Exterro launches on-premises AI forensics tool ARMOURop
Exterro has introduced ARMOURop, an on-premises AI product designed to automate and coordinate digital forensic workflows without routing case evidence through a public cloud service. The Portland, Oregon-based legal and forensic software company says the tool connects AI reasoning to its proprietary forensic technology, allowing investigators to describe an investigative objective and have ARMOURop orchestrate the supporting tasks: media analysis, hash comparison, transcription, facial detection, communications review, artefact analysis and evidence correlation.
The company says its representative benchmark testing shows stark time reductions. Preparing a one-terabyte evidence set reportedly drops from four to six hours to between one and five minutes, while grading child sexual abuse material (CSAM) across 10,000 images falls from a full week to between one and three hours. Exterro acknowledges results will vary by hardware, evidence composition and configuration.
Built for the backlog
Exterro frames the product as a direct response to the digital evidence backlog now weighing on law enforcement forensic units. The company cites figures that around 85% of criminal investigations rely on electronic evidence, that data requests to service providers have tripled since 2017, and that a single modern smartphone can hold up to half a terabyte of data. It points to named examples: Indiana State Police's 15-person Digital Forensic Unit closed 2025 with 639 devices still pending examination, while South Wales Police reported 722 devices awaiting review, nearly 300 of which had already waited three to six months.
Harsh Behl, VP of DFIR Product Management at Exterro, described the distinction from first-generation AI tools: "Every finding must be supported by evidence, validated by an examiner, and capable of withstanding legal scrutiny. ARMOURop connects AI reasoning directly to Exterro's proprietary forensic technology, enabling AI to coordinate supported forensic workflows while experienced investigators remain responsible for every finding, decision, and conclusion."
The product preserves examiner control throughout. Investigators define scope, review outputs, exclude false leads and validate findings before any conclusion enters the case record. Exterro positions this as a requirement for maintaining chain of custody and evidentiary integrity, a threshold that general-purpose AI chatbots do not meet. ARMOURop is available now, with a 14-day trial on request.
Market and competitive context
The digital forensics software market has a handful of established vendors, including Cellebrite, Magnet Forensics (now part of Grayshift following a 2023 merger) and OpenText's EnCase product line. Each has been adding AI-assisted triage and classification capabilities, making the automated-workflow pitch a crowded one. Exterro's differentiating argument is architecture: by keeping inference and execution on-premises rather than calling out to a hosted model, it targets agencies with strict data-handling obligations, including US federal law enforcement and UK policing bodies subject to the College of Policing's digital forensics code of practice.
That architecture choice has regulatory logic behind it. Agencies operating under Criminal Justice Information Services (CJIS) Security Policy in the United States are restricted in how criminal justice data may be transmitted to third-party cloud environments, and similar controls apply under UK Government Security Classifications. An on-premises AI product sidesteps those constraints more cleanly than a cloud-native equivalent.
ARMOURop is part of Exterro's broader ARMOUR framework, which the company describes as an architecture for governed, auditable and defensible AI-coordinated execution. The immediate commercial question is whether forensic labs stretched by backlogs and constrained budgets can deploy the requisite on-premises hardware to realise the headline benchmark gains, given that the performance figures are directly tied to local compute configuration.