We do not build everything ourselves. We select — and we say openly what we work with.
A forensic result is only as verifiable as the route to it. Our technology stack is therefore not an internal matter but part of the evidence.
Platform
Farsight (Switzerland) — cloud-native eDiscovery and compliance platform from a Swiss provider. It carries processing, search and review in our Investigate mandates. That the platform partner is itself Swiss and also carries the Swiss Made Software label is no coincidence but part of our data residency commitment: your data does not change legal jurisdiction by way of the software vendor.
Secure collaboration and access
Data exchange — open-source platform, operated by us, for data rooms and exchange with clients and law firms. Open-source and self-operated means: no third-party cloud provider between you and us, encryption and retention periods on our terms, and an auditable access log for every data room.
Single sign-on — self-hosted identity provider for single sign-on with multi-factor authentication for our systems, without an external identity service.
Credentials — password manager for team credentials, end-to-end encrypted.
Why no product names here: we deliberately describe our internal IT and security systems by function only — anyone who knows them in detail can attack them more precisely. Clients receive the full list on request as part of engagement scoping.
Forensic tooling
Compelson (Czech Republic) — MOBILedit Forensic for acquiring and analysing smartphones, smartwatches and cloud data; Camera Ballistics for attributing photos to their camera via the sensor fingerprint. With suspected manipulated or AI-generated images, origin decides, not appearance.
Passware — decryption and password recovery for encrypted files, containers and drives, where legally permitted and covered by the mandate.
SysTools — specialist tools for extraction, conversion and processing of data in formats that defeat standard software: legacy holdings, proprietary archives, damaged containers.
Kernel — recovery and processing of email and data holdings, particularly where sources are defective, incomplete or partly deleted.
Why several tools: no single tool reads every format reliably. For admissibility, what counts is not which tool we prefer but that the result can be reproduced with a second one.
Open sources and research
Maltego — graphical representation of relationships between people, companies, domains and accounts. Networks that get lost in spreadsheets become visible at a glance.
Hunchly — complete preservation of online research: every page visited is captured with a timestamp and hash value, so findings remain provable even if they later go offline.
Shadowspotter — domain intelligence from public internet data: domains, DNS records, TLS certificates, WHOIS data and web server responses. We use it to spot look-alike domains and phishing infrastructure, trace which domains and servers belong together, and monitor a client's infrastructure for new anomalies.
Darknet Search — research in darknet sources, for example for leaked credentials, company data or offers concerning your organisation.
Spoofguard — detecting spoofing, i.e. forged senders and fake identities.
Processing, text recognition and conversion
Own OCR engine — text recognition based on the open-source PaddleOCR, operated by us. Scanned and image-based documents become searchable without data going to an external service.
KODAK Capture Pro — capture software for digitising paper files, from batch processing to indexing.
MessageCrawler — converting chat and messenger data to the Relativity Short Message Format (RSMF), so conversations remain readable as conversations in review instead of loose individual messages.
Data deletion and sanitisation
KillDisk — documented, standard-compliant erasure of storage media and mandate data at the end of a mandate, with an erasure record.
The part rarely spoken about: an investigation mandate creates copies of your company's most sensitive data. How those copies disappear again is as much a part of due care as their preservation. You receive a record of it, not an assurance.
Documented processes
ISMS.online — platform for our information security and privacy management system under ISO/IEC 27001 and 27701, and for the process documentation of our eDiscovery and forensic workflows. What we do is described; what is described is audited.
Partnership does not mean tied
We are exclusively tied to no vendor and receive no payment for recommending a particular tool. Where a mandate calls for a different tool, we use the different tool. This page records the current state and is updated when it changes.
Would you like to become a technology partner?
We assess tools on whether they deliver reproducible results, whether their data residency is compatible with our commitment, and whether they withstand forensic scrutiny.