Custody comes first
Everything else in the platform sits on top of it. No action, at any privilege level or in any deployment, touches evidence without writing to the ledger. There is no fast path that skips the record.
Home/Company
GhostKey Development Inc.ghostkey.dev
GhostKey Development Inc.
We build Bloodhound for investigators, DFIR teams and legal engagements where the integrity of the evidence is as important as the findings themselves.
What we build
A forensics platform that assumes it will be challenged
Bloodhound ingests disk images, mobile extractions and logical collections, then parses, correlates and timelines the artifacts inside them so investigators can find what matters fast.
What sets it apart is custody. Every piece of evidence is hashed at intake and tracked through a cryptographically chained, append-only ledger, so the integrity of your findings is provable from acquisition to report.
Self-hosted, offline by default, and validated against known reference datasets, Bloodhound is a serious alternative to the established commercial suites for teams that need their evidence to survive scrutiny.
Engineering principles
The rules the product is built under
These are constraints we hold the codebase to, and the reason a few convenient features do not exist in Bloodhound.
The original is never modified
Sources are opened read-only and analysis runs against verified working copies. If a working copy fails its hash comparison, processing halts and the failure is recorded rather than quietly retried.
Open formats over lock-in
We read the formats the field already uses, and export to formats other tools can read. If you stop paying us, you keep your evidence and your findings in a form you can still work with.
Your data does not leave
No telemetry, no analytics, no cloud processing tier, no phone-home licence check. A Bloodhound install makes no outbound connections, and the commercial model is built around that rather than against it.
The tool proves itself
Reliability claims that rest on vendor assurance do not survive cross-examination. Ours rest on a reproducible validation suite whose signed output we expect you to hand over with the report.
Provenance travels with the record
Every record retains its source item, path, byte offset and parser version, so any line in a report can be walked back to a specific location on a specific exhibit.
Bloodhound is one of the things we build
GhostKey Development Inc. builds security and privacy tooling for people who have to defend their work afterwards. Bloodhound is our digital forensics platform. The rest of what we do lives on the company site.
Who we build for
Who we build for
Law enforcement units
Digital forensics units processing device evidence where custody and methodology get contested at trial.
DFIR teams
Incident responders who need timeline reconstruction across endpoints, and defensible handling of material that may later become evidence.
Legal & eDiscovery
Counsel and litigation-support teams who need device evidence handled to a standard that survives a motion to exclude.
Private examiners
Independent consultants and small firms carrying the whole defensibility burden personally, with no agency behind them.
On the tagline
Track everything. Prove all of it.
Plenty of tools track what they did; that part is not hard. The proving is what gets difficult eighteen months later, when a methodology challenge lands and the examiner who ran the case has moved departments. Bloodhound is built so that the answer to “how do you know?” is a signed artifact somebody else can verify, rather than someone’s recollection.
Every artifact accounted for.
Talk to the people who build it. Evaluations run on your hardware, against your evidence.