Complete Product Introduction
Investigate digital evidence with a clear, repeatable workflow.
WholeClear Investigator is a professional, high-fidelity desktop forensic workspace designed for registering evidence, preserving cryptographic integrity metadata, indexing supported mailboxes and documents, running high-fidelity searches, recording examiner observations, and producing traceable reports and exports.
What is WholeClear Investigator?
WholeClear Investigator is the forensic investigation environment of the WholeClear product family. It enables forensic examiners, corporate compliance staff, and eDiscovery professionals to convert loose directories of email stores, individual messages, documents, images, and archives into a structured, searchable case database.
The application manages all work within a self-contained case. Each case tracks evidence registrations, SHA-256 integrity logs, extracted attachments, full-text indexes, examiner annotations, and exported reports. Original evidence files are mounted strictly in read-only mode to prevent any alteration of the primary media source.
Why is this tool useful?
01. One case, one record
Maintain the lead examiner's identity, case reference, evidence inventory, notes, and exports together in a single workspace database.
02. Integrity visibility
Verify files automatically with SHA-256 hashing to immediately alert the examiner if registered files have been modified on disk.
03. Accelerated review
Reduce manual search times with deep indexing, boolean logic, field-specific filters, timeline visualizations, and attachment tracking.
04. Repeatable analysis
Establish a rigorous, standard process: Evidence Registration → Verification → Indexing → Findings → Standardized Export.
05. Traceable actions
Record all processing stages, investigator steps, and system errors in append-only logs for transparent case reporting.
06. Shareable outputs
Generate highly readable, standalone HTML/PDF reports or structured CSV/JSON databases for downstream review systems.
Core Capabilities
| Capability | Description | Forensic Value |
|---|---|---|
| Case Management | Initialize, save, resume, and close individual case profiles. | Keeps distinct matters completely isolated on the host system. |
| Evidence Intake | Register individual mailboxes, loose folders, documents, images, or archives. | Establishes a precise system of record for all evidence files. |
| Integrity Tracking | Capture and re-check cryptographic SHA-256 signatures for registered sources. | Provides tamper-evident proof of file stability. |
| Advanced Indexing | Parse supported emails, metadata, headers, bodies, and embedded files. | Exposes deep communication context for instant query retrieval. |
| OCR Processing | Perform Optical Character Recognition on images and scanned PDF documents. | Makes non-searchable visual evidence text-searchable. |
| Review & Search | Browse folder structures, preview items, and run field-aware search queries. | Allows granular filtering of large-scale datasets. |
| Forensic Analysis | Track interaction frequency, communication patterns, and timeline activities. | Identifies anomalies, active communication nodes, and relationship networks. |
| Dossier Reporting | Generate professional HTML summaries, PDFs, and selected-mail dossiers. | Creates clear, audit-ready deliverables for legal or compliance review. |
Useful Cases and Scenarios
- Corporate Investigations: Examine corporate mailboxes for policy violations, intellectual property theft, or insider risks.
- Incident Response: Trace phishing indicators, suspicious headers, timestamps, external links, and sender IP addresses to compile incident timelines.
- eDiscovery Preparation: Locate, bookmark, and export key message subsets from massive data dumps before loading them into larger platforms.
- Pre-Migration Review: Analyze health, structure, and integrity of PST, OST, EML, MBOX, MSG, and EMLX mailboxes prior to large-scale data transfers.
- Document Examination: Process loose PDFs, images, and scanning directories to index textual and metadata properties in a central database.
Standard Investigation Workflow
Initialize Case Profile
Record case names, examiner details, organizational context, reference codes, and primary descriptions.
Secure Intake Registries
Point to evidence folders, calculate initial SHA-256 hash digests, and log custody transfer events.
Execute Database Indexing
Parse structural components, text strings, metadata fields, and run OCR over eligible target files.
Execute Search and Browse
Run keyword, phrase, and advanced field searches to identify and bookmark relevant items.
Document and Export Findings
Compile reports, trace anomalies, write examiner notes, and export secure, verified evidence packages.
Important Technical Boundaries
To maintain absolute forensic integrity, examiners must understand the scope of the application:
- Read-Only Mounts: The application does not write to, move, or rename original source evidence. All indexing and extractions are stored as derived, isolated data in the cases folder.
- Admissibility Disclaimer: WholeClear Investigator provides the technical tools to execute, document, and preserve a repeatable process. It does not provide legal opinions, court certifications, or guarantees of admissibility.
- Automated OCR and Metadata: Extracted data and text derived from OCR are automated helpers. Examiners must verify critical text against the original, high-resolution source images.