Industries · Law Enforcement
A recovered artefact that a court will not admit is worse than no artefact — it costs the case and the unit's credibility at once. Zentara works alongside Polri cyber units, prosecutors and agency forensic labs on the part that decides outcomes: acquisition that holds, chain of custody that documents itself, and examiners who will stand up and be questioned on it.
What we are defending
The queue is the constraint, not the technique. Throughput work — triage discipline, prioritisation and parallel examination — usually returns more than another tool licence.
Increasingly the evidence never touched the device. Preservation requests, lawful acquisition from providers, and reconciling what a provider returns with what an examiner can attest to.
Tracing that stands next to a PPATK analysis rather than duplicating it, and that a prosecutor can put in front of a judge without a tutorial.
Where a cybercrime case meets incident response: logs, malware, infrastructure. Attribution written to an evidentiary standard, not an intelligence one.
The most frequent point of failure and the least glamorous to fix. Formal validity turns on integrity being demonstrable, which means the record has to be made as the work happens — reconstructed afterwards it is challengeable, and it is usually challenged.
Method, tool validation and reproducibility only matter on the day someone contests them. Work we produce is written to be defended by the person who did it.
Instrument · Requirement · What holds in court
KUHP and KUHAP baru came into force on 2 January 2026, and electronic evidence is squarely admissible under UU 1/2024 — provided it satisfies both formal validity, meaning authenticity and integrity, and material validity, meaning relevance and reliability. Every line below is scoped to that second half.
UU 20/2025 — KUHAP
In force 2 Jan 2026
Requires
Revised criminal procedure for investigation, prosecution and trial, with strengthened transparency and accountability, expanded victim and witness rights, and explicit accommodation of digital methods.
We do
Align acquisition and reporting practice to the new procedure, and rehearse it — the first case tried under a new code is not the one to discover a gap in.
What withstands challenge
Procedure-aligned SOPs, examiner briefings
UU 1/2024 — ITE
Article 5(1)
Requires
Electronic information, electronic documents and their printouts are valid legal evidence — subject to authenticity and integrity being demonstrable.
We do
Hashing, imaging and verification practice that makes integrity a matter of record rather than assertion, from first contact with the exhibit.
What withstands challenge
Verifiable acquisition record, integrity attestation
ISO/IEC 17025
Accreditation
Requires
Competence of testing laboratories: validated methods, qualified personnel, controlled equipment, measurement traceability and demonstrable impartiality. Accredited in Indonesia by KAN against a defined scope.
We do
Laboratory process design and assessment against the standard, and the parts that fail most often in practice — transport, storage, and the handover nobody logged.
What withstands challenge
Assessed process, validated methods
NIST SP 800-86
Guidance
Requires
Integration of forensic technique into incident response — a defensible technical method rather than an ad hoc one.
We do
Method definition and tool validation, so a finding can be reproduced by a second examiner who was not there the first time.
What withstands challenge
Validated method, reproducibility record
UU 8/2010 — TPPU
Anti-money laundering
Requires
Tracing and evidencing proceeds of crime, including through digital and virtual asset channels.
We do
Blockchain and financial artefact tracing produced to evidentiary standard and structured to sit alongside a PPATK analysis rather than compete with it.
What withstands challenge
Traceable flow-of-funds exhibit
UU PDP
Republik Indonesia
Requires
Personal data obligations that constrain how investigative material is handled, retained and shared — including by state bodies.
We do
Handling design that keeps an investigation lawful in its own right, so the method does not become the defence's argument.
What withstands challenge
Retention and access controls, documented basis
Admissibility · The only score that counts
Most forensic capability discussions are about what can be recovered. Courts ask a different question, and they ask it late — after the work is done, in front of the person who most wants it excluded. Indonesian practice now requires electronic evidence to satisfy formal validity, meaning authenticity and integrity, and material validity, meaning relevance and reliability. The ladder below is where a piece of work sits against that. Level 3 is where most units are and it is not a criticism; it is where the tooling takes you. Levels 4 and 5 are process and documentation, which cost less than tooling and are what actually holds on the day.
Evidentiary strength
Recovered
The artefact exists. Nothing about how it was obtained is documented.
Documented
An acquisition record exists, written after the fact and by one person.
Verified
Hashes taken, integrity demonstrable, custody logged contemporaneously.
Reproducible
Method and tools validated. A second examiner reaches the same result independently.
Defended
The examiner testifies, is cross-examined, and the method holds under challenge.
Highlighted: where work has to sit before a contested hearing rather than an uncontested one.
Derived from UU 1/2024, KUHAP baru, ISO/IEC 17025 and NIST SP 800-86
Sector threat model
What this sector answers to
The regulatory landscape for law enforcement. Our own accreditations are listed on certifications.
Track record
Cross-border OSINT attribution delivered to evidentiary standard, and insider investigations closed with signed findings the instructing party could act on.
For cross-border matters
Cybercrime rarely respects a jurisdiction, and an exhibit acquired for an Indonesian file increasingly has to satisfy a prosecutor or court somewhere else as well. Working to the international standards from the start is far cheaper than reconstructing provenance for a mutual legal assistance request eighteen months later.
Before you have to justify us internally
So here is the answer to the questions your risk committee will ask, before they ask them.
We act on warrant, court order or lawful instruction within its stated scope, and we say so in writing at the start. An engagement that outruns its authority contaminates the case it was meant to serve.
Work is done by named people who will appear, explain their method and be cross-examined on it. A report nobody will stand behind is a report the other side will enjoy.
Where we support an investigating agency we will not accept instruction from a subject of it. Conflicts are checked before scoping, not after a defence team raises one.
Every engagement is structured to leave capability behind — method, documentation and trained people. A unit that depends on an outside firm for routine examination has a budget problem and a continuity problem.
Commercial forensic tools are validated against known data sets and the results recorded. When a method is challenged, the answer is a file rather than a reputation.
No case material in marketing, no anonymised war stories, no reference calls about live work. Discretion is a condition of the engagement, not a courtesy extended afterwards.
Recommended
VAPT & Offensive Security
22 services in the catalog apply to Law Enforcement — from point-in-time pentests to red team and continuous validation.
Black-box test of internet-facing assets, perimeter exposure, and exploitable services.
Assumed-breach lateral movement, AD abuse, sensitive data discovery from inside.
Kerberoasting, AS-REP, ACL abuse, BloodHound paths, hybrid identity review.
Rule base hygiene, ACL drift, hardening against CIS Benchmarks.
IKE/IPsec, SSL VPN, split tunneling, ZTNA migration readiness.
SPF/DKIM/DMARC, MTA-STS, DNSSEC, BIMI, phishing surface.
OWASP Top 10, business logic, authenticated/unauthenticated flows.
Manual review of critical flows + SAST tooling for OWASP/CWE coverage.
What we have written about it
For years, a quiet assumption shaped how companies thought about cloud security and the law. If a system lived on a server in another country, it sat outside Singapore’s reach. Move your workloads to an overseas data centre, and you move them beyond the regulator’s grasp. That assumption
In 2026, the aftermath of a cyberattack is no longer a “black box” of lost data. As organisations transition to hyper-automated and cloud-native environments, the trail of digital forensic evidence left behind has become more complex but also more detailed than ever before. Whether you a
Start with a scored maturity baseline or go straight to a specialist conversation.