Tornado

Bring Cloud Evidence Into the Investigation

Evidence collection for Microsoft365, Google Workspace, and other cloud environments – built for complete investigations.

Not all evidence lives on endpoints. From SaaS platforms to cloud identities, critical data is often out of reach — slowing investigations and creating blind spots. Tornado gives you direct access — instantly.

The problem

Cloud evidence shouldn’t be the bottleneck

Today’s cyber incidents span endpoints, identities, email systems, and cloud services.

Whether investigating Business Email Compromise (BEC), account compromise, insider threats, or broader security incidents, investigators often need access to evidence stored across cloud platforms. Yet collecting that evidence remains difficult:

Evidence is scattered across multiple cloud consoles

Manual exports create delays and inconsistency

Retention windows can close before evidence is collected

Teams lose valuable time gathering data before analysis can begin

The Solution

Purpose-built for cloud evidence collection

Binalyze Tornado is a free standalone desktop application that helps investigators collect and triage cloud-based evidence from platforms such as Microsoft 365 and Google Workspace.

Gather key investigative artifacts including email records, User access activity, audit and administrative logs, platform-specific evidence.

How it works

From Collection to Investigation

Step 1

Install Tornado

Download and install the free standalone desktop application.

Step 2

Connect & Collect

Authenticate securely and collect evidence from supported cloud platforms including Microsoft 365 and Google Workspace.

Step 3

Analyze & Prioritize

Run built-in analyzers and keyword searches to automatically surface suspicious activity, anomalies, and findings directly within the collection workflow.

Step 4

Export to Binalyze AIR

Continue Investigation in AIR. Send enriched evidence and findings directly to AIR’s Investigation Hub for broader investigation and case management, or export as SQLite for external analysis.

Why Tornado

Investigate without Borders

Cloud evidence often holds the missing context behind security incidents. Tornado helps bring that evidence into the investigation.

Business Email Compromise (BEC)

Account Compromise

Suspicious Email Activity

Insider Threat Investigations

AIR Integration

Connect Cloud Evidence to the Bigger Picture

Tornado integrates directly with AIR, allowing investigators to combine cloud evidence with endpoint, identity, and other investigative data in a single case view.

Move from isolated evidence to a complete understanding of what happened.

BETA PREVIEW

Extend Investigations Into the Cloud

Tornado is available today as a free standalone application.

Collect cloud-based evidence from Microsoft 365 and Google Workspace, review findings, and continue investigations in Binalyze AIR.