Johnny 5 · Pilot Program

The Quest Begins.

Aaron's lab. OSU Police Department. 90 days to a fully compliant, AI-augmented forensic workflow.

🔬

Aaron Sutherland

Digital Forensic Examiner · Oregon State University PD · Benton & Linn Counties

4
Examiners
10
Cases/Mo
3mo
Backlog
P1
Phase
Program Progress 230 / 1000 XP — Phase 1: DEOP
Active Quests
Phase 1 — DEOP

Digital Employee Onboarding Phase. Johnny 5 learns the lab.

✓

Complete Examiner Intake Form

Full submission received April 4, 2026 — all 7 sections complete.

+100 XP
✓

Tool Inventory Submitted

Cellebrite, Axiom, FTK, UFED, Magnet GrayKey, X-Ways, AmpedFIVE, Griffeye Pro, Recon ITR, OS Forensics, Forensic Explorer, Magnet Witness, Sumuri — all logged.

+50 XP
✓

Pain Points Identified

Primary bottleneck confirmed: manual review of large volumes of unstructured data. Most draining: prolonged detailed review.

+80 XP
⚡

CJIS Compliance Assessment

Review CJIS requirements for email access and AI tool integration with OSU systems. Determine compliant architecture path.

+150 XP
⚡

Email Triage System — Test Deployment

Deploy People Manager agent on Tommy's inbox first, then hand off to Aaron's OSU, DPS, and personal contracting accounts after validation.

+200 XP
🔒

Truleo Competitive Analysis Review

Aaron reviews the Truleo vs. Haystack feature comparison and confirms priority gaps for Phase 2 build.

+100 XP
🔒

SWGDE Standards Walkthrough

Live session: Johnny 5 walks Aaron through on-scene protocol for each device type. Aaron validates accuracy against real-world workflow.

+200 XP
🔒

Dallas Conference Meetup — May 18–21

Aaron in Dallas/Fort Worth for conference. Tommy + Sarah coordinate in-person meeting. Johnny 5 live demo on-site.

+250 XP
Lab Intel
What Johnny 5 Knows

Extracted from Aaron's intake submission. This is the foundation of the build.

Agency
Oregon State University Police
Benton & Linn Counties, Oregon
Team Size
4 Digital Forensic Examiners
Aaron is the lead / primary contact
Case Volume
5–10 cases / month
3-month backlog · 4–5 weeks per case
Case Types
Homicide, Child Exploitation, Rape
Also: fraud, car crashes, theft
Certification
CFCE
3 years in forensics · occasional expert witness
Compliance Status
SWGDE Only
No formal lab certification · no case mgmt software
Infrastructure
Windows 11 · Mixed Network
Air-gapped + connected environments
Evidence Challenged?
Not Yet
Primary concern: documentation inconsistencies, chain of custody
90-Day Goal
"Easy-to-follow SWGDE process"
Fast, compliant examination guides — on scene and in lab
Tool Stack
Aaron's Current Arsenal

Everything Johnny 5 needs to integrate with or augment.

Cellebrite Magnet AXIOM FTK UFED Magnet GrayKey X-Ways Forensics AmpedFIVE Griffeye Pro Recon ITR OS Forensics Forensic Explorer Magnet Witness Sumuri
Hard Rules
What Johnny 5 Must Never Do

Aaron's non-negotiables from intake. These are locked into the build.

⚠
AI must NEVER modify evidence data. Read-only access only.
⚠
Always ask clarifying questions rather than making assumptions about case facts.
⚠
All AI outputs must be legally defensible and cite the specific SWGDE/NIST standard referenced.
⚠
Data security is paramount — CJIS compliance is non-negotiable before any live deployment.
⚠
AI accuracy must be verifiable — no black boxes, no unexplained conclusions.
90-Day Roadmap
Phase by Phase

Build → validate → expand. Starting where the pain is biggest.

Phase 1 · Active Now

DEOP — Digital Employee Onboarding

Johnny 5 learns the lab. Email triage across OSU, DPS, and personal contracting accounts. Workflow mapping. Supervised actions only — Aaron approves everything before it ships.

In Progress
Phase 2 · Unlocks after DEOP complete

DERA — Digital Evidence Review Assistant

Ingest the evidence pile. Johnny 5 reads, tags, clusters, and surfaces what matters from large volumes of unstructured data — the #1 pain point. Texts, images, videos, timelines, behavioral patterns. Aaron reviews and signs off.

Locked
Phase 3 · The Endgame

DECM — Digital Employee Compliance Monitor

Ongoing SWGDE + NIST compliance monitoring across the lab. Real-time on-scene protocol guidance. Flags deviations before they become courtroom problems. Auto-updates when standards change.

Locked