Use case
Document and metadata investigation
Preserve collected file bytes and safely extract local metadata, text and candidate entities without executing content.
Likely evidence
- Immutable file artifact and hash
- Safe local metadata and text extraction
- Candidate entities and references
Graph relationships
- File contains metadata
- Document references object
- Hash identifies artifact
Expected outputs
- Artifact custody record
- Extracted canonical candidates
- Evidence and report sections
Safety boundary
Evidence still needs judgment.
Downloaded scripts, macros, JavaScript, archives and embedded content are never executed by default.
This workflow is explanatory, not a scan profile or guarantee of discovery. Target compatibility, registry readiness, configuration, scope and budget determine the exact plan.
Start with a target
Turn this workflow into an explainable investigation.
Create an account to plan your first evidence-backed investigation, or talk to us about team and workflow requirements.