JUSTITIA

JUSTITIA LOGO

Forensic Digital Twins for Judicial Grade Cybercrime Reconstruction and Cross-Border Evidence Integrity

JUSTITIA is a Horizon Europe project that develops tools to turn fragmented digital evidence into clear and verifiable reconstructions of cybercrime incidents. It supports police authorities, forensic institutes and judicial actors in analysing complex cases and sharing evidence across borders while preserving its integrity and respecting fundamental rights. At its core is a Forensic Digital Twin and Replay Engine that reconstructs incidents from logs, memory and disk images, network traffic, cloud data and mobile or IoT artefacts. Investigators will be able to replay events, examine relationships between evidence and test hypotheses in secure virtual environments. Interactive timelines, causality graphs and plain-language explanations will help prosecutors and judges understand the findings. A provenance and chain-of-custody layer will record how evidence is collected, accessed, processed and exported, using digital signatures, trusted timestamps and auditable logs. Original evidence will remain separate from simulations. An embedded legal compliance layer will flag procedural risks and support disclosure and admissibility checks against EU and national requirements. Evidence packages will be designed for exchange through established European judicial cooperation pathways, including eEDES and e-CODEX. The tools will be validated through four pilots covering healthcare ransomware, vehicle forensics, smart-home crime scenes and a cross-border training and mock-trial environment. Practitioner feedback, repeatable validation methods and training will support future adoption by investigative and judicial organisations.

Main objectives

  • Develop a Forensic Digital Twin Engine for dynamic reconstruction and replay of cybercrime incidents using real forensic traces. 
  • Embed legal admissibility and procedural compliance checks, supported by verifiable provenance and chain of custody throughout the evidence lifecycle. 
  • Enable lawful cross-border evidence handling through automated compliance checks, traceable legal explanations and interoperable evidence packaging. 
  • Establish consistent validation methods and explainable outputs to improve the reliability, reproducibility and transparency of forensic tools and workflows. 
  • Provide interfaces and immersive training tailored to investigators, forensic experts and judicial actors, with input from relevant European stakeholders. 
  • Integrate and validate the JUSTITIA platform through four pilots that demonstrate reconstruction, evidence integrity and judicial cooperation in realistic scenarios. 
  • Support dissemination, exploitation, certification and standardisation activities to encourage adoption and sustain the results beyond the project. 

ITML’s role in the project

ITML acts as JUSTITIA’s technical coordinator, aligning the technical roadmap, component development and integration across the consortium. It leads the work package on user stories, requirements, use cases and system architecture, ensuring that practitioner needs and legal safeguards guide the design of the platform.

ITML leads the design of the reference architecture, including component interfaces, data contracts and deployment patterns for on-premises and sovereign-cloud environments. It also develops the chain-of-custody and provenance layer, providing digital signing, trusted timestamps, auditable records and evidence manifests that can be verified in judicial settings. 

For the Forensic Digital Twin, ITML leads the modelling framework that brings together evidence, system entities and timelines. The framework will provide the data structures and interfaces used by reconstruction, behavioural simulation and visualisation components, while preserving a clear separation between original evidence and generated simulations. 

ITML also leads platform integration and preparation of the pilot deployments, bringing the components into a secure, reproducible system for validation by practitioners. In parallel, it leads dissemination and communication activities to share the project’s progress and results with relevant communities. 

Additional Info

Consortium partners: 10 partners from 8 European countries 

  • Hellenic Mediterranean University (HMU), Greece — Coordinator 
  • IOTAM Internet of Things Applications and Multi Layer Development Ltd (ITML), Cyprus 
  • Ayuntamiento de Madrid (MPOL), Spain 
  • Ministry of the Interior (FIMOI), Finland 
  • Ministério da Justiça (PJ), Portugal 
  • Serviciul de Protecție și Pază (SPP), Romania 
  • ATHENA Research and Innovation Center (ATHENA), Greece 
  • Vrije Universiteit Brussel (VUB), Belgium 
  • K3Y, Bulgaria 
  • 6th Health Region of Peloponnese, Ionian Islands, Epirus and Western Greece (6YPE), Greece 

Project number: 101309214 

Call: HORIZON-CL3-2025-01 — Civil Security for Society 

Topic: HORIZON-CL3-2025-01-FCT-01 — Open topic on modern information and forensic evidence analysis and on frontline policing (Option B) 

Project duration: 36 months, from 1 October 2026 to 30 September 2029 

Social media: LinkedIn 

Website: Website (under construction) 

Funded by EU logo