PostgreSQL server you host.
1. One case, many investigators
In Teams, the case is a shared surface. One investigator captures structured intake, another adds evidence, a third works the timeline, a fourth marks witness positions on the map. Every change routes through the Workspace API, which records the material actions, who made them and when. So the reconstruction stops being one person's working file and becomes one record the whole team builds, with supported actions attributed to the acting user.
2. The shared timeline
The timeline belongs to the shared case. Investigators can align supported sources with clock offsets while retaining the original timestamp values. Review the recorded changes alongside the source material.
3. The shared scene map
The incident map is edited across the team with attributed changes and section-aware coordination. Camera and incident pins, witness positions taken from interview transcripts, and the routes and zones drawn with boxes, circles, and arrows can each come from a different investigator. Placements are attributed to their author. Record the source and confidence of a location so reviewers can distinguish an observation from an estimate. Basemap data is OSM-derived, delivered through a Falcrex-controlled map delivery service using Cloudflare infrastructure; map requests never include pins, evidence, or case content, and any browser cache is local to the client workstation.
4. Shared link analysis
Link analysis maps how a case's people, evidence, and entities connect. It uses the shared case records available to the investigator. Filter by entity type and drill into any node; because every entity is a typed object in the shared graph, a link you would otherwise miss scrolling through case notes shows up as an edge. Case access follows permissions; Managers and Administrators retain broader workspace access.
5. One integrity model, attributed to the team
The reconstruction tools use the shared case record and retain the records each workflow supports. Files are hashed (SHA-256) on intake and the original is preserved, never overwritten. The team works on a copy that links back to the source hash, and every material action through the Workspace API is timestamped and attributed to the investigator who took it. The difference at team scale is that the audit trail carries the identity of each actor, so the export shows reviewing counsel exactly which team member contributed which part of the analysis.
Reconstructing incidents as a team? EMP Intake Teams puts a case in front of several investigators with shared access and per-actor attribution, role-scoped so each person sees and edits only what their role allows. It's soft collaboration, not Google-Docs-style live keystroke editing, with a pilot planned for 2027. Apply to the Teams pilot →