- Recover data from social networking communications, instant messenger chats, cloud-based artifacts, P2P file sharing apps, mobile backups, webmail, web browser history, pictures and videos

- Mount & Search volume shadow copies on a live system

-Proprietary carving technique recovers more data from unallocated space & RAM

-Searches entire logical or physical drives: E01,Ex01,L01,Lx01 and dd images

-Searches Files including the pagefile.sys, hiberfil.sys, and more

-Ability to search multiple drives, images, file & folders in a single search

-Leave no digital footprints on target computer with “Stealth mode”

• Use “Quick Search” preset to see what’s there and focus the investigation
• Review results in real-time without having to wait for search to complete
• Target search by artifact type, keyword  and location on hard drive
• Refine search results by skin tone & body part detection
• Multi-threaded support for multi-core processors improving search speed

• Rebuild web pages in their original format on the date they were visited
• Parsed search queries for user keyword searches on major search engines
• Web history categorization (i.e. dating, cloud, classified, chat and social media sites)
• Search, filter, and bookmark important evidence
• Export report in html, pdf, excel, csv, and tab-delimited formats
• Share “Portable Case Folder” with other investigators and stakeholders
• View results in a visual graphical timeline

• Single search for over 200 Internet artifacts.  No need to run multiple scripts.
• Start working on your case immediately. No complicated setup.
• Just “set it” and “forget it” while you work on other things
• Automatically checks for disk encryption (ie. Truecrypt, PGP, Bitlocker, Safeboot)
• Built-in live RAM capture
• No extensive training needed