FAQ

18.1 What is the difference between a case and an acquisition?

A case is the overall investigation container. An acquisition is one collection session inside a case. A case can contain multiple acquisitions.

18.2 What is an evidence item?

An evidence item is one captured object or action, such as a screenshot, page source, file download, email message, or full-page capture.

18.3 What is an evidence package?

An evidence package is the final ZIP for one evidence item. It contains the raw evidence archive, report, summary, timestamp files, and blockchain metadata where available.

18.4 What is an acquisition package?

An acquisition package preserves the full collection session, including evidence packages, logs, database, browser profile, network artifacts, video, reports, and summaries.

18.5 What is a case package?

A case package is the final export for the whole investigation. It contains one or more acquisitions and case-level reports, summaries, timestamps, and integrity metadata.

18.6 Why does Eviquire use UTC?

UTC avoids ambiguity caused by time zones and daylight saving changes. It supports consistent review across jurisdictions.

18.7 Which hash should I rely on?

Use SHA2-256 as the primary integrity hash. SHA3-256 is also strong. MD5 is included for compatibility and should not be used alone.

18.8 Does Eviquire prove that online content was true?

No. Eviquire preserves what was observed and collected under documented conditions. It supports authenticity and integrity of the capture, not the truthfulness of the content itself.

18.9 Can Eviquire capture authenticated pages?

Yes, when the investigator has lawful access and uses the forensic browser session. Browser profile and cookies may preserve authenticated state.

18.10 Are credentials captured?

They can be, especially in network captures, browser profiles, cookies, TLS key logs, screenshots, or video. Use caution and follow legal scope.

18.11 What happens if network capture is disabled?

The acquisition can still collect screenshots, source, downloads, reports, and logs. The PCAPNG artifact will not be created.

18.12 Why is TShark required?

TShark is used for packet capture. Without it, Eviquire cannot create TShark PCAPNG network captures.

18.13 What is the TLS key log?

The TLS key log stores secrets that can help decrypt browser TLS traffic in compatible analysis tools. It is sensitive and must be protected.

18.14 What is a timestamp request file?

The .tsq file is a timestamp request generated for a summary JSON file.

18.15 What is a timestamp response file?

The .tsr file is the timestamp authority response proving the summary existed in a particular hashed form at timestamping time.

18.16 What does blockchain anchoring do?

It submits a summary hash to an external blockchain-related anchoring workflow. This provides an additional external integrity reference.

18.17 Can I edit evidence after capture?

Do not edit evidence files. Work on copies for analysis. Editing original evidence will change hashes and may compromise defensibility.

18.18 Why does Eviquire create JSON reports?

JSON reports provide structured metadata for technical review, validation, automation, and long-term archival.

18.19 Why does Eviquire create PDF reports?

PDF reports provide human-readable summaries suitable for review, printing, disclosure, and legal presentation.

18.20 Can I use Eviquire in a virtual machine?

Yes, and it is often recommended. Confirm video recording, network capture, display scaling, and storage access before operational use.

18.21 Why should I close unrelated applications before network capture?

Network capture may record host-level traffic. Closing unrelated applications reduces irrelevant or private traffic in the PCAP.

18.22 What if a hash mismatch occurs?

Preserve the package, review the hash list, check logs and timestamps, document the mismatch, and reacquire if required and permitted.

18.23 Can I send evidence by email?

Avoid sending evidence packages by ordinary email. Use approved secure transfer methods and encryption.

18.24 Can I password-protect exports?

Case export workflows may support password protection. Use strong passwords and send them separately from the package.

18.25 What should I deliver to legal reviewers?

Provide the final package, export hash, case report, verification instructions, known limitations, and password transfer details if applicable.

18.26 Does Eviquire preserve browser cookies?

The acquisition browser uses persistent profile storage, so cookies and session state may be preserved in the browser profile artifacts.

18.27 What is deep collection?

Deep collection enables additional technical capture such as request/response or richer page-related data depending on configuration.

18.28 Should I enable every option?

No. Enable options required by the investigation. More artifacts can improve context but also increase sensitivity, size, and review burden.

18.29 Can I reopen a closed case?

No, reopen a case is not possible to Preserve the integrity of the original closed package.

18.29.1 Can I add documents directly to a case?

Yes. Use the FILES tab in EDIT CASE to attach supporting files. Those attachments become part of the case, and the interface warns that recipients of the exported case will be able to access them. Keep attachments separate from independently acquired evidence items.

18.29.2 What is the difference between PCAPNG, HAR, and NetLog?

PCAPNG records packet-level traffic, HAR records browser-level HTTP exchanges, and Chromium NetLog records browser network diagnostic events. Enable the outputs that correspond to the investigation’s questions; none is a complete replacement for the others.

18.29.3 Does selecting Reject all automatically reject cookies?

Not by itself. Automatic Cookie Consent must also be enabled, and actual results depend on the target website and handling rules. Review the session logs and the rendered page to establish what occurred.

18.30 How should I verify a final case ZIP?

Compute the ZIP hash, extract a copy, review the case summary, compare archive/report hashes, validate timestamp files if required, and review blockchain metadata where present.

18.31 What is the difference between automatic consent and advanced cookie collection?

Automatic Cookie Consent attempts supported Accept all or Reject all actions and logs the clicks it performs. Advanced Cookies Collection records detailed browser cookie metadata and lifecycle events. Either option can be used independently when available.

18.32 Does case integrity verification change my evidence?

The graphical integrity-verification workflow is designed to compare file inventory and cryptographic hashes without modifying original evidence. Preserve the original files and record the verification results.

18.33 Does Save Evidence Report Online control local evidence reporting?

No. Version 6 supports local evidence reports; the online-report option is a separate publication or storage choice for eligible reports.

18.34 Can I compare a historical web archive to the live page?

Yes. The WEB ARCHIVE tool supports supported Wayback Machine and Arquivo.pt snapshot searches, opening historical captures, and comparison with the current page. Preserve any relevant comparison as evidence according to case scope.

18.35 Are recovered acquisitions automatically complete?

No. Recovery preserves available materials and records incomplete processing when appropriate. Review the Chain of Custody, file inventory, and cryptographic verification results before accepting the acquisition as complete.