Exterro launches on-premises AI solution ARMOURop, slashing evidence prep from 6 hours to 5 minutes

PORTLAND, Ore. and COIMBATORE, India, July 17, 2026 /PRNewswire/ — Exterro today introduced ARMOURop, a new on-premises AI solution that enables digital forensic labs to use artificial intelligence without sending sensitive case evidence to a public cloud service.

Unlike general-purpose AI tools that summarize information or generate responses, ARMOURop combines AI reasoning with governed forensic execution. AI interprets the investigative objective and coordinates supported forensic workflows, while Exterro's proprietary forensic technology performs the authorized work against locally loaded evidence. Sensitive evidence remains within the agency's controlled environment throughout the investigation.

The result is faster, more scalable forensic work designed to preserve chain of custody, evidentiary integrity, and examiner accountability.

Benchmark Performance

Representative benchmark testing demonstrates significant time reductions:

• Evidence preparation: Reduced from 4–6 hours to as little as 1–5 minutes for a one-terabyte evidence set
• CSAM grading: Previously consuming a full week, now completed in 1–3 hours

Results reflect representative benchmark workloads and may vary based on hardware, evidence composition, configuration, data volume, and investigative workflow.

Industry Context

"The first generation of AI helped professionals search faster and summarize more information. Digital forensics demands something far more rigorous. Every finding must be supported by evidence, validated by an examiner, and capable of withstanding legal scrutiny," said Harsh Behl, VP of DFIR Product Management at Exterro.

"ARMOURop connects AI reasoning directly to Exterro's proprietary forensic technology, enabling AI to coordinate supported forensic workflows while experienced investigators remain responsible for every finding, decision, and conclusion."

Addressing the Digital Evidence Backlog

Digital evidence is expanding faster than forensic examiners can process it:

• Approximately 85% of criminal investigations now rely on electronic evidence
• Requests for data from service providers have tripled since 2017
• The FBI notes that a single modern phone can hold up to half a terabyte of data

Real-world backlog examples:

• Indiana State Police (2025): 15-person Digital Forensic Unit examined 1,769 devices, ending the year with 639 pending
• South Wales Police: 722 devices awaiting examination, with nearly 300 already waiting 3–6 months

Forensic examiners currently spend excessive time on repetitive first-pass reviews rather than interpretation, validation, reporting, and complex case decisions.

How ARMOURop Works

Instead of manually selecting, sequencing, and operating forensic functions across every evidence source, forensic examiners describe what the investigation must establish. ARMOURop:

1. Interprets the objective
2. Coordinates the supported forensic workflow
3. Enables Exterro's technology to perform the work — including media analysis, known-hash comparison, transcription, facial detection, communications review, artifact analysis, and evidence correlation
4. Returns organized findings for examiner review and validation

The examiner remains in control throughout: defining scope, reviewing evidence, excluding false leads, validating findings, and determining what the evidence supports before any conclusion is used in the case.

Impact Across Key Investigation Types

CSAM and ICAC Investigations

• Hash matching, image classification, and known-content comparison across 10,000 images reduced from a full week to 1–3 hours
• Reduces both case backlog and examiner exposure time to harmful content

Homicide and Criminal Investigations

• Facial detection across 10,000 images drops from three days to one hour
• Image and video classification drops from three days to 6–8 hours
• Provides investigative direction while evidence remains actionable

Evidence Processing at Scale

• A one-terabyte evidence set prepared for investigation in 1–5 minutes instead of 4–6 hours
• Broad range of forensic artifact types — including mobile, communications, memory, drone, and application data — unified in a single console

"The challenge facing digital forensics today isn't simply processing more evidence; it's helping experienced forensic examiners accomplish dramatically more with the time they have. AI shouldn't simply make individual forensic tasks faster; it should help forensic laboratories complete more investigations by coordinating supported forensic work while keeping every investigative decision under examiner control," Behl added.