Know what left your lab.
And who did it.
Forensic Endpoint 360 watches every Windows computer in your digital-forensics lab and records what was copied out, who did it, when, and how. It never deletes a file or disturbs a phone acquisition — built for evidence rooms and lab workstations on Windows 10 and 11.
Made in India · On-premises · No cloud · Works offline
Every Copy-Out,
On One Page.
One dashboard inside your lab — every computer, device, copy, and alert. No cloud, no file contents read by default, and tamper-evident records built to hold up under scrutiny.
USB Copies
Files copied to pendrives: name, size, time, and — for evidence — the source file.
Network Shares
Server, share, and the program behind each copy.
Uploads
Evidence files sent to the internet, with destination and amount.
Print Log
Who printed what, on which printer, and how many pages.
Devices
Every USB plug-in and removal: maker, model, serial, and time.
From One Dashboard
to Defensible Proof.
Built for digital-forensics labs and evidence rooms — light agents on Windows 10 and 11, reporting to a server that stays inside your laboratory.
USB Hold & Control
Unknown sticks stay off until an officer gives name, password, and reason — even on a shared Windows login.
Copy Tracking
Copies to USB or shares, with name, size, time, and source file.
Clock Integrity
Clocks checked against the server every 10 minutes; manual changes are named.
Threat Detections
11 built-in detections, each with a MITRE ATT&CK label. Always on.
Investigation Timeline
Follow a file, drive, person, or case number across all computers.
Windows Compliance
60 checks in 9 areas, with one-click fixes you can roll back.
Software Inventory
Installs and removals noticed in minutes, tagged approved or not.
Find Files
Search by name, size, and date. Duplicates are listed — never deleted.
Tamper-Evident Audit
Admin actions chained with SHA-256. Any edit breaks the chain.
16 report templates · Shared repository · Scheduled backups · Agent updates from the dashboard · Works offline · <2% typical CPU load
Acquisition Mode — Imaging Stays Calm
While you acquire, scans, updates, and pop-ups wait. Phones in their normal connection modes, recognised write-blockers, and licence dongles are never held. Forensic Endpoint 360 reports copies and uploads; it does not stop them by default. Only the unknown-USB hold and optional lab controls can block. It is not an antivirus — it reads what Microsoft Defender reports and never cleans a file. By default no file contents are opened; no keystrokes, screenshots, camera, or microphone are captured.
Install. Watch.
Investigate. Prove.
A light agent on each lab computer reports every minute to a server inside your laboratory — then you follow the trail and export fingerprinted reports.
Forensic Endpoint 360 — Common Questions
Who is Forensic Endpoint 360 for?
Digital-forensics labs and evidence rooms that need to know what left lab computers — and who was responsible — without cloud dependency.
Does it block all copies?
No. By default it reports copies and uploads. Only the unknown-USB hold and optional lab controls can block. Phones in normal connection modes and approved write-blockers are never held.
Is it an antivirus?
No. It reads what Microsoft Defender reports and never cleans a file. By default no file contents are opened; no keystrokes, screenshots, camera, or microphone are captured.
Does any data leave the lab?
No. The server runs inside your laboratory. Nothing is sent to Cyfonix. The product works offline.
What platforms are supported?
Light agents for Windows 10 and 11, reporting to an on-premises server in your lab.
Does it work with DFL 360?
Yes. Lab-activity findings and fingerprinted reports can support investigations and lab governance alongside DFL 360 case workflows.
Phones in their normal connection modes (file transfer, PTP, USB debugging, fastboot, Apple, and chip-maker service modes) are never held. Windows and Microsoft Defender are trademarks of the Microsoft group of companies. MITRE ATT&CK is a trademark of The MITRE Corporation.
Ready to see Forensic Endpoint 360 in your lab?
Talk to us about your evidence-room and workstation controls. We'll walk your team through a live demonstration aligned to real lab workflows.