ARMOURop | Exterro: Find the evidence that matters, in minutes, not weeks.
ARMOURop · On-prem AI evidence triage

Find the evidence that matters,
in minutes, not weeks.

ARMOURop is AI-powered triage for digital forensics labs. Connect a seized drive, phone extraction or disk image, and it surfaces what's likely to matter, running entirely on your own hardware, with every finding checked by your examiner.

💾 Seized-Laptop-04.E01 · 1 TBprocessing…
Plug in the evidence. ARMOURop triages, flagging, clustering and transcribing, while the examiner directs.
Start your 14-day trial See the problem ↓
↓
MONDAY · 08:04 · THE INTAKE SHELF
The queue is already longer than the week.

Devices arrive faster than any team can examine them. Every one holds more data than the one before it. Hiring doesn't close that gap, because the volume grows faster than headcount ever can.

By noon, the first drive was still processing.

A single 1 TB device takes 4–6 hours before anyone can even look at it.

By Friday, the queue grew faster than it shrank.

Devices with nothing on them cost the same processing time, shelf space and waiting as the one that breaks the case open.

And the people who can clear it are the scarcest resource.

Senior examiner time goes to repetitive sorting instead of analysis, testimony and case strategy.

4–6 hours
to process one 1 TB device before anyone can look at it
1 week
to grade 10,000 images and videos by hand
2 weeks
to review a million files for privileged content
3 days
to classify 10,000 images and videos

Every one of these is time spent before an examiner forms a single opinion.

What if the first look took
minutes, not weeks?

Most cases don't turn on every byte of a device, they turn on a handful of files, faces or conversations. The job of the first hour is to find those, and to rule out the devices that hold nothing at all. That's triage, and it's where cases are actually won or lost.

The first hour

From evidence bag to first findings,
before the coffee's cold.

One console. Every artifact. ARMOURop does the sorting; the examiner does the deciding.

00:00

Plug in anything.

Live folders, network shares, raw device paths, E01 images, UFDR mobile extractions and ZIP archives. Attached drives are detected automatically, including partitioned and NTFS volumes, with one-click triage for each. Several cases run at once.

E01 · UFDR · ZIPauto-detect drivesparallel cases
00:05

A terabyte, processed.

1 TB in as little as 1–5 minutes. Every file lands in one console with live counts by type, ready to filter, drill into and bookmark straight into the report.

1 TB → minuteslive countsbookmark to report
00:12

The important material surfaces itself.

Models built for forensic content classify images and video, cluster every face in the case, turn hours of audio into searchable text, and check every hash against your CAID sets, without an examiner sitting and waiting.

3 known hits flagged477 people clusteredaudio → searchable
00:41

The examiner decides.

Every result is a proposal, not a verdict. Examiners review, verify against the source and bookmark what matters, building a defensible report from minute one.

AI proposesexaminer decidescourt-ready trail
Everything in the box

Many capabilities. One console.

INGEST

The case starts the moment the drive is plugged in.

ARMOURop ingests all of it: live folders, network shares, raw device paths, E01 disk images, UFDR mobile extractions and ZIP archives.

CLASSIFY

Stop scrolling forty thousand thumbnails to find four.

Vision models built for forensic content categorise and describe every image and video as it lands, so 10,000 files drop from ~3 days of review to 6–8 hours.

WATCH

Nobody should scrub six hours of footage to find six seconds.

Every video is broken into representative frames with AI descriptions, so footage becomes searchable text. Search "cars" and jump straight to the matching frame.

IDENTIFY

Find every appearance of one person in an hour, not a week.

Faces are detected and clustered across the entire data set. Select any person and see every image and video they appear in, without opening a file.

MATCH

Known illegal material is flagged before an examiner ever sees it.

A built-in lookup builder loads CAID hash sets (SHA-256 or MD5) into a local store. Every result is checked automatically, duplicates ignored, lookups incremental.

LISTEN

Hours of audio, turned into searchable text.

Multi-speaker recordings transcribed near real-time, timestamped, clickable and searchable across the whole case.

ORGANIZE

One unified console.

Live counts, date and folder filters, thumbnail or list views, and bookmarks straight into the report.

SCALE

Email, drone & batch.

Triage-grade email reader, built-in UAV forensics, and concurrent batch jobs across several cases at once.

The math

What examiners get back.

Typical workloads. Results vary by hardware, data composition and workflow.

Task
Before
With ArmourOP
Data processing1 TB
4–6 hours
1–5 minutes
CSAM grading10K images / videos
1 week minimum
1–3 hours
LPP detection1M files
2 weeks
1 day
Image / video classification10K files
3 days
6–8 hours
Facial detection10K files
3 days
1 hour
Audio transcriptionmulti-speaker
Hours per hour of audio
Near real-time
Known-hash lookupCAID / NCMEC
Separate tool
Built in
Drone forensicsUAV evidence
Separate tool
Built in
A fair question

"So the AI decides
what's evidence?"

No, and that's the design, not a disclaimer. ARMOURop sorts, surfaces and proposes. A qualified examiner reviews, verifies and decides. Every automated result exists to be checked by the person who signs the report.

1 · THE SOFTWARE

Sorts & surfaces

Processes the evidence, classifies media, clusters faces, transcribes audio and flags known hashes, the high-volume work no team can do by hand.

✓  Does the sorting at machine speed✗  Never draws conclusions for the case
2 · THE MODELS

Purpose-built, on-box

Vision, speech and language models built for forensic content and formats. Every model ships with the product and runs locally.

✓  Trained for forensic artifacts✗  No cloud calls, evidence never leaves
3 · THE EXAMINER

Verifies & decides

Reviews what was surfaced, verifies it against the source, bookmarks what matters and owns the findings, from triage to testimony.

✓  Every finding human-verified✗  Nothing enters the report unreviewed
Data sovereignty

Evidence never leaves your building.

Forensic evidence can't be handed to a public cloud service. Doing so risks breaking chain of custody, exceeding the terms of a warrant, and creating disclosure problems that surface at exactly the wrong moment, in court. ARMOURop doesn't ask you to.

⌂

Fully on-prem

Every AI model ships with the product and runs on your hardware. Nothing is sent out for processing.

⛔

Air-gap ready

Deployable in classified environments with no connectivity required.

⛓

Chain of custody

Preserved end to end, from ingestion through to the bookmarked report.

✓

Built for law enforcement

Designed to fit existing data-handling requirements rather than work around them.

Where it earns its keep

Built for the cases that can't wait.

①

Child exploitation

Known material matched in minutes rather than days; victims safeguarded sooner and less exposure for your team.

②

Homicide & violent crime

Face clustering and in-video search across every phone, camera and computer in the case.

③

Counter-terrorism

Full triage capability inside air-gapped and classified environments.

④

Fraud & financial crime

Tens of thousands of messages filtered by sender, domain, attachment and date.

⑤

Corporate investigations

Faster scoping at the point of collection, which lowers downstream review cost.

⑥

Drone & UAV forensics

Built in, so flight data and UAV media don't need a separate tool or specialist.

⑦

Field & onsite seizure

Triage at the scene, so teams decide what to seize before they leave.

⑧

Service providers & consultancies

Per-examiner pricing and self-serve onboarding that scale with demand.

No gatekeeper. No procurement cycle.

Try ARMOURop free
for 14 days.

Install on-prem and triage your first case the same afternoon. Full product, no credit card.

Start your 14-day trial Book a guided demo
exterro.com/armour-op · on-prem install · full capability set