Case intake that respects what comes out of the lab.
Preserve files exported by your acquisition tools and record the source and method for each derivative. EMP uses SHA-256 to check file integrity while keeping the examiner's documented provenance available for review.
Replace the folder. Keep the lab.
The imaging tool makes an image, the acquisition tool makes a report, and the case file becomes a folder named after the matter with chain of custody parked in a spreadsheet. Replace the folder. Keep the lab.
Digital forensics evidence management is the discipline of keeping a matter's acquisition image and every derivative organized as one case file. The image comes out of the lab clean, then spends six months as a working copy: people carve it, parse it, export pieces into reports, and drop those into a folder named after the matter. By the time discovery lands, nobody can say which report came from which image, or whether the image you have now is the one you started with. EMP preserves the original and records how each derivative was produced from it, with every file hashed by SHA-256 so the recorded lineage and file integrity can be reviewed separately, on a workflow aligned with the NIST SP 800-86 / 800-101 evidence model (a design target, not a certification).
Where EMP fits in the workflow.
Your digital-forensics packet might include
- ✓ The acquisition image as the canonical original
- ✓ Device and file hashes
- ✓ Derivatives with recorded lineage to the source
- ✓ Examiner notes
- ✓ The exhibit export
Mobile forensic case
Import the mobile acquisition image as the canonical original and preserve its hash. Reports you derive (call logs, messages, location data) are tracked as derivatives with provenance back to the image, so the lineage from acquisition to exhibit stays intact.
Computer forensic case
Import disk images, preserve the hash at intake, and ship a verifiable export package (manifest and per-file checksums). EMP keeps that intake copy untouched, so later integrity checks can compare the retained file with its intake hash.
Cloud-acquisition case
When a cloud-collection export (Workspace, M365) lands in the case, EMP records where it came from and holds it as the original you measure everything else against. Anything that shifts later is easy to spot.
Retainer / multi-incident case
Organize multiple incidents under one retainer engagement with a continuous audit trail the corporate client and their counsel can rely on.
Expert-witness packaging
Build a package from selected acquisition files and derivatives. Enable Manifest for per-file checksums; the completed ZIP hash is recorded separately in EMP and can be supplied to the recipient. Opposing counsel recomputes it with stock tools and verifies it independently. No EMP install, nothing to take on faith.
How a digital-forensics case moves through EMP
- Import the acquisition image as the canonical original. The image from your lab tool comes in and EMP calculates SHA-256 for the imported file, preserving the original bit-for-bit. That intake copy is never edited.
- Record how each derivative was produced from the source. The reports you carve out (call logs, messages, location data) are tracked as derivative objects with provenance back to the image hash, so the lineage from acquisition to exhibit is recorded and can be checked later.
- Build the chain and reconstruct events. Link the derivatives to the people and devices in the case, and place extracted events on a timeline to show the sequence the exhibits describe.
- Build the exhibit set as an Export Package. One ZIP with selected acquisition files and derivatives. Enable Manifest for file checksums. EMP records the completed ZIP's SHA-256 outside the archive in its package and export-audit records.
- Opposing counsel verifies the exhibit set independently. They recompute every hash with sha256sum or the /verify tool. Six months later the image still matches intake, and if one byte changed it shows. No EMP install, nothing taken on faith. The court decides admissibility.
Feature availability: Standard adds Chain of Custody, Audit Timeline and Incident Maps. Timeline Recon, Link Analysis and custom report branding require Professional. Core includes case management, file intake and exports.
Case workspace example
EMP does not replace acquisition tools. After exporting from your forensic tools, use EMP to preserve the originals, track devices and assets, connect people and places, record findings and file notes, and produce a verifiable handoff package.
Ingests your exports. Doesn't replace your tools.
EMP sits downstream of acquisition and analysis tools. Import their exported files, retain the acquisition reports and record source and derivation details for later review.
- Mobile acquisition images from your forensic tool, imported with hash preservation
- Disk images from your forensic tool, imported as canonical originals
- Cloud-collection exports imported as files with source provenance recorded
- Exhibit-grade export packages a reviewing party can verify and ingest
- Scanned reports and PDFs fingerprinted on intake, so the proof travels with each file
Questions these teams ask first.
Does EMP replace Cellebrite or EnCase?
No. EMP Intake WS is the case-management layer on top of your acquisition and analysis tools. Cellebrite produces an image; EMP preserves that image as a canonical original and manages everything you derive from it, with provenance back to the source hash.
How are hashes from my acquisition tool preserved?
EMP computes SHA-256 for the imported file. Retain the acquisition tool's original report and checksums as source evidence, and record the source device and derivation details with the case.
How does EMP handle the mobile preservation model?
For mobile-device evidence, EMP preserves the acquisition image as the canonical original. Reports derived from the image (call logs, messages, location data) are derivative objects with provenance back to the image hash. That maps to the NIST SP 800-101 mobile-forensics preservation model, as a design target, not a certification.
Can a reviewer verify an export without EMP?
Enable Manifest to include checksums for the declared package files and the standalone verifier. EMP also computes the SHA-256 of the finished ZIP after archive creation and records it outside the archive, so the exporter can provide it when exact container verification is required. The next reviewer recomputes the per-file hashes with the included verification tool, on our /verify page, or with a standard tool like sha256sum. If one byte changed, it shows. No EMP install required.
Where does this sit next to Magnet REVIEW or Cellebrite Pathfinder?
Magnet REVIEW supports collaborative digital-evidence review; Cellebrite Pathfinder supports investigative analysis. EMP preserves files exported from other tools and records their handling. These remain separate applications; exchange depends on the files they export.
Build the case anyone can verify.
EMP Intake Workstation comes with a 14-day trial, no card and no sales call, so bring a real case and watch it stay defensible.