Investigative triage for Indian law enforcement
Trident runs from a USB drive on the officer's own laptop, with no network and nothing installed on the target machine. It collects what matters, searches it in the languages the case is written in, and leaves with a report and an export the laboratory can ingest.
One tool for the first hour of a digital investigation — the hour in which a seizure decision is usually made.
Targeted collection from Windows, macOS and Linux · disk imaging · volatile memory capture · prioritised processing of the folders that matter · downloaded cloud storage content
Keyword and ad hoc search across UTF-8 scripts · hash set filtering · automatic detection of numbers and identifiers · visual and audible alerts · offline image classification
An audit log of every operation · a case that reopens with its past scans and searches intact · HTML and PDF reports · an export the laboratory's forensic software can ingest
The order the tool is actually used in, from arriving at the premises to leaving with something the investigation can act on.
The solution operates in complete offline mode, without requiring internet or local network connectivity — including image classification, which runs on the machine rather than in a service. A scene with no signal is the normal case, not the exception.
Triage runs from the USB drive. A powered down machine can be booted from the same drive, and a BitLocker volume opens with the recovery keys the investigating officer supplies — so the target is read, not changed.
The point of triage is the decision taken in the first hour. Targeted collection, prioritised processing and alerting on the keywords that matter give an officer grounds for that decision while still standing in the room.
What the unit is buying. A USB drive that turns any officer laptop into a triage station: it collects from the computers and storage media at the scene, searches what it collected in the scripts the case is written in, records every operation it performed, and leaves behind a report and an export — with no network, no installation on the target, and no dependence on a vendor service.
Capabilities
Six areas covering the whole of a triage session: how it runs at the scene, how a case is set up, what it collects, what it finds, what the system itself gives up, and what leaves with the officer.
Each area lists its capabilities one by one rather than in prose, so an evaluator can set them against their own requirement list instead of reading around them. The numbered specification behind this summary is available to named recipient agencies on request.
How the tool reaches the target machine, and what it does not leave behind.
Operates with no internet and no local network connectivity at any point in the workflow.
Triage is conducted without installing any software on the target device.
Where the target is powered down, it can be booted from the USB drive to reach its storage.
BitLocker encrypted drives are decrypted using recovery keys supplied by the investigating officer.
One session covers the computers and external storage media held at the scene of crime.
What the session collects is preserved on the collection USB device rather than written back to the target.
Preparation done in the office so that the scene is a matter of selection rather than configuration.
Cases are organised in the tool and devices are associated with the case they belong to.
A Triage Profile bundles the feature set, the search keyword lists and the devices supported, and is selected at the start of an investigation.
Selecting a Triage Profile drives the session, so a common case type is opened consistently rather than assembled by hand each time.
The tool can be used without selecting a Triage Profile at all, with features and keyword lists chosen by hand.
A case can be reopened to view the data from past scan, search and filter operations.
The solution is customised to the agency's requirement where that is needed, rather than the agency working around the defaults.
What comes off the machine, and in what order.
Windows, macOS and Linux systems are collected with the high value artefacts prioritised for extraction.
Certain folders, folder types or content types can be pushed to the front of the queue, so the first results are the useful ones.
Imaging of Windows and Linux disk drives for the cases where an image, not a collection, is what the investigation needs.
Capture of RAM on Windows systems, for the state that does not survive the machine being powered down.
Cloud storage content already downloaded to the machine is included in the analysis rather than skipped.
Finding the thing, in the languages the case is actually written in.
Text searches across the collected material using the keyword lists carried in the Triage Profile or chosen by hand.
One-off searches run at the scene, when the material suggests a line the Triage Profile did not anticipate.
Searches run across content created in UTF-8 scripts, so material in Indian languages searches like anything else.
Visual and audible alerts are raised whenever an important search keyword is located during a search operation.
Files are filtered by matching hash values against a hash set database, so known material can be set aside or singled out.
Phone numbers, email addresses, credit card numbers and identity card numbers are identified automatically.
The agency extends that detection by adding its own regular expression patterns.
Images are classified automatically by their content, in fully offline mode, on the machine running the session.
What the system itself gives up about how it was used, and how an officer looks at it.
Web browser history, installed applications, installed services, running processes and email content from Windows and Linux systems.
The list of processes running at the time of collection is extracted and displayed.
Where a pre-defined critical application is installed, or currently running, it is highlighted rather than left to be noticed.
Collected data is presented in list views filtered by date and timestamp, file extension and other file metadata.
PDF, docx, xlsx, image and text files are viewed in the tool, without a second application on the officer's laptop.
What the session leaves behind, for the case file and for the laboratory.
An audit log of all the operations a user performed on a device is created automatically, without the officer being asked to keep notes.
Reopening a case shows the data from its earlier scan, search and filter operations, so a second session builds on the first.
Reports are generated automatically in HTML and PDF, so the same output serves a file, an email and a print.
Case data exports in formats that forensic software can ingest, so the laboratory continues from where the scene left off.
100% Make in India. Trident is designed, built and supported in India under the Atmanirbhar Bharat initiative, with a dependency provenance disclosure an agency can audit rather than take on assertion.
At the scene
There is no server to procure, no agent to deploy and no installation on the machine being examined. The tool travels on the collection USB, runs on the officer's own laptop, and keeps what it collects on that drive.
That shapes what an agency has to buy and what it has to govern. There is no network dependency to secure, no vendor service in the path, and nothing left behind on a target that a defence will later ask about. The officer's laptop and the drive are the deployment.
| Target | What the session can do |
|---|---|
| Windows | Targeted collection, disk imaging, volatile memory capture, and system artefacts including browser history, installed applications and services, running processes and email content. |
| Linux | Targeted collection, disk imaging, and system artefacts including browser history, installed applications and services, running processes and email content. |
| macOS | Targeted collection of high value artefacts. |
| External storage media | Collection and analysis alongside the computers in the same case. |
Which one an officer uses depends on the state of the machine in front of them.
The tool runs from the drive with nothing installed on the target. Volatile memory, running processes and the artefacts that only exist while the machine is on are available in this mode.
The target is booted from the same drive to reach its storage, and a BitLocker encrypted volume is opened using recovery keys the investigating officer supplies.
A standard laptop to run the session from. No server estate, and no software installed on the machine under examination.
The USB drive the tool runs from, and the drive the collected material is preserved on.
The keyword lists and Triage Profiles the unit wants available at a scene, prepared in advance.
The hash set database used for filtering, loaded locally since no network is available at the scene.
BitLocker recovery keys are supplied by the investigating officer; the tool does not attempt to defeat encryption.
No internet, no local network, no vendor hosted service, and no dependency that has to be reachable for the session to run.
Company
A Hyderabad based product company building evidence software for Indian law enforcement. We started from a single question a prosecutor asks and a case file often cannot answer: can you prove this record is the record you collected?
The company was founded by engineers with long experience of product development across several domains, including regulated environments where a record has to survive being questioned rather than merely being stored. Trident applies that discipline to the first hour at a scene, where the decisions are taken and the tooling has historically been thinnest. The product is specified, built and supported in India.
No foreign origin runtime dependency in the core platform, and a dependency provenance disclosure an agency can audit rather than take on assertion.
We treat a claim as unverified until it has been exercised against the running system. What we put in front of an evaluator is what the build does, not what the specification hoped for.
Offline first because most scenes have no signal. Reasons captured because supervisors are accountable. Plain language in every officer facing screen and every report heading.
The useful first conversation is ninety minutes with the officers who will actually use it. We take a laptop and a phone, run a triage session end to end at your own pace, and show the report and the export that leave with the officer.
For tenders and RFP responses we can supply the numbered specification, the feature by feature mapping against your requirement list, and the dependency provenance disclosure, under confidentiality to the named recipient agency.
What to send us. Unit size, the device types you see most at a scene, the languages your material is written in, and the hash sets you already hold. That is enough for us to say what a deployment would look like and what it would cost you to operate, before anyone books a meeting.