Monolith supports integrations that connect specific workflows with external systems and services.

Available integrations may require additional configuration or administrative access to the corresponding external service.

Forensic Partner Reports

The Forensic Partner Reports integration supports organizations that report forensic Case and Evidence metrics to the United States Secret Service.

The integration can help map Monolith Case Types and Evidence Types to the corresponding categories used for Forensic Partner Reporting and provides an Excel report containing the applicable metrics.

The generated report can be used to review and transfer reporting information according to your organization's USSS reporting process.

When enabled, the integration may also create supporting Custom Fields used to capture information required for the report.

The Mattermost integration allows supported Monolith notifications to be sent to a Mattermost channel.

This can help teams surface Monolith activity within an existing Mattermost collaboration environment.

Configuration requires access to the Mattermost environment where notifications will be delivered.

The Microsoft 365 Admin integration connects supported Microsoft 365 directory workflows with Monolith.

Depending on the workflow, Microsoft 365 directory information can be used to help populate or import records such as users and people information rather than entering each record manually.

This can be particularly useful for organizations that already maintain employee, requestor, or contact information in Microsoft 365.

See , , and for more information about how these records are used in Monolith.

The Google Workspace Admin integration provides similar directory-based workflows for organizations using Google Workspace.

Supported directory information can be used to help populate Monolith records such as users and people information, reducing duplicate data entry when that information is already maintained in Google Workspace.

See , , and for more information.

Integrations are intended to extend specific Monolith workflows rather than being required for normal use of the platform.

Organizations may choose to configure integrations when they already use the corresponding external service or when the integration reduces duplicate data entry, improves collaboration, or supports an existing reporting requirement.

Monolith Release Notes provide a history of product updates across Monolith.

Use Release Notes to review changes introduced in the current version or look back at updates from previous releases.

Release Notes are organized by Monolith version.

Select a version from the version menu to review the changes included with that release.

Release information may include:

The Audit workspace brings together the items being reviewed, current verification progress, Audit details, and historical Audit activity.

Use this page to understand the major areas available after opening an Audit.

Navigation Tabs

An Audit contains two primary navigation tabs:

• Audit Items: Contains the Audit details and the items included in the verification process.

• Audit Logs: Displays recorded activity related to items being reviewed during the Audit.

Most Audit work takes place under Audit Items.

Within Audit Items, Monolith organizes records into several views:

• Audit Overview: Displays information about the Audit itself.

• All: Shows all items included in the Audit.

• Pending: Shows items that have not yet been verified.

The counts displayed with each view provide a quick indication of Audit progress.

As items are reviewed, they move from Pending into the appropriate Passed or Failed result.

The Audit Overview provides high-level information about the Audit.

Information may include:

• Status

• Item Type

• Total Items

• Pending Items

The original filter criteria are particularly useful when reviewing an Audit later because they show how the set of included Evidence or Storage Items was selected.

An Audit can remain Open while verification work is still being performed.

Once the Audit process is finished, use Complete Audit to complete the Audit.

Review the Pending, Passed, and Failed items before completing the Audit so the final results accurately reflect the work performed.

The Audit Logs tab provides historical activity related to the Audit process.

Use these logs when you need additional context about item verification activity or want to review actions recorded during the Audit.

After reviewing the Audit layout, use the Pending, Passed, and Failed views to work through the included items.

See Auditing Items for the item verification workflow.

If your organization uses barcode or QR code labels, see Using a Scanner for information about scanning items during an Audit.

Monolith uses Clients and Contacts to help your team keep track of the people and organizations connected to your work.

Although both store information about people or organizations, they serve different purposes within Monolith.

Clients

Clients generally represent the person or organization requesting work from your team.

A client may be associated with a case directly or originate from a request submitted through Relay. Client records help preserve information about who requested the work and provide a consistent record that can be associated with multiple cases over time.

Use Clients to:

• Maintain information about requestors or customer organizations

• Associate a client with one or more cases

• Review cases connected to a client

• Maintain contact and organization details for repeat requestors

See for more information.

Contacts represent other people associated with your forensic work.

A contact can be connected to a case, , acquisition, or other relevant case context, allowing your team to preserve the relationship between a person and the work being performed.

Contacts may include:

• Suspects

• Victims

• Witnesses

• Custodians

Use Contacts whenever preserving information about a person and their relationship to the case may be useful later.

See for more information.

The Organization section in Monolith contains tools for managing your internal team and office structure.

Use these areas to define who works in Monolith and how your organization is structured across physical offices or locations.

Team Management

Use Team Management to manage the people who have access to your Monolith environment.

Team settings can affect user access, assignments, casework, and other workflows throughout Monolith.

See Team Management for user account and access management.

Offices

Use Offices to represent the physical offices, laboratories, or organizational locations used by your team.

Offices help provide organizational context for users and can also be relevant to evidence locations and chain of custody workflows.

See Offices for setup and usage guidance.

In this section you can add additional details to your organization's profile including name, address details, contact information, and website.

Here you are also able to change the default Monolith logo to the logo of your organization.

The Case Management section contains the primary tools used to organize forensic work in Monolith.

Cases bring together the people, evidence, acquisitions, files, notes, tasks, quality assurance, reporting, and other information associated with a matter or investigation.

Use Inquiries to review incoming requests before they become active casework.

Cases

A Case is the central record used to organize forensic work in Monolith.

Cases can contain and connect information such as:

• Evidence Items

• Acquisitions

• Storage Items

• Clients and Contacts

• Tasks

• Notes

• Files

• Quality Assurance

• Reports

• Activity history

Cases also maintain their own identifying information, assignments, status, progress, dates, and other metadata used to manage and report on work across your organization.

See to learn how cases are created, managed, and used throughout Monolith.

Monolith can generate Microsoft Word reports using information stored throughout a Case.

Reports can include case information, evidence, acquisitions, chain of custody, analysis, notes, tasks, contacts, and other supported case data.

See for information about Monolith's standard report builder and custom report templates.

Inquiries provide a staging and triage area for work that has been requested but has not yet become an active Case.

Inquiries are commonly created from requests submitted through Relay, but they can also support other intake workflows.

Your team can review the submitted information, update the Inquiry status, communicate with the requestor through Relay when applicable, and decide when the work should become a Case.

An Inquiry can be used to:

• Create a new Case

• Merge the request into an existing Case

• Carry supported Evidence, Contacts, files, and custom field information into the Case

See for additional guidance.

For Relay-specific workflows, see .

AI-powered features are added to Monolith over time as part of normal product development.

Our goal is to keep AI-assisted workflows optional where possible so users can control when information is provided to AI systems for processing.

AI Subprocessors in Monolith

Monolith currently supports AI processing through the following providers:

• OpenAI

• Anthropic

• AWS Bedrock

Current AI-assisted features include:

Evidence Scanning can scan textual information from devices, documents, labels, or screens and use the detected information to help populate the Evidence creation form.

Using Evidence Scanning is optional.

See for additional information.

Evidence Smart Paste reads textual information copied by the user, interprets the available Evidence details, and uses them to help populate the Evidence creation form.

Using Smart Paste is optional.

See for additional information about creating and managing Evidence in Monolith.

As additional AI-assisted capabilities become available in Monolith, this page will be updated to describe their use.

Once you have purchased Monolith and are ready to deploy, you will be provided with a Monolith On-premises deployment package. This package contains configuration files necessary to run the deployment.

The package will contain the following items:

• .env

Monolith supports two primary ways to create case reports: and .

Both options help teams turn structured Monolith data into a Microsoft Word document that can be reviewed, edited, finalized, and shared according to your organization's reporting process.

Monolith Case Reports are built into the product and allow users to generate reports by selecting the sections they want to include.

This is the most common reporting workflow for users who want a point-and-click way to create a case report without building or maintaining a custom template. Users can choose the relevant report sections, generate the report, and export it to Microsoft Word for final review, formatting, or QC edits.

Use Monolith Case Reports when you want to quickly generate a report from available case data such as case details, evidence, acquisitions, notes, files, contacts, quality assurance, and related activity.

Item Locations allows you to keep track of where you are physically storing items in your lab and keep that record associated with your evidence and storage items in Monolith. When you assign a location to an evidence or storage item, Monolith tracks where that item sits and updates it automatically as the item moves through the chain of custody process.

Item Locations are organized by Office.

Each Office can maintain its own Team location, Location Groups, and individual locations to reflect how evidence and storage items are handled at that facility.

If your organization has multiple offices, use the Office selector at the top of Item Locations to switch between their location structures.

See for information about creating and managing Offices in Monolith.

The Analytics section provides organization-wide reporting across information recorded in Monolith.

Use Analytics when you want to review trends, workload, activity, or operational metrics across multiple Cases and records rather than reporting on a single Case.

The Reports page allows users to create Metrics Reports from supported areas of Monolith.

Current report categories include:

• Cases - Overview

Monolith on-premises deployments do not include a built-in backup service.

Organizations running Monolith on-premises should establish and maintain a backup process appropriate for their infrastructure and recovery requirements.

Your backup strategy should include the persistent Monolith data stored by the deployment.

For deployments using the standard local storage configuration, this includes the data folder maintained by the Monolith server.

See for additional information about the contents of this directory.

The Monolith MySQL database should also be backed up separately.

Create a new audit

Navigate to Evidence Management > Audits and select New Audit to begin creating an Audit.

The Create Audit form includes:

1. Audit Name: Enter a short, descriptive name for the Audit.

2. Assignee: Select the Monolith user responsible for performing or administering the Audit.

3. Start Date: Enter the anticipated start date.

4. Due Date: Enter the expected completion date.

5. Item Type: Select whether the Audit will contain Evidence Items or Storage Items. Only one Item Type can be selected for an Audit.

6. Description: Add context about the purpose or scope of the Audit.

7. Cancel: Close the form without creating the Audit.

8. Create Audit: Create the Audit using the selected settings and filters.

Most Audits only need to include a subset of the Evidence or Storage Items tracked in Monolith.

For example, your organization may want to audit:

• Items created during a particular year or quarter

• A specific Evidence Type

• Items associated with a particular location

• Storage Items matching certain criteria

After selecting an Item Type, Monolith displays the Audit Creation Filter.

The Audit Creation Filter works similarly to the Query Filter used throughout Monolith.

The available fields depend on the Item Type selected:

• Evidence Audits use fields available for Evidence Items.

• Storage Audits use fields available for Storage Items.

Add one or more filter conditions to define which records should be included in the Audit.

For example, an Evidence Audit might include items that:

• Have an Evidence Type of Smartphone

• Were created during a specific year

The resulting Audit will contain only the Evidence Items matching those conditions.

See Query Filter for additional guidance on building field-based filters.

Before creating the Audit, review the filter conditions and confirm that the expected scope is correct.

After configuring the Audit and any applicable filters, select Create Audit.

Monolith creates the Audit and adds it to the Audits table.

The Audit record shows the number of items included based on the selected Item Type and filter conditions.

From there, the Audit can be opened and used to begin verifying the included items.

Monolith Desktop allows users to access Monolith from a dedicated desktop application instead of a web browser.

The application is available for Windows and macOS. After installation, connect Monolith Desktop to the correct cloud region or on-premises environment before logging in.

Initial Installation

Download and install the version of Monolith Desktop that matches your operating system and device type.

The latest desktop installers are available on the Accessing Monolith page.

Monolith Desktop can also be downloaded from within the Monolith web application:

1. Log in to Monolith.

2. Go to Settings.

3. Select System.

4. Scroll near the bottom of the page.

5. Download the appropriate Monolith Desktop installer for your device.

After installing Monolith Desktop and opening it for the first time, you will be prompted to select an API mode.

This setup screen determines whether Monolith Desktop connects to a Monolith cloud tenant or an on-premises Monolith server.

Customers using a Monolith-hosted cloud region or supported partner environment should keep the API mode set to Cloud.

Cloud mode connects Monolith Desktop to a Monolith-hosted cloud tenant. When using cloud mode, select the region where your Monolith tenant is hosted.

Monolith currently supports the following cloud regions:

• United States / North America

• Australia

• Canada

Select the cloud region or partner environment where your Monolith tenant is hosted.

If you are not sure which region to select, use the same region you use when accessing Monolith from the web application, or contact your Monolith administrator.

Note: Trial tenants are typically hosted in our US / North America region by default. However, trials can be requested in any supported Monolith region. Selecting the preferred region during the trial can help avoid a tenant migration later and may be preferred for data residency or organizational reasons.

On-premises customers should change the API mode to On-Premises.

This mode allows Monolith Desktop to connect to a Monolith server running within your organization’s own environment or network.

After selecting On-Premises, enter your Monolith server’s API endpoint. This is typically the IP address of your Monolith server or a custom domain configured by your organization.

The API endpoint should use one of the following formats:

Examples:

If Monolith Desktop can successfully reach the server, a green check mark will appear and the Monolith login screen will load.

If the connection does not validate, confirm that the endpoint is correct, the server is reachable from your device, and your organization’s network or VPN settings allow access to the Monolith server.

If you need to change the Monolith Desktop connection settings after initial setup, use the Reset Monolith option on the Monolith login screen.

Resetting Monolith returns the desktop application to the API mode selection screen. From there, you can switch between cloud and on-premises mode, select a different cloud region, or enter a new on-premises API endpoint.

This can be useful if:

• You selected the wrong cloud region during setup

• Your on-premises server address changed

• You need to switch between cloud and on-premises environments

The Lab Management section helps your organization keep track of the software and equipment used to perform forensic work.

Use these records to maintain operational information about the tools your lab depends on and keep important details available to the rest of your Monolith workflow.

Forensic Software

Use Forensic Software to maintain information about the software products used by your team.

Software records can help your organization keep track of details such as:

• Software name

• Version information

• Licensing or subscription information

• Expiration dates

• Other relevant software details

Forensic Software can also be referenced when documenting Acquisitions, allowing users to record which tool and version were used during forensic collection.

See Forensic Software for additional guidance.

Use Equipment to maintain records for physical lab equipment used by your organization.

Equipment records can help centralize information about the tools and devices your team relies on during forensic work.

Examples might include:

• Forensic workstations

• Write blockers

• Imaging hardware

• Mobile acquisition equipment

See Equipment for additional guidance.

Keeping software and equipment information in Monolith provides a shared reference for your team and helps preserve operational context around the tools used during forensic work.

This can be useful for:

• Tracking software versions and licensing

• Monitoring software expiration dates

• Maintaining equipment information

• Supporting repeatable forensic workflows

What are storage items?

Storage items represent the physical devices or storage systems used to preserve forensic data that has been collected, processed, or provided to your organization.

Monolith tracks storage items separately from evidence items so teams can document where forensic data is stored, associate storage with cases, and manage the item throughout its lifecycle.

Examples of Storage Items

Storage items may include:

• External Hard Drives

• USB Drives

• Network-attached storage devices

• FTP Servers

• Cloud storage systems

• Other physical or digital storage used for forensic data

• Forensic images

• Mobile device extractions

• Case data

Evidence and storage items serve different purposes in Monolith.

Evidence items represent the original source of forensic evidence or data. Examples may include smartphones, computers, email accounts, cloud accounts, removable media, or other original sources.

Storage items represent the device or system where collected or processed forensic data is stored. Examples may include an external hard drive containing a forensic image or a network storage system containing data from multiple cases.

A useful distinction is:

• Evidence is the original source or item being examined.

• Storage is where collected or processed data is preserved.

Monolith supports two categories of storage items:

• General

• Assigned

General storage items represent shared or permanent storage systems that may contain data from multiple cases.

A common example is a network-attached storage system used to preserve forensic images and case data for the lab.

General storage items:

• Cannot be assigned to a specific case

• May contain data from multiple cases

• Do not use case-specific chain of custody tracking

Assigned storage items represent storage associated with a specific case.

These items are often smaller or portable devices that contain data for one case, such as an external hard drive prepared for a forensic examination or client delivery.

Assigned storage items:

• Must be assigned to a case before they can be used within that case

• Can contain data for only one assigned case at a time

• Support chain of custody while assigned to a case

There are two ways to associate a storage item with a case:

• Create a new storage item

• Assign an existing storage item

To create and assign a storage item from a case:

1. Open the case.

2. Select the Storage Items tab.

3. Create a new storage item.

4. Enter the storage item details.

The new storage item is created and assigned to the current case.

To assign an existing storage item:

1. Open the case.

2. Select the Storage Items tab.

3. Choose the option to assign an existing item.

4. Select the storage item.

An existing item may also be assigned through the available Actions menu.

Storage items may move through several stages during their use.

Depending on your organization’s workflow, an assigned storage item may be:

• Created for a case

• Assigned to an existing case

• Used to store one or more acquisitions

• Moved between physical locations

• Use clear storage numbers and descriptions.

• Record make, model, serial number, capacity, and location when available.

• Use General storage for shared systems that contain data from multiple cases.

Monolith is designed to support organizations that need to protect sensitive case, evidence, and forensic information while maintaining practical access for their teams.

The Cloud Security section provides an overview of the security and authentication options available for Monolith-hosted environments.

Security Overview

The Security Overview provides additional information about the controls and practices used to protect Monolith cloud environments and customer data.

Use this page when reviewing Monolith from an information security, compliance, procurement, or IT perspective.

See Security Overview for additional information.

Authentication and Access

Monolith supports several authentication controls for accessing cloud environments.

Depending on your organization's configuration, users may authenticate using:

• Monolith account credentials

• Two-factor authentication

• Single sign-on through your organization's identity provider

See for information about standard Monolith authentication.

Organizations can configure Single Sign-On (SSO) so users authenticate through their existing identity provider.

SSO can help organizations align Monolith access with existing identity, account management, and authentication policies.

Monolith and Relay can both support SSO, but their configurations are managed separately.

See for additional information.

Organizations with firewall, allowlisting, or other network requirements may need information about the Monolith services their users access.

See for current endpoint and network reference information.

This section focuses on Monolith-hosted cloud environments.

Organizations that deploy Monolith within their own infrastructure should see for deployment-specific guidance.

The Settings section contains organization-wide configuration options used to tailor Monolith to your team's workflow.

Most settings are intended for administrators configuring how Cases, Evidence, users, reporting, quality assurance, and other Monolith features behave across the organization.

General Settings

Use these settings for account, organization, and user-facing configuration.

• System: Review subscription information, download Monolith Desktop, and configure date, time, and currency formats.

• : Manage your personal Monolith email notification preferences.

• : Maintain your organization's name, address, logo, and other organization-level information.

Use these settings to define how Cases and Evidence are classified, numbered, and tracked.

• : Configure automatic numbering formats for Cases, Evidence Items, and Storage Items.

• : Define the categories of casework performed by your organization.

• : Configure Case Status options in addition to Monolith's core Active and Closed statuses.

Use templates to reduce repetitive work and standardize common processes.

• : Create reusable content for Case and Evidence Notes.

• : Build repeatable Tasks and subtasks for common workflows.

• : Configure label templates used for Evidence, Storage Items, and other supported records.

Templates can help teams standardize recurring workflows without requiring users to recreate the same information each time.

Use these settings to support consistent work tracking and review processes.

• : Define categories used when recording time in Monolith.

• : Create reusable checklist items for Quality Assurance reviews.

• : Define the types of issues that can be recorded during QA workflows.

Relay is Monolith's request portal for collecting structured forensic requests from people outside the primary Monolith user base.

Relay-specific settings in Monolith control areas such as tenant information, request instructions, user management, and which Custom Fields are exposed to requestors.

For complete Relay setup and administration guidance, see .

See for information about enabling Inquiry and Evidence Custom Fields in Relay and mapping Inquiry fields to Case fields.

Use these areas when Monolith needs to connect with other systems or workflows.

• : Configure supported Monolith integrations.

• API: Manage API access for supported Monolith resources.

For developer documentation and available endpoints, see .

Webhook documentation is maintained separately as Monolith's event-driven integration capabilities are documented.

• : Review supported administrative activity recorded within Monolith.

• Release Notes: Review product updates and changes when available.

For a new Monolith environment, you do not need to configure every setting before beginning work.

Start with the settings most relevant to your organization's workflow, such as:

1. Organization information

2. Users and Offices

3. Item Number Formats

4. Case Types and Case Progress

See for the recommended implementation checklist.

The Forensic Software section provides a central inventory of the software products and licenses used by your organization.

Maintaining these records can help your team track software versions, licensing information, expiration dates, costs, and other operational details. Forensic Software records can also be selected when documenting Acquisitions, preserving which tool and version were used during forensic collection.

View Forensic Software

Navigate to Lab Management > Forensic Software to view the software records maintained by your organization.

The table can display information such as:

• Vendor

• Software

• License Name

• Edition

• Purchase Date

• Expiration Date

• Time until expiration

• Cost

• Software Maintenance or Support cost

• Location

• Other available software metadata

Use the table controls to search, filter, sort, show or hide columns, and organize the view around the information most useful to your team.

See for additional guidance on working with Monolith tables.

Select New Software to create a software record.

Available information may include:

• Software

• Vendor

• License Name

• Edition

Capture the information that is useful to your organization's licensing and software management process.

Software and Vendor fields can be selected from existing values or entered as needed.

Forensic Software records can be referenced when documenting an Acquisition.

When creating an Acquisition, users can select the forensic software used and record the applicable software version.

This creates useful historical context around how forensic data was collected and allows the software information to be incorporated into supported reporting workflows.

Keeping the Forensic Software inventory current also makes software selection more consistent when users document Acquisitions.

Expiration dates can help your team identify software licenses or subscriptions that may require renewal.

The Forensic Software table can provide an at-a-glance view of upcoming or past expiration dates so administrators can review licensing needs across the organization.

Users can also configure supported software expiration notifications under .

The Forensic Software table can be exported to Microsoft Excel using the Export control.

Exports follow the same table behavior used elsewhere in Monolith. The visible columns and active filters determine the information included in the exported file.

If expected information is missing from an export, confirm that the appropriate columns are visible and that no unintended filters are applied.

All matching records are included in the export, not only the page currently visible on screen.

See for more information about table exports.

Select an existing software record to review or update its information.

Update the record when licensing, version, expiration, cost, location, or other tracked information changes.

Keeping existing records current helps preserve an accurate shared software inventory for the organization.

Users with the appropriate permissions can delete software records that should no longer be maintained in Monolith.

Review the record before deleting it, particularly when the software may have been referenced as part of previous forensic work.

• Maintain one clear record for each software license or installation your organization needs to track.

• Record expiration dates when software requires renewal.

• Keep software and vendor naming consistent.

Time Entry Categories provide a consistent way to classify the type of work being recorded in Monolith.

Organizations that use Monolith's time-tracking features can create categories that reflect the activities their team performs, making recorded time easier to review and report on.

Examples might include:

• Client Meeting

• Collection & Preservation

• Forensic Analysis

• Intake

• Machine Time

• On-site Work

• Reporting

• Team Meeting

• Testimony

The Time Entry Categories settings page displays the categories currently configured for your organization.

Each category also shows the number of Time Entries currently associated with it.

Use this list to review the classifications available when users record time in Monolith.

To create a new category:

1. Select Create Category.

2. Enter the name of the new Time Entry Category.

3. Select Create Category to save it.

The category becomes available for supported time-entry workflows throughout Monolith.

Choose category names that clearly represent meaningful types of work performed by your team.

Time can be recorded against work performed through the Monolith Tasks system.

Users can quickly add time from a Task or use the detailed Time Entry view under Dashboard > Tasks to review, create, or modify Time Entries.

Categories help preserve what type of work was performed in addition to who performed it and how much time was recorded.

See for more information about Task management and time tracking.

Consistent Time Entry Categories make it easier to understand how time is being spent across your organization.

For example, categories can help distinguish time spent on:

• Evidence intake

• Collection and preservation

• Analysis

• Reporting

Time-entry information can also be reviewed alongside users, Tasks, Cases, duration, and other supported fields.

Keeping categories consistent makes this information more useful when reviewing workload or exporting time-entry data.

Time Entry Categories can be deleted when they are no longer needed.

If Time Entries are currently associated with the category being deleted, those entries must be reassigned to another existing Time Entry Category before deletion can be completed.

• Create categories that represent meaningful types of work performed by your organization.

• Keep category names clear and consistent.

• Avoid duplicate or nearly identical categories.

Monolith email notifications help users stay informed about assignments and important updates related to their work.

Email notification preferences are managed from Monolith Settings, but these settings apply to the currently logged-in user. Updating these options changes which email notifications you receive. It does not change notification preferences for other users in your organization.

Access Email Notifications

To manage your email notification preferences:

1. Open Settings from the left navigation.

2. Select Notifications.

3. Review the available email notification options.

4. Toggle each notification on or off based on your preference.

Monolith currently supports email notifications for the following events:

• Notify me when I am assigned to a case

• Notify me when I am assigned to a task

• Notify me when software is about to expire

When a notification is enabled, Monolith may send an email to your account email address when the related event occurs.

Email notification preferences are user-specific.

Each user should review their own notification settings after their account is created. For example, one user may want to receive emails when assigned to a case, while another user may prefer to only receive task assignment notifications.

Single sign-on, or SSO, allows users to log in to Monolith using their organization’s identity provider.

If your organization has configured SSO, you may not need to use a separate Monolith password. Instead, Monolith will redirect you to your organization’s login page after you enter your email address.

SSO can be configured for both Monolith and Relay. Because they are separate applications, SSO configuration for Monolith and Relay is handled separately.

Logging In With SSO

To log in with SSO:

1. Open Monolith using the correct web, desktop, or mobile application.

2. Enter your account email address.

3. Select Log In.

4. If SSO is enabled for your organization, Monolith will redirect you to your organization’s identity provider.

5. Complete the login process required by your organization.

6. After authentication is complete, you will be redirected back to Monolith.

Organizations using Relay may also configure SSO for Relay access.

Relay and Monolith use separate authentication configurations. Enabling SSO for Monolith does not automatically enable SSO for Relay.

Relay SSO allows approved Relay users to authenticate through the organization's identity provider rather than using a separate Relay password.

SSO configuration requires coordination between your organization's IT team and Monolith Support.

To configure SSO for Monolith or Relay, contact . Monolith Support can provide the required service provider information and coordinate configuration and testing with your IT team.

Monolith and Relay SSO should be configured and tested separately when your organization uses both applications.

If you are unable to log in with SSO, confirm that:

• You are using the correct Monolith URL for your organization's cloud region or environment

• Your Monolith user account has been created and is active

• Your email address is associated with your organization's SSO configuration

If the issue continues, contact your Monolith administrator or Monolith Support.

Template Examples provide downloadable Microsoft Word .docx files that demonstrate how Monolith report variables and template syntax can be used in real report layouts.

Use these examples as a starting point when building or troubleshooting your own Custom Report Templates.

You can open a template to review how variables, loops, tables, images, and other report logic are structured, then adapt the approach to match your organization's reporting requirements.

Standard Monolith Report

The Standard Monolith Report is an example of a complete templated report generated by Monolith.

This example demonstrates several common Custom Report Template techniques, including:

• Report variables

• Case information

• Evidence data

• Evidence loops

• Microsoft Word tables

• Evidence photos

• Other supported report content

Download the template and review it alongside the documentation to see how Monolith data is placed throughout the Word document.

The Chain of Custody With Signatures example demonstrates how to output Chain of Custody records for an Evidence Item, including signature images.

This example is useful when building a report that needs to display custody history in a structured Word document format.

Use it as a reference for:

• Evidence loops

• Nested Chain of Custody records

• Custody metadata

• Signature images

See for the supported Chain of Custody variables and syntax.

When working with an example template:

1. Download the .docx file.

2. Open it in Microsoft Word.

3. Review the Monolith variables and template syntax used throughout the document.

Starting from a working example can make it easier to understand how Monolith data and Microsoft Word formatting work together.

Once you have created a reusable report template, save it in so it can be selected again for future Cases.

Templates can also be marked as Shared so other Monolith users can select and reuse them when generating reports.

See for additional guidance.

Navigate to Evidence Management > Audits to view existing Audits in your Monolith environment.

Audits are displayed in a standard Monolith table so you can review available records and open the Audit you want to work with.

View Existing Audits

The Audits table can display information such as:

• Audit Name

• Status

• Item Type

• Assignee

• Start Date

• Due Date

• Other available Audit metadata

Use the table controls to sort, search, filter, or adjust the visible columns as needed.

See Tables for information about working with standard Monolith table controls.

To open an existing Audit:

1. Navigate to Evidence Management > Audits.

2. Find the Audit you want to review.

3. Select the Audit Name from the table.

The Audit opens to its detailed view where you can review the included items, track verification progress, and continue the Audit workflow.

Access to Audits depends on the permissions available to your Monolith user account.

If you do not see the Audits section or cannot access an Audit you expect to use, contact your Monolith administrator.

The Dashboard provides a starting point for returning to recent work and identifying items that may need your attention.

Use the Dashboard to review recent activity, access personalized or administrative summary information, and manage Tasks across Monolith.

Overview

The Overview page contains the My Dashboard and Admin Dashboard views.

My Dashboard acts as a catch-up board, helping users quickly return to recently accessed Cases and Evidence Items, review recent activity, see assigned QA Reviews, monitor Tasks due soon, and identify new Inquiries.

Users with appropriate access can also use the Admin Dashboard for a high-level snapshot of Case activity, Evidence volume, Acquisitions, time tracking, Clients, and other organization-wide metrics.

See for more information about Dashboard widgets and customization.

The Tasks page provides a centralized view of Tasks across Monolith.

Use this area to review and manage work across Cases rather than opening individual Cases one at a time.

See for more information about creating, assigning, organizing, and tracking Tasks.

Global Search helps you quickly find records across Monolith without first navigating to a specific section.

Search results can include:

• Cases

• Evidence Items

• Notes

• Tasks

• Acquisitions

• Storage Items

• Case Files

To open Global Search, press Control + F on your keyboard.

You can also select the magnifying glass icon near the bottom of the Monolith sidebar.

Begin typing your search term and matching results will appear as you type.

Select a result to open the associated record.

If more results are available than fit in the search window, scroll within the results to continue reviewing matches.

You can also open global search by clicking the magnifying glass icon in the lower left corner of the sidebar menu.

As you type, matching results appear in the search box. Click the arrow icon on the search results to open the item.

If a search returns more results than fit in the window, scroll down within the search box to see the rest.

Welcome to the Monolith documentation site.

Monolith is a case, evidence, and analysis management platform built for digital forensic workflows. Use these docs to get started, learn how Monolith fits into your process, and reference specific features as your team works in the platform.

New to Monolith?

If you are accessing Monolith for the first time, start with:

• Accessing Monolith: Find the correct cloud region and learn how to access Monolith through the web, desktop, or mobile applications.

• : Review the recommended configuration steps for a new Monolith environment.

• : Learn how Monolith authentication and two-factor authentication work.

• : Learn how to sign in when your organization uses Single Sign-On.

• : Install and connect the Monolith desktop application.

Monolith brings the major parts of the forensic workflow together in one system.

Common areas include:

• Case and Inquiry management

• Evidence intake, tracking, and storage

• Chain of custody

• Acquisitions and forensic work

Use the section to explore these product areas in more detail.

extends common Monolith workflows to your phone or tablet.

Use the mobile app to work with cases and evidence, capture evidence information and photos, perform chain of custody actions, collect signatures, and take notes while away from your workstation.

See to get started.

Relay is Monolith's structured request portal.

Relay allows investigators, attorneys, employees, partner organizations, and other requestors to submit forensic requests without requiring access to the primary Monolith application.

Requests submitted through Relay flow into Inquiries in Monolith for review and triage before becoming active casework.

See to learn how Relay fits into Monolith.

For technical deployment and security information, see .

Topics include:

• Cloud security

• On-premises deployments

• Monolith endpoints and network access

• Other technical deployment guidance

Monolith provides APIs for organizations that need to integrate case, evidence, acquisition, storage, task, client, contact, Inquiry, and other supported data with external systems.

See for authentication and endpoint documentation.

Webhook documentation will also be added to provide guidance for event-driven integrations.

Use these resources alongside the documentation based on how you prefer to learn:

• : Product, solution, and platform information.

• : Product overview and mobile workflow highlights.

• : Learn more about structured forensic request intake.

The Evidence Management section brings together the tools used to track evidence, storage, physical locations, and inventory verification throughout Monolith.

Use these areas to maintain an accurate record of what your organization has, where items are located, and how they move through your workflow.

Evidence Items

Evidence Items provides an organization-wide view of evidence entered into Monolith.

Use it to find and review evidence across cases, work with evidence details, and access related evidence workflows.

See Evidence Items for additional guidance.

Storage Items

Storage Items tracks the physical or digital media used to preserve forensic data.

Storage items can be managed independently or associated with cases and evidence depending on your workflow.

See Storage Items for setup and usage guidance.

Item Locations models the physical locations used by your organization for evidence and storage movement.

Locations are organized by Office and can represent users, evidence rooms, shelves, lockers, cages, work areas, and other places where items may be located.

See Item Locations to learn how Offices, Location Groups, and individual locations work together.

Audits helps your organization verify that evidence and storage items are physically located where Monolith expects them to be.

Audits can be used as part of routine inventory checks and evidence accountability workflows.

See Audits for additional guidance.

The About page provides general information about the Monolith application and Monolith Forensics.

Use this page to review the version of Monolith currently running in your environment, find Monolith Forensics contact information, and review software licensing information.

Monolith Version

The current Monolith application version is displayed near the top of the About page.

This can be useful when:

• Confirming which version of Monolith your environment is running

• Reviewing Release Notes for a particular version

• Troubleshooting an issue with Monolith Support

• Comparing behavior before and after an update

See to review changes included in current and previous Monolith versions.

The About page also includes Monolith Forensics company and support information.

For product questions, technical assistance, or other support needs, contact:

support@monolithforensics.com

See for additional information about getting help with Monolith.

The About page includes the Monolith Software License Agreement applicable to the software.

For the full agreement in the Monolith documentation, see .

The System settings page contains general information and display settings for your Monolith environment.

Navigate to Settings > System to review account information, access Monolith Desktop installers, and configure date, time, and currency formats.

The Account Information section provides a high-level view of your Monolith environment.

The Organization Profile displays information about your organization.

Organization details are managed separately under Settings > Organization Info.

Monolith can be deployed on-premises for organizations that prefer to host the application within their own infrastructure rather than use a Monolith-hosted cloud environment.

The Monolith application is containerized and designed to be straightforward to deploy. The specific implementation depends on how Monolith needs to connect with your organization's existing infrastructure, network, storage, database, backup, security, and access requirements.

On-premises implementations are typically coordinated with an organization's IT or infrastructure representative who understands the environment where Monolith will run.

Monolith can work with your technical team throughout the deployment process to understand those requirements and help integrate Monolith into the environment. Organizations with the appropriate technical experience may also use the documentation in this section to manage much of the deployment process directly.

Before deployment, it is helpful to understand:

These commands can be used together to fully stop and restart the Monolith containers.

Additional Docker commands are available in the official Docker documentation:

Additional Docker Compose commands are available in the official Docker documentation:

Evidence Types provide a consistent way to categorize the different kinds of Evidence Items your organization handles in Monolith.

An Evidence Item may represent a physical device, cloud account, email account, storage media, or another source of data. Evidence Types help organize those records into meaningful categories.

Consistent Evidence Types make it easier to filter, report on, and understand the volume and makeup of Evidence across your organization.

The Evidence Types settings page displays the Evidence Types currently configured for your organization.

Each Evidence Type also shows the number of Evidence Items currently associated with it.

Use this list to review the categories available when creating or updating Evidence Items.

Your organization should review and configure the core settings that support users, cases, evidence, storage, reporting, and quality assurance.

Some settings may already be configured during implementation or trial setup. Use this page as a setup checklist to confirm that Monolith is ready for your team’s workflow.

Confirm your organization details before users begin working in Monolith.

See:

This information may be used throughout Monolith, including reports, labels, and other organization-specific areas.

Create user accounts for team members who need access to Monolith.

Quality Assurance Checklists allow your organization to create repeatable review processes for work performed in Monolith.

A checklist can represent the items another user should verify during a QA Review, helping teams apply a consistent review process across Cases and Evidence workflows.

Organizations can create different checklists for different types of review, such as:

• Case review

In this section, Monolith allows you to customize your Case number, Evidence number, and Storage number format.

Item Number Formats control how Monolith automatically generates identifiers for , , and .

Consistent numbering makes records easier to identify, search, report on, label, and reference throughout your organization.

Each numbering format can combine static text, date values, and an automatically incrementing Iterator.

Number formats can be built using the following components:

Once deployed, Monolith stores persistent application data in a folder named data.

This folder contains information used by the Monolith deployment, including:

• Application logs

• Files uploaded to Monolith

This page covers restoring a Monolith MySQL database from a previously created SQL dump.

This restore process assumes that you previously created a SQL dump of your Monolith MySQL database.

A SQL dump is a text-based backup containing SQL statements that can be used to recreate database tables, data, and other supported database objects.

MySQL uses databases, also referred to as schemas, to organize tables and data.

A MySQL server can contain multiple databases or schemas. Your Monolith data is stored within the Monolith database configured for your deployment.

When restoring from a SQL dump, confirm that the backup is being restored to the intended Monolith database or schema.

Monolith users can log in with their account email address and password. Cloud users are also required to use two-factor authentication unless Single Sign-On (SSO) has been configured for their organization.

To log in to Monolith:

1. Open Monolith using the correct web, desktop, or mobile application.

2. Enter your account email address.

This page provides Docker installation guidance for systems that may be used with a Monolith on-premises deployment.

To install Docker on Windows, install Docker Desktop for Windows.

Follow the official Docker installation instructions:

Docker Desktop for Windows can use as its container backend.

Depending on the Windows system and Docker configuration, Docker Desktop may use WSL 2 or another supported backend such as Hyper-V.

Editor Templates are reusable note templates for Monolith’s note-taking system.

Teams can use editor templates to standardize how notes are written for common workflows, collection procedures, examinations, reviews, or other repeatable processes. Templates can be kept private for your own use or shared with other Monolith users in your organization.

Use editor templates when your team regularly documents the same type of information in notes.

Common examples include:

• Evidence intake notes

Create and manage the individual people who have access to your Monolith environment.

Team Management allows administrators to add users, assign roles and offices, review account status, and manage access for existing team members.

1. In the left-hand navigation, open the Organization tab and click Team Management.

2. Click New User

Monolith supports Topaz signature tablets for capturing electronic signatures during supported workflows such as Chain of Custody.

A signature tablet can be useful when Evidence or Storage Items are physically transferred and your organization wants the person involved in the custody action to sign directly at the workstation.

The currently tested and supported model is:

• Topaz T-S460-HSB-R Signature Pad

Topaz signature tablet integration is currently supported on Windows systems.

Monolith can be accessed through a web browser, the Monolith Desktop application, or Monolith Mobile.

Choose the method that best fits your workflow and make sure you are connecting to the correct Monolith environment.

Monolith can be accessed through supported web browsers, including:

• Google Chrome