🔍 Forensic Tool Disclaimer & Limitations

1. Intended Use

File Cataloger is intended for:

• Personal file organization and cataloging
• Small business data management
• Preliminary forensic analysis and investigation
• Educational purposes in digital forensics
• IT administrators for system auditing
• Data recovery assistance
• Security researchers and analysts

2. Forensic Capabilities

Our software provides the following forensic features:

Evidence Handling

• Hash Verification: SHA-256, SHA-1, and MD5 hash calculation and verification
• Chain of Custody: Documentation support for evidence tracking
• Audit Trail: Comprehensive logging of all actions performed
• Case Management: Organize findings by case number and examiner

Analysis Features

• File Type Detection: Magic byte signature analysis
• Entropy Analysis: Detection of encrypted/compressed content
• YARA Scanning: Pattern matching for malware detection
• Metadata Extraction: EXIF, document properties, and more
• Credential Detection: Identification of potential sensitive data
• Cryptocurrency Detection: Wallet and key file identification

Reporting

• Professional HTML, Text, and Markdown report generation
• Customizable report sections and disclaimers
• Evidence item documentation
• Audit trail export

3. Limitations & Disclaimers

Technical Limitations

• Cannot guarantee detection of all file types or malware
• Entropy analysis may produce false positives/negatives
• YARA rules depend on rule quality and updates
• Hash verification requires original evidence integrity
• Metadata extraction varies by file format support
• AI-powered features depend on external API availability

Legal Limitations

• Not a substitute for certified forensic tools (EnCase, FTK, etc.)
• Chain of custody documentation is user-responsibility
• Report authenticity cannot be independently verified
• No legal certification or accreditation

4. Best Practices for Forensic Use

To maximize the forensic value of this tool, we recommend:

1. Use Write-Blockers: Always use hardware or software write-blockers when working with original evidence
2. Work with Images: Create forensic images (E01, dd) and analyze copies, not original evidence
3. Document Everything: Use the case management and audit trail features to document all actions
4. Verify Hashes: Calculate and verify hashes at every step of the evidence handling process
5. Maintain Chain of Custody: Document all evidence transfers and access
6. Cross-Verify Results: Use multiple tools to verify critical findings
7. Seek Professional Review: Have a certified forensic examiner review findings before legal use

5. Standards & Compliance

While File Cataloger is not formally certified, we strive to align with industry standards and guidelines:

• NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
• SWGDE: Scientific Working Group on Digital Evidence best practices
• ISO/IEC 27037: Guidelines for identification, collection, acquisition and preservation of digital evidence

Note: Alignment with standards does not constitute certification or endorsement.

6. Limitation of Liability

THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM THE USE OF THIS SOFTWARE.

Users assume all responsibility for:

• Proper evidence handling procedures
• Verification of analysis results
• Compliance with applicable laws and regulations
• Maintaining evidence integrity and chain of custody
• Any legal consequences of using analysis results

7. When to Seek Professional Help

We recommend engaging certified forensic professionals when:

• Evidence may be used in legal proceedings
• Criminal activity is suspected
• Corporate litigation or HR investigations
• Insurance claims requiring forensic evidence
• Regulatory compliance investigations
• Expert testimony may be required

Certified forensic examiners hold credentials such as:

• EnCE (EnCase Certified Examiner)
• ACE (AccessData Certified Examiner)
• GCFE (GIAC Certified Forensic Examiner)
• CCE (Certified Computer Examiner)
• CFCE (Certified Forensic Computer Examiner)

8. Questions & Support

For questions about the forensic capabilities of File Cataloger or this disclaimer, please contact us at:

• Email: support@tantulabs.com
• Documentation: docs.tantulabs.com