How VERA works

From a raw file tree to a working case file.

VERA begins where acquisition ends. It takes the extraction exactly as your acquisition tool produced it, builds the structure itself, and hands your examiner a workspace where everything is searchable and every finding points back to the record that produced it.

  • Any operating system, any acquisition tool, any application version
  • No upstream licence required
  • Runs offline on your infrastructure

01 · Ingestion

The extraction goes in exactly as it came off the device.

VERA reads the raw Full File System extraction directly. There is no conversion step, no proprietary intermediate format, and no requirement that the extraction was produced by a particular vendor's tool. If your service does not hold a licence for the acquisition suite that made the extraction, VERA still reads it.

Evidence is opened read only. The extraction on disk is never modified, and the provenance of every record travels with it from this point onwards.

  • Any acquisition source

    Extractions from the tools your service already uses, and from tools it does not own.

  • Read-only access

    The evidence store is opened without write access at any stage of the pipeline.

  • Provenance from the first read

    Every record keeps the file, the path and the position it came from.

Seal · PX-04-2026-011 Reading extraction
  • extraction/
  • data/
  • app_a/databases/
  • store.db
  • store.db-wal
  • app_b/files/
  • cache.bin
  • prefs.xml
  • app_c/shared/
  • records.sqlite

sources detected

347

Read only · hash preserved

02 · Structuring

Thousands of folders become views built for analysis.

The raw file tree is reorganised into viewers designed for the work rather than for the storage format: conversations that read like conversations, a media gallery, contacts, calls, locations, application activity, system traces.

Applications the software already knows are recognised on import and mapped automatically from a library of validated mappings. That covers the common case in seconds, and it leaves the examiner free to spend attention on what is genuinely unfamiliar.

ViewersLibrary applied
Messages12 418
Media31 902
Contacts1 204
Calls3 771
Locations9 640
Application activity48 115

03 · Validation

Generated coverage is proposed, never imposed.

Where an application has never been seen before, or where a version changed since the last time it was met, VERA generates the mapping itself and presents the result as a preview over the real data.

The examiner reviews that preview and accepts it. Where a correction is needed, it is made in a visual editor by connecting boxes, with no code involved. Nothing enters a case until a human has accepted it.

Coverage is generated. The examiner's job is validation, and occasionally correction. It is never construction.
Mapping previewGenerated · awaiting review
TIMESTAMPSENDERMESSAGE BODY
11/03 21:04Contact 7you around this weekend
11/03 21:06Ownerdepends what for
11/03 21:11Contact 7saturday, same as last time
11/03 21:12Ownerfine. 14th works
Validate and indexCorrectFictitious data

04 · Retrieval

Keyword and meaning, running together.

Keyword search misses anything phrased differently, including deliberately coded language. Meaning-based search catches those but can drift. VERA runs both and merges the results, with automatic expansion of search terms to related vocabulary, and the examiner controls the balance between the two.

Searches can be scoped to a case, a seal, a single mapping or one conversation, and the same engine is available inside every viewer.

Search this seal
quiet meetingKeywordsMeaning
Expanded termsrendezvousmeet upalonediscreet
  • 0.94saturday, same as last timeMessaging · thread 41
  • 0.81plan for 14th, aloneNotes · entry 12
  • 0.77meet at the usual placeMessaging · thread 9

312 results · 0.38 s

05 · Questions and answers

Ask in plain language. Get the source with the answer.

The assistant answers questions about a whole device, a seal or a single thread. Every element of an answer links back to the exact file, table and row behind it, and one click puts the examiner on the original record.

Every action the assistant takes and every result it receives is written to an audit log. The assistant proposes and the examiner decides.

Ask a questionFictitious data

Summarise the exchanges about a meeting

Three exchanges arrange a meeting between 11 and 13 March. The sender asks to come alone.

messaging_store.db :: message :: 8842messaging_store.db :: message :: 8846notes.db :: entry :: 12
Read-only access · every action logged

Deployment

Installed inside your network, and it stays there.

VERA runs as a client on analyst workstations with a central inference server on your own intranet. No internet connection is required or used. There is no telemetry, no online licence check and no vendor remote access.

The models run on your hardware and you can replace them, so the deployment carries no dependency on a single AI supplier's pricing, availability or jurisdiction.

  • Closed network

    No investigation data crosses your perimeter under any configuration.

  • Your hardware

    A central server for inference, thin clients on the analyst workstations.

  • Replaceable models

    The client calls an internal interface, so models can be changed without touching it.

Keep reading

See it running on a real extraction

Thirty minutes, on fictitious data, with time for your questions. If VERA does not fit what your service needs, that is a useful answer too.

Request a demonstration Write to Alexandre

Every request is reviewed before access is granted.