Armour OP | Exterro — Weeks of evidence. Hours of triage.
Armour OP · On-prem AI triage

Weeks of evidence.
Hours of triage.

AI-powered triage of digital evidence — on your hardware, in your lab, under your examiner's control.

💾 Seized-Laptop-04.E01 · 1 TBprocessing…
Plug in the evidence. The agent triages — flags, clusters and transcribes — while the examiner directs.
Start your 30-day trial See the problem ↓
↓
— MONDAY · 08:04 · THE INTAKE SHELF
130 devices

arrive at a typical digital forensics unit every month. Seventeen per investigator. And each one holds more data than the last.

By noon, the first drive is still processing.

A single 1 TB device takes 4–6 hours before anyone can even look at it.

By Friday, the queue grew faster than it shrank.

Three to four weeks of backlog is now typical — while cases, victims and courts wait.

And the people who can clear it are the scarcest resource.

The skills gap keeps widening. You can't hire senior examiners fast enough to outrun the data.

130
devices / month per unit
Exterro · Cyber Social Hub 2024
76%
more data per case in 3 years
Cellebrite 2024
74%
cite a widening skills gap
Cellebrite Trends 2022
94%
of DFIR pros now use AI
Magnet State of DFIR 2025

What if the first look took
minutes, not weeks?

ADF field data · what examiners report · Forensic Focus
The first hour

From evidence bag to first findings —
before the coffee's cold.

One console. Every artifact. The agent does the sorting; the examiner does the deciding.

00:00

Plug in anything.

Live folders, network shares, raw device paths, E01 images, UFDR mobile extractions, ZIP archives. The console auto-detects attached drives — one click to triage each.

E01 · UFDR · ZIPauto-detect drivesparallel cases
00:05

A terabyte, processed.

1 TB in as little as 1–5 minutes. Every file lands in one console with live counts — Graphics, Media, Email — ready to filter, drill and bookmark straight into the report.

1 TB → minuteslive countsbookmark to report
00:12

The needles surface themselves.

DFIR-aware models classify images and video, cluster every face in the case, transcribe hours of audio into searchable text, and check every hash against CAID/NCMEC — automatically.

3 known hits flagged477 people clusteredaudio → searchable
00:41

The examiner decides.

Every AI result is a proposal, not a verdict. Examiners review, verify and bookmark what matters — building a defensible report from minute one.

AI proposesexaminer decidescourt-ready trail
Everything in the box

Eight capabilities. One console.

INGEST

Flexible ingestion

Folders, shares, device paths, E01, UFDR, ZIP — auto-detected, one-click triage.

ORGANIZE

Unified console

Live counts, date and folder filters, thumbnail or list views, bookmarks to report.

CLASSIFY

AI image & media

DFIR-aware vision models categorise and describe — filter to what matters.

LISTEN

Audio transcription

Timestamped, clickable, searchable speech across hours of recordings.

WATCH

In-video search

Frame-level descriptions. Search "cars" and jump to the matching frame.

IDENTIFY

Face clustering

Every individual across the case — select a person, see everywhere they appear.

MATCH

CAID / CSAM hashes

Built-in lookup builder; every result auto-checked against known hash sets, locally.

SCALE

Email, drone & batch

Triage-grade email reader, built-in UAV forensics, concurrent batch jobs.

The math

What examiners get back.

Typical workloads. Results vary by hardware, data composition and workflow.

Task
Before
With Armour OP
Data processing1 TB
4–6 hours
1–5 minutes
CSAM grading10K images / videos
1 week minimum
1–3 hours
LPP detection1M files
2 weeks
1 day
Image / video classification10K files
3 days
6–8 hours
Facial detection10K files
3 days
1 hour
Audio transcriptionmulti-speaker
Hours per hour of audio
Near real-time
Known-hash lookupCAID / NCMEC
Separate tool
Built in
Drone forensicsUAV evidence
Separate tool
Built in
A fair question

"So the AI decides
what's evidence?"

No — and that's the design, not a disclaimer. The AI proposes. The examiner decides. Every automated result exists to be verified by a human who signs the report.

1 — THE AGENT

Sorts & surfaces

Processes the evidence, classifies media, clusters faces, transcribes audio and flags known hashes — the high-volume work no team can do by hand.

✓  Does the sorting at machine speed✗  Never draws conclusions for the case
2 — THE MODELS

DFIR-aware, on-box

Vision, speech and language frameworks built with leading AI providers for forensic content and formats. Every model ships with the product and runs locally.

✓  Trained for forensic artifacts✗  No cloud calls — evidence never leaves
3 — THE EXAMINER

Verifies & decides

Reviews what the agent surfaced, verifies against the source, bookmarks what matters and owns the findings — with a defensible trail from triage to testimony.

✓  Every finding human-verified✗  Nothing enters the report unreviewed
Data sovereignty

Evidence never leaves your building.

Forensic evidence can't be shipped to public-cloud AI — chain of custody, warrants and defensibility all say no. Armour OP doesn't ask you to.

⌂

Fully on-prem

Every AI model ships with the product and runs on your hardware.

⛔

Air-gap ready

Deployable in SCIFs and classified environments — no connectivity required.

⛓

Chain of custody

Preserved end-to-end, from ingestion to the bookmarked report.

✓

CJIS-aligned

Built for law-enforcement data handling requirements by default.

Where it earns its keep

Built for the cases that can't wait.

①

Child exploitation (CSAM)

CAID/NCMEC matching in minutes — victims safeguarded sooner.

②

Homicide & violent crime

Face clustering and in-video search across every device in the case.

③

Counter-terrorism

Air-gap-capable triage with full model and data sovereignty.

④

Fraud & financial crime

Email triage at scale — sender, domain, flags, attachments.

⑤

Corporate investigations

Onsite or remote endpoint triage with reduced collection cost.

⑥

Drone & UAV forensics

Built-in — no separate tool for flight data and UAV media.

⑦

Field & onsite seizure

Triage at the point of seizure. Decide what to take before leaving.

⑧

MSPs & consultancies

Per-examiner pricing and self-serve onboarding that scales on demand.

No gatekeeper. No procurement cycle.

Try Armour OP free
for 30 days.

Install on-prem and triage your first case the same afternoon. Full product, no credit card.

Start your 30-day trial Book a guided demo
exterro.com/armour-op · on-prem install · full capability set