Offline-first DFIR operationsDocument the work.
Document the work.
Defend the record.
One field-ready workspace for case notes, evidence inventory, repeatable calculations, operational playbooks, and source-linked forensic references.
No evidence upload required Local-first case records Offline-ready after first load
CASE 26-0716-DF OFFLINE READY
CASE READINESS
Mobile device examination
Authority, evidence, notes, and integrity context in one reviewable record.
4 of 6 checks complete67%
LATEST EVENT • 09:33 UTCWorkstation time verified before examination.
Private by defaultCase content remains under examiner control.
Built for the fieldAlready loaded core workflows can remain available offline.
Context, not shortcutsEvery reference includes limits and caveats.
ONE OPERATIONAL WORKSPACE
The record around the evidence matters.
DFIR Toolkit helps examiners capture the decisions, context, and verification details that are easiest to lose under pressure.
Structured case records
Track authority, evidence condition, collection details, examiner notes, readiness, and a chronological audit trail.
Versioned field forms
Complete repeatable seizure, custody, acquisition, triage, live-response, and photography records.
Caveated knowledge
Search artifact locations, file signatures, standards, and playbooks with explicit limits on what each item can prove.
Reviewable exports
Generate portable JSON, CSV, Markdown, and print-ready records without sending case content to a hosted analysis service.
BUILT BY A WORKING DIGITAL FORENSIC EXAMINER
Experience behind the workflow, not just software around it.
DFIR Toolkit was built by Eric L. Waldrep, CEO of The Waldrep Company, a court-qualified digital forensic examiner, forensic trainer, and U.S. Department of State Antiterrorism Assistance Cyber Mentor. The product reflects the documentation problems that surface in real examinations, field operations, reviews, and testimony.
About The Waldrep Company Founder credentials are provided for professional background and do not imply government endorsement of this product.- 17+
- Years in digital forensics
- 27+
- Years in law enforcement
- 200+
- Cases examined
- MCFE
- Certified and court-qualified
LOCAL-FIRST ARCHITECTURE
Your evidence does not need another cloud.
The commercial architecture separates account and license management from case content. Subscriptions can be managed online while case records remain on the examiner's device.
Inspect the workflowONLINE ACCOUNTIdentity and licenseEmail, plan, organization, reference updates
LOCAL WORKSPACECase and evidence recordsInventory, notes, forms, audit history, exports
FREE FIELD RESOURCE
Strengthen the record before you buy anything.
Get the six-page DFIR Field Documentation Pack with practical case-intake, chain-of-custody, acquisition, evidence-photography, and examiner activity forms.
- Six-page printable documentation pack
- Designed for field and laboratory use
- Delivered as a downloadable PDF
SIMPLE LAUNCH PRICING
Start with the examiner. Scale to the team.
Document one complete encrypted case free. Solo Pro removes the case limit, and annual Team Licensing starts at five users.
$0
foreverUse the complete workflow on one encrypted local case.
- One encrypted local case
- Forms and exports for that case
- Current utilities and references
- Verified account required
$29
per monthThe complete workspace for an independent examiner.
- Unlimited local cases
- All forms and exports
- Complete reference library
- Installable web app
$290
per yearThe complete Solo Pro workspace with two months free.
- Unlimited local cases
- All forms and exports
- Complete reference library
- Save $58 each year
Paid plans renew automatically until canceled. Cancellation takes effect at the end of the paid period. Refund requests are accepted within seven calendar days after an initial or renewal charge. See the Terms for details.
TEAM LICENSINGTeam 5 from $1,290 per year
View Team Licensing Independent examiner accounts, consolidated annual licensing, purchase-order support, and custom options for 11 or more users.
TOOLKIT + PROFESSIONAL TRAINING
Explore training Make the documentation standard part of the training.
The Waldrep Company provides professional digital-forensics training for examiners and agencies. Ask about adding one year of Solo Pro to an eligible course enrollment for $199.
QUESTIONS BEFORE CASEWORK
Clear boundaries before you rely on it.
The toolkit is explicit about where records live, when connectivity matters, and what the product does not attempt to replace.
What is included with the free case?
A verified account can create one encrypted device-local case and use the evidence inventory, forms, notes, audit history, export workflow, utilities, and current references. Solo Pro removes the one-case limit.
Does DFIR Toolkit upload evidence or case records?
No evidence upload is required. In the production workspace, case records and completed forms are encrypted in the browser's device-local vault. The hosted account layer is reserved for identity, licensing, and billing state.
Can I use the toolkit without a network connection?
Core tools and an already loaded, unlocked workspace can continue operating without a network connection. Initial sign-in, license checks, reference updates, and a fresh application load may require connectivity.
Does this replace forensic acquisition or analysis software?
No. DFIR Toolkit documents the work around an examination and provides decision support. It is not an acquisition, parsing, malware-detonation, or evidence-analysis engine.
What happens if I lose my vault passphrase?
There is no server-side recovery key. If the passphrase and every unlocked session are lost, the encrypted vault cannot be recovered. Encrypted backups and passphrases should be stored separately.
Are calculations and references authoritative?
They are operational aids, not substitutes for source validation or examiner judgment. Reference entries include limits and caveats so conclusions can be checked against authoritative sources and case context.
How does Team Licensing work?
Current Team plans provide independent Solo Pro accounts with consolidated annual licensing. Each examiner maintains a separate encrypted local vault. Central administration, shared cases, and supervisor dashboards are not included yet.
Can an agency evaluate it before deployment?
Yes. The public demo uses synthetic data, and an agency can begin with individual examiners before choosing team licensing or a broader rollout.
Put the field record on equal footing with the technical result.
Explore the complete toolkit with sample data. Nothing you enter in the demo should be treated as a retained production record.
Open the product demo