Multi-store ORC, clustered into one verifiable file.
One crew hits three stores in two weeks, and the evidence lives in three folders. Retail investigation evidence management gives the case one spine across every store, so the repeated suspect and vehicle become traceable.
The reassembly is where cases stall
When the case finally goes to a DA or a civil-recovery firm, the package gets rebuilt by hand: timelines reconciled, photos re-collected, suspect IDs cross-referenced one by one. Cases close when an investigator can hand over a verifiable evidence file, not a shared-folder link and a promise that nothing moved.
Retail investigation evidence management clusters an organized retail crime (ORC) case across multiple stores, suspects, and weeks into one regional packet. The POS exceptions sit with one investigator, the CCTV clips with another, the suspect photos with a third, and all of it lives in different folders, inboxes, and heads. By the time it goes to a DA, half the work is just proving the pieces belong together. EMP gives the case one spine across every store and incident, so the repeated suspect, vehicle, and method become a single packet. For single store apprehension caseloads, see the loss prevention page.
Where EMP fits in the workflow.
Your retail-investigations packet might include
- ✓ Linked incidents across stores
- ✓ POS and CCTV per store
- ✓ Suspect vehicle and method details
- ✓ The cluster summary
- ✓ The DA export
Cross-store ORC case packet
Evidence intake from several stores into one organized retail crime case packet. On Professional, Link Analysis helps review recorded connections between suspects, vehicles and incidents across locations; the map shows incident geography and the timeline reconstructs the sequence across weeks, ready to hand a regional partner or a DA as one suspect-and-method file.
Suspect / vehicle / method packet
Build the ring around what recurs. Tag the suspect, the vehicle, and the method across every hit, so a reviewer can examine recurring details and the evidence supporting the proposed pattern.
Internal theft
POS exception exports, exported video, the interview record, and asset-recovery details into one case file with a continuous audit trail.
Vendor fraud
Returns fraud, vendor kickback, and supply-chain integrity cases. Import files supplied by multiple parties, preserve their originals and record each file's SHA-256 at intake.
Civil recovery & law-enforcement hand-off
Prepare selected files and reports for review. Enable Manifest for checksums; Standard and Professional can include Audit Timeline. Import into another system depends on that system's formats.
How a multi-store retail-investigations case moves through EMP
- Pull every store's evidence into one case. The POS logs, CCTV clips, and suspect photos from three stores over two weeks all import into a single case. Each file is hashed (SHA-256) at receipt, so the moment it lands a record travels with it.
- Cluster the incidents into one ring with link analysis. Review recorded connections across stores and link each proposed connection to its supporting evidence. The investigator remains responsible for assessing whether incidents are related.
- Map the geography and reconstruct the sequence. The incident map shows where each hit happened and the timeline reconstructs the order across weeks, tying the multi-store pattern into one narrative.
- Generate one Export Package for the whole ring. One ZIP with selected originals and reports. Enable Manifest for file checksums and the verifier; Standard and Professional can also include Audit Timeline and supported audit data.
- The DA or civil-recovery firm verifies it independently. They recompute the hashes with sha256sum or the /verify tool. If a byte changed since intake, it shows, so the case doesn't stall on reassembly. No EMP install required
Feature availability: Standard adds Chain of Custody, Audit Timeline and Incident Maps. Timeline Recon, Link Analysis and custom report branding require Professional. Core includes case management, file intake and exports.
Case workspace example
Organized retail crime pattern file. Track vehicles, plates, stores, incident locations, associates, evidence clips, recovered goods, and timeline events. Add a heat map of hit locations and a link graph of associates, so the case is not rebuilt from memory, then export a verifiable package.
Ingests your exports. Doesn't replace your tools.
EMP organizes records exported by your POS and video systems. Import POS reports, CCTV clips and store photos, then prepare a package whose included files the recipient can verify.
- CSV exports from your POS reporting system, hashed at intake
- CCTV export packages from your video system, imported as case evidence
- Civil-recovery firms: files and checksums they can review without EMP. Import into another system depends on its supported formats
- Law enforcement: selected evidence and reports for review, with optional manifests and entitled audit content
- Store-level photo and document sets get a fingerprint the moment they land, so a record of each file travels with it
Questions these teams ask first.
Can EMP handle a multi-store, multi-week case?
Yes, within one investigator's caseload on a single workstation. Evidence from several stores lands in one case, and link, map, and timeline views cluster suspects, locations, and events together. For shared caseloads across regional AP teams and central ORC investigators, several attributed users can access and work across the same shared caseload in EMP Intake Teams (pilot planned for 2027), which runs the same model on a PostgreSQL database inside your own environment.
Can I import our POS exception reports?
CSV exports from your POS exception-reporting system come in through the file-import workflow. Each file is hashed (SHA-256) at intake, so the imported record is part of the chain of custody from the moment it enters the case.
What does a package handed to law enforcement contain?
The selected evidence preserved bit-for-bit, a manifest with every per-file hash, and reports. On Standard and Professional the package can also include the Audit Timeline PDF and entitled machine-readable audit data. EMP calculates the SHA-256 of the finished ZIP after archive creation and records that value outside the ZIP in the package and export audit records; the exporter can provide it when exact-container verification is required. Enable Manifest to include the verifier. Recipients can check supported package contents with it; checksum tools can also check the listed files. No EMP install required. If one byte changed, it shows.
Does the same case support criminal referral and civil recovery?
The same case package supports both. Build the export once; the manifest and hashes make it equally verifiable for a DA submission or a civil-demand response.
Does my evidence leave my workstation?
No. EMP Intake Workstation is a local-first Windows desktop application. Case data lives in a SQLite database on the workstation. No cloud upload and no telemetry of file contents. The only calls that leave are a licensing check on activation and validation, an optional update check, and map-resource requests when map views, Timeline Recon playback, or exports use online basemaps. Map requests go through a Falcrex-controlled map delivery service using Cloudflare infrastructure (see the Trust page for details). None transmit case data.
Build the case anyone can verify.
EMP Intake Workstation comes with a 14-day trial, no card and no sales call, so bring a real case and watch it stay defensible.