Communications
Review message records and conversation sequence while retaining sender, recipient, ordering and source-line context.
An artifact view should answer two questions at once: what does this record represent, and where can the examiner inspect its source?
Planned analytical views
Application data
Explore structured application records, SQLite-backed content and fields in the context of their source database.
Timeline
Compare original time values with normalized analytical time, keeping the conversion logic visible.
Identifiers and relationships
Compare identifiers across records and distinguish direct references from analytical correlations.
Files and metadata
Inspect file and media metadata alongside the fields and source structures from which it was derived.
Source detail
Move from a summary or structured row to the originating file, path, line or record reference when available.
Keep evidence states distinct
| Evidence state | What it represents | How it is reviewed |
|---|---|---|
| Source record | Data represented directly in an acquired or exported source. | Inspect native context and the originating record. |
| Parsed artifact | A structured representation produced by deterministic parsing. | Review parser context and source linkage. |
| Recovered item | Information reconstructed from incomplete or fragmented structures. | Review the recovery method, assumptions and uncertainty. |
| Analytical correlation | A relationship formed by comparing multiple artifacts. | Inspect the supporting records and reasoning. |
| AI-assisted observation | A generated summary, suggestion or analytical aid. | Identify generated text and inspect supporting records. |
| Practitioner-reviewed finding | A technical conclusion recorded after evidence review. | Retain the method, references and review context. |
Current implementation
WhatsApp text exports are the first supported source format. The broader artifact views above describe the product’s development direction.