DFIR Evidence Map Builder.

Required input fields.

• Incident type (required): Ransomware, Business email compromise, Cloud account compromise, Insider incident, ...
• Environment (required): Cloud-first, Hybrid, On-premises
• Log source coverage (required): Central and retained, Partial, Weak or short retention
• Known time window (required): Known narrow window, Broad window, Unknown
• Business impact (required): Low, Material, Critical

Data handling: this interface uses the L2ET protected same-origin instrument engine. Do not enter confidential, regulated, privileged, incident, medical or sensitive operational data.

Incident Timeline logic.

Maps incident type to evidence families, prioritizes volatile and high-value sources, and converts log coverage and time-window uncertainty into preservation priority.

Source families

Assumptions

• No evidence is collected by the tool.
• Incident facts may change during investigation.
• Legal hold and regulatory obligations require qualified review.

DFIR evidence timeline and matrix.

The generated artifact includes findings, assumptions, limitations, recommended next actions and exportable structured output.

Export options

Example input and output.

Example input

Cloud account compromise with hybrid environment, partial logs and broad time window.

Example output

Outputs evidence matrix covering identity logs, cloud audit, endpoint telemetry, email logs, timeline plan and chain-of-custody reminders.