Windows activity, in context
Review traces such as Prefetch, BAM, Amcache, browser history and Windows Event Logs within a consistent investigative workflow.
← All Evoloptis softwareWINDOWS FIELD PROTOTYPE
EVOLOPTIS / TDT COMPUTER FORENSICS
Every trace. A story you can verify.
Imagine an investigation where every finding reveals its source, every timeline shows its uncertainty, and every conclusion can be independently examined.
The existing portable Windows build performs limited activity-artifact analysis and reporting. The interactive case intelligence experience below illustrates a broader design ambition. It does not perform evidence acquisition or forensic analysis on this website.
FORENSICS / CONCEPT INTERFACE05
CASE INTELLIGENCEFollow the evidence.
EVTXBAMCASEPREFETCHAMCACHE
SOURCE → TIMELINE → FINDING
TraceVerifyExplain
Concept visual with synthetic labels. No actual case evidence.
THE INVESTIGATION EXPERIENCE
Don't just find artifacts. Connect the meaning.
Try this interactive concept using fictional evidence. It shows the experience we want to make possible, not a functioning forensic engine on this webpage.
TDT FORENSICS / CASE INTELLIGENCEOne case. Every source. A defensible story.
CASE FX-07 · SYNTHETIC EXAMPLEINTERACTIVE CONCEPT / 01
Evidence Atlas
Follow relationships, not isolated file names.
DEVICE ACTIVITYConnected evidence
PrefetchApplication launch traces
Event LogsRecorded system events
BAMExecution traces
AmcacheApplication inventory clues
Imagine opening any finding and following its evidence lineage, parser, timestamp and alternative explanation.
THE EXISTING WINDOWS FOUNDATION
A real foundation for an ambitious investigation platform.
The private USB-capable Windows utility focuses on read-only activity analysis, integrity records, multi-device timelines and reporting. Availability is limited to authorized field evaluation.
From event to case timeline
Join observations across collected devices and focus on the sequence worth examining further.
Preserve your evidence trail
Record hashes, case-handling information and structured findings that an examiner can revisit.
OUR CASE INTELLIGENCE VISION · INTERACTIVE CONCEPTS
Investigate beyond the timeline.
These are distinctive engineering targets for an evidence-first investigation system. The goal is to turn complexity into auditable clarity; they are not all functions of the current Windows field build.
Evidence Constellation
Reveal how the same event connects applications, files, devices and people — with traceable source references for each link.
Case Replay
Move through the investigation moment by moment, see contradictory timestamps and identify gaps instead of guessing.
Hypothesis Lab
Test competing explanations, show what supports each one, and highlight which artifact could disprove a conclusion.
Proof Packet
Produce a reproducible, independently reviewable case with source references, parser versions, hashes and human decisions.
Investigation Memory
Understand patterns across explicitly authorized cases without merging confidential evidence or weakening case boundaries.
Attorney & Examiner Views
Switch between a clear narrative for counsel and full technical detail for a forensic specialist, with one shared evidentiary basis.
Integrity Watch
Identify timestamp inconsistencies, unexpected evidence changes and gaps in chain-of-custody handling with explicit uncertainty.
Explainable Assistant
Use an AI research companion that shows its source, alternative interpretations, and what it cannot determine — never invented certainty.
TDT COMPUTER FORENSICS
Evidence should speak clearly.
We're building a more transparent experience for authorized digital investigations — grounded in source data, careful human review and reproducible findings.
Discuss a private evaluation ↗Not a full-disk imaging suite, proof of a specific human's actions, or a court-certified forensic service. Findings require examiner validation.
