Work in context
Keep the source information visible while recording the applicable details. Copy identifiers, timestamps, tool information, and observations directly from the examination instead of reconstructing them later.
ByteCase tool suite
Five tools prepared for the first signed release cycle.
Intake, Acquire, Verify, Notes, and Validate have reached their current pre-release milestones. The case-centered tools already write into one shared ByteCase case folder, giving examiners a connected workflow today without waiting for Hub or orchestration.
Second-monitor workflow
Built for the second monitor.
Capture the record while the work is still in context.
ByteCase is designed to sit beside the forensic tools examiners already use. Keep the extraction, analysis, or review platform open on the primary monitor, then use ByteCase on the second monitor to document the work as it happens.
Capture once
Enter the record when the work occurs. ByteCase modules are intended to preserve reusable local records instead of forcing the examiner to repeat the same information across temporary notes and final reports.
Preserve momentum
ByteCase complements the primary forensic platform without interrupting extraction or analysis. Open the module needed for the current task, save the record, and continue the examination.
How ByteCase fits
A companion workspace, not another analysis platform.
ByteCase does not perform the extraction, parse the evidence, or decide what an artifact means. It helps preserve the request, acquisition details, integrity checks, examiner-authored observations, validation history, and workflow status surrounding the technical work.
See how ByteCase runs →Modular adoption
Start with one workflow problem. Keep the rest compatible.
Each prepared tool can be used independently, while Intake, Acquire, Verify, and Notes already write into the same case-number folder. Examiners gain a connected local workflow now, and Playbook can add guidance around that existing structure later.
Pre-release suite
Prepared tools awaiting signed publication.
Pre-release ready
No signed download is being represented as live yet.
v0.9.0
Pre-release readyDigital Forensics Request Builder
ByteCase Intake
Incomplete forensic requests force examiners to chase case, authority, scope, device, attachment, and handoff information before work can begin.
- Build structured examiner-ready forensic requests
- Record authority, scope, devices, peripherals, attachments, and physical item photos
- Review required information before export
- Save TXT, DOCX, and JSON records inside the shared ByteCase case structure
Publication gate
Signed Windows publication pending Azure Artifact Signing certificate verification.
v0.9.0
Pre-release readyAcquisition Packet Generator
ByteCase Acquire
Acquisition details are often split across handwritten notes, screenshots, tool logs, report fragments, and examiner memory.
- Record multiple devices, tools, methods, destinations, timestamps, hashes, and exceptions
- Generate TXT, JSON, DOCX, and XLSX documentation
- Apply configurable defaults, report branding, and review-before-export
- Preserve acquisition records inside the shared ByteCase case structure
Publication gate
Signed Windows publication pending Azure Artifact Signing certificate verification.
v0.9.1
Pre-release readyHash Manifest and Verification Tool
ByteCase Verify
A one-time hash result is easy to lose and difficult to reproduce when evidence must be checked again before review, handoff, disclosure, or court.
- Hash files and recursive folders with MD5, SHA-1, and SHA-256
- Save reusable JSON manifests and reopen them later
- Verify manifests or compare one manifest with another
- Export TXT, CSV, DOCX, and XLSX integrity records
Publication gate
Signed Windows publication pending Azure Artifact Signing certificate verification.
v0.9.0
Pre-release readyStructured Examiner Notes Workspace
ByteCase Notes
Examiner notes often become fragmented across text files, screenshots, handwritten records, temporary documents, and memory.
- Create timestamped and categorized examiner-authored notes
- Assign artifact identifiers and validate artifact references
- Attach supporting files and embed images in DOCX exports
- Reopen the JSON-backed workspace and continue the examination later
Publication gate
Signed Windows publication pending Azure Artifact Signing certificate verification.
v0.9.3
Pre-release readyLaboratory Tool Validation Repository
ByteCase Validate
Validation records and reference material are often scattered across spreadsheets, screenshots, vendor documents, research papers, and institutional memory.
- Create structured internal validation records
- Track versions, environments, datasets, expected results, and observed results
- Preserve limitations, exceptions, references, and revalidation triggers
- Maintain reusable laboratory knowledge outside individual case folders
Publication gate
Signed Windows publication pending Azure Artifact Signing certificate verification.
What pre-release ready means
Prepared for distribution, not presented as final.
Each tool has reached a usable pre-1.0 milestone with its primary workflow, local records, packaging process, limitations, and release-support material established. The next public step is signed distribution and structured external testing.
Core workflow implemented
The intended examiner or laboratory task is available in the current build.
Local output and continuity records
Each tool preserves reusable local files rather than depending on a hosted service.
Release preparation documented
Build, limitations, dependency, packaging, and release-checklist material is in place.
Signed Windows publication
Waiting on completion of Azure Artifact Signing certificate verification.
External pre-release feedback
Signed builds will support examiner testing before stable v1.0 positioning.
Active development
The next major ByteCase module is built to develop the examiner.
Active Development
Main attraction module
Examiner Education and Workflow Coaching
ByteCase Playbook
Guided practice, field references, coaching, and tiered knowledge checks in one local examiner workspace.
Playbook is being built as a learning and professional-development companion for digital forensic examiners. It combines guided workflows, fieldwork references, department-authored best practices, scenario-based coaching, and customizable quiz packs for novice, experienced, and expert users.
Supporting development
Additional modules advancing beside Playbook.
Active Development
Case and Module Orchestration
ByteCase Hub
Separate workflow utilities still require examiners to locate cases, reopen tools, and remember which outputs already exist.
- Search and open local ByteCase case work without browsing folders manually
- View the active case, workflow stage, module record counts, warnings, and missing records
- Launch compatible standalone ByteCase modules from one local workspace
- Build reports from structured source records while preserving source revision details
Product design
Accepted directions that remain subject to workflow testing.
Product Design
Case Presentation and Exhibit Builder
ByteCase Exhibit
Turning selected forensic findings into a clean presentation or exhibit packet is repetitive and disconnected from case documentation.
- Organize examiner-selected screenshots and references
- Create consistent exhibit numbers, captions, and source details
- Link presentation material back to ByteCase Notes
- Support future presentation and document output
Product Design
Manual Case Timeline Builder
ByteCase Timeline
Examiners often need a focused timeline of important events without committing to another automated artifact parser.
- Create examiner-authored timeline entries
- Record date, time, time zone, source, and artifact reference
- Assign examiner-selected confidence and relevance
- Link entries to Notes and future exhibits
Product Design
Case Completion and Readiness Review
ByteCase Closeout
Missing reports, manifests, notes, or handoff records may not be discovered until a case is being archived, transferred, or revisited.
- Review expected outputs before handoff or archive
- Use customizable completion and archive checklists
- Surface missing documentation without judging the examination
- Generate a final examiner-authored closeout summary
Follow the release track
Public status should be specific, testable, and transparent.
The source repositories remain available while signed Windows publication is pending. Use the roadmap for product direction or share feedback about a workflow that ByteCase should support.