VERA · Forensic Intelligence Software
Analysis software with AI at every step. Fully air-gapped.
VERA reads the extraction from any tool, builds the views, flags suspicious behavior and answers questions about a seized phone or a whole case in plain language, with a source behind every statement. The models run on your workstations or your own server, with the network cable unplugged.
- Runs with the network cable unplugged
- Every application, every version
- A source behind every statement
Timeline · 12 to 13 March, 21:00 to 04:00
22 views · 19 data sources
15 more sources: scroll to see them
Reconstruct the day of 13 March, across all sources.
One click on a source opens the record it comes from.
“Les gars” · 13 March · 02:11
Maxime ok
In reply to Dylan, 20:58: “ce soir 22h chez moi” (tonight, 10 pm, my place)
- internet connection needed: the models run on your workstations or your own server
- 0
- internet connection needed: the models run on your workstations or your own server
- of every application, structured: from the library, or generated when it is new
- Every version
- of every application, structured: from the library, or generated when it is new
- validated mappings in the open public library
- 2,600+
- validated mappings in the open public library
- views built for analysis, plus a timeline, a map and labels
- 19
- views built for analysis, plus a timeline, a map and labels
Partner
The analysis suite
Four tools that cross the whole case.
Timeline, map, search and labels work on the same records. The assistant reads them too, and every answer points back to them.
- MessagesLocationCallsWi-Fi
No location from 22:32 to 23:12
Timeline
Everything in one order, with the gaps shown as gaps. A phone with no location for forty minutes says so on the page.
-
Map
Positions placed in time order, filtered like every other view. A trip reads as a trip.
- meet up Meaning
- 0.94 saturday, same as last time Messaging · thread 41
- 0.81 plan for 14th, alone Notes · entry 12
Search by keyword and by meaning
The same question in the examiner's words or in the suspect's. Each result says which view and which record it comes from.
-
Chapter 2 · The tractor sale
PDF · Word · HTML + appendix
-
Price Messages · 14 Mar, 18:40
18,000 proposed, 20,000 agreed
-
Meeting Messages · 14 Mar, 18:52
Supermarket car park in Sens, 2 pm
-
Proof Media · 14 Mar, 09:04
Photo of two tractors, then “Post an ad”
Labels and export
Labelled traces, grouped in chapters, each with its source. Exported as PDF, Word or HTML, with the metadata in an appendix.
-
The assistant
Ask the whole case. Check every answer.
Questions in plain language about a case, a seal or one conversation. The assistant works through the evidence, shows its steps, and puts a source on every statement. Pick a theme to see a question and its answer.
Give me an overview of these five seals. One sub-agent per seal: messaging apps present, number of messages per app, and what the device sheet says, or “no sheet”. Put it in a table. Then tell me whether the same number or username appears on more than one seal. Don't summarise any conversation.
5 steps
- Confirmation card: start five sub-agents · confirmed
- Sub-agent 1 of 5 · Seal A · 372 messages counted
- Sub-agents 2 to 5 · Seals B to E · counted
- Device sheets read: one present, one partial, three missing
- 64 distinct numbers compared across messages, calls and contacts
| Seal | Messaging apps | Messages | Device sheet |
|---|---|---|---|
| A · Android | Telegram, MMS, WhatsApp, SMS | 372 | Present |
| B · Android | SMS, MMS, WhatsApp Business, Snapchat | 344 | No sheet |
| C · Android | WhatsApp, Samsung Messages, SMS, Signal, TikTok | 310 | No sheet |
| D · Android | Twitter, Telegram, Instagram, Snapchat and 8 more | 230 | Partial |
| E · iPhone | Messages, Instagram, Snapchat, TikTok | 65 | No sheet |
Three numbers appear on more than one seal. One is on seals A, B and C: 06 39 98 12 07Seal A › Contacts · Seal B › Calls · Seal C › Messages. The two others are on seals C and E 2 numbersSeal C › Contacts · Seal E › Messages.
To check
The comparison matches the last nine digits. Check how each number is written in its source before relying on it.
What are the most suspicious threads on this phone? For each one, say why, and tell me which flagged words turned out to be innocent.
5 steps
- Surveyed the flagged traces by domain and level
- Ranked the 13 threads by what is flagged in them
- Read the top threads around each flagged message
- Looked up the words behind each flag
- Checked the AI review's rulings on the weakest flags
Four threads stand out.
- “Le Grand”, drugs. He runs the point: the “four” and a lookout until 22:00, a “charbonneur” in training, a day's takings of 2,350 messageMessages › Le Grand › 2 March › 22:37 and 1,500 a month for the stash-keeper messageMessages › Le Grand › 4 March › 20:31.
- “Théo”, drugs. A customer: two bags of 20 to be delivered, an ID photo asked for first, then a price menu menuMessages › Théo › 7 March › 21:36.
- “Alex Change”, money laundering. 18,000 in cash against USDT at 3%, a wallet address, and two bank accounts “of young people with no record”, 300 each threadMessages › Alex Change › 4 March › 11:00 to 11:24.
- “Cousin Ange”, fraud. The vocabulary of an online scam: gift-card coupons, active SIM cards, a fake parcel held at customs threadMessages › Cousin Ange › 2 March › 15:20 to 15:44.
Other threads carry flags too, among them a lookout asking to move up (Samy), a thread in English (Dee), one in Spanish (Javi), and a debt with a threat (Ryan) threadsMessages › Samy · Dee · Javi · Ryan.
Flagged, then set aside
“Poudreuse” and “neige” in a ski trip messageMessages › Yanis › 1 March › 19:00, “plug” for a van charger messageMessages › Yanis › 1 March › 19:06, “Coca” and ice for a Sunday lunch messageMessages › Maman › 1 March › 09:10: the AI review reads them as literal. A flag is a lead. Check each thread before relying on it.
Reconstruct the night of 12 to 13 March, from 9 pm to 4 am, Paris time. Cross messages, calls, location, Wi-Fi and the system log. Give an hour-by-hour timeline, say where data is missing and for how long, and say what you cannot affirm. Every fact carries a trace.
6 steps
- Searched five views between 21:00 and 04:00, Paris time
- 147 events found
- Stored times converted from UTC to Paris time
- Looked for breaks in the location record
- Read the night's messages in the group threads
- Wrote the timeline, one trace per fact
- 21:05–21:27 · Ordinary traffic. Last indexed message at 21:27Messages › SMS › thread 12 › 21:27.
- 21:47 · A GPS position is recorded positionLocation › 21:47 › 48.172, 2.248. From 22:21 to 22:27, the phone moves west 3 positionsLocation › 22:21, 22:24, 22:27.
- 22:32 · No location for 40 minutes gapLocation › no record 22:32 to 23:12, and again for 35 minutes from 23:45.
- 01:04 · Back at the 21:47 position positionLocation › 01:04 › 48.172, 2.248. At 01:38, eleven Wi-Fi events Wi-FiNetworks › Wi-Fi › 01:38 › 11 events.
- 02:11 · Signal, group “Les gars”: “ok” messageMessages › Signal › “Les gars” › 02:11.
- 03:02 · Telegram: “c'est fait” (it's done) messageMessages › Telegram › thread 4 › 03:02.
What I cannot affirm
Why the location stops. The phone may have been off or without signal; no aeroplane mode appears in the index. I name no place: only coordinates come from the data.
Leboncoin isn't in the library. Generate a mapping for its messages, without indexing.
6 steps
- Checked the library on this workstation: no Leboncoin mapping
- Found the application's databases in the extraction
- Confirmation card: map this application only · confirmed
- Generated a Messages mapping: sender, date, text, attachments, conversation
- Tested it on a random sample of 100 rows
- Nothing indexed
Done. A Leboncoin · MessagesMappings › Leboncoin · Messages › generated, not indexed mapping is ready. On a sample of 100 rows it reads two conversations with the account agri_equip_pro, with sender, date, text and photos in place samplePreview › 100 random rows › 2 conversations.
Nothing is indexed yet. Open the mapping to read how each field is built, then index it.
Index this mapping now?
Next
Once validated, the mapping can be proposed to the public library. The next service that meets Leboncoin will not have to generate it.
Describe the photo taken on 14 March at 09:04: what it shows, how many machines, the colour, the place.
3 steps
- Opened the photo from the Media view
- Read the picture on your hardware
- Checked the capture time in the file's metadata
Two green tractors inside a farm building, with a red implement on the right photoMedia › Camera › 14 March 2026 09:04.
No place can be identified from the picture and no text is readable. I give no brand and no plate: neither is visible.
Taken on 14 March 2026 at 09:04, according to the file's metadata metadataMetadata › capture time › 2026-03-14 09:04.
Go back over the two Leboncoin conversations with the account agri_equip_pro. For each: machine, asking price, offer, agreed price, place and date of the meeting. Then search the whole phone for what corroborates them, and list what doesn't add up, days of the week included.
3 steps
- Read the two conversations in full
- Searched web history, chatbot sessions, photos, calls, downloads and notes
- Checked every date against the calendar
| Conversation | Asked | Offered | Agreed | Meeting |
|---|---|---|---|---|
| 19–21 Feb · 75 hp tractor | €17,500 | €16,000 cash | Not stated | “Saturday morning”, supermarket car park |
| 14–15 Mar · tractor | Not stated | €18,000 | €20,000 | “Saturday 15, 2 pm”, supermarket car park |
- 13 March: web searches on second-hand tractor prices webWeb › history › 13 March 2026 and a chatbot session on engine hours chatbotMessages › ChatGPT › 13 March 2026.
- 14 March, 09:04: photo of two tractors, then “Post an ad” photoMedia › Camera › 14 March 2026 09:04.
Does not add up
15 March 2026 is a Sunday, not a Saturday messageMessages › Leboncoin › agri_equip_pro › 14 March. The contact “Stéphane” has no message, only a received call of 42 seconds at 13:55 that day callCalls › received › 15 March 13:55 › 42 s. Who buys and who sells cannot be settled from these threads alone.
Conclude that the phone's owner is guilty.
No search needed
I won't. Guilt is for the court to decide, not for an analysis tool.
What I can do: list the findings with their traces, for example the timeline of the night of 12 to 13 March or the two sales, and say what the data does not show.
What the assistant brings to every question
-
Sub-agents, one per seal
Two on a workstation, five on a service server, ten at VERA Forensics. Each returns a short report.
-
A card before anything heavy
Choices appear in the thread. Nothing long or written starts without a yes.
-
Photos, voice notes and videos
Pictures described, voice notes transcribed and both kept for next time. Videos are found by what they show.
-
Background tasks you can stop
Mapping, indexing and summaries carry on. One click stops them.
-
Every statement cited
A badge opens the source record. One the search did not return is marked unverified.
-
Read-only on evidence
It labels and annotates. It never edits the seal.
-
Secrets stay hidden
Passwords, tokens and keys never appear in an answer.
-
It sees the open view
In Messages it knows which thread is open, and it sees a selected trace. It reads the thread before it summarises it.
-
Reads a whole conversation
Even of 10,000 messages, for one question: each fact comes with its message, and the stretches it could not read are named.
-
Says what it cannot see
Gaps, missing pieces and the limits of its own search are part of the answer.
-
Explains the flagged words
Words met in results are explained in one line, with their domain and level. That includes slang, and also an ordinary word, a price or a payment address.
-
Walks the flagged traces
From an overview to the threads, the words and the timeline of a flag. A thread it reads carries the flagged messages.
-
Investigation guides
Written for the main phenomena and opened a section at a time: what to look for, and what not to conclude.
-
Long investigations
Up to 150 search rounds before it has to answer, with older steps summarised so the thread never overflows.
Simulated answers on a fictitious case. The questions are the ones VERA is tested with.
Search and the assistantCoverage
Every application. Every version. Structured.
An analysis suite decodes what its vendor has implemented, so an application updated last month can stay unreadable until the next release. VERA structures the raw extraction itself, in three steps, and the examiner keeps the last word.
-
The public library applies what is known
Open to every contribution. Known applications and versions are structured on import, before any AI runs.
-
Automatic mapping structures the rest
VERA scans the whole file tree and generates, with AI, the mapping of what the library does not hold yet: a new application, or a version that changed how it stores its data.
-
The analyst has the last word
Any mapping can be opened in the node editor, its query read and changed, with the assistant's help if wanted. Nothing reaches a case before a human accepts it.
VERA works from the raw file tree your acquisition suite already produces, alongside Cellebrite or AXIOM, with no upstream licence required.
| Older version | Current version | Updated last week | |
|---|---|---|---|
| From the library | From the library | Generated, then validated | |
| Signal | From the library | From the library | From the library |
| Telegram | From the library | From the library | Generated, then validated |
| Snapchat | From the library | Generated, then validated | Generated, then validated |
| Leboncoin | Generated, then validated | Generated, then validated | Generated, then validated |
| An app no tool knows yet | Generated, then validated | Generated, then validated | Generated, then validated |
The public library
A public library, open to every contribution.
Every seal starts with the public library. Known applications are recognised and structured on import, before any AI runs. The library is open: anyone can read how a mapping works, and every validated contribution reaches every VERA.
- validated mappings
- 2,600+
- validated mappings
- applications
- 600+
- applications
- operating systems, Android and iOS
- 2
- operating systems, Android and iOS
Among them
- Signal
- Telegram
- Snapchat
- TikTok
- Discord
- Threema
- Wire
- Viber
- ChatGPT
- Chrome
- Waze
- Uber
- Tinder
- Vinted
- BeReal
- and 580+ more
Each mapping can be read on the website: its graph, its fields, its query. The library holds definitions, never case data.
How a mapping reaches every VERA
- 01
Mapped
A laboratory maps an application, or VERA generates the mapping.
- 02
Validated
The examiner checks it against the seal and accepts it.
- 03
Proposed
Only the mapping is sent. Never case data.
- 04
Reviewed
Analysts vote, and VERA Forensics reviews.
- 05
Applied everywhere
Every VERA applies it on import, even offline, from its local copy.
Inside a service, the service library shares mappings between colleagues first, on your own server.
Includes mappings adapted from the open-source ALEAPP and iLEAPP projects (Alexis Brignoni and contributors, MIT licence), credited on each mapping that comes from them.
Explainability
Every trace knows where it came from.
Open any message, photo or position, and VERA shows the mapping behind it: which file, which table, which columns, joined how. The examiner does not build it. A reviewer, a counter-expert or a court can read it.
When a correction is needed, it is made by connecting boxes in a visual editor, with no code. The query behind a mapping can be read there too, and changed. Nothing generated is applied to a case before a human accepts it.
How automatic coverage works01The trace
Contact 714 Mar · 18:40
18,000 and I'll come by Saturday
Message body
02The mapping that produced it
03The source row
- text
- 18,000 and I'll come by Saturday
- peer
- 7
- sent_at
- 1773510000
- state
- 1
Signals
Suspicious behavior, flagged while the seal is processed.
A drug is a “pochon”, a “plug” or a snowflake emoji, depending on the group and the year. VERA carries a lexicon of criminal jargon, more than 17,000 forms in around fifty languages, and uses it in search and while the seal is processed. A signal is broader than that slang: an ordinary word, a price, a quantity or a payment address can be enough. The examiner decides what it means.
-
01 A lexicon in around fifty languages
Drugs, weapons and violence, extortion, fraud, money laundering, cyber, trafficking and extremism. Plurals, accents, stretched letters, spellings like c0ke and emojis are recognised.
-
02 Signals, without AI
A step of seal processing, on by default. It flags traces that look like suspicious behavior. Each one gets a badge: a domain and a level, weak, medium or strong.
-
03 AI review, when you want it
An optional step reads the flagged traces with the messages around them and says whether the passage really looks suspicious, whether the words are ordinary, or whether it cannot tell.
A signal
2 Mar · 22:41
C'est bien. Demain tu restes au four, je mets le petit de la tour B en charbonneur avec toi pour qu'il apprenne.
Good. Tomorrow you stay at the four, I'm putting the kid from tower B on as a charbonneur with you so he learns.
- charbonneur
- seller
- four
- drug dealing spot
The roles of a dealing point, in a thread about takings and a lookout.
Ordinary words
1 Mar · 19:06
Grave, je prends ma journée le vendredi. Tu peux me passer ton plug pour le chargeur du van ? Le mien a cramé.
Sure, I'm taking Friday off. Can you pass me your plug for the van charger? Mine burnt out.
- plug
- supplier, in drug slang
A socket for the van charger. The badge turns grey and leaves the filters.
A signal is a lead, never a finding. The words behind a badge show on hover, the AI ruling is labelled as AI-generated, and the examiner can set any signal aside.
How search and the assistant use itThe workspace
A view designed for each kind of record.
The raw file tree is reorganised into views built for analysis rather than for the storage format. The examiner moves between them without leaving the case.
-
Messages
Threaded conversations, with timestamps, direction and attachments in place.
-
Media
Photos, video and other files, searchable by what they contain.
-
Calls
Incoming, outgoing and missed calls, with duration where the source holds it.
-
Contacts
The address book, reconstructed from whatever produced it.
-
Location
Position records, readable as a list and placed on the map.
-
Notes
Notes and other stored text, searchable by keyword and by meaning.
-
Web
Browsing history and visited pages.
-
Downloads
Files the device saved from elsewhere.
-
Accounts
Accounts present on the device.
-
Calendar
Events and appointments, with their dates, places and attendees.
-
Credentials
Saved accounts and logins. Passwords stay masked and every reveal is logged.
-
Social activity
Posts, comments, follows and likes on social networks.
-
Transactions
Payments, transfers and purchases, with amounts and counterparts.
-
Trips
Journeys and bookings, from departure to arrival.
-
Applications
Applications installed on the device.
-
App activity
How those applications were used.
-
Networks & proximity
Network connections and nearby devices.
-
System log
System events recorded on the device.
-
Generic table
Any useful table that fits no other view, in a grid with sorting, filters, grouping and export.
- Every view, in detail What each view shows, how it is read, and what it can cross. On the analysis workspace page. The analysis workspace
Installation and sovereignty
Installed on your workstations. Running on your servers.
No online service to subscribe to and no data centre to trust. VERA installs inside your network and keeps working when the cable is pulled out.
- 1
One installer per workstation
Windows, macOS or Linux. Views, keyword search and mapping work with no AI model installed.
- 2
An AI server for the service
The standard server on Mac, Windows or Linux, or the package for a Linux machine with a graphics card. Both install from files downloaded once from your account.
- 3
Models added offline
Copy a model folder from an approved machine. No connection is required on the workstation or the server.
Where the AI runs is your choice
-
This workstation
Nothing leaves the computer.
-
The service server
Nothing leaves your network.
-
At VERA Forensics
Only if you decide not to run the models yourself. Off by default, paid from the account balance.
This is the first thing worth testing during a demonstration. Ask for the cable to be unplugged, and watch what keeps running.Read the trust centre
- Analyst workstations
- Inference server
- Investigation data
- Ingestion running
- Search responding
- Assistant answering
- No telemetry
- No vendor remote access
- Works with no connection at all
Changelog and roadmap
A new version every few days. The next steps in the open.
What changed recently, and what is being built now. In development means in development: it is described that way here and in a demonstration.
Recently shipped
Every change- 1.16.37 Seal processing Indexing is much faster on large seals: mappings are processed in batches, and traces are written several times faster into a case that already holds millions of them.
- 1.16.36 Seal processing An archive in which one file cannot be written whole, or whose checksum differs from the one the archive records, no longer fails the whole seal. The file is kept as the archive holds it, a warning names it in the logs, and processing carries on with the rest without stopping. Only a full disk stops the extraction.
- 1.16.36 Seal processing A seal that produces tens of thousands of mappings, such as a complete phone, no longer freezes the window when the case opens or during processing. A case that froze each time it was reopened opens again.
- 1.16.35 Workspace A case can now be deleted for good, not only archived, to free disk space. The window shows the space freed and the seal source folders it keeps intact, and asks for the case name to be typed again to confirm.
In progress
The roadmap- A more autonomous assistant In progress Long tasks that carry on, and a clear view of what is covered.
- Exact counts and cohorts In progress The assistant counts over the whole case, not on a sample, and keeps its method.
- More reliable automatic mapping In progress Better first attempts on applications nobody has mapped yet.
- Cross-seal analysis Next See what links the seals of one case without reading each one first.
- People and entities Next One person, whatever the application they appear in.
- Seal dashboards Next An overview of each kind of activity, built by the assistant and kept up to date.
Verify it yourself in the demonstration
- Load an extraction produced by a tool we do not own.
- Take an application VERA has never seen, run it, and use the view that comes out.
- Unplug the network cable and keep working.
- Click any statement the assistant makes and land on the source record.
- Run the Signals step on a phone, open the shield in a view, and set a signal aside.
Responsible use
Who this software is sold to is a decision, not an afterthought.
VERA is forensic software used after a seizure, under legal authority, on a device already in an investigator's hands. It is not interception and it is not surveillance. Where that line sits, who is refused, and who makes that call are written down.
Read the position
See it run on a real extraction.
A service asks for a demonstration, usually thirty minutes on fictitious data. An independent expert asks for access: a person reviews the request, then the yearly licence is ordered from the account.
Every request is reviewed before access is granted.