Guardian
An independent network sensor that observes device communications without requiring privileged access to the monitored device.
Independent visibility · Correlated evidence · Sovereign control
Trust is not a security control.
Validate it.
ForensicsGuard provides independent forensic visibility across mobile devices and their network environment. It helps organisations identify suspicious behaviour that conventional endpoint and network security may not reveal.
- On-premiseSovereign deployment
- OfflineIndependent core operation
- EvidenceUnder your control
The principle
Your technology may be trusted. That doesn't mean it shouldn't be verified.
Modern organisations depend on devices, operating systems, applications, cloud services, updates and global supply chains they cannot independently inspect.
For most environments, that trust is necessary. For high-risk environments, trust should be supported by independent evidence.
ForensicsGuard was designed for exactly that purpose.
The platform
One system. Three perspectives.
Evidence is strongest when it comes from more than one vantage point. ForensicsGuard observes the same activity from the network, from the device, and across time.
Mobile Sensor
Adds device and application context from Android and iOS, strengthening attribution and investigation.
Lab Station
Correlates network, mobile, historical and threat-intelligence evidence to identify patterns that may be insignificant in isolation.
One signal can be noise. Multiple independent signals can become evidence.
Forensic by design
Detection is only useful if you can investigate what happened
ForensicsGuard is engineered around evidence integrity, traceability, reproducibility, offline operation and independent validation — so an alert can become the beginning of an investigation rather than the end of one.
Identify Preserve Analyze Report
Case study
Watch a case move through the platform
A synthetic investigation, recorded from the product interface: suspicious activity is observed on the network, identified as a departure from the device's own baseline, correlated against the handset's own record, placed on the map, sealed as evidence, and written up.
What it shows
- Observe The Guardian records what the network carried — destinations, volume and the names each device asked for.
- Detect Regular low-volume contact while the handset is idle, departing from the baseline the device set for itself.
- Correlate The device-side and network observations of the same activity are matched and graded, with the basis shown.
- Map The correlated events placed geographically and stepped through in time, alongside the case timeline.
- Preserve Evidence hashed and sealed with its origin, time and engagement attached.
- Report Findings drafted locally and validated against the case record before an analyst sees them.
Sovereignty without isolation
Your evidence stays under your control
ForensicsGuard is designed for environments where sensitive telemetry and forensic evidence should not depend on a third-party cloud for analysis. Guardian and the Lab Station operate locally — inside existing laboratories, government facilities or fully isolated networks — with controlled offline update mechanisms.
- Evidence stays where you put it Cases, captures and exports live on systems you operate.
- Designed to run offline Core collection and analysis do not require an internet connection.
- Cryptographic identity Each Guardian carries its own hardware-bound identity.
- Verifiable software Releases are distributed with signed integrity manifests.
Who it's for
Built for high-risk environments
ForensicsGuard is designed for organisations where the compromise of a mobile device is not an inconvenience but an operational risk.
Government & law enforcement
Independent forensic visibility for sensitive devices, investigations, senior personnel and high-risk operational environments.
Media, journalists & human-rights defenders
Additional assurance for journalists, NGOs and individuals exposed to sophisticated targeted surveillance.
Critical & strategic organisations
Forensic assurance where a compromised device or channel could carry operational, financial or national-security consequences.
Digital forensic & incident-response teams
Cross-source mobile and network evidence, historical correlation and investigative workflows for deeper analysis.
Validation
Claims should be tested, not trusted.
We apply the same principle to ourselves. ForensicsGuard is undergoing structured validation covering forensic integrity, detection performance, cross-source correlation and operational assurance. Methodology and validation results will be published as evidence becomes available.
What is being validated
- Forensic integrity of collected evidence
- Detection performance against realistic activity
- Cross-source correlation between network and device
- Operational assurance in the field
Founder-led
Direct accountability, not a faceless vendor
ForensicsGuard was founded by Khireddine Garri, a digital-forensics practitioner with close to two decades of experience across digital forensics, security governance and cyber risk management. The company remains deliberately small and technically led — when you raise a question about the architecture, the answer comes from the people who built it.
ForensicsGuard is not a black-box product.
It is a transparent initiative built for lawful analysis, institutional capability-building, and the protection of high-risk professionals.
Don't replace trust. Validate it.
A pilot puts a Guardian and a Lab Station into your environment, on a network you control, with your own team running the workflow.