Forensic data processing
Your evidence becomes a collection your team can search in seconds. All work happens on forensic copies, with a hash at every handover and a log that records each step.
- Hash for every evidence item at handover and before export
- SHA-256
- All work happens on forensic copies, originals stay untouched
- Copies
- From extraction to index without a manual step in between
- Automated
- In house or in certified German data centres
- Germany
Raw data is not yet evidence.
Processing is what makes it usable.After a search, a tip-off or a lawsuit, data rarely arrives in a form anyone can work with. A forensic image holds an entire file system, a mailbox export thousands of messages with nested attachments, and a scan is at first just a picture. In between sit duplicates, archives inside archives and formats no office computer will open.
Processing therefore has two jobs. It has to extract content completely, make it readable and bring it together. And it has to be documented well enough that every file can later be traced back to its source. Without the second part, the first is worth little in court.
That is exactly why we built our own processing pipeline. It runs automatically from intake to index, records every step and delivers a collection your team searches in Inspector. The page on eDiscovery describes what is possible there.
What happens during processing.
Six stages, from image to index.- 01
Forensic imaging
Every evidence item gets an exact copy. All further steps run on that copy, the source itself is never changed.
- 02
Extraction
File systems, archives and mailboxes are unpacked completely, emails are extracted together with their attachments. Nested content becomes separate objects in the collection.
- 03
Text recognition
Scanned documents and images containing text go through OCR. Faxes, receipts and scanned contracts then become searchable in full text.
- 04
Deduplication
Identical emails and files stored in several mailboxes or backups are detected. Your team reviews each object only once.
- 05
Structuring
All content is brought into one consistent format. Metadata such as sender, recipients, timestamps and the original folder structure is preserved and becomes filterable.
- 06
Indexing
The result is one index per case. It powers fast searches in Inspector, analyses in Tracer and exports with complete provenance.
Every step is in the log.
Starting with the intake of the evidence.In the sample case CASE-JKL1, the log starts with the intake of evidence items A-01 to A-05, whose hashes the system verifies. From then on it records every appointment, sign-in, tag and export.
- 01
Intake with hash check
The first entry comes from the system, before any person has seen the data.
- 02
Roles per case
Case lead, reviewers and the external expert each see only the sources assigned to them.
- 03
Fixed after the fact
No entry can be edited or removed, not even by the case lead.
%20--%3e%3csvg%20version='1.1'%20id='Ebene_2'%20xmlns='http://www.w3.org/2000/svg'%20x='0px'%20y='0px'%20viewBox='0%200%20595.3%20841.9'%20style='enable-background:new%200%200%20595.3%20841.9;'%20xml:space='preserve'%3e%3cstyle%20type='text/css'%3e%20.st0{fill:%231A5DED;}%20.st1{fill:%23FFFFFF;}%20%3c/style%3e%3cpolygon%20class='st0'%20points='325.9,255.1%20265.9,255.1%20235.9,307%20265.9,359%20325.9,359%20355.9,307%20'/%3e%3cpolygon%20class='st1'%20points='325.9,141.1%20265.9,141.1%20235.9,193.1%20265.9,245.1%20325.9,245.1%20355.9,193.1%20'/%3e%3cpolygon%20class='st1'%20points='325.9,596.8%20265.9,596.8%20235.9,648.8%20265.9,700.8%20325.9,700.8%20355.9,648.8%20'/%3e%3cpolygon%20class='st1'%20points='325.9,482.9%20265.9,482.9%20235.9,534.9%20265.9,586.8%20325.9,586.8%20355.9,534.9%20'/%3e%3cpolygon%20class='st0'%20points='325.9,369%20265.9,369%20235.9,420.9%20265.9,472.9%20325.9,472.9%20355.9,420.9%20'/%3e%3cpolygon%20class='st1'%20points='325.9,710.8%20265.9,710.8%20235.9,762.7%20265.9,814.7%20325.9,814.7%20355.9,762.7%20'/%3e%3cpolygon%20class='st0'%20points='424.1,198.1%20364.1,198.1%20334.1,250.1%20364.1,302%20424.1,302%20454.1,250.1%20'/%3e%3cpolygon%20class='st1'%20points='424.1,84.2%20364.1,84.2%20334.1,136.1%20364.1,188.1%20424.1,188.1%20454.1,136.1%20'/%3e%3cpolygon%20class='st1'%20points='424.1,539.9%20364.1,539.9%20334.1,591.8%20364.1,643.8%20424.1,643.8%20454.1,591.8%20'/%3e%3cpolygon%20class='st1'%20points='424.1,425.9%20364.1,425.9%20334.1,477.9%20364.1,529.9%20424.1,529.9%20454.1,477.9%20'/%3e%3cpolygon%20class='st1'%20points='424.1,312%20364.1,312%20334.1,364%20364.1,415.9%20424.1,415.9%20454.1,364%20'/%3e%3cpolygon%20class='st1'%20points='424.1,653.8%20364.1,653.8%20334.1,705.8%20364.1,757.7%20424.1,757.7%20454.1,705.8%20'/%3e%3cpolygon%20class='st0'%20points='522.4,141.1%20462.4,141.1%20432.4,193.1%20462.4,245.1%20522.4,245.1%20552.4,193.1%20'/%3e%3cpolygon%20class='st1'%20points='522.4,27.2%20462.4,27.2%20432.4,79.2%20462.4,131.1%20522.4,131.1%20552.4,79.2%20'/%3e%3cpolygon%20class='st1'%20points='522.4,482.9%20462.4,482.9%20432.4,534.9%20462.4,586.8%20522.4,586.8%20552.4,534.9%20'/%3e%3cpolygon%20class='st1'%20points='522.4,369%20462.4,369%20432.4,420.9%20462.4,472.9%20522.4,472.9%20552.4,420.9%20'/%3e%3cpolygon%20class='st1'%20points='522.4,255.1%20462.4,255.1%20432.4,307%20462.4,359%20522.4,359%20552.4,307%20'/%3e%3cpolygon%20class='st1'%20points='522.4,596.8%20462.4,596.8%20432.4,648.8%20462.4,700.8%20522.4,700.8%20552.4,648.8%20'/%3e%3cpolygon%20class='st0'%20points='167.3,643.8%20227.3,643.8%20257.3,591.8%20227.3,539.9%20167.3,539.9%20137.3,591.8%20'/%3e%3cpolygon%20class='st1'%20points='167.3,757.7%20227.3,757.7%20257.3,705.8%20227.3,653.8%20167.3,653.8%20137.3,705.8%20'/%3e%3cpolygon%20class='st1'%20points='167.3,302%20227.3,302%20257.3,250.1%20227.3,198.1%20167.3,198.1%20137.3,250.1%20'/%3e%3cpolygon%20class='st1'%20points='167.3,415.9%20227.3,415.9%20257.3,364%20227.3,312%20167.3,312%20137.3,364%20'/%3e%3cpolygon%20class='st0'%20points='167.3,529.9%20227.3,529.9%20257.3,477.9%20227.3,425.9%20167.3,425.9%20137.3,477.9%20'/%3e%3cpolygon%20class='st0'%20points='68.9,700.8%20128.9,700.8%20158.9,648.8%20128.9,596.8%2068.9,596.8%2038.9,648.8%20'/%3e%3cpolygon%20class='st1'%20points='68.9,359%20128.9,359%20158.9,307%20128.9,255.1%2068.9,255.1%2038.9,307%20'/%3e%3cpolygon%20class='st1'%20points='68.9,472.9%20128.9,472.9%20158.9,420.9%20128.9,369%2068.9,369%2038.9,420.9%20'/%3e%3cpolygon%20class='st1'%20points='68.9,586.8%20128.9,586.8%20158.9,534.9%20128.9,482.9%2068.9,482.9%2038.9,534.9%20'/%3e%3c/svg%3e)
From seizure to review.
The chain of custody in four stages.- 01
Intake and handover
You hand over physical media, individual files or forensic images in E01 and AD1, in person or through an encrypted upload. The handover is documented in a traceable way and the hash is recorded right away.
- 02
Imaging and processing
We create forensic copies and start the processing pipeline. Formats outside the standard set are added to the processing by arrangement.
- 03
Provision for review
The finished collection goes onto a review laptop that we deliver with Inspector installed, or it is unlocked for your team in Sinacluster.
- 04
Export with proof
Findings leave the collection as a PST archive, a report or, for account data, as a money trail. A second hash comparison before export proves the data is intact.
How the collection reaches you.
Depending on how sensitive the case is.Processing is identical in both cases. The only difference is where and how your team accesses the finished collection.
- Review laptop
- Fully offlineNo radio module and no network socket, Inspector and data preinstalled. The device stays on your premises.
- Sinacluster
- Access over VPNThree-factor sign-in, several reviewers at once, data centres in Eschborn and Frankfurt am Main.
- Formats
- E01, AD1, PST, OST, MSG, EML, ZIP and morePlus office documents, PDF, images, video and audio, as well as bank statements in MT940, CAMT and CSV.
- Export
- PST archive, report, money trailsTagged emails with metadata, findings with source references, money flows as PDF, PNG and Excel.
- Documentation
- A log of every stepHandover, processing, access and exports, each backed by hashes.
What matters in processing.
And how we handle it.- 01
Traceability
Every file in the collection can be traced back to its evidence item. Hashes at the start and before export show that nothing was changed.
- 02
No manual work in between
The pipeline runs automatically up to the index. Fewer manual steps mean fewer sources of error and a shorter wait until review.
- 03
Short distances
Software, processing and your contact sit under one roof. You clarify questions about the collection directly with the people who processed it.
Questions about data processing.
Formats, duration, data protection.Your question is not listed? Write to us.
Forensic images in E01 and AD1, mailboxes as PST, OST, MSG or EML, archives such as ZIP, office documents and PDF, images, video and audio, as well as bank statements in MT940, CAMT and CSV. Special formats are added by arrangement.
That depends mainly on data volume, the share of scanned documents and the number of sources. Tell us these details and your deadline in the contact form, and you usually receive an assessment of the process within one business day.
No. We create a forensic copy of every evidence item and work exclusively with it. The hash of the original is recorded at handover and can be checked again at any time.
Exclusively in Germany: in house or in certified data centres at two sites in the Frankfurt area, Eschborn and Frankfurt am Main itself. The data is encrypted in transit and at rest.
In person on storage media or through an encrypted upload. For uploads and an overview of running jobs there is the Sinabis Dashboard.
Each case is priced by its data volume and the effort involved. There are no fixed list prices because collections differ too much. We prepare the quote based on your details.
Next in the process.
What comes after processing.Got a case on your desk?
Describe data volume, sources and deadline. Within one business day you get an assessment of process and effort.The people behind Explorer, Inspector and Tracer. Your enquiry goes straight to us in Bad Soden am Taunus.
