Forensic Digital Twins for Judicial-Grade Cybercrime Reconstruction and Cross-Border Evidence Integritycore
JUSTITIA · Horizon Europe grant · 2026-10-01–2029-09-30
EC contribution
Total cost
Beneficiaries
About the data
Source: CORDIS (official EU open data), Horizon Europe. Framework HORIZON · call HORIZON-CL3-2025-01 · scheme HORIZON-RIA · topic HORIZON-CL3-2025-01-FCT-01. CORDIS record →
Objective
JUSTITIA addresses the persistent gap between fragmented digital traces and court-ready narratives by transforming heterogeneous artefacts into coherent, lawful, and explainable reconstructions that security practitioners and judicial actors can trust, share, and admit across borders. It delivers a Forensic Digital Twin & Replay Engine that reconstructs multi-stage incidents end-to-end from logs, disk and memory images, network captures, cloud/edge telemetry, and mobile/IoT artefacts; a provenance and chain-of-custody fabric that cryptographically signs, timestamps, and cleanly separates originals from simulations; and an automated legal admissibility and compliance layer that encodes EU and national rules to flag procedural gaps and support disclosure throughout the workflow. Cross-border interoperability is built-in via adapters and export templates aligned with eEDES/e-CODEX and SIRIUS guidance, with consent, necessity, and proportionality documented to uphold fundamental rights. Beyond static review, the microservice/Kubernetes- and SDN-orchestrated architecture enables full-system reenactment and interactive analysis in safe, virtualised environments that mirror the originals, producing courtroom-ready timelines, causality graphs, and integrity bundles that courts can verify offline. Validation focuses on tool and method verification through minimum practices, reference datasets, and repeatable test harnesses, while practitioner-centred UX and plain-language rationales raise evidentiary clarity for investigators, prosecutors, and judges. A portfolio of pilots (e.g., healthcare ransomware, edge-to-cloud vehicle forensics, smart-home crime scenes, and a federated cross-border mock-trial) exercises dynamic replay, custody, admissibility, and evidence exchange under realistic constraints to generate measurable improvements and accelerate uptake with Europol Innovation Lab and related initiatives.
Beneficiaries (10)
| Organisation | Country | Role | EC contribution | SME |
|---|---|---|---|---|
| ELLINIKO MESOGEIAKO PANEPISTIMIO | EL | coordinator | €682,500 | |
| IOTAM INTERNET OF THINGS APPLICATIONS AND MULTI LAYER DEVELOPMENT LTD | CY | participant | €469,688 | Yes |
| ATHINA-EREVNITIKO KENTRO KAINOTOMIAS STIS TECHNOLOGIES TIS PLIROFORIAS, TON EPIKOINONION KAI TIS GNOSIS | EL | participant | €386,562 | |
| K3Y | BG | participant | €371,875 | Yes |
| VRIJE UNIVERSITEIT BRUSSEL | BE | participant | €342,812 | |
| SISAMINISTERIO (SM) | FI | participant | €176,250 | |
| Ministerio da Justica | PT | participant | €149,094 | |
| SERVICIUL DE PROTECTIE SI PAZA | RO | participant | €148,125 | |
| AYUNTAMIENTO DE MADRID | ES | participant | €133,750 | |
| DIOIKISI 6IS YGEIONOMIKIS PERIFEREIAS PELOPONNISOU IONION NYSON IPEIROU KAI DYTIKIS ELLADAS | EL | participant | €120,000 |
Get the EU Defence Funding Calendar — free
The full calendar of open EU defence and dual-use funding calls, sorted by deadline, updated nightly. Delivered with DFM Analysis, our weekly briefing on who is funding what in European defence.
Or browse all open defence & dual-use calls on the funding calendar →
Defence Finance Monitor is an analytical and informational product. Grant data is official CORDIS; the paid Annual Professional subscription is handled on DFM Analysis.