VERA · Forensic Intelligence Software
VERA is forensic analysis software for seized devices. It takes the raw extraction from a phone, a computer or a hard drive, builds the structure itself, and lets your examiners search it and question it. Everything runs inside your network, with no internet connection.
Developed and deployed at the national digital forensics laboratory of the French Service National de Police Scientifique.
Mapping editor · coverage generated by the software, accepted by the examiner
In service
Deployed at the SNPS
VERA was built inside a working laboratory and is deployed there today.
Deployment
Offline, on your infrastructure
No investigation data leaves your network under any configuration.
Ingestion
Any extraction
Any operating system, any acquisition tool, any application version. No upstream licence required.
The problem today
This is the situation laboratories work with today, before VERA. Full File System extractions have outgrown manual review. A single phone now yields more records than a team can read in the time a case allows, and the volume rises with every handset generation.
Analysis tools decode what their vendor has already implemented. An unfamiliar application, or a version that changed since the last release, leaves the examiner waiting for a release cycle that has nothing to do with the case in front of them.
The data is present in the extraction the whole time. It is simply not readable.
Not VERA. The industry as it stands.
80%
still unread
20%
typically decoded
How it works
Five stages. The examiner stays in control of every one of them.
VERA reads the raw Full File System extraction exactly as the acquisition tool produced it, whatever the operating system and whatever tool made it. No proprietary upstream format is required, and no upstream licence is needed.
Sources are read and reorganised into views designed for analysis: messages, media, calls, contacts, locations, notes, accounts, applications, system traces, and the rest of the device. Known applications are recognised on import from a library of validated mappings.
Where an application has never been seen before, VERA generates the mapping itself and presents the result. The examiner reviews it and accepts it. Where a correction is needed, it is made in a visual editor by connecting boxes, with no code involved.
Keyword search and meaning-based search run together over everything that was structured, with automatic expansion to related vocabulary. The examiner controls the balance between the two.
The assistant answers questions in plain language about a case, a seal or a single conversation. Every statement links back to the exact file, table and row behind it, and one click puts the examiner on the original record.
sources detected
347
Read only · hash preserved
312 results · 0.38 s
Was a meeting arranged in the week before the seizure?
A meeting was arranged for Saturday 14 March. The sender confirms attending alone.
Read-only · every action logged
What VERA does
Each one is demonstrable in under ten minutes, on a device you choose.
VERA ingests a raw Full File System extraction from any operating system, any acquisition tool and any version of any application, and reorganises it into views built for analysis. Each kind of record gets a view designed for it: messages, media, calls, contacts, locations, notes, accounts, applications, system traces. No proprietary upstream format is required.
How VERA worksKnown applications are mapped on import. For anything else, VERA generates the mapping itself and the examiner validates it, correcting it in a visual editor where needed. Validated mappings can be shared between laboratories, so coverage compounds instead of being rebuilt.
Automatic coverageHybrid keyword and meaning-based search with automatic query expansion. An assistant answers questions in plain language about the whole device, and every answer links back to the exact file, table and row behind it.
Search and assistantVERA runs entirely on your infrastructure, offline. No investigation data leaves your network at any point. The models run locally and can be replaced by you, so there is no dependency on a single AI supplier.
Sovereignty and trustThe workspace
The raw file tree is reorganised into views built for analysis rather than for the storage format. The examiner moves between them without leaving the case.
Threaded conversations, with timestamps, direction and attachments in place.
Photos, video and other files, searchable by what they contain.
Incoming, outgoing and missed calls, with duration where the source holds it.
The address book, reconstructed from whatever produced it.
Position records, readable as a list and placed on the map.
Notes and other stored text, searchable by keyword and by meaning.
Browsing history and visited pages.
Files the device saved from elsewhere.
Accounts present on the device.
Identity and configuration of the seized device itself.
Applications installed on the device.
How those applications were used.
Network connections and nearby devices.
System events recorded on the device.
Timeline and Map assemble records that have already been indexed. They do not invent a chronology the sources did not contain.
Every indexed record that carries a timestamp, in one chronological view.
Every indexed record that carries coordinates, placed on a map.
The difference that matters
Every forensic tool decodes what its vendor has already implemented. When a suspect uses an application the tool does not know, or a version that changed since the last release, the examiner is stuck until someone else ships a parser.
VERA handles this in three stages, and the examiner's job is validation rather than construction.
Matched against a library of validated mappings and applied automatically at import.
VERA examines the sources, works out what they contain, and generates the mapping itself.
The examiner adjusts the result in a visual editor by connecting boxes, with no code involved.
unknown_source
never seen before
Timestamp
TIMESTAMP
Sender
TEXT
Message body
TEXT
Direction
ENUM
Nothing is ever applied to a case without a human accepting it first.
Sovereignty
VERA is installed inside your network and works with no internet connection. There is no telemetry, no licence check that phones home, and no vendor remote access. No investigation data is sent anywhere, under any configuration.
The models run on your own hardware and you can replace them, so your service carries no exposure to a single AI supplier's pricing, availability or jurisdiction.
This is the first thing worth testing during a demonstration. Ask for the cable to be unplugged, and watch what keeps running.Read the trust centre
The assistant
The examiner asks a question in plain language about a case, a seal or a single conversation. The assistant works through the evidence and answers, and every statement links back to the exact file, table and row behind it. One click puts the examiner on the original record.
The assistant proposes and the examiner decides. No output enters a report without a human checking the source against the original data.
Was a meeting arranged in the week before the seizure?
A meeting was arranged for Saturday 14 March. The sender confirms attending alone and asks the recipient to keep it quiet.
messaging_store.db :: message :: row 8842
Alongside your tools
Cellebrite and AXIOM are strong at what they do, and most VERA users have one of them. VERA works from the raw extraction rather than from their output, which means it covers the applications and versions they have not implemented, and it runs entirely on your own hardware.
The two run alongside each other. Nothing needs to be replaced, and no upstream licence is required to use VERA.
Extracts the device, handles the physical and logical acquisition, and produces the raw file tree. That work stays exactly where it is.
UnchangedTakes that raw file tree, builds structure for everything in it including what no tool decoded, and makes the result searchable and questionable offline.
OfflineBefore you ask
One caught exaggeration destroys every true claim made before it. So here is the honest position, before the conversation starts.
If a capability is not on this page, ask about it directly. The answer will be what it is.
Responsible use
VERA is forensic software used after a seizure, under legal authority, on a device already in an investigator's hands. It is not interception and it is not surveillance. Where that line sits, who is refused, and who makes that call are written down.
Read the position
Usually thirty minutes on a video call, on fictitious data. On site if you need it, or a conversation first. If VERA does not fit what your service needs, that is a useful answer too and we would rather hear it.
Every request is reviewed before access is granted.
