Case management
Cases hold the evidence, the engagements that produced it, the analysis performed on it, and the reporting derived from it. Work is scoped to a case rather than pooled.
Lab Station
Where observations become a case
The Lab Station is the analyst's environment. It takes in what the sensors observed, correlates it across sources and across time, preserves it with its provenance intact, and turns it into something an investigator can act on and defend.
The analyst environment
Built around the case, not the capture
A capture is not an investigation. The Lab Station is organised around cases — the unit an investigator actually works in — with evidence, correlation, analysis and reporting all attached to the case that owns them.
Evidence ingestion
Guardian acquisitions and Mobile Sensor exports are checked on the way in. Where an export carries a signature, a failed check refuses the import outright. The verification result is recorded against the evidence and carried into the reporting, so its standing is never left implicit.
Cross-source correlation
Device-side and network observations describing the same activity are matched into one account. Matches are presented with the basis for the match, so an analyst can agree or disagree with it.
Historical analysis
Activity is examined across time rather than at a single instant — including comparison against a device's own earlier behaviour.
Timeline and map
Case activity can be walked through chronologically and placed geographically, with playback across a period rather than a single static view.
Intelligence
Indicator sets and network-intelligence datasets are held on the Station and distributed to enrolled Guardians, so the fleet works from a consistent basis.
Sensor Fleet
Discover, identity-confirm, enrol and monitor Guardians from one place, including their health and the software they are running.
Role-based access
Access follows role, and case access can be restricted to the people working a case. Operating a Guardian and analysing case material are separate privileges, held independently of each other.
Reporting and export
Findings are assembled into reports for technical and non-technical readers, with the supporting evidence referenced rather than summarised away.
Correlation
Matches you can interrogate
Correlation is the platform's central claim, so it is built to be questioned. When the Lab Station proposes that two observations describe the same activity, it shows why.
Matches are graded rather than asserted: strong, unambiguous agreement is presented differently from mere consistency, and where the evidence will not support a confident match the platform says so instead of forcing one.
Why this matters evidentially
An investigator will be asked how they know two records describe the same event. A correlation that cannot answer that question is not usable in a serious case. The basis for every match stays attached to it.
The analyst decides, not the matcher
The platform's job is to surface candidates and show its reasoning. A match is never presented as a settled fact, and where the evidence will not support a confident one the platform records that instead of choosing. What the evidence supports remains the judgement of the person accountable for it.
AI and analytics
Where the intelligence actually sits
ForensicsGuard uses machine learning and algorithmic analysis in three specific places. Being precise about which is which matters, because they carry very different weight in a case.
- Anomaly analysis
- Statistical and machine-learning methods identify activity that departs from a device's established baseline, so an analyst's attention goes to what is unusual rather than to what is merely present.
- Correlation
- Algorithms match device-side and network observations that describe the same activity, grade the strength of each match, and surface the basis for it.
- Report generation
- A language model, running locally, drafts and explains findings in readable prose. Its output is checked against the underlying case data before an analyst sees it, and a section that fails that check is replaced rather than shown.
All three run inside your environment. None of it is a cloud service, and case material is not sent anywhere to obtain it.
The language model writes about findings. It never produces one.
Scores and verdicts are computed deterministically from the evidence — fixed arithmetic over rule, anomaly and correlation results, reproducible from the same inputs. No generated text feeds back into them. That separation is enforced in the code, not left to convention, and it is why an assisted report can be checked line by line against the evidence it came from.
Local analysis. No cloud services.
Detection, prioritisation, correlation and reporting run inside your environment. Evidence remains under your control.
Integrity
Provenance travels with the evidence
The Lab Station is the point where material from different sources becomes a single case. That makes it the point where provenance most needs to hold.
Checked on ingest
Integrity material is checked before evidence enters a case. A failed signature check refuses the import; every outcome is recorded against the evidence.
Sealed and hashed
Evidence is hashed when taken in, so later alteration is detectable rather than assumed against.
Origin retained
Which sensor produced it, when, and under which engagement stays attached to the material for the life of the case.
Audited access
Actions taken against case material are recorded, so the handling of evidence is itself reviewable.
The cryptographic mechanisms are described on the Security & Trust page.
See it on your own network
A pilot puts a Guardian and a Lab Station into your environment, on a network you control, with your own team running the workflow.