GUIDED PRODUCT DEMO
Explore a field-ready workflow.
Use the sample records to explore casework, forms, calculations, playbooks, and references. Demo changes are not production records.
2Active cases
3Evidence items
44Reference entries
48File signatures
LOCAL CASE VAULT
Active cases
AUDITABLE CONTEXT
Recent case activity
26-0716-DFInitial condition note recorded.
26-0716-DFEvidence received and seals inspected.
IR-2026-024Original audit export received, hashed, and preserved.
DFIR Toolkit is a reference and documentation companion. It does not acquire, parse, or analyze evidentiary data.