Shared library
One laboratory's coverage becomes every laboratory's.
A mapping validated in one service is useful in every service that later meets the same application. The public library already holds more than 2,600 of them, for more than 600 Android and iOS applications, and it holds parsing definitions rather than evidence.
- 2,600+ validated mappings, 600+ applications
- Parsing definitions only, never case data
- Readable by anyone on the website
How it works
Validated once, applied everywhere it fits.
When an examiner accepts a mapping, it can be shared at two levels. The service library keeps it on your own server, for your colleagues, the moment it is shared. The public library receives it as a proposal: analysts vote, VERA Forensics reviews, and a validated mapping reaches every VERA.
At import, VERA applies the service library first, then the public library from the copy on the workstation, so it works offline. An imported mapping that nobody modified upgrades in place, and an older VERA never receives a mapping it cannot run.
- 01
Mapped
A laboratory maps an application, or VERA generates the mapping.
- 02
Validated
The examiner checks it against the seal and accepts it.
- 03
Proposed
Only the mapping is sent. Never case data.
- 04
Reviewed
Analysts vote, and VERA Forensics reviews.
- 05
Applied everywhere
Every VERA applies it on import, even offline, from its local copy.
Inside a service, the service library shares mappings between colleagues first, on your own server.
Open and credited
Built on the open-source work of the field.
The public library includes mappings adapted from ALEAPP and iLEAPP, the open-source projects led by Alexis Brignoni, under the MIT licence. Each adapted mapping carries its credit. VERA Forensics adds its own, notably for applications those projects do not cover.
Anyone can open a mapping on the website and read its graph, its fields and its query. A free account is enough to vote on a proposal.
The question everyone asks first
Case data never goes into the library.
The library holds parsing definitions, which describe how to read a given application's data structure. It never holds evidence, never holds records recovered from a device, and never holds anything that identifies a case, a device or a person.
The service library is hosted on your infrastructure and runs offline. Proposing a mapping to the public library is a deliberate act by an examiner, never automatic, and that decision can be never.
The library holds definitions of how to read a structure. It does not hold the data that structure contained.
Why it matters
Expertise stops leaving with the person who had it.
An examiner who works out how to read an unfamiliar application usually holds that knowledge personally, and it leaves the service when they retire or transfer. A validated mapping is that knowledge in a form the service keeps.
Across a group of cooperating laboratories the effect compounds. Each service stops rebuilding what another has already validated, and coverage grows from use rather than from anybody's product roadmap.
What is working today, and what is not
Working today
- A public library of more than 2,600 validated mappings for 600+ Android and iOS applications.
- Proposals, votes and review of mappings on the website, readable by anyone.
- A service library on your own server, shared between colleagues first.
- Matching at seal import, with automatic application, offline from the local copy.
- Versioning, and upgrade in place of imported mappings.
In development
- Traceability for the service: a readable log of the service library and of assistant conversations.
- Mappings for computer sources, log files and any readable file.
Keep reading
- Library Read the public mappings. The graph is the same preview as in VERA.
- Automatic coverage Where a validated mapping comes from in the first place.
- Sovereignty and trust Self-hosting, offline operation and what leaves your perimeter.
- Questions and answers Including what the library does and does not contain.
See it running on a real extraction
Usually thirty minutes on a video call, on fictitious data. On site if you need it, or a conversation first. If VERA does not fit what your service needs, that is a useful answer too.
Every request is reviewed before access is granted.