NERVE is live across local, private and approved-cloud deployments. Book an evaluation

Use cases

/

Device and forensic

Search approved device-package information through a common model.

Search approved device-package information through a common model.

An existing approved extraction package is imported whole, its artefacts preserved, and its explicit records mapped into the canonical families without inventing conclusions.

An existing approved extraction package is imported whole, its artefacts preserved, and its explicit records mapped into the canonical families without inventing conclusions.

Audience

Digital forensics teams and analysts who receive extraction packages from a separate acquisition process.

Source families

Device and forensic packages

The workflow

Source to searchable, step by step.

Source to searchable, step by step.

01

Input

Alex imports an approved extraction package that was produced elsewhere. The package arrives with its own artefact layout and supplied tool and custody references.

02

Acquisition and preservation

The package is retained exactly as delivered, together with its internal artefacts and the acquisition record that accompanied it. Supplied tool and custody references are preserved as source-stated values rather than being rewritten.

03

Transformation

Explicit messages, contacts, calls, media items and location observations are mapped to their canonical families. Source-specific detail that has no canonical home is retained under its own namespace rather than being dropped.

04

Discovery and retrieval

Identifier search works across the package and across other datasets in the same corpus. Each match resolves to the exact artefact it came from, and the supplied custody reference travels with it.

05

Governance

Device packages frequently carry a stricter handling rule than other material. That rule is attached at the dataset level and enforced on every derived record and every search response.

When it goes wrong

Failure is reported, not absorbed.

Failure is reported, not absorbed.

Failure variant

A proprietary sub-format inside the package has no supported parser. It is preserved and marked Unprocessed under policy, remains retrievable, and is picked up automatically when a parser that supports it is added.

What this does not claim

A matching identifier indicates the same identifier, not the same person. A location observation records that a device reported a position, not that a person was present. NERVE presents what the source stated and leaves the conclusion to the analyst.

Evaluation measures

Measure these on your own material.

Measure these on your own material.

Bring an approved sample and we will plan the run around these measures. The numbers belong to your environment, so they are established with you rather than quoted in advance.

Bring an approved sample and we will plan the run around these measures. The numbers belong to your environment, so they are established with you rather than quoted in advance.

Exact package recovery against the delivered bytes

Field fidelity for mapped artefacts

Identifier search across datasets

Retention of unsupported sub-formats

Effort to explain provenance to a reviewer

Next step

See this workflow against your own holdings.

See this workflow against your own holdings.

An evaluation runs NERVE against a representative sample of your own sources, so you can measure acquisition, normalisation and retrieval behaviour on material you already understand.

An evaluation runs NERVE against a representative sample of your own sources, so you can measure acquisition, normalisation and retrieval behaviour on material you already understand.

Start an evaluation

All use cases

Architecture