Forensic examiner
Move from a structured artifact to its source record, compare original and normalized time values, and retain the details needed to explain a technical observation.
Practitioner workflows
Investigative analyst
Organize authorized records, review chronology and examine potential relationships across communication and application data.
Technical reviewer
Prepare a clear account of source material, methods, supporting artifacts, interpretation and known limitations.
Analytical areas in development
Mobile communicationsCalls and contactsSQLite and application databasesFile and media metadataTimeline reconstructionIdentifier correlationSource-linked reporting
One record, several useful views
The target workflow may present a communication record as a source line, a parsed artifact, a timeline event or part of a conversation sequence. Connected views are intended to preserve those relationships while making each analytical step reviewable.
CURRENT BUILD
WhatsApp text-export parsing
The present implementation establishes a source-linked starting point. Broader artifact formats and examiner workflows are being developed around the same provenance model.