Bloodhound is self-hosted and offline by default. Case data stays on infrastructure you control, in a deployment model that fits the restrictions your lab already operates under.
The full platform on a single examiner workstation. Suits solo practitioners, consultants and small units with case volumes that fit on one machine.
A central processing and storage node, with examiners working concurrently from their own seats. Parsing runs server-side and custody is unified across the team.
Deployment inside a network with no outbound path at all. Installation, licensing, updates and validation datasets move by controlled offline media.
Case material is among the most sensitive data any organisation holds: victims, suspects, warrant scope, unindicted third parties. We build on the assumption that none of it may ever transit a network you do not own.
Parsing and indexing are CPU- and I/O-bound. Treat these as starting points; we will size against your real case volumes during evaluation.
| Profile | CPU | Memory | Storage | Typical use |
|---|---|---|---|---|
| Workstation | 8 cores | 32 GB | 2 TB NVMe | Solo examiner, one or two active cases |
| Lab node | 16–32 cores | 128 GB | 8 TB NVMe + array | Small unit, several concurrent examiners |
| Processing tier | 64+ cores | 256 GB+ | NVMe tier + bulk array | High-volume lab, sustained parallel parsing |
| Air-gapped enclave | Matched to tier | Matched to tier | Local only, no network storage | Classified or restricted environments |
Linux server and workstation distributions, with containerised and native install paths. No dependency on a particular hypervisor or cloud provider.
Local NVMe for working copies and indexes, bulk arrays or SAN for retention. Evidence stores are encrypted whatever the underlying medium.
Evidence, ledger and case metadata back up as one verifiable set. A restored case re-verifies its chain and its evidence hashes before it will reopen.
A signed installation bundle on controlled media. Signature and hash are checked before anything is written.
Licences activate against the local node with no callback, no seat check and no expiry surprise in the middle of a case.
Run the validation suite on your hardware to establish a documented baseline before first case use.
Updates arrive as signed bundles you apply on your own schedule. Re-run the suite afterwards.
A case records the platform build that processed it. Labs can hold that build in place for the life of an open matter, so the version you testify about is still the version installed, and can still be re-validated on demand.
Tell us how your lab is configured and what it is allowed to connect to. We will size the deployment around that.
