System Requirements

2.1 Supported Operating Systems

Supported operating systems depend on the Eviquire edition and installer. Current packaging and deployment workflows support Windows and Linux/Ubuntu release targets. Recommended operating systems:

• Microsoft Windows 10 or Windows 11, 64-bit.
• Ubuntu Linux 22.04, 64-bit (identified in the 2026 desktop release notes).
• macOS beta builds were introduced with version 5.0.6110.13; platform availability and capture permissions depend on the distributed build.
• For other Linux versions, use only a build explicitly supplied for that distribution.

Investigator Tip: Use a dedicated acquisition workstation or virtual machine. Avoid running unrelated applications during capture, especially when network capture is enabled, because system-wide traffic may be included in the PCAP file.

2.2 Hardware Requirements

Minimum hardware depends on the size and complexity of evidence. For basic web screenshots and page source captures, Eviquire can run on a modern workstation. For video recording, full-page capture, network capture, batch acquisitions, and large exports, higher specifications are strongly recommended. Minimum recommended hardware:

• 64-bit processor with 4 cores.
• 8 GB RAM.
• 20 GB free disk space for small cases.
• Display resolution of 1366 x 768 or higher.
• Stable network connection.

Recommended forensic workstation:

• 6 or more CPU cores.
• 16 GB RAM or more.
• Dedicated SSD storage with substantial free space.
• Separate evidence storage volume.
• Hardware encryption or encrypted evidence volume.
• Reliable backup destination.
• Trusted time synchronization.
• Appropriate permissions for installation, evidence folders, and any packet-capture components. A portable application build may run without administrator rights, but operating-system packet capture components can still require separate installation or elevated permissions.

2.3 Disk Space

Disk space is one of the most important operational requirements. Eviquire can generate many artifacts:

• Screenshots and full-page images.
• PDF reports.
• JSON reports.
• Raw evidence archives.
• Final evidence ZIP files.
• Acquisition archives.
• Case archives.
• Browser profiles.
• Network PCAPNG files.
• TLS key logs.
• Video recordings.
• Database files.

Large web pages, long videos, full network captures, and batch collections can grow quickly. Before starting an acquisition, estimate how much content will be captured and confirm that the destination drive has adequate free space. As a practical rule, maintain free space at least three times larger than the expected raw acquisition size. This is because Eviquire may temporarily hold raw files, archive files, reports, summaries, and final packages at the same time during finalization. Eviquire has a specific feature to safely stop and close an acquisition if the space is running low.

Caution: Low disk space can cause incomplete capture, missing files, failed report generation, hash mismatches, or corrupted packages. Always confirm available disk space before a high-volume acquisition.

2.4 RAM

RAM usage depends on browser workload, page complexity, screenshots, full-page capture, video recording, and network processing. A minimum of 8 GB RAM is acceptable for small acquisitions. For production forensic use, 16 GB should be considered the practical minimum, and 32 GB or more is preferred. Full-page capture can consume significant memory because the browser, image buffers, page source, scripts, and generated image/PDF artifacts may exist simultaneously. Batch capture and deep collection further increase memory use.

2.5 Network Requirements

Eviquire requires network access for acquisitions involving live online content. Optional features may require additional network access:

• Proxy exit-node checks.
• Tor routing.
• DNS-over-HTTPS servers.
• WHOIS lookup services.
• Online evidence report storage.
• Timestamp Authority requests.
• Blockchain Timestamp anchoring.
• Software updates.
• License validation or telemetry, depending on edition.

If your organization operates in a restricted network, allowlist the required vendor, timestamp, blockchain, proxy, and update endpoints according to your deployment guidance.

2.6 Permissions

Some features require elevated permissions or supporting tools:

• Some installation methods may require administrator rights; portable distribution can avoid an application-installation step where supported.
• Network capture may require TShark/dumpcap permissions, regardless of whether Eviquire itself runs as a standard user.
• Packet capture drivers may be required on Windows.
• Writing to protected folders may require elevated privileges.
• Browser profile, case package, and export folders must be writable.
• Linux network capture may require capture capabilities or root-level configuration.

Warning: Do not run Eviquire with unnecessary elevated privileges during routine evidence collection unless required by policy or a specific feature. Use the least privilege that permits the intended acquisition.

2.7 Optional Forensic Workstation Recommendations

For high-assurance work, prepare a dedicated workstation or VM profile:

• Install only required acquisition tools.
• Disable unrelated background applications.
• Use a clean browser profile generated by Eviquire.
• Synchronize system time with a trusted source.
• Record workstation identity and operator identity.
• Use encrypted storage for evidence output.
• Keep software versions documented.
• Validate TShark and packet capture availability before operational use.
• Test report generation and export on a non-evidentiary sample case.