Cases & forensics

Working a case

A case is the sealed record of an investigation. When your run finishes, the platform assembles the incident's timeline and every artefact that was acquired, each with its hash and its custody chain, so you can review what happened, check it has not changed, and export it.

It is a record rather than a notebook. A case is written once the run is sealed and is never edited afterwards, so there is nothing to save into it. The place to write while you work is your run: per-question notes as you go, and the written deliverables you hand in for review.

Evidence integrity

Forensic soundness is a first-class feature, not an afterthought. Every artefact is fingerprinted with a SHA-256 hash at the moment of capture, and each handling step is recorded in an append-only, hash-chained custody ledger. Because each entry locks in the one before it, any later change to the chain is detectable: you can demonstrate that an artefact has not been altered since capture.

When a signing key is configured, the platform also seals the ledger by signing the chain's head with a key held off the database, so tampering is detectable even by someone with direct database access. Write-once (WORM) storage and external time-anchoring are further controls on the production deployment path; where they are not enabled, the hash chain and the signature still make the ledger tamper-evident.

This is designed to be forensically sound for training and internal review. It is not a substitute for jurisdiction-specific evidentiary requirements, and the platform does not claim court admissibility.

Checking a ledger yourself

A case shows a Ledger integrity panel with two separate facts, so neither is overstated. The first is whether the hash chain recomputes: every custody entry locks in the one before it, so a broken chain means the ledger was altered after it was sealed. The second is the seal signature: when a signing key was configured at seal time, the chain's head carries a signature, and the panel reports whether it verifies against a trusted key.

A ledger can be intact but unsigned, which simply means no signing key was configured; it is still hash-chained and tamper-evident, just not attributable to a key. A ledger can also be signed but unverifiable here, which means this deployment holds no trusted key for it. Neither state means tampering.

Handing a case over

Export bundle downloads the case as a single file: its metadata, every artefact's SHA-256, and the full custody ledger including the seal. A recipient can re-verify it offline, with only the bundle and the ledger's public key, using the academy-bundle verify-case command. It checks the chain, the seal, and that the exported evidence is exactly the set the chain sealed, so an artefact added or removed afterwards is caught.

The bundle carries the hashes and the custody record, not the raw evidence bytes, so it attests the integrity of the evidence rather than reproducing it. The custody actors are pseudonyms, so no trainee personal data leaves with it.

Privacy by design

Lab evidence is synthetic or verified-anonymised, and your own identity and performance data are kept separate from the evidence stores. See the Privacy Policy for how personal data is handled and your rights.