Evidence ingestion with provenance preserved

Core statement

Evidence loses value the moment provenance is unclear. Hexarch Ingest treats intake as a first-class forensic operation.

Ingest is about capture, not analysis.

What this capability does

• Accepts evidence from external systems and tools
• Normalizes structure without altering content
• Records source, timing, and context
• Creates immutable intake records

Ingest produces facts. It does not infer meaning.

What it explicitly does not do

• No verification conclusions
• No enrichment decisions
• No automation triggers
• No policy evaluation

Ingest answers “what entered the system, and when?”

Inputs

• External tools (DFIR tooling, exports, uploads)
• Raw artifacts and metadata

Outputs

• Canonical evidence records
• Source-bound manifests
• Intake audit entries

Where this fits

Ingest precedes verification. Verification depends on ingest integrity. If ingest is compromised, verification will fail — by design.