Screen a forensic timeline for patterns potentially consistent with data movement through removable media, staging, cloud transfer, email, or print/export activity. Findings require contextual review and do not independently establish intent, attribution, or unauthorized transfer.
Get ranked findings, confidence labels, and short review-ready summaries.
Start a Local ScanLoaded Scenario
Screen a timeline for potentially relevant data-movement patterns.
Choose or drop a CSV timeline
CSV only, up to 25 MB. Files at or above 8 MB use large-file mode.
Timeline ready for analysis
Ready to Analyze
Choose a CSV timeline above, then select “Scan for Exfiltration Patterns.”
Your evidence is processed locally in your browser and is not uploaded to Precision Forensics.
Live stage timings for local scan performance.
| Stage | Status | Time | Details |
|---|
Total scan time: --
Slowest stage: --
Rows processed: --
Findings generated: --
This is a screening tool, not a final expert opinion. Indicators may also reflect legitimate activity and require review against source artifacts and case context.
Use synthetic demonstration data to see how the detector identifies potentially relevant data-movement patterns.
Synthetic demonstration data
Analyze a synthetic timeline containing activity involving file staging, removable media, cloud activity, communications, and other potential data-movement indicators.
This demonstration runs through the same analysis pipeline as an uploaded CSV. Findings are calculated, not prewritten.
Calculated screening findings are ranked for attorney review. Expand a finding for its technical basis.
The detector normalizes mapped CSV fields and applies five deterministic, time-windowed rule families: removable media, staged collection, cloud/web upload, email transfer, and print/export. Findings are ranked screening indicators, not proof of theft, intent, attribution, or unauthorized transfer.
The detector does not assess authentication compromise or determine whether an account was hacked.
Results depend on the completeness, accuracy, timestamp quality, and field mapping of the supplied timeline. Validate each indicator against original artifacts and case context.
This is a technical screening tool, not a final expert opinion. Findings require contextual review and do not independently establish intent, attribution, theft, or unauthorized transfer.
Privacy: Analysis occurs locally in this browser. The evidence file, filename, findings, and report are not transmitted to Precision Forensics.
Full field registry for transparency and technical validation.
This scan supports preliminary chronology review. Formal opinions and complete forensic reconstruction require deeper technical review.
Request Exfiltration Review