Security & Trust
Evidence that survives being questioned
Forensic findings get challenged. This page describes the mechanisms that let a ForensicsGuard finding withstand that — how an appliance proves which appliance it is, how software proves it has not been altered, and how evidence proves it has not changed since collection.
Validation
Validation and quality framework
ForensicsGuard has undergone internal testing and reviews covering evidence integrity, analysis, reporting and operational readiness. Initial testing identified areas for improvement, most of which have since been addressed through subsequent development. Remediation and verification are documented by software version and test scope, with reference to recognised international digital-forensics and forensic-science guidance. This process supports continuous improvement and transparent reporting while keeping sensitive implementation details confidential.
| Area | Assessment references | Purpose |
|---|---|---|
| Digital evidence collection and preservation | ISO/IEC 27037 | Preserve evidence integrity and document its origin |
| Examination and analysis methods | ISO/IEC 27041 and 27042 | Evaluate method suitability and the limits of analytical results |
| Digital investigation processes | ISO/IEC 27043 | Support structured, reviewable investigation procedures |
| Examination, interpretation and reporting | ISO 21043-3, 21043-4 and 21043-5 | Communicate findings clearly and distinguish evidence from interpretation |
| Support for forensic laboratory requirements | ISO/IEC 17025 and ILAC G19 | Provide records and functions that support laboratory obligations |
| Tool testing and performance validation | NIST CFTT and SWGDE guidance | Support documented, repeatable testing within defined conditions |
This is traceability, not certification
These references describe the assessment and improvement framework; they do not imply ISO certification, laboratory accreditation or endorsement by the referenced organisations. Detailed validation documentation is available to qualified organisations on request, subject to confidentiality arrangements.
Results
Validation results
Guardian + Lab Station detected 100% of the validated RAT scenarios across the tested adverse corpus, while maintaining a 0.8% HIGH-severity finding rate on the benign validation population. Validation also includes CTU-13, CIC IoT, CTU Normal and CIC malware datasets, alongside additional internal and third-party datasets used in ongoing validation.
| Validation area | Guardian + Lab Station result |
|---|---|
| Validated RAT / adverse scenarios | 100% — 8/8 validated RAT units detected |
| Previously validated R1 beacon detections | 100% preserved — 0 detections lost across all 8 units |
| Benign validation population | 5 HIGH findings / 664 observations = 0.8% |
| Golden regression set | 100% preserved — identical to both approved reference baselines |
| Public datasets included in validation | CTU-13, CIC IoT, CTU Normal, CIC Backdoor/Malware |
Scope of these results
Results apply to the specified datasets, scenarios, and validation conditions and do not imply universal detection of every possible threat.
Frameworks
General security frameworks
Alongside the forensic-methodology references above, the architecture is also documented against ISO/IEC 27001 and the NIST SP 800-53 and SP 800-171 control families, for general information-security practice.
The limits
What we are not claiming
A trust page is exactly the wrong place to overstate. To be explicit about the boundaries of everything written above:
- No certification is claimed
- ForensicsGuard does not hold, and does not claim, any security certification, accreditation or government approval. The platform is designed against recognised evidence-handling principles, but no independent evaluation has been carried out against them. Where a formal evaluation is required for your procurement, that is a conversation to have directly.
- No hardware security module in the Guardian
- The Guardian's identity is bound to its hardware and its signing key is protected by the operating system, but it is not held in a secure element or a TPM, and we do not describe it as one. Mobile Sensor evidence signing on iOS does use the device's secure element — that is the exception, and we name it as such.
- No guarantee of detection
- No forensic platform can guarantee it will detect a given capability. The platform is built to observe, correlate and preserve — not to promise completeness. Every finding is bounded by what was observable, where, and during which period.
- Integrity is not interpretation
- These mechanisms establish that evidence has not changed and came from where it says it did. What the evidence means remains a matter for qualified analysis by a person who is accountable for the conclusion.
- Authorisation is yours to establish
- The platform is built for authorised observation of environments and devices you have the lawful right to examine. It does not, and cannot, establish that authorisation on your behalf.
Bring your own security reviewer
We would rather your security team examined this properly than took a web page at face value. Technical documentation for review is available to organisations evaluating the platform.