IT Administrator Setup & Deployment Guide

This guide provides IT Administrators and Systems Engineers with the technical specifications required to securely deploy the Exhibit In-Sight Desktop/MDT application and the Android Mobile companion app across your agency's endpoints. Please review the network, system, and group policy requirements to ensure successful deployment alongside existing Endpoint Detection and Response (EDR), Mobile VPN, and firewall infrastructure.

1. Minimum & Recommended System Requirements

A. Desktop / MDT Application (Windows)

• Operating System: Windows 10 (64-bit, Version 21H2 or newer) or Windows 11 Pro / Enterprise (64-bit).
• Processor (CPU): Intel Core i5 (8th Gen or newer) or AMD Ryzen 5 (Minimum 4 Cores / 8 Threads). Recommended: Intel Core i7 / AMD Ryzen 7 for multi-page PDF search warrant OCR/text stripping and rapid SHA-256 batch photo hashing.
• System Memory (RAM): Minimum 8 GB RAM (16 GB Recommended). Under operational workloads, managing Swing UI rendering, concurrent in-memory PDF manipulation, and hosting the embedded TLS 1.3 server simultaneously requires adequate memory headroom.
• Local Storage: Minimum 10 GB free SSD storage (50 GB+ recommended for major investigations). The application automatically maintains up to 3 generational rolling backups in an adjacent hidden folder and creates temporary uncompressed workspace scratch directories during active syncing.
• Display Resolution: Minimum 1600 × 900 (Recommended: 1920 × 1080 Full HD at 100% OS Scaling). The MDT user interface is fixed to a standard 1500 × 900 layout. Lower resolutions (e.g., 1366 × 768) will cause bottom action buttons to clip off-screen.
• Wireless Network Adapter: 802.11ac or 802.11ax (Wi-Fi 6) wireless adapter supporting Wi-Fi Direct / Hosted Network AP mode. If the workstation adapter lacks hosted network driver support, the software gracefully falls back to operating over existing cruiser Wi-Fi routers or station subnets.

B. Mobile Companion Application (Android)

• Operating System: Android 10 (API Level 29) through Android 15+. Application UI is strictly locked to portrait orientation for tactical field ergonomics.
• System Memory (RAM): Minimum 4 GB RAM (6 GB or 8 GB Recommended). Required to prevent Android's Low Memory Killer (LMK) from prematurely terminating background activity while the hardware camera intent captures high-resolution imagery.
• Device Storage: Minimum 32 GB internal storage with at least 5 GB free available space for image caching and offline .eis_mobile archive creation.
• Camera Hardware: Rear-facing camera with minimum 8.0 Megapixels, Autofocus, and dedicated LED Flash (essential for macro-focusing on serial numbers and low-light scene documentation).
• Device Security: Active hardware-backed Screen Lock (PIN, Pattern, Password, or Biometric Fingerprint/Face) verified via Android KeyguardManager.
• Wi-Fi Capabilities: Dual-band 2.4 GHz and 5.0 GHz Wi-Fi client mode.

2. Network & Firewall Configuration

The software suite utilizes an air-gapped wireless architecture. The desktop application acts as a localized HTTPS server communicating with mobile devices via a WPA2-secured Wi-Fi hotspot or local cruiser subnet.

A. Local Area Network (Inbound/Outbound Rules)

• TCP Port 51038 (HTTPS / TLS 1.3): Primary endpoint for encrypted data synchronization (JSON payloads, Multipart image transfers, and audit log ingestion). An ephemeral 2048-bit RSA X.509 certificate is dynamically generated in memory on startup. Mobile clients enforce strict certificate pinning against the exact SHA-256 fingerprint displayed in the pairing QR code.
• UDP Port 51039 (Local Discovery Beacon Only — Zero Evidence): Used strictly for unencrypted, localized subnet discovery broadcasts. Mobile clients broadcast DISCOVER_MDT_REQUEST across the local subnet, and MDTs respond with DISCOVER_MDT_RESPONSE containing only the workstation computer name, active TCP port, session license GUID, and the public TLS certificate SHA-256 fingerprint. Zero evidentiary data, case notes, suspect information, occurrence numbers, or photographs are ever transmitted over UDP. 100% of case and evidence data is strictly restricted to encrypted TLS 1.3 communications over TCP Port 51038. (Note: Enterprise Wi-Fi controllers configured to drop 255.255.255.255 subnet broadcasts will suppress UDP auto-discovery; in such environments, scanning the on-screen QR code connects devices directly via TCP Port 51038).
• Local Mode Fallback: If Windows hotspot tethering is restricted by group policy or lacks an external cellular uplink, the software automatically transitions to "Local Mode Only." In this mode, TCP port 51038 remains fully operational over the agency's existing Wi-Fi, cruiser router, or ethernet subnet.

B. Cruiser Mobile VPNs & Virtual Adapters (NetMotion / Absolute)

Many agencies deploy persistent Mobile VPN clients (e.g., NetMotion Mobility, Absolute Secure Access) on in-vehicle MDTs. To ensure uninterrupted mobile device pairing:

• Split-Tunneling & Local Subnet Passthrough: Configure your Mobile VPN policy to bypass traffic targeting local private subnets, specifically the Windows Hotspot default subnet (192.168.137.0/24) and local cruiser Wi-Fi subnets. If the Mobile VPN client forces all local adapter traffic through a centralized gateway, mobile devices will be blocked from reaching the MDT on TCP Port 51038.
• Host Physical Identity Resolution: The MDT software resolves physical workstation computer names directly via the Windows COMPUTERNAME environment variable, ensuring that virtual adapter addresses created by Mobile VPNs do not alter or obscure the physical workstation audit record.

C. Windows Time Synchronization (W32Time Service)

At application startup, the MDT queries the local time provider (w32tm /query /source) and logs the active clock source into the audit trail. If the machine cannot resolve a network time source, it logs CMOS Local Hardware Clock.

• Configuration: Ensure the Windows Time Service (W32Time) is set to Automatic startup on all MDT endpoint images and configured to synchronize with your agency's Active Directory Domain Controller or an authorized stratum-1 NTP source via cellular modem.
• Drift Prevention: Keeping system clocks synchronized across endpoints prevents timeline and timestamp discrepancies between mobile companion entries and master MDT containers.

D. Outbound License Validation

The desktop software requires periodic outbound HTTPS (TCP 443) access to communicate with our licensing verification server. This is a lightweight HTTP GET request containing your agency's unique billing key.

• Target Endpoint: https://api.exhibitinsight.com/verify-license (Hosted in Google Cloud — Toronto, Canada region northamerica-northeast2).
• 60-Day Disconnected Grace Period: Validated endpoints cache an offline cryptographic signature bound to a dynamic 256-bit machine salt stored in the local registry, permitting up to sixty (60) days of completely disconnected field operations without requiring internet connectivity.

3. Endpoint Protection (EDR) & Antivirus Whitelisting

The MDT application utilizes high-performance, non-blocking Java NIO FileChannel streams with active OS-level file locking (.lock files) to prevent multi-process data corruption during rapid live evidence logging. To avoid false-positive quarantines, performance degradation, or deadlocks caused by aggressive Endpoint Detection and Response (EDR) platforms (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne), please configure the following behavioral and directory exclusions:

• Process Whitelisting: Add process execution exclusions for the main application launcher (Exhibit In-Sight.exe and underlying runtime binary javaw.exe within the installation directory).
• PowerShell Execution: The desktop application dynamically executes a standard Windows PowerShell script (using the -ExecutionPolicy Bypass flag) to interact with the Windows.Networking.NetworkOperators.NetworkOperatorTetheringManager API to programmatically activate and configure the mobile hotspot. EDR rules must allow this specific tethering script execution.
• Windows Registry Access: Allow read/write access to the current user's registry hive: HKEY_CURRENT_USER\Software\JavaSoft\Prefs\com\exhibitinsight\collection. This path stores agency billing keys, department defaults, salted officer PIN hashes, and dynamic machine salts.
• File Lock Exclusions: Ensure that real-time antivirus scanners do not lock or intercept files matching *.eis.lock or temporary atomic files (*.tmp) in directories where officers save active case containers.
• Temporary Workspaces & Logs: Whitelist the creation and deletion of scratch directories matching eis_active_workspace_* and eis_conflict_check_* within %TMP% (or %USERPROFILE%\AppData\Local\Temp), and allow text log writes to %LOCALAPPDATA%\ExhibitInSight\logs (or %USERPROFILE%\.eis\logs). Automatic pruning removes diagnostic logs older than 14 days.
• Hidden Backup Directories: The application programmatically generates a localized rolling backup folder (Exhibit In-Sight Backups) adjacent to the active case file and applies the OS-level dos:hidden attribute (retaining up to 3 generational backups). EDR policies must allow the application to create, modify, and restore these files without flagging them as anomalous behavior.

4. Enterprise User Authentication & 30-Minute Auto-Lock

• Windows Domain Binding & Quick PIN: User identity is anchored to the authenticated Windows Domain session (System.getProperty("user.name")). Officers register their Name and Badge ID and set a 4-digit numeric Quick PIN (stored locally as a salted SHA-256 hash) for auditable, sub-second user switching on shared MDTs.
• Automated 30-Minute Session Timeout & Unattended MDT Protection: To mitigate the risk of unauthorized access on mobile workstations deployed in vehicles, the desktop application incorporates an automated background activity tracker. The software listens for system-level mouse and keyboard events using global AWT event masks. If no user interaction is detected for thirty (30) consecutive minutes, the application automatically locks the screen behind an unclosable, modal PIN-verification dialog and writes a SESSION_LOCKED_INACTIVITY entry to the immutable audit ledger. The active officer must input their registered 4-digit PIN to resume operations, which logs a corresponding SESSION_UNLOCKED audit event.

5. Mobile App Deployment (MDM Guidelines)

The Android companion application is distributed as a signed .apk download, suitable for deployment via your agency's Mobile Device Management (MDM) solution (e.g., Microsoft Intune, VMware Workspace ONE, SOTI MobiControl).

• Mandatory Device Lock: The application enforces device-level security via Android's KeyguardManager. Devices lacking an active PIN, Pattern, or Biometric lock are blocked from opening the evidence container and directed to Android Security Settings.
• Cloud Backup Blocked: The application manifest is hard-coded with allowBackup="false". This prevents the Android OS from backing up the app's secure internal sandbox to personal cloud accounts (Google Drive, Samsung Cloud).
• Android 12+ Wi-Fi & Location Permissions: On Android 12 and newer, the app requests NEARBY_WIFI_DEVICES; on legacy versions, the Android OS mandates ACCESS_FINE_LOCATION to allow an application to discover and connect to local Wi-Fi direct network SSIDs. The application contains zero GPS tracking libraries and does not record, track, or transmit geographic coordinates. This permission is utilized strictly for local MDT Wi-Fi hotspot connectivity.
• Camera & Vibration Permissions: CAMERA permission is required to photograph exhibits and scan the MDT pairing QR code; VIBRATE provides haptic feedback upon successful scan acquisition.

6. Data Storage, Cloud Syncs, & Encryption at Rest

All case files generated by the MDT application are compiled as proprietary .eis container files (structured, uncompressed ZIP archives containing data.json, raw JPEGs, and warrant scans). In field-offline environments, mobile devices can also export self-contained .eis_mobile archive packages for manual USB or email transfer to the MDT.