CYFOR: Modernising Digital Forensics Operations on Salesforce
Snapshot
- Client: CYFOR (UK digital forensics specialists)
- Industry: Digital Forensics / DFIR (incl. time-critical evidence collection & incident response)
- Challenge: Replace an ageing operations toolset and remove operational friction across case intake, evidence handling, chain of custody, logistics, and reporting allowing a flexible process that can change with the organisation while supporting ISO-aligned quality expectations
- Solution: A Salesforce-based Forensics Operations application (Nucleus Forensics) built with CYFOR through an iterative MVP approach
- Outcome: A scalable operational platform designed to improve case flow, evidence traceability, and management insight, with the flexibility to evolve as CYFOR’s services and demand change
The challenge
Digital forensics teams sit at the intersection of high case volumes, heterogeneous evidence types, and strict defensibility requirements. Research consistently highlights that delays are often driven by administrative and workflow factors as much as investigative complexity, especially as evidence volume and variety grows.
CYFOR needed to modernise how work moves from request to completion, not just “track cases”, but run operations: bookings, transfers, exhibits, time, SLAs, dashboards, and the inevitable exceptions that happen when real-world logistics meets real-world investigations.
At the same time, CYFOR operates in an environment where quality and competence matter. ISO-17025 expectations (and the operational behaviours that support it) place a premium on repeatability, documentation, and traceability.
The approach
We partnered with CYFOR using a discovery-led, iterative MVP delivery:
- Discovery & process mapping
Mapped end-to-end operational flow: request → case creation → exhibit booking/collection → transfers → processing → reporting → close/reopen, including edge cases and exceptions. - Security model first
Designed a security model aligned to operational reality (teams, queues, restricted access patterns, and controlled deployments), so the platform could scale safely. - Build the “operational spine” before embellishment
Delivered the capabilities that remove friction day-to-day: evidence movements, logistics queues, case timelines, time logging, and document outputs. - Adopt, measure, refine
Built with feedback loops so CYFOR could validate usability quickly and evolve the solution with confidence.
This mirrors what the market expects from modern forensic operations platforms: operational oversight, portal-style submissions, workflows, and quality management capabilities, but implemented on a flexible, extensible platform.
The solution
A Salesforce-based Forensics Operations application purpose-built for CYFOR’s operational needs, including:
1) Case intake and lifecycle control
- Rapid case creation with statuses that reflect operational reality (e.g., “awaiting collection”, “on hold”, “ready for dispatch”, “completed”, “reopened”)
- SLA visibility and operational timeline management to keep work moving and prevent cases going stale
- Logging significant dates and key events to support defensible reporting and clear handovers
2) Exhibit and evidence lifecycle management
- Book-in and scheduling of evidence collection
- Exhibit processing records, barcode visibility, and structured handling workflows
- Transfers and movements recorded end-to-end for chain-of-custody integrity (including bulk actions and special handling flags)
3) Logistics and capacity-aware operations
- Queue-based work allocation for collection/dispatch activities
- Controls to reduce operational failure points (e.g., location capacity constraints) and improve coordination between teams
4) Time and effort visibility
- Time logs and effort tracking linked to cases and related artefacts
- Improved management insight into where time is spent (useful for planning, forecasting, and continual improvement)
5) Document generation for operational paperwork
- Automated production of operational documents (e.g., manifests/forms) using document generation, reducing manual admin and standardising outputs
- Supporting behaviours that improve consistency and reduce rework in high-throughput operations
6) Dashboards, reporting, and export
- Operational dashboards for cases and time entries (at-a-glance workload and performance insight)
- Simple export mechanisms for quick extraction when stakeholders need data fast
7) Competency and training records
- Structured capture of competency/training records to support people/process maturity over time (particularly important in quality-led environments)
The impact (add CYFOR-approved numbers)
Replace the placeholders below with measured outcomes you’re comfortable publishing:
- Faster case set-up: reduced average time from request → case created by 23%
- Reduced admin overhead: evidence transfer paperwork reduced by 16% through standardised document generation
- Improved visibility: operations team can see single view of cases, live queues and SLA breaches without spreadsheets
- Stronger traceability: Exhibits now have complete movement history captured with much better reporting
- Better planning: time-entry insight enables capacity forecasting and resourcing decisions
“Before Nucleus, we spent too much time stitching together operations across tools. Now we have one operational spine for Sales, cases, exhibits, transfers, and reporting, and we can evolve it as we grow.”
— Andrew, CYFOR
Why Salesforce worked for CYFOR
Salesforce provided a proven platform for:
- Configurable processes (without rebuilding the world every time the operating model changes)
- Role-based access and auditability suitable for regulated workflows
- Reporting at scale, with dashboards that can evolve alongside leadership questions
- An ecosystem for integration, enabling future enhancements without locking CYFOR into rigid product constraints
What’s next
The platform creates a foundation CYFOR can build on, such as:
- Client submission experience improvements (portal-style intake where appropriate)
- More workflow automation and guided procedures for repeatable processes
- Quality management expansion (audits, non-conformance, document control) where desired
- AI-assisted summaries, triage, and operational insights (with appropriate governance)