Every file is hashed, tracked, and handed off with a record

1. What the integrity model does

The whole model:

• Hash on arrival: every file gets a SHA-256 and is stored unmodified as the original.
• Originals never change: annotations are separate objects, each pointing back to the original.
• Every transfer rehashes: each custody event recomputes the hash and appends a row.
• Append-only log: no audit or custody row is updated after insert; controlled archived-case purge is the only deletion path, enforced at the database layer.
• The export carries the chain: the package you hand off contains the full record.

2. NIST SP 800-86 and 800-101 alignment

NIST SP 800-86 describes a forensic lifecycle: collection, examination, analysis, reporting, and EMP maps its data model to each phase. Alignment is a design target that shapes the product, not a certification claim.

• Collection: a SHA-256 hash captured the moment a file arrives.
• Examination & analysis: derived evidence linked back to its parent by hash.
• Custody transfer: the hash recomputed at each handoff.
• Reporting: an export-container hash over the whole package.
• Mobile (SP 800-101): the design reference concerns handling and exporting mobile-device evidence acquired elsewhere, not extraction from a device.

3. What the audit trail captures

Audited operations write a row: timestamp, actor, case ID, object ID, and the operation (such as view, export, annotate, derive, retire), with hash and note context where recorded. The log is append-only, enforced at the database layer, and written to the same SQLite database as case data. The Audit Timeline is included in the export package as a PDF with a machine-readable audit JSON dataset on Standard and Professional.

4. Local first means local first

EMP Intake is a Windows desktop application. Case data lives in a SQLite database on the workstation. There is no cloud sync and no telemetry of file contents: EMP does not upload case or evidence content and does not synchronize cases to a Falcrex cloud service. Three kinds of request can leave the workstation, and none carry case content: a license activation or validation check, an update check when that is enabled, and map-resource requests when map views, Timeline Recon playback, or exports use online basemaps. Map requests go to a Falcrex-controlled map delivery service using Cloudflare infrastructure. Map requests carry standard connection information and the technical map-resource request needed to display the selected area, so no evidence files leave, though the approximate viewed area may be inferable from request patterns. Pin and case data never leave.

5. What happens at export

The file you hand off is a versioned ZIP with a stable, documented layout: a Case Report, a manifest carrying the per-file SHA-256 values, the originals preserved bit-for-bit, and the timeline, map, and physical evidence records. The SHA-256 of the ZIP itself is recorded outside the archive, in the export audit record; the per-file hashes sit in the manifest inside it. A reviewing party recomputes the file hashes with the included tool, on our website or with PowerShell and confirms nothing changed. No EMP license required.

6. What this is NOT

EMP Intake is not:

• Not FIPS-validated: SHA-256 is computed in the standard sense, not certified.
• Not a write-blocker: EMP preserves a hashed copy of what you ingest; it does not perform read-only acquisition of the source media.
• Not a guarantee of admissibility: that judgment belongs to a court.

Frequently asked questions