VERA · Forensic Intelligence Software

Any structure. Searchable. On your infrastructure.

VERA takes any extraction, builds the structure, and the examiner validates it. The examiner then asks the seal in plain language. Meaning-based search covers the words and what a picture shows, and the assistant answers with a click that opens the source row. The models run on the workstation or on a server your service hosts.

Sign Up / Request a Demonstration See how it works
source_table 244 rows text TEXT peer TEXT sent_at INTEGER state INTEGER kind INTEGER conv_id INTEGER VALUE MAP 1 → received 2 → sent Timestamp TIMESTAMP Sender TEXT Message body TEXT Direction ENUM Thread ID TEXT Read BOOL Attachments JSON

Mapping editor · coverage generated by the software, accepted by the examiner

  • Structure

    Any extraction

    Any operating system, any acquisition tool, any application version. VERA builds the structure. The examiner validates it.

  • Questions

    Ask the seal

    Plain language, including what a picture shows. Every sentence of the answer opens the source row. The models stay on your hardware.

  • Premises

    On your infrastructure

    No telemetry. No licence check over the internet. Case files stay on your network unless your service chooses otherwise.

Partner

AFSIN

The problem today

Most of what you seize is never examined.

This is the situation laboratories work with today, before VERA. Full File System extractions have outgrown manual review. A single phone now yields more records than a team can read in the time a case allows, and the volume rises with every handset generation.

Analysis tools decode what their vendor has already implemented. An unfamiliar application, or a version that changed since the last release, leaves the examiner waiting for a release cycle that has nothing to do with the case in front of them.

The data is present in the extraction the whole time. It is simply not readable.

Not VERA. The industry as it stands.

A typical analysis suite After vendor decode

80%

still unread

20%

typically decoded

Decoded by the acquisition suite Present in the extraction, unread
  • Native messaging READABLE
  • Call and contact records READABLE
  • Camera roll and gallery READABLE
  • Third party messaging, current version READABLE
  • Third party messaging, version changed last month WAITING
  • Regional social application WAITING
  • Encrypted notes application WAITING
  • Ride hailing and delivery history WAITING
  • Payment and wallet activity WAITING
  • Application caches and system traces WAITING

The assistant

Ask in plain language. Check the source.

The examiner asks a question in plain language about a case, a seal or a single conversation, including what a picture shows. The assistant works through the evidence and answers, and every statement links back to the exact file, table and row behind it. One click opens that row in its view.

The assistant proposes and the examiner decides. No output enters a report without a human checking the source against the original data.

Assistant Offline

Was a meeting arranged in the week before the seizure?

A meeting was arranged for Saturday 14 March. The sender confirms attending alone and asks the recipient to keep it quiet.

messaging_store.db :: message :: row 8842

Ask a question about this seal…
Messaging · thread 41
  • 11 Mar · 21:04 Contact 7 you around this weekend
  • 11 Mar · 21:06 Device owner depends what for
  • 11 Mar · 21:11 Contact 7 saturday, same as last time. come alone and keep it quiet
  • 11 Mar · 21:12 Device owner fine. 14th works
Search and assistant

How it works

From a raw file tree to an answer you can defend.

Five stages. The examiner stays in control of every one of them.

  1. 01

    The extraction goes in as it is

    VERA reads the raw Full File System extraction exactly as the acquisition tool produced it, whatever the operating system and whatever tool made it. No proprietary upstream format is required, and no upstream licence is needed.

  2. 02

    Structure is built automatically

    Sources are read and reorganised into views designed for analysis: messages, media, calls, contacts, locations, notes, accounts, applications, system traces, and the rest of the device. Known applications are recognised on import from a library of validated mappings.

  3. 03

    Generated coverage is validated

    Where an application has never been seen before, VERA generates the mapping itself and presents the result. The examiner reviews it and accepts it. Where a correction is needed, it is made in a visual editor by connecting boxes, with no code involved.

  4. 04

    The whole seal becomes searchable

    Keyword search and meaning-based search run together over everything that was structured, including what a picture shows, with automatic expansion to related vocabulary. The examiner controls the balance between the two.

  5. 05

    Every answer carries its source

    The assistant answers questions in plain language about a case, a seal or a single conversation. Every statement links back to the exact file, table and row behind it. One click opens that row in its view, so the next step is the record itself.

Seal · PX-04-2026-011 Reading extraction
  • extraction/
  • data/
  • app_a/databases/
  • store.db
  • store.db-wal
  • app_b/files/
  • cache.bin
  • prefs.xml
  • app_c/shared/
  • records.sqlite

sources detected

347

Read only · hash preserved

Views
  • Messages
  • Media
  • Calls
  • Contacts
  • Location
  • Notes
  • Web
  • Downloads
  • Accounts
  • Device
  • Applications
  • App activity
  • Networks & proximity
  • System log
  • Timeline
  • Map
Mapping previewGenerated · awaiting review
TIMESTAMPSENDERMESSAGE BODY
11/03 21:04Contact 7you around this weekend
11/03 21:06Ownerdepends what for
11/03 21:11Contact 7saturday, same as last time
11/03 21:12Ownerfine. 14th works
Validate and indexCorrect
Search this seal
quiet meetingKeywordsMeaning
Expanded termsrendezvousmeet upalonediscreet
  • 0.94saturday, same as last timeMessaging · thread 41
  • 0.81plan for 14th, aloneNotes · entry 12
  • 0.77meet at the usual placeMessaging · thread 9

312 results · 0.38 s

AssistantOffline

Was a meeting arranged in the week before the seizure?

A meeting was arranged for Saturday 14 March. The sender confirms attending alone.

messaging_store.db :: message :: 8842messaging_store.db :: message :: 8846notes.db :: entry :: 12

Read-only · every action logged

Ask a question about this seal…

What VERA does

Four capabilities.

Each one is demonstrable in under ten minutes, on a device you choose.

01

Any structure

Any extraction, any tool, any application version. VERA builds the structure. The examiner validates it. Nothing is treated as decoded until that validation.

How VERA works
02

Ask the seal

Keyword search and meaning-based search run together, including what a picture shows. The assistant answers a question about a case, a seal or one conversation, and every statement is a click that opens the source row in its view.

Search and the assistant
03

On your premises

Nothing leaves your network unless the service decides it does. No telemetry. No licence check over the internet. The assistant still answers when the workstation has no internet connection.

Sovereignty and trust
04

Coverage you validate

Known applications are recognised on import. For anything else, VERA generates the mapping and the examiner accepts it before it is applied.

Automatic coverage

The workspace

A view designed for each kind of record.

The raw file tree is reorganised into views built for analysis rather than for the storage format. The examiner moves between them without leaving the case.

  • Messages

    Threaded conversations, with timestamps, direction and attachments in place.

  • Media

    Photos, video and other files, searchable by what they contain.

  • Calls

    Incoming, outgoing and missed calls, with duration where the source holds it.

  • Contacts

    The address book, reconstructed from whatever produced it.

  • Location

    Position records, readable as a list and placed on the map.

  • Notes

    Notes and other stored text, searchable by keyword and by meaning.

  • Web

    Browsing history and visited pages.

  • Downloads

    Files the device saved from elsewhere.

  • Accounts

    Accounts present on the device.

  • Device

    Identity and configuration of the seized device itself.

  • Applications

    Applications installed on the device.

  • App activity

    How those applications were used.

  • Networks & proximity

    Network connections and nearby devices.

  • System log

    System events recorded on the device.

Timeline and Map assemble records that have already been indexed. They do not invent a chronology the sources did not contain.

  • Timeline

    Every indexed record that carries a timestamp, in one chronological view.

  • Map

    Every indexed record that carries coordinates, placed on a map.

The analysis workspace

The difference that matters

When the application has never been seen before, VERA maps it anyway.

Every forensic tool decodes what its vendor has already implemented. When a suspect uses an application the tool does not know, or a version that changed since the last release, the examiner is stuck until someone else ships a parser.

VERA handles this in three stages, and the examiner's job is validation rather than construction.

  1. 01

    Known applications

    Automatic

    Matched against a library of validated mappings and applied automatically at import.

  2. 02

    Anything unknown

    Generated

    VERA examines the sources, works out what they contain, and generates the mapping itself.

  3. 03

    Correction where needed

    Human control

    The examiner adjusts the result in a visual editor by connecting boxes, with no code involved.

How automatic coverage works
Mapping editor Generated mapping · awaiting review

unknown_source

never seen before

  • col_a
  • col_b
  • col_c
  • col_d

Timestamp

TIMESTAMP

Sender

TEXT

Message body

TEXT

Direction

ENUM

Validate and index

Nothing is ever applied to a case without a human accepting it first.

Sovereignty

Pull the cable out. Keep working.

VERA is installed inside your network. There is no telemetry, no licence check that phones home, and no vendor remote access. On this deployment, investigation data stays on your infrastructure.

The models run on your own hardware and you can replace them, so your service carries no exposure to a single AI supplier's pricing, availability or jurisdiction.

This is the first thing worth testing during a demonstration. Ask for the cable to be unplugged, and watch what keeps running.
Read the trust centre
Network state External network connected
Your perimeter
  • Analyst workstations
  • Inference server
  • Investigation data
  • Ingestion running
  • Search responding
  • Assistant answering
  • No telemetry
  • No vendor remote access
  • No online licence check

Alongside your tools

VERA starts where the extraction ends.

Cellebrite and AXIOM are strong at what they do, and most VERA users have one of them. VERA works from the raw extraction rather than from their output, which means it covers the applications and versions they have not implemented, and it runs entirely on your own hardware.

The two run alongside each other. Nothing needs to be replaced, and no upstream licence is required to use VERA.

How the two work together

Your acquisition suite

Extracts the device, handles the physical and logical acquisition, and produces the raw file tree. That work stays exactly where it is.

Unchanged

VERA

Takes that raw file tree and builds the structure, including what no tool decoded. The examiner then asks the seal in plain language. Meaning-based search covers the text and the pictures, and the assistant answers with a click that opens the source row.

Offline

Before you ask

What is working today, and what is not.

One caught exaggeration destroys every true claim made before it. So here is the honest position, before the conversation starts.

Verify it yourself in the demonstration

  • Load an extraction produced by a tool we do not own.
  • Take an application VERA has never seen, run it, and use the view that comes out.
  • Unplug the network cable and keep working.
  • Click any statement the assistant makes and land on the source row.

Working today

  • Raw Full File System ingestion, any OS, any tool, any application version.
  • Automatic mapping with a mandatory human validation gate.
  • Visual node editor for correction and full manual control.
  • Shared library: matching, contribution, moderation, automatic application.
  • Hybrid search with query expansion and reranking.
  • Assistant with mandatory source citation and full action logging.
  • Views for messages, media, calls, contacts, locations, notes, web history, downloads, accounts, the device, applications, application activity, networks and system events, plus a timeline and a map over already-indexed records.
  • Models on the workstation or on the service server, replaceable, with no telemetry and no licence check over the internet.

In development, and described as such

  • Knowledge graphs and automatic relationship mapping.
  • Automatic timeline reconstruction across sources.
  • Deduplication and linking across seals.
  • The full breadth of export and report generation.

If a capability is not on this page, ask about it directly. The answer will be what it is.

Responsible use

Who this software is sold to is a decision, not an afterthought.

VERA is forensic software used after a seizure, under legal authority, on a device already in an investigator's hands. It is not interception and it is not surveillance. Where that line sits, who is refused, and who makes that call are written down.

Read the position

See it run on a real extraction.

Usually thirty minutes on a video call, on fictitious data. On site if you need it, or a conversation first. If VERA does not fit what your service needs, that is a useful answer too and we would rather hear it.

Sign Up / Request a Demonstration

Every request is reviewed before access is granted.