CODI: Case Oriented Digital Investigator
Your evidence. Your questions. One connected investigation workspace. Explore the desktop GUI with agent-assisted analysis, source inspection, findings, and visual investigation boards.
Inside CODI / Desktop showcase
See the investigation take shape.
From a question to the evidence behind it. Explore the desktop workspace in a short product film.
Captured in CODI with entirely fictional demo evidence. Edited for clarity and pacing.
Read the visual transcriptAsk. Investigate. Follow the evidence.
Give the agent a question, watch its tool activity, and review the result.
Keep the source in sight.
Browse the case evidence and inspect the records behind the investigation.
Turn observations into findings.
Bring important results into a dedicated review workflow.
Bring the investigation together.
Arrange the leads and supporting material on an investigation board.
Your next investigation starts with a question.
Request a CODI demonstrationYour Investigation Command Center
CODI brings AI agents, evidence browsing, findings, and reporting into a connected desktop workspace. Follow an investigation visually, inspect the sources, and keep the terminal and scripting tools within reach.
- Connected workspace — evidence, agents, findings, and reports
- Windows and Linux — macOS coming soon
- Self-hosted — runs entirely on your infrastructure
- AI-first — natural language-driven investigations
Built for DFIR Professionals
Every feature designed to accelerate your investigations while maintaining forensic rigor.
Natural Language Investigation
Ask complex questions like "Did AnyDesk run on this host?" and let the AI agent plan and execute the investigation autonomously.
Case Management
Structured, reproducible investigation workspaces. Organize evidence, notes, findings, and chain of custody in one place.
Go / Python / SQL Scripting
Write and execute scripts directly against evidence using the built-in SDK. Full language support for custom analysis workflows.
40+ Tool Integrations
Disk forensics, memory analysis, network forensics, malware analysis, reverse engineering — all accessible from one interface.
Investigation Board
Bring questions, evidence and findings into a visual workspace. Develop an investigation while keeping supporting material close at hand.
Semantic Search
Vector embeddings and intelligent search powered by Weaviate. Find relevant evidence across massive datasets with natural queries.
How It Works
Create & Load
Create a case, load forensic images and evidence. CODI organizes everything in structured, reproducible workspaces.
Investigate
Query with natural language or write Go/Python/SQL scripts. The AI agent plans multi-step investigations and executes them.
Report & Verify
Review findings, inspect their supporting evidence, and prepare a report for your audience.
Your Workflow. Your Environment.
Desktop and terminal workflows, with a service stack you host and model providers you choose.
Windows
x64
macOS
Intel / Apple Silicon
Coming soon
Linux
x64 / ARM64
Comprehensive Tool Integrations
CODI unifies your forensic toolkit. Access everything from disk analysis to reverse engineering through one consistent interface.
Disk Forensics
- Disk image ingestion (E01/RAW/VMDK/VHD)
- File system analysis
- Artifact recovery
- Timeline generation
Memory Analysis
- Volatility integration
- Process analysis
- Memory artifact extraction
- Dynamic tracing
Network Forensics
- PCAP analysis
- Network flow reconstruction
- Protocol decoding
- Traffic analysis
Malware Analysis
- YARA scanning
- Static analysis
- Behavioral analysis
- Threat intelligence
Reverse Engineering
- Ghidra integration
- Radare2 support
- x64dbg scripts
- Binary analysis
Data & Logs
- Log parsing
- SQL queries
- Graph analysis (Neo4j)
- Crypto analysis
Get CODI
Full power with every license.
Available now for Windows x64 and Linux x64 / ARM64. macOS is coming soon.
CODI Professional
- Self-hosted investigation workspace
- Windows and Linux; macOS coming soon
- AI-powered natural language investigation
- Go, Python, and SQL scripting with built-in SDK
- 40+ forensic tool integrations
- Hypothesis mode with confidence scoring
- Semantic search via vector embeddings
- Desktop GUI and terminal interfaces
- Case management and evidence organization
- Self-hosted — no cloud dependency
- Software updates included with your plan
- Customer portal access
Each license includes a separate .lic file, delivered together by email and listed in your portal.
Choose a whole number from 1 to 100.
Total: $1,500 one-time
Secure checkout via Stripe
One-time payment. Includes updates within the current major version.
Prices in USD.
Need more than 100 licenses or have questions? Contact us.
Frequently Asked Questions
What platforms does CODI support?
How is the license delivered?
Is there a trial available?
How do updates work?
Can I use CODI offline?
What LLM providers are supported?
Ready to Transform Your Investigations?
Join the next generation of DFIR professionals using AI-powered investigation workflows.