INVESTIGATION WORKSPACE
Start with a case.
Bring findings from every computer into one shared investigation.
Link related cases to keep the full context in view.
New findings or linked context are available.
Investigation findings
Context across linked investigations
Includes every case in this linked group. Confirmed findings have a human review; hypotheses and disputes remain visible.
Evidence repository
Original files are retained with SHA-256 hashes. Up to 8 MB per file.