Cipher Break – Digital Evidence Decryption and Management System

Handling encrypted digital evidence creates two recurring bottlenecks: accessing password-protected files and, once accessed, documenting and controlling every subsequent action. Many available tools focus mainly on decryption and then leave investigators to record steps manually, which can introduce gaps in traceability. To address this, we developed Cipher Break, a system that combines password recovery with end-to-end evidence activity tracking—from initial upload through report generation. Implemented using Python (Flask) and PostgreSQL, Cipher Break supports both dictionary and brute-force attacks and executes jobs across multiple threads to improve throughput while preserving correctness. Each decryption attempt, verification event, and access action is automatically logged to maintain a continuous chain of custody. Security is strengthened through role-based access control, SMS-based login verification, and SHA-256 integrity checks to detect unauthorized modification. Feedback from forensic practitioners and law-enforcement users informed interface refinements, clearer audit trails, and more granular visibility controls. Overall, Cipher Break provides a practical Digital Evidence Decryption and Management System that is fast when required, strict where it matters, and simple to operate in day-to-day investigative work.