Forensic Mode and chain of custody

Forensic Mode is the property that decides whether a Case keeps a durable, evidentiary record of a search. It is the switch that separates an audit-preserving Case from an ephemeral one.

Case Management modal, showing the FORENSIC MODE column with per-Case switches

What Forensic Mode does

Forensic Mode determines whether a Case retains its bookmarking and history and provides a chain of custody.

• Forensic Mode ON — the Case retains bookmarking and history and provides chain of custody. This is the evidentiary, audit-trail-preserving mode.
• Forensic Mode OFF (a private, ephemeral Case) — the Case keeps no bookmarking and no history. It records nothing and is effectively ephemeral.

The practical trade-off is between audit-trail retention with chain of custody (Forensic Mode ON) and an ephemeral Case that records nothing (Forensic Mode OFF).

The product corroborates these semantics in the Create a Case dialog, where the Forensic Mode option is labelled Enable Forensic Mode (Case History Logging & Bookmarking) — naming the two things the mode retains: case history logging and bookmarking. (observed in the Create a Case dialog)

Note

Turning Forensic Mode ON permits bookmarking and history retention; it does not mean any Bookmarks have been created yet. A Forensic-ON Case can still show zero Bookmarks until you save some.

Chain of custody

The chain of custody is the durable record a Forensic-ON Case preserves so that your searches, Bookmarks, and History remain accountable over time. In UserSearch, this is exactly what Forensic Mode ON provides and what an OFF (ephemeral) Case does not.

Caution

The retention and chain-of-custody behaviour above is confirmed. What is not confirmed is any cryptographic tamper-evidence guarantee behind it — whether the retained record is signed or otherwise provably unaltered — so do not rely on Forensic Mode as a technical assurance of tamper-proofing beyond what is documented.

Note

Case security is a separate mechanism from Forensic Mode. A Case password encrypts that Case’s Bookmarks on the UserSearch server, and a private key is held only by the user — if it is lost, the encrypted data cannot be unencrypted and is permanently unrecoverable. See Private key and Case password in the Case Management reference. (per Lee, 2026-07-10)

Where Forensic Mode is controlled

Forensic Mode appears in two places, and how they relate is not yet confirmed.

1. Per-Case switch. Each Case has its own FORENSIC MODE switch in the FORENSIC MODE column of the Case Management modal. In the captured state, every Case row shows this switch in the on (orange) position.
2. Header control. A Forensic Mode control is also present in the Dashboard header across all view modes.

FORENSIC MODE column, per-Case switches in the on (orange) position

Caution

The relationship between the header-level Forensic Mode control and the per-Case FORENSIC MODE switches is not yet confirmed. It is unknown whether the header control sets a global default, mirrors the active Case’s setting, or is independent of the per-Case switches. Treat the per-Case switch as the authoritative, captured control until this is verified.

The FORENSIC MODE column

In the Case Management modal, FORENSIC MODE is one column of the case table:

#	NAME	CREATED AT	SHARE	FORENSIC MODE	PRIVATE KEY	ACTIONS

The FORENSIC MODE header carries a ? help indicator; hovering it reveals an explanatory tooltip for the column.

In the captured state, each Case shows Forensic Mode ON:

Case	FORENSIC MODE
Default	on (orange)
Mark2	on (orange)
Mark	on (orange)

How to set Forensic Mode

1. Open Case Management from the left navigation.
2. Locate the Case in the case table.
3. Toggle the switch in that row’s FORENSIC MODE column.

Because the switch is per-Case, you set retention and chain of custody independently for each Case.

Related concepts

• Cases and Case Management — the container Forensic Mode is a property of, plus the SHARE, PRIVATE KEY, and ACTIONS columns.
• Bookmarks and Reports — the saved artefacts a Forensic-ON Case retains.
• History — the search and login record a Forensic-ON Case preserves.

Verified against UserSearch v2.0.20