Bloodhound is a self-hosted digital forensics platform that turns device and disk evidence into defensible findings, with tamper-evident chain of custody built into every action.
Bolted on after the fact, filled in from memory. Bloodhound treats it as the foundation. Every evidence item is hashed at acquisition and verified on every access. Every custody event, who touched what, when, and why, is written to an append-only ledger where each entry is cryptographically chained to the one before it.
Alter a record and the chain breaks visibly. When your methodology gets challenged, you have a signed, verifiable trail from acquisition to final report.
How the ledger worksParsers, timelining and link analysis that get an examiner to the relevant records quickly, and keep the provenance of every one of them.
Open and standard formats, opened read-only from the first byte. Originals are never modified, and analysis runs against a verified working copy.
Messages, call logs, contacts, browser history, location data, media metadata and app databases, including recovery of deleted records.
One chronology across every artifact and every device in the case, normalised to a single timezone. Each row carries its source.
Maps the relationships between people, numbers, accounts and devices, so the contact that ties two suspects together across three handsets is visible rather than inferred.
Flags known material and filters out known-good files, which is usually the difference between a two-day review and a two-week one.
A report builder that assembles findings and custody records into output you can disclose.
Register the item, capture the acquisition metadata, hash the source before anything else touches it.
The working copy is hash-matched against the original. A mismatch halts the case.
Parsers run across the image, extracting and recovering records with their source offsets retained.
Timeline, link analysis and hash matching pull the picture together across all items.
Findings and the custody ledger are assembled, signed and exported.
The dashboard is the front page of a case. Behind it sit a fast evidence explorer, communications and media review, geolocation mapping and the report builder.
Built for investigators, DFIR teams and legal engagements where the integrity of the evidence is as important as the findings themselves.
| Capability | Bloodhound | Commercial mobile suites | Open-source toolkits |
|---|---|---|---|
| Cryptographically chained custody ledger | Built in | Audit log | Manual |
| Hash verification on every access | Every access | At intake | At intake |
| Self-hosted, air-gap capable | Default | Varies / cloud tiers | Yes |
| Mobile extraction parsing | Full | Full | Limited |
| Unified cross-device supertimeline | Yes | Per-device | Add-on |
| Signed tool validation report | Shipped | On request | Community |
| Per-seat cloud dependency | None | Common | None |
| Report includes full custody appendix | Automatic | Assembled manually | Manual |
Based on our own assessment of typical product tiers, including Cellebrite, Magnet and Autopsy. Feature sets move. Run a side-by-side against your own reference data before you take our word for any of it.
Bloodhound tests its parsers against known reference datasets and produces a signed validation report, giving you documented, defensible proof of tool reliability before anyone asks for it.
Bring Bloodhound into your lab on your own hardware. Evaluation licences include the full platform, the validation suite and the reference datasets it runs against.
