Turn a device into evidence
Acquire or process a backup → a normalized, SHA-256-hashed, signed bundle that Forge ingests into the case timeline.
🚀 Process a device acquisition
Output = a bundle (manifest.json + per-artifact SHA-256 + Ed25519 signature). Ingest from Forge → Add data → server path.
⚙️ Engines
📱 Connected devices — USB, iMazing-style acquisition
| scanning… |
Connect + unlock + trust an iPhone (or enable Android USB debugging), then Acquire → fresh backup + full parse → a bundle.
💽 Disks — USB / SATA drives & partitions (pick one to recover or carve — no typing /dev paths)
| scanning… |
⚠ A mounted read-write volume is refused (it can change under the read). Unmount or remount read-only first.
🧠 Smart acquisition — auto-detect the best method + AI operator guidance
Fingerprints connected devices — iOS checkm8 eligibility (A9–A11) · Android chipset → MTK / EDL / root — and picks the acquisition path. AI advice is a leads/operator aid, never evidence.
| click “Detect & Recommend” with a device connected. |
🔧 Recovery / Restore — un-brick a boot-looping / DFU device (reads the chip off iBoot even when it won't boot)
Sees a device that idevice_id can't — one stuck in Recovery or DFU. Identifies the exact chip (incl. old 30-pin iPads) and the un-brick path.
| click “Scan” with a device in recovery/DFU (hold Home while plugging in). |
⚠ Exit-Recovery is non-destructive — try it first (fixes a stuck loop if the OS is intact). Restore erases + re-flashes the device (for a test/non-evidence unit). Apple no longer signs firmware for iPad 1/2/3, so “latest” restore fails there — unsigned needs SHSH + futurerestore.
🧱 Jobs — auto-refreshing
| # | status | processor | input | progress |
|---|
🖼 Recovery Review — triage recovered files (keep/reject · damage-checked) → promote ONLY keepers to Forge, no bloat
Run a Recover/Carve job (auto-cataloged) or Catalog a path above, then triage here.
🧾 Audit log — who ran what, when
| when (UTC) | actor | role | action | detail |
|---|