Mabillon
Alpha · opening to a small number of pilot examiners

The government made claims about the phone. Test every one.

Mabillon is a verification layer for defense forensic examiners, on top of Cellebrite and AXIOM. It splits the affidavit into claims and checks each one against the extraction you already have. It takes the scrolling, not the judgment.

Book a demo See how it works
Mabillon State v. Examplesynthetic case · 2 sources · read-only Offline · local model
Affidavit · page 6PDF

¶ 14On March 3, 2025, at approximately 9:00 p.m., REYES sent PETROV a text message reading “bring it tonight.”

¶ 15Phone records show that REYES called PETROV on the morning of March 4.

¶ 16On March 5, PETROV replied “ok same place,” which your affiant believes confirmed the meeting.

REYES texted PETROV “bring it tonight” at about 9 p.m. on March 3.

  • ✓Sender account matches REYESPassed+1 410-555-0147 · link to REYES confirmed by you
  • ✓Time falls in the stated windowPassed21:07:41 at UTC−05:00 · raw “3/3/2025 9:07:41 PM(UTC-5)”
  • “Model label on the message: supportsQuote verified“bring it tonight” found word for word · Chats, row 212
  • ?Your review of the supporting messagePending
A model's label alone never makes a claim supported. It waits for you. Unprovenawaiting expert

Example with made-up names and data.

Why it exists

The affidavit quotes a line. The phone holds the conversation.

Checking a claim by hand means scrolling thousands of records for the few that matter, then reading what came before and after. Mabillon searches for the records behind each claim, puts the candidates in front of you, and shows what the document left out around every quote it can place. It can miss a record, so your own search still counts.

Quoted in the affidavit
Next to the quote, not in the affidavit

How it works

From the government's document to a status for every claim

  1. 01

    Reads what you have

    The affidavit or report as a PDF, and the extraction reports: Cellebrite Excel, PDF and UFDR, and Magnet AXIOM XML and Excel. Each file opens read-only, and its SHA-256 is recorded.

  2. 02

    Splits it into claims

    A local model proposes claims one at a time. You accept, edit or remove each one and add your own. The claim list is yours.

  3. 03

    Tests each claim

    Code checks sender, account, time and time zone, weekday, counts, and what a source can and cannot show. A model labels individual records, never the claim.

  4. 04

    You decide what counts

    Fixed, versioned rules give each claim a status from your decisions and the checks. Every decision goes into the audit log under your name.

Rules, not the model

The model never decides a verdict

Three statuses, set by rules that carry a version number into every report.

Supportedconfirmed by you

When you accept the evidence behind it, or set the status yourself. A model's label alone never makes a claim supported.

Contradictedby a failed check

When a code check on one of the claim's core facts fails, such as a wrong sender or a time outside the stated window. A model's "contradicts" counts only after you confirm it.

Unprovenuntil shown

Everything else, with the records found and what is still missing. You can override any status.

Every quote checked word for word

model: “bring it tonight” → found in Chats, row 212 · kept
model: “bring it to me tonight” → not in the record · thrown away

A quote a model attributes to a record is verified by code before it is stored. One that does not match is discarded.

A record you can stand behind

0410claim 7 created · 4c1e…9a02
0411link REYES ↔ +1 410-555-0147 confirmed · b77d…11fe
0412evidence accepted, reason logged · e03a…5c7b

A hash-chained audit log under your name. The report lists source hashes, rule, model and prompt versions, and the log's last hash.

"Not found" never means "did not happen"

Searched: calls and messages between REYES and PETROV, March 4, 00:00 to 08:00 (UTC−05:00).
Coverage: curated report. It holds only what the examiner selected, so it cannot show an absence.

Identities stay proposed

Links between a number, a handle and a person stay proposed until you confirm them. Mabillon never merges people on its own.

Your data

Local by default. Cloud AI only when your case allows it and you opt in.

Your computer

Everything runs here

  • Files opened read-only and hashed
  • The screen answers only this computer
  • Cases can be encrypted with a passphrase
Cloud AI, per case

Only with your attestation

  • You attest the protective order allows it
  • You set up your own key
  • Never for a case marked as possibly containing CSAM
  • The report names the model that labelled the case
Off by default

What it won't do

Your opinion stays yours

Decide for youNo opinion and no conclusion about any person.
Replace your toolsIt does not extract phones or recover data, and it does not replace Cellebrite, AXIOM or your own review.
Fill gaps with guessesWhen it finds no contact or counts records, it says what it searched and what the source could show. A curated report can never show that something is absent.
Promise numbersNo speed or accuracy figure is published until it is measured on real extractions.

Where it stands

Early, and plain about it

Stage
Alpha, opening to a small number of pilot examiners. No pilot has started yet.
Testing
Tested on synthetic cases only. No accuracy figure for real cases yet.
Formats
The UFDR and AXIOM readers have not yet been checked on a real export. Mabillon says so on screen and in every report.
Attorneys
Mabillon is built for the forensic expert you retain. To bring it into a case, ask us about a pilot together with your expert.

Book a demo

Bring your next case review.

Tell us your role and the tools you use, and we'll walk you through Mabillon on a synthetic case. Prefer email? Write to [email protected]. Please don't send any case material.

Book a demo