Data analysis for law enforcement
We make seized drives, images and mailboxes searchable in one index. Review happens on laptops without any network connection, and Explorer's AI pre-classifies images and video.
- Review laptops without hardware for wireless or wired networks
- Offline
- Recorded at handover, checked again before export
- Hashes
- Inspector for communication, Explorer for media, Tracer for accounts
- 3 tools
- until you receive an assessment of process and effort
- 1 business day
More evidence than time to review it.
A familiar problem in many agencies.Two laptops, several external hard drives, USB sticks and a mailbox export: a single search warrant easily produces terabytes of data. Someone still has to establish what is relevant as evidence when the seized media are examined, often under time pressure and with the indictment in mind.
Classic forensic software is designed to examine individual systems. For reviewing the content of large volumes of emails, documents, chats and images, what is often missing is search speed, shared workplaces and a way to pre-sort distressing images without every photo being looked at individually.
This is exactly where we work for law enforcement. We take care of the forensic data processing of the evidence and deliver the collection so that your investigators can start reviewing right away, if required entirely without a network connection.
Tools for the review.
The right one for every kind of evidence.- 01
Communication in Inspector
Emails, chats, appointments and documents from all evidence of a case in one search. Filters by person and period reveal contacts between suspects.
- 02
Media in Explorer
Images and videos are classified locally with AI, incriminating material first and with obscured previews. That saves time and protects reviewers.
- 03
Bank statements in Tracer
Transactions from bank statements become one collection. Money can be followed through intermediary accounts, and Tracer flags suspicious patterns with a score.
- 04
Search audio
Seized audio files are transcribed, so conversations can be searched for names and terms too.
- 05
Review without a network
Review happens on laptops that lack the hardware for wireless and wired networks. Data and software are preinstalled, and the device stays at your agency.
- 06
Roles and experts
Case lead, reviewers and external experts get separate access. An expert witness may see only what was tagged as relevant, for example, and every access is logged.
Eleven hits, none of them visible.
Evidence item A-03 in Explorer.On the storage device from evidence item A-03, Explorer has classified 826 media files. The search “classified:explicit” hides everything else and shows only the eleven files that count as incriminating material.
- 01
Redacted up front
To protect the investigation and the victims, previews are unrecognisable and marked as locked.
- 02
The rest stays counted
The sidebar still lists 815 neutral media files and 362 sorted by people, objects and animals.
- 03
On the office computer
Explorer works locally and needs no outside connection to classify.
How we work together.
From exhibit to case file.- 01
Request with key facts
You describe the number and type of exhibits, the approximate data volume and your deadline. You usually receive an assessment of the process by the following business day.
- 02
Handover of the exhibits
You hand over drives or images in person or through an encrypted upload. The hash of every exhibit is recorded and the handover documented.
- 03
Processing and delivery
We create forensic copies, extract and index the content and deliver the collection on a review laptop. Alternatively, distributed teams work together in Sinacluster.
- 04
Review and export
Your team tags what is relevant as evidence and exports the findings as a report or PST archive. A second hash comparison proves the data is unchanged.
What goes into the case file.
Provable, complete, traceable.In proceedings, what counts is not only the finding but also how it was found. That is why documentation is part of every result. Whether evidence is admitted is ultimately decided by the court.
- Report
- Findings with sourcesEvery finding points to exhibit, file and location.
- Export
- PST archive of the relevant emailsWith all metadata, readable in Outlook.
- Media
- Flagged image materialSorted by confidence, previews obscured.
- Money trails
- Money flows as graph and tableFrom Tracer, as report, graph and spreadsheet.
- Proof
- Hash log and audit logHandover, access and exports documented without gaps.
Why agencies work with us.
Three reasons.- 01
Data stays in Germany
We process exhibits exclusively in Germany, either in house or in certified data centres in Eschborn and Frankfurt. For highly sensitive cases the review runs without any network.
- 02
Distressing material pre-sorted
Explorer flags harmful and explicit material with a confidence score. Investigators see first what really matters for the case.
- 03
Part of a forensic group
The Sinabis Group also includes X64 Forensic GmbH, which specialises in digital forensics for law enforcement. Acquisition and analysis are therefore close together.
Questions from law enforcement.
On procedure, security and process.Your question is not listed? Write to us.
No. The drives are acquired as usual by your forensic unit or a contracted provider. We start with the secured images and drives and make their content searchable. If only originals are available, we create the forensic copies ourselves.
The review laptop lacks any hardware for a network connection. If you work in Sinacluster, access runs over an encrypted VPN with three-factor sign-in, and the data is stored exclusively in German data centres.
In Sinacluster, yes, with shared tags and exports. Roles define who sees which sources. On a review laptop, one person works per device.
The case lead appoints experts directly in Inspector and restricts their access, for example to all objects tagged as relevant. Every sign-in and every action of the expert appears in the log.
Costs depend on the data volume and effort of the case. Independently of that, agencies can use Explorer free of charge to pre-sort media.
You export findings as a report with source references or as a PST archive, and money flows from Tracer also as PDF, PNG and Excel. The hash log and audit log document the path from exhibit to finding.
For your next case.
Services investigators often combine.Got a case on your desk?
Describe data volume, sources and deadline. Within one business day you get an assessment of process and effort.The people behind Explorer, Inspector and Tracer. Your enquiry goes straight to us in Bad Soden am Taunus.
