Core Concepts

5.1 Case

A case is the outer container for an investigation. It holds acquisition sessions and ultimately becomes the final case package. A case provides organizational, legal, and reporting scope. Case data can include:

• Case identifier.
• Description.
• Owner or investigator.
• Last edit date.
• Closure date.
• Case state.
• Acquisition list.
• Case archive.
• Case report.
• Case summary.
• Case timestamp and blockchain metadata.

The forensic value of the case is context. It explains why acquisitions are grouped together and provides a final deliverable for the matter.

5.2 Acquisition

An acquisition is a collection session inside a case. It is the operational unit that records the live capture process. An acquisition starts when the investigator launches the acquisition browser and ends when the session is closed and packaged. Acquisition data can include:

• Acquisition ID.
• Acquisition name.
• Acquisition type.
• Investigator.
• Start and end time.
• Duration.
• Version.
• Public IP and country.
• Proxy IP.
• Tor state.
• DNS-over-HTTPS configuration.
• User agent.
• Mail or mobile parameters where applicable.
• Video recording state.
• Network capture state.
• WHOIS, system info, certificate, and deep collection settings.
• Evidence list.
• Acquisition archive, report, summary, timestamp, and blockchain metadata.

The forensic value of the acquisition is procedural. It documents the session in which evidence was collected.

5.3 Evidence Item

An evidence item is one captured object or capture action. It may be a screenshot, page source, full-page capture, file download, mail message, video, or combined capture. Each evidence item receives an evidence ID and is associated with:

• Case ID.
• Acquisition ID.
• Acquisition type.
• Investigator identity.
• URL/domain or device/mail context.
• Chain-of-custody events.
• Raw evidence files.
• Evidence archive.
• Evidence report.
• Evidence summary.
• Timestamp files.
• Blockchain metadata where enabled.

The forensic value of the evidence item is precision. It isolates one captured thing so it can be reviewed and verified independently.

5.4 Evidence Package

An evidence package is the final ZIP for one evidence item. It normally contains the raw evidence archive, evidence report, JSON report, summary JSON, timestamp files, and blockchain metadata. The evidence package is useful when a reviewer needs one item without the entire acquisition. It is also useful for targeted disclosure, technical validation, or exhibit preparation.

5.5 Acquisition Package

An acquisition package is the sealed package for an entire session. It contains the evidence packages and session artifacts needed to explain the collection environment. Acquisition artifacts can include:

• Acquisition database.
• Chain-of-custody logs.
• Browser profile.
• Network logs.
• PCAPNG.
• TLS key log.
• Video recordings.
• System info.
• Certificates.
• Evidence packages.
• Acquisition report.
• Acquisition summary.
• Timestamp and blockchain metadata.

The acquisition package is useful when the complete session must be reviewed.

5.6 Case Package

A case package is the final export for the whole investigation. It can contain one or more acquisitions, case reports, summaries, timestamp files, blockchain metadata, and optionally a viewer package. The case package is the most complete deliverable. It is appropriate for archiving, disclosure, handoff to legal teams, or long-term preservation.

5.7 Session IDs

Eviquire uses IDs to bind files and records together:

• C-…UTC identifies a case.
• A-…UTC identifies an acquisition.
• E-…UTC identifies an evidence item.

These identifiers appear in folder names, package names, reports, summary JSON, database records, and chain-of-custody entries. This makes it easier to correlate artifacts during review.

5.8 Hashes

Hashes are cryptographic fingerprints of files. Eviquire records MD5, SHA2-256, and SHA3-256 values. If a file changes, its hash changes. Eviquire uses hashes to:

• Identify evidence files.
• Validate packages.
• Detect mismatches between capture-time and packaging-time file states.
• Populate reports and summaries.
• Support timestamp and blockchain anchoring.

5.9 Timestamping

Timestamping creates external proof that a specific summary file existed at a particular time. Eviquire uses timestamp request and response files:

• .tsq: timestamp query/request.
• .tsr: timestamp response.

The timestamp is applied to the summary JSON, not necessarily every raw file individually. Because the summary contains hashes of the archive and report, timestamping the summary effectively timestamps the integrity statement for the package.

5.10 Blockchain Verification

Where enabled, Eviquire submits summary hashes for blockchain anchoring. This provides an additional external integrity reference. Blockchain metadata is stored with the package so reviewers can inspect anchoring information. Blockchain anchoring does not replace traditional forensic verification. It supplements hashes, timestamp authority files, chain-of-custody records, and reports.

5.11 Chain Of Custody

Chain of custody is the documented history of evidence handling. Eviquire records chain-of-custody events during acquisition. These events help explain what happened, when, by whom, and which file was produced. Eviquire logs include:

• UTC timestamp.
• Event type.
• Event description.
• URL.
• File path or relative file name.
• SHA2-256 file hash where applicable.

The chain-of-custody record is central to defensible review.