Secure Digital Evidence for Law Enforcement

MetaDefender Drive boots and scans a seized computer without starting its native operating system, helping investigators assess devices before connecting them to investigative environments. MetaDefender Kiosk scans removable media at a standalone checkpoint and can apply additional security controls based on organizational policies. MetaDefender Endpoint validates device compliance before allowing access to protected systems and resources, helping prevent compromised or non-compliant devices from accessing sensitive case data.

MetaDefender Core scans forensic images, disk clones, and extracted evidence files using Metascan™ Multiscanning with more than 30 anti-malware engines. It calculates file hashes, identifies known and emerging threats, and provides additional file analysis capabilities such as hyperlink extraction before examiners begin their investigation. It can also use AI Content Inspector to flag AI-generated images, manipulate visual evidence, and fraudulent documents, helping examiners verify the authenticity of evidence.

Yes. MetaDefender Core uses Deep CDR™ Technology to remove or rebuild risky elements—macros, scripts, and embedded objects—and produce a clean, usable version of a file when policy allows. This lets investigators and prosecutors work with documents and media without exposing systems to file-borne threats.

Yes. MetaDefender Core inspects documents, images, archives, and video for sensitive information such as credit card numbers, national ID numbers, and personal data, including text inside images and video through Optical Character Recognition (OCR) and pattern matching. Agencies can then classify, redact, route, or restrict evidence based on policy before it is shared or stored.

MetaDefender Aether uses advanced sandboxing and threat intelligence capabilities to safely analyze unknown and evasive threats. By combining behavioral analysis with threat intelligence enrichment, it helps uncover hidden malicious activity, including ransomware behavior, command-and-control communications, and potential data exfiltration attempts, without exposing forensic systems to risk.

MetaDefender Managed File Transfer provides role-based access controls, encryption, and tamper-evident audit trails. MetaDefender Core calculates file hashes that can be used to verify file integrity as evidence moves between collection points, field offices, forensic labs, and repositories. Together, these capabilities support evidence handling and verification workflows.

Yes. MetaDefender Aether helps agencies investigate, enrich, and share threat intelligence derived from digital evidence. Using standardized formats such as STIX and MISP, organizations can exchange indicators, threat context, and investigation-relevant findings across teams and partner agencies. MetaDefender Aether also integrates with SIEM, SOAR, and EDR platforms to support collaboration and operational workflows.

An optional NetWall data diode provides hardware-enforced one-way transfer of evidence into a protected or air-gapped repository. This allows approved data to move into the secure environment while preventing reverse communication paths.

No. OPSWAT complements existing forensic workflows by helping organizations securely collect, transfer, analyze, and store digital evidence. The solution works alongside forensic acquisition and examination tools by providing malware prevention, secure transfer, threat analysis, and evidence protection capabilities.

Yes. The solution supports fully air-gapped deployments and is suitable for classified, disconnected, and highly secure investigative environments.