ILLUSTRATIVE · FICTIONAL, SYNTHETIC DATA · NOT VALIDATED OUTPUT

Evidenx™ Demonstrations

The flagship cards below are real deterministic output of the Evidenx™ pipeline over forensic artifacts from hypothetical proof-of-concept cases. Hypothesis generation is in prototype. The cards beneath them are illustrative demonstrations on fictional, synthetic data, showing how the same evidence structure could apply beyond digital forensics. They are not current product capabilities: Evidenx™ is focused on digital forensics and incident response today. In every card the invariants hold: Evidenx™ does not score, and does not conclude. It structures evidence and alternatives; the domain expert makes the determination.
Flagship · Digital Forensics (real pipeline data)
DFIR Hypothesis Card: Attacker Toolkit DetectionREAL DATA
Genuine deterministic output of the Evidenx™ pipeline (Artifacts → Observations → Entities) over real forensic artifacts from a hypothetical proof-of-concept case. Not generated, not fiction. Structures the evidence; asserts no maliciousness or verdict.
DFIR Hypothesis Card: Remote PowerShell SessionREAL DATA
Genuine deterministic output of the Evidenx™ pipeline over a real two-host collection. Nothing in it came from an alert: it reconstructs the session, the credential reuse and file transfer that preceded it, and the burst of file writes that followed, from evidence the hosts recorded anyway. Separates what a machine could confirm from what still needs an investigator to read, and leaves the determination blank. Not generated, not fiction.
Illustrative · Beyond DFIR (fictional, synthetic data)
Cyber Threat Attribution: Intrusion-Set Profiling
A fictional malware/infrastructure cluster tested against a TTP profile. Assessment support for an analyst: clusters indicators, names no actor, not an attribution.
OSINT / SIGINT Fusion: Maritime
A fictional AIS transmission gap fused with imagery, RF, and open sources. Tasking support for an analyst, not a determination or attribution.
Aviation Incident
A fictional accident sequence structured for an investigation board. Leads with supporting context, not findings.
Cold-Case Reinvestigation: Homicide
A fictional cold case re-structured from the original file. Leads, not proof. The investigator decides what carries weight.
Cold-Case Reinvestigation: Missing Person
A fictional 1987 disappearance, still unresolved, reopened on a new forensic lead toward a person of interest. An investigative lead, not proof of involvement or an answer to what happened. The investigator decides what carries weight.
Mobile Device Forensics: Human Trafficking
A fictional Cellebrite extraction from a person of interest's phone, corroborated by independent carrier, financial, and platform records. A device artifact alone is never treated as sufficient; investigators and prosecutors decide what carries weight.
Virtual Health / Teleconsultation
A fictional austere-care teleconsult. Clinical decision support for the reviewing clinician, not a diagnosis or prescription.
Everyday: A Parent Reading a Report Card
A fictional dip in one grade, structured into the story behind the letter. The explain-it-to-anyone example. Understanding a term, not a grade or a label on the child.
These pages are unlisted and excluded from search indexing. The flagship shows the real shape of Evidenx™ output on a hypothetical case; the illustrative cards show how the same structure could apply in other domains, on fictional data, and give domain experts a concrete strawman to correct.
← Back to the Experience