How VERA works
From a raw file tree to a working case file.
VERA begins where acquisition ends. It takes the extraction exactly as your acquisition tool produced it, builds the structure itself, and hands your examiner a workspace where the seal can be questioned in plain language. Meaning-based search covers the text and what a picture shows. The assistant answers, and every statement is a click to the source row.
- Any operating system, any acquisition tool, any application version
- No upstream licence required
- Ask the seal in plain language. Every statement opens the source row
01 · Ingestion
The extraction goes in exactly as it came off the device.
VERA reads the raw Full File System extraction directly. There is no conversion step, no proprietary intermediate format, and no requirement that the extraction was produced by a particular vendor's tool. If your service does not hold a licence for the acquisition suite that made the extraction, VERA still reads it.
Evidence is opened read only. The extraction on disk is never modified, and the provenance of every record travels with it from this point onwards.
-
Any acquisition source
Extractions from the tools your service already uses, and from tools it does not own.
-
Read-only access
The evidence store is opened without write access at any stage of the pipeline.
-
Provenance from the first read
Every record keeps the file, the path and the position it came from.
- extraction/
- data/
- app_a/databases/
- store.db
- store.db-wal
- app_b/files/
- cache.bin
- prefs.xml
- app_c/shared/
- records.sqlite
sources detected
347
Read only · hash preserved
02 · Structuring
Thousands of folders become views built for analysis.
The raw file tree is reorganised into views designed for the work rather than for the storage format: conversations that read like conversations, a media gallery, contacts, calls, locations, notes, accounts, applications, system traces.
Applications the software already knows are recognised on import and mapped automatically, first from your service library, then from the public library: more than 2,600 validated mappings for more than 600 Android and iOS applications. That covers the common case before any AI runs, and it leaves the examiner free to spend attention on what is genuinely unfamiliar.
- Messages
- Media
- Calls
- Contacts
- Location
- Notes
- Web
- Downloads
- Accounts
- Calendar
- Credentials
- Social activity
- Transactions
- Trips
- Applications
- App activity
- Networks & proximity
- System log
- Generic table
- Timeline
- Map
- Labels
03 · Validation
Generated coverage is proposed, never imposed.
Where an application has never been seen before, or where a version changed since the last time it was met, VERA generates the mapping itself and presents the result as a preview over the real data.
The examiner reviews that preview and accepts it. Where a correction is needed, it is made in a visual editor by connecting boxes, with no code involved. Nothing enters a case until a human has accepted it.
Coverage is generated. The examiner's job is validation, and occasionally correction. It is never construction.
04 · Retrieval
Keyword and meaning, running together.
Keyword search misses anything phrased differently, including deliberately coded language. Meaning-based search catches those but can drift. VERA runs both and merges the results, with automatic expansion of search terms to related vocabulary, and the examiner controls the balance between the two.
Searches can be scoped to a case, a seal, a single mapping or one conversation, and the same engine is available inside every view.
- 0.94saturday, same as last timeMessaging · thread 41
- 0.81plan for 14th, aloneNotes · entry 12
- 0.77meet at the usual placeMessaging · thread 9
312 results · 0.38 s
05 · Questions and answers
Ask in plain language. Get the source with the answer.
The assistant answers questions about a whole device, a seal or a single thread. Every element of an answer links back to the exact file, table and row behind it, and one click puts the examiner on the original record.
It can split a question across up to five seals, describe a photo, transcribe a voice note, and asks before any heavy action. Every action it takes and every result it receives is written to an audit log. The assistant proposes and the examiner decides.
Was a meeting arranged in the week before the seizure?
A meeting was arranged for Saturday 14 March. The sender confirms attending alone.
Read-only · every action logged
Deployment
Installed inside your network, and it stays there.
VERA runs as a client on analyst workstations with a central inference server on your own intranet. No internet connection is required or used. There is no telemetry, no online licence check and no vendor remote access.
The models run on your hardware and you can replace them, so the deployment carries no dependency on a single AI supplier's pricing, availability or jurisdiction.
-
Closed network
With the AI on the workstation or on your server, no investigation data crosses your perimeter.
-
Your hardware
One installer per workstation. For the service, the standard server on Mac, Windows or Linux, or the package for a Linux machine with a graphics card. Models arrive by copying a folder.
-
Replaceable models
The client calls an internal interface, so models can be changed without touching it.
See it running on a real extraction
Usually thirty minutes on a video call, on fictitious data. On site if you need it, or a conversation first. If VERA does not fit what your service needs, that is a useful answer too.
Every request is reviewed before access is granted.