When government agencies buy digital forensics tools, they aren’t just buying software. They’re investing in the integrity of evidence that can affect people’s liberty, national security and public trust. Recent federal attention to supply chain and foreign-adversary risk shows that checking a vendor’s ownership, control and development provenance is an essential part of due diligence, not a compliance checkbox.

Paraben Corporation was founded in 1999. We are a 100% U.S. owned and operated, privately held, woman-owned small business (WOSB) headquartered in Gruetli-Laager, Tennessee. U.S. citizen employees maintain all source code for the E3 Forensic Platform, Zandra AI and our related tools within the United States. We don’t ask buyers to take this on faith. Below is a practical way to check these claims, for Paraben or any other vendor, using public federal guidance and standard due diligence.

A 3-Step Provenance Verification Checklist

(Informed by NIST SP 800-161 Rev. 1, NIST SP 1326 and ISO/IEC 17025:2017)

Note: These NIST publications are risk-management guidance, not pass/fail requirements. NIST expects each organization to decide which countries it treats as high risk and how much foreign exposure it will accept. The checklist below is our recommended practice built on that guidance.

Step 1: Confirm Ownership and Control

Guidance: NIST SP 800-161 Rev. 1, Appendix D, § D.4.1.3 (Information Gathering and Scoping Analysis); NIST SP 1326, p. 8

What to verify: Whether any foreign government or foreign-government-controlled interest has ownership, control or influence (FOCI) over the vendor, including through investment, leadership ties, board seats or financial authority. Also check whether the vendor faces a pending foreign merger or acquisition. The scoping questionnaire in NIST SP 800-161 asks buyers to check supplier ownership, foreign or domestic, and any ties to foreign governments. NIST SP 1326 suggests checking results against sources such as the Department of Commerce foreign adversaries list (15 CFR § 791.4).

Our recommendation:

Ask for current, independently verifiable ownership records, such as SAM.gov registration, SBA certification status and corporate filings, rather than relying only on the vendor’s own statement. Records that are recent and independently verifiable give stronger assurance.

Step 2: Validate Development Provenance

Guidance: NIST SP 1326, pp. 8–9; NIST SP 800-161 Rev. 1 (control SR-4, Provenance)

What to verify: Where the source code is compiled and maintained, reviewed, and developed and whether the vendor or its developers are subject to foreign laws that could compel them to share data or source code with security services. China’s National Intelligence Law and Russia’s Yarovaya Law are two examples. NIST SP 1326 defines provenance as the history of a component’s origin, development, ownership and location. It specifically points to the “locations of key source-code developers” as something to examine, and it points to software bills of materials (SBOMs) as supporting evidence.

Our recommendation:

Ask vendors to identify where development takes place and who has access to source code and build environments. Ask for an SBOM that covers third-party and open-source components. Each agency should set its own limits on acceptable jurisdictions.

Step 3: Ensure Ongoing Monitoring

Guidance: NIST SP 800-161 Rev. 1 (supply chain risk assessment, § D.4, and its ongoing monitoring practices); ISO/IEC 17025:2017 § 6.6.2

What to verify: That ownership, control and provenance are checked again over the life of the contract, not just attested once at signing. Forensic labs accredited to ISO/IEC 17025 already have a related duty. Section 6.6.2 requires labs to evaluate, select, monitor and re-evaluate their external providers, and software vendors fall within that scope.

Our recommendation:

Build periodic re-attestation and change-of-ownership notice requirements into your contracts.

Why This Matters Beyond Compliance

As a digital forensic examiner, I have worked cases with many different tools. When a tool’s provenance is unclear, questions about reliability can follow the evidence into court. SWGDE’s Best Practices for Computer Forensic Examinations (18-F-001-2.0, § 4.2.2) already calls for forensic tools to be tested and validated before use. Knowing who builds a tool, and where, is a natural part of that validation. Judges and juries are right to ask: if a vendor won’t say who built its tool, what else might it be hiding?

Paraben started in 1999 as a consumer shareware company and shifted its focus to digital forensics in 2001. We have always been open about our history and foundations. We believe our development practices should meet the same standards we expect of digital evidence.

Legal Perspective

Don Wochna a long standing member of the DFIR community as an attorney and a qualified expert and examiner shares a legal perspective on this matter. Read More.