Hansken

Netherlands Forensic Institute

Digitally seized material plays a crucial role in criminal investigations. Digital material includes computers and laptops with files and documents, smartphones with messages and photos, online accounts for communication patterns and cloud storage for data such as plans. Hansken helps organise the data found on the digital material.

Last change on 5th of December 2025, at 7:06 (CET) | Publication Standard 1.0

• Publication category: High-Risk AI-system
• Impact assessment: DPIA
• Status: In use

General information

Theme

Public Order and Safety

Begin date

201501

Contact information

[e-mail]

Link to publication website

https://www.hansken.nl

Responsible use

Goal and impact

In investigative investigations, media such as phones, computers and digital cameras are seized. The algorithms in Hansken make it possible to make the digital traces present, such as files, images and chat messages, insightful and searchable.

Considerations

The amounts of data to be examined in Hansken are so large that manual searches are no longer possible. The algorithms make filtering possible by categorising the data. All data remains manually searchable.

Human intervention

Relevant traces emerging from the data are always reviewed by a user and then manually processed in a court report or reports. Review is done in court, with judges assisted by experts assessing whether evidence found is relevant.

Risk management

There is a supervisory "forensic and legal board" that advises on applications that are in doubt. For users, it indicates when the use of artificial intelligence is involved.

Legal basis

The investigation of digital evidence in criminal cases in the Netherlands is possible on the basis of the Code of Criminal Procedure, supplemented by the Police Data Act and European frameworks such as the E-evidence Regulation and the LED, which together define the powers, privacy rules and international cooperation around digital investigation.

Impact assessment

Data Protection Impact Assessment (DPIA)

Operations

Data

Different types of data are collected.

Technical design

Hansken processes large volumes of digital forensic material by indexing them in a scalable infrastructure. During import ("extraction"), files from computerised works are decomposed into data and metadata. Each element is analysed with specialised extractors that convert relevant information (such as text, timestamps, hashes, communication structures) into standardised attributes. These are stored in an Elasticsearch-based index, enabling fast search and filtering actions across billions of data points. The index links data objects, context and provenance, allowing researchers to find relationships without modifying or duplicating the original evidence, ensuring reproducibility and transparency.

External provider

The Netherlands Forensic Institute.

Link to code base

https://www.hansken.nl