The vocabulary, without the assumption that you already have it.

The question of whether evidence can be considered by a court, which turns on how it was obtained, how it was handled and whether it can be verified, rather than on which product surfaced it.

No forensic tool makes evidence admissible. What a tool can do is make verification practical enough that the examiner actually performs it.

An environment physically or logically isolated from the internet and from other networks. Forensic laboratories frequently work this way, which means any software that quietly requires a connection, including for licensing, is unusable there.

A written record of actions and results, held so that a decision can be reconstructed later. Where an AI assistant is involved, the log is what allows a court to see the sequence that produced a finding rather than only the finding.

The property that an application nobody has implemented support for can still be read, because the software works out the structure itself and an examiner validates the result.

The alternative, which is the industry norm, is that coverage arrives in a vendor release and an unsupported application is a dead end until it does.

Recovering data from unallocated space, journals and other remnants where a record has been marked as deleted but its contents survive.

A carved record must always be presented as recovered rather than as live, because the two carry different evidential weight. VERA marks recovery status alongside provenance for exactly this reason.

The record showing every person who handled an item of evidence, when, and what they did with it. A break in that chain is one of the most reliable ways for evidence to be excluded, regardless of what it contains.

Analysis software does not maintain the physical chain of custody, but it can either support it or quietly undermine it. Read-only evidence access and a complete action log are the parts that matter.

The principle that data remains under the jurisdiction and control of the organisation holding it. For European public authorities this covers both the physical location of the data and whether any foreign legal instrument could compel its disclosure.

The contract value under which a public body may purchase without running a formal procurement procedure. The figure varies by country and by contracting authority.

It is relevant here because it is usually the practical route to a first pilot with a small supplier.

The queue of devices seized but not yet examined. It grows when the volume of data per device rises faster than the number of examiners, which is the position most laboratories have been in for several years.

An acquisition that copies the entire file system of a device rather than the subset an application chooses to expose. It includes application databases, caches, configuration files and system traces, which is why it contains far more than a logical extraction and why it takes far longer to review.

Commonly abbreviated to FFS. It is the input VERA is designed for.

A step in the pipeline that cannot be skipped: a generated mapping is shown to the examiner as a preview over the real data, and it is not applied to the case until the examiner accepts it.

It matters legally as much as technically, because it is what keeps a human decision at the point where an automated system could otherwise become the author of a finding.

Retrieval that runs exact keyword search and meaning-based search together and combines the results, rather than choosing one. Keyword search misses anything phrased differently; meaning-based search catches those and can drift.

Running both, with the examiner controlling the balance, is more reliable than either alone in work where the vocabulary is deliberately oblique.

An acquisition that collects the data the device's own interfaces expose, typically contacts, messages, call logs and media. It is faster and less invasive than a full file system acquisition, and it misses everything an application keeps to itself.

A definition that says how the contents of a given source, for example an application's database, should be read and reorganised into the fields a viewer expects: a timestamp, a sender, a message body, a direction.

In VERA a mapping is generated automatically where the source has not been seen before, reviewed by an examiner, and corrected in a visual editor where needed. It contains no evidence, only the description of how to read a structure.

Indexing media so it can be retrieved by content rather than only by filename, timestamp or hash. It matters most where media volume is the whole problem, and it is never a substitute for a human examiner's judgement about what an image shows.

An editor in which a source sits on one side, the fields a viewer expects sit on the other, and the examiner connects them, inserting transformations where a value needs reformatting or translating.

It exists so that examiners keep control of the result, not because they are expected to build mappings from scratch.

Software installed and operated inside the customer's own infrastructure rather than accessed as a hosted service. For seized-device data this is often not a preference but a hard requirement, because the data cannot lawfully or politically be placed in a third-party environment.

Broadening a search to related vocabulary so that a query for one term also retrieves its synonyms, its slang forms and the coded language used in its place. Particularly relevant in narcotics and trafficking work, where the vocabulary changes between groups and over time.

Accessing an evidence store in a mode that cannot write to it. It protects the integrity of the original and it removes an entire category of question in a security review and in court.

An approach in which a model answers from documents retrieved at query time rather than from what it memorised during training. Widely abbreviated to RAG.

In a forensic context the value is not the generation but the retrieval: the answer is anchored to specific records, which is what makes citing a source possible at all.

In French practice, a scellé: the sealed item entered into the case with its own reference, which is the unit an examination is organised around. A case can contain many seals, and a seal can contain more than one device or storage medium.

VERA organises work the same way, so that the software's structure matches the procedure rather than the other way round.

An arrangement in which a copy of the software's source code is deposited with an independent third party and released to the customer if defined conditions occur, such as the vendor ceasing to trade.

It is the standard contractual answer to the continuity risk of buying from a small supplier.

The property that any statement in a report can be followed back to a specific record: which file, in which path, which table, which row. Without it, a finding is an assertion.

In VERA, provenance is carried by the record itself rather than reconstructed at display time, so a citation still resolves after the mapping that produced it has been revised.

Automatic reporting of how software is used, sent to the vendor. Normal in commercial software and a serious problem in a forensic context, because the metadata alone can reveal case activity.

VERA collects and transmits none, which is also why the vendor cannot observe how a deployment is used.

The interval between a device arriving and an investigator having something they can act on. It is a more useful measure than processing throughput, because a device fully processed and never read has produced nothing.