Forensic Application - NEFS
Nightingale Email Forensic Suite (NEFS) provides defensible email investigation with evidence integrity built in from the first byte. Acquire, analyze, and report with proven chain of custody.
Key Features
- Acquire with evidence integrity and SHA-256 verification
- Process PST, OST, MBOX, EML, MSG, and Maildir formats
- Advanced full-text search with risk scoring
- Automatic category tagging with custom keywords
- Signed forensic reports for legal proceedings
- Embedded database - zero configuration required
Core Features
SHA-256 hash of every evidence copy with verification and chain of custody
Parse PST, OST, MBOX, EML, MSG, and Maildir formats seamlessly
Full-text search with phrases, boolean operators, wildcards, and field filters
Rule-based risk scores with automatic category tagging and custom keywords
PDF and DOCX digitally signed reports with audit trails and manifests
Embedded database and search engine - one installer, zero configuration
NEFS Capabilities
Acquisition
Hash, copy, verify, and lock evidence with automatic integrity verification
- Source files read-only protection
- SHA-256 hash verification in same pass
- Re-read and verify forensic copies
- Multi-file wizard with progress tracking
- Start time, duration, and throughput recording
Processing
Parse emails at scale with resumable background jobs
- Extract headers, bodies, and attachments
- OCR support for document attachments
- URL and IP extraction
- Entity identification and tagging
- Process 100,000+ messages on standard 8GB PC
- Pause, resume, and survive restarts
Investigation
Search, review, and tag with risk-based findings
- Dense table interface with thousands of visible rows
- Filter on risk scores, categories, sender, recipient, domain
- Bulk select and sort operations
- Reading pane for message content
- Four-eyes workflow for findings confirmation
- Human validation required for conclusions
Reporting
Create forensic reports that courts can rely on
- Digitally signed PDF and DOCX reports
- Case summary with methodology
- Evidence listings with hashes
- Chain of custody documentation
- Findings with confirmation status
- XLSX and CSV exports for email data
Investigation Flow
Case
Create, assign, set legal hold
Acquire
Hash, copy, verify, lock
Process
Parse, OCR, index, score
Investigate
Search, review, tag
Report
Sign, approve, share
Built-in Category Packs
Auto-tag emails as they are processed with 13 built-in category packs. Edit keywords and add your own to re-scan and apply custom tags to existing evidence.
Note: Risk scores and category tags are indicators for review, not conclusions. Findings are confirmed by a person.
Security, Control & Accountability
8 role levels from Super Admin to Client with granular permissions
Per-computer licensing with registration verification at every sign-in
Findings confirmed by different person; reports approved before sharing
Hash-chained audit logs protected by database triggers
Deployment Options
Desktop app with bundled engine
Best For
Individual examiners, labs, field work
Features
- Local evidence folder
- Embedded database
- Setup wizard or silent install
Windows service on server with HTTPS clients
Best For
Teams with shared cases
Features
- Server folder or network share evidence storage
- Desktop clients connect over HTTPS
- Central evidence repository
Technical Specifications
System Requirements
- Platform: Windows 10 21H2+, Windows 11, Windows Server 2019+ (64-bit)
- Memory: 8 GB minimum, 16 GB recommended
- Storage: SSD recommended for optimal performance
- Database: Embedded - no separate SQL Server required
Capabilities
- Mail Formats: PST, OST, MBOX, EML, MSG, Maildir
- Hashing: SHA-256 plus additional digests for every evidence copy
- Reports: PDF and DOCX (digitally signed), XLSX and CSV exports
- Processing: Handles 100,000+ messages on standard 8GB PC
Report Types
- Case summary and evidence overview
- Selected emails with full headers
- Investigator findings and conclusions
- Methodology and tools used
- Hash verification results
- Every handling event with timestamp
- Person responsible for each action
- Chain verification results
- Evidence copy tracking
- Tamper detection status
- Fresh re-hash of each evidence copy
- Comparison with recorded values
- Verification timestamps
- Integrity confirmation
- Discrepancy reporting
- JSON manifest of all evidence
- XLSX email listing with metadata
- CSV export for database import
- Hash summary export
- Investigation timeline export
Frequently Asked Questions
Do we need SQL Server?
No. NEFS includes its own embedded database and search engine. There is nothing to install or configure separately.
Can it handle large mailboxes?
Yes. Processing runs as resumable background jobs; tests with 100,000 messages processed and reported on a standard 8 GB desktop PC.
Is evidence ever modified?
No. Sources are read-only, copies are hash-verified and locked read-only, and every access is logged.
Does it send our data out?
No evidence or case data leaves your network. Only licence activation and sign-in events go to the licensing service.
Benefits
Benefit 1
Defensible investigations that hold up in court
Benefit 2
Proven chain of custody from first byte to signed report
Benefit 3
Reduce investigation time with automated processing
Benefit 4
Handle large-scale email volumes efficiently
Benefit 5
Maintain evidence integrity throughout investigation
Benefit 6
Generate court-ready reports with digital signatures