HEXBEE

The system is made of three parts: HexBee Scout – an ESP32-S3 powered USB inspection device that identifies connected devices, collects metadata, performs safe file triage, generates evidence hashes, and sends results onward without executing files. HexBee Hive – a Raspberry Pi gateway that manages communication, logging, evidence handling, and case organisation. HexBee Queen – a dedicated forensic workstation used for deeper investigation and reporting. HexBee follows the workflow: Detect, Collect, Isolate, Analyse, Report The goal is to make digital investigations safer by protecting evidence integrity, preventing accidental execution of suspicious files, and providing a structured way to analyse unknown devices.