Department
Historical dossier / evidence
Every investigation begins after the damage is done. The room is silent, the machine is still warm, and the only honest question is: what happened here, and who benefits from the version we tell?
The Sûreté was built on a simple idea: crime leaves a pattern, and a pattern can be remembered. The modern investigator did not begin with a microscope. They began with a system for preserving what everyone else wanted to forget.
The pattern can be filedA war was prosecuted with paper: orders, ledgers, memos and photographs. The archive became a witness, and the question was no longer only what happened, but what the record could prove.
Evidence is memory with custodyA single analyst walked out with a hard drive and the architecture of mass surveillance became public. The evidence was not a confession; it was a copy. In the digital case, the witness is often a file that should not exist.
The copy remembersExhibit B / the second scene
Caesar trusted the room. The room killed him.
A body tells us where the story ended. The device tells us how it began: the last session, the process that should not exist, the connection that opened a door from the other side of the system.
Image first. Nothing boots from the original. Every hash and timestamp is recorded before the first question is asked.
Disk, memory and network evidence are folded into one chronology — process start, credential use, lateral movement, exfiltration.
Separate the intrusion from the intruder. Infrastructure, tooling and behaviour are correlated, then written up so another investigator can reproduce the finding.
Void Walkers