Introduction

1.1 What Is Eviquire

Eviquire is a forensic evidence acquisition platform designed to help investigators collect, preserve, verify, package, and review digital evidence. This manual documents the Eviquire 6 generation and follows the current Case → Acquisition → Evidence interface. It provides a controlled acquisition environment for web, mail, mobile, file download, network, and session-based evidence. The platform is intended for situations where an investigator must be able to show not only what was collected, but also how it was collected, when it was collected, who collected it, which system collected it, and whether the exported material still matches the original capture.

Eviquire treats an acquisition as a structured forensic event. A user does not simply take a screenshot or save a web page. Instead, Eviquire creates a case context, starts an acquisition session, records chain-of-custody events, creates evidence identifiers, hashes captured files, writes summaries, produces reports, timestamps integrity records, and packages evidence into archives that can later be reviewed or transferred. The platform is especially useful when live digital content must be collected from environments that can change quickly, such as web pages, authenticated portals, social media, online marketplaces, messaging interfaces, webmail, downloadable files, or content reached through specific browser, proxy, DNS, or session settings.

Eviquire is also useful for internal compliance and corporate investigations where a repeatable workflow and documented handling process are required.

1.1.1 Scope of This Manual

This guide covers the Desktop Case Manager and forensic-browser workflows, including web, Android Mobile Live (beta), and Mail (beta) acquisition. It incorporates documented functionality in 6.0.6110.18, released 16 October 2026. The interface illustrations were captured from the 6.0.6110.16 build of the same release generation. Cloud editions and licensed configurations may present different options.

A case is an investigation container, an acquisition is one collection session, and an evidence item is one recorded capture or event. These three levels are displayed together in the Case Manager. For clarity, screen-level guidance uses the exact text of controls wherever the supplied interface screenshots expose it.

Forensic scope: Hashes, timestamp responses, blockchain transaction references, and activity records substantiate preservation and integrity; they do not independently prove the truth, authorship, or legal admissibility of source material.

1.1.2 Publisher and Product Ownership

Eviquire is a software product developed and published by Ricta Technologies Srl. Ricta Technologies Srl provides product information at www.ricta.io, while Eviquire product information is available at www.eviquire.com.

For product assistance, use the Support function within Eviquire, consult help.eviquire.com, or contact [email protected]. When sharing screenshots, logs, or other diagnostic materials, follow your organization’s evidence-handling and data-protection requirements.

Manual coverage: Eviquire Desktop 6.0.6110.18 (16 October 2026 release). Screenshots show build 6.0.6110.16. Feature availability depends on the installed platform, licensing, configuration, and acquisition type. Always record the actual running application version in investigative records.

1.2 Purpose Of The Platform

The purpose of Eviquire is to make digital evidence collection more defensible. A defensible collection workflow requires more than saving files. It requires a documented procedure, stable identifiers, traceable timestamps, integrity verification, reviewable metadata, and packaging that protects context. Eviquire supports that purpose by combining acquisition tools with forensic recordkeeping. The platform records activity logs, creates evidence packages, stores acquisition metadata, captures network and browser artifacts when configured, and creates reports at evidence, acquisition, and case level. This layered design allows an investigator to explain a single evidence item in detail while still preserving the broader session and case context.

Eviquire is not a replacement for investigator judgment, legal authorization, or organizational evidence-handling policy. It is a technical platform that helps apply those requirements consistently. Important: Eviquire can collect sensitive information, including browser session data, cookies, downloaded files, mail evidence, network traffic, TLS key logs, and investigator credentials if they are transmitted during capture. Operate the platform according to applicable law, warrant scope, consent requirements, organizational policy, and data protection obligations.

1.3 Key Capabilities

Eviquire provides the following key capabilities:

• Case management for organizing one or more acquisition sessions.
• Web acquisition using a controlled forensic browser environment.
• Screenshot and full-page visual capture.
• Page source and full-page source capture.
• Combined visual and source capture.
• File download capture.
• Mail evidence acquisition.
• Video recording of acquisition sessions.
• Network capture using PCAPNG output where TShark is available and enabled.
• Browser profile preservation, including cache, cookies, and persistent storage.
• Chain-of-custody logging with UTC timestamps.
• Evidence, acquisition, and case reporting in PDF and JSON formats.
• File hashing using MD5, SHA2-256, and SHA3-256.
• Evidence hash lists and packaging-time hash comparisons.
• Timestamp Authority request and response files.
• Blockchain anchoring of summary hashes where enabled.
• Case closure and final case ZIP package creation.
• Review workflows for packaged evidence and acquisition data.
• Optional proxy, Tor, DNS-over-HTTPS, automation, and batch collection features.

1.4 Who Should Use Eviquire

Eviquire is designed for professionals who need reliable digital evidence collection and documentation:

• Law enforcement investigators collecting online evidence.
• Digital forensic examiners preserving web, mail, and session-based material.
• Corporate investigators documenting internal or external web evidence.
• Compliance teams preserving regulatory or policy-related evidence.
• Legal professionals preparing evidentiary material for disclosure or review.
• Incident response teams collecting web-based indicators, downloads, and network traces.
• Fraud teams documenting marketplace listings, phishing pages, or account activity.
• Technical reviewers validating integrity of exported evidence packages.

Beginners can use Eviquire through its guided case and acquisition workflow. Advanced users can enable additional forensic options such as network capture, deep collection, browser profile preservation, proxy routing, DNS-over-HTTPS, and batch acquisition.

1.5 Core Forensic Principles

Eviquire is designed around five forensic principles: integrity, chain of custody, repeatability, defensibility, and separation of scope. Integrity means that evidence files are hashed and summarized so later reviewers can determine whether the material changed. Eviquire records MD5, SHA2-256, and SHA3-256 values for files and packages. SHA2-256 and SHA3-256 are the primary modern integrity indicators; MD5 is included primarily for compatibility with legacy review environments. Chain of custody means that Eviquire records what happened during the acquisition. Events include timestamps, descriptions, URLs, files, hashes, and investigator/session context. The chain-of-custody record helps explain the path from live source to forensic package.

Repeatability means that investigators can use consistent workflows across cases. Eviquire provides standard acquisition settings, predictable identifiers, structured folders, and consistent reports. Defensibility means the final package can be explained. An investigator should be able to describe the case, acquisition, evidence item, capture method, timestamps, hashes, reports, and exported files in a clear and technically coherent way. Separation of scope means that Eviquire preserves evidence at multiple levels. A single evidence item is its own package. A full acquisition is a session package containing all evidence and session artifacts. A case is the outer investigative package containing one or more acquisitions.