Triage-G2

Forward operators can exploit media and gather critical intelligence in under 2 minutes with the #1 DOMEX tool.

• Image live macOS computers via our remote agent and create an AFF4 logical image
• Ability to run in stealth mode
• Easy-to-use and deploy with minimal training
• Portable and lightweight deployment utilizing an unmarked rugged USB key
• Simple multi-workstation deployment with a single configuration file
• Rapid data collection from computers and digital devices
• Highly configurable artifact and file collection including web browser cached files, social media, P2P, Cryptocurrency, cloud storage, user login events, anti-forensic traces, saved credentials, files shared via Skype, USB history, user connection log, etc.
• Prepare a Collection Key without Search Profiles to select Captures just before scan
• Prepare a Collection Key with pre-configured or custom Search Profiles
• Prepare a Collection Key: Protect the Collection Key with BitLocker (instead of the Search Profile option)
• Prepare a Collection Key: the ability to borrow license tokens for collection keys
• Scan & Image: discover remote Mac OS agents automatically
• Supports collection of artifacts from Windows and macOS (including T2 and M1 chips)
• Search and collect emails including MS Outlook, Windows Mail, Windows Live Mail 10, Apple Mail
• Investigate attached devices, live powered on computers, boot scans from powered off computers, forensic images, the contents of folders and network shares (including shares made available by NAS devices)
• Rapidly search suspect media using large hash sets (>100 million)
• Find relevant files and artifacts using powerful keyword and regular expression search capability
• Image drives Out-of-the-box with image verification and imaging log file
• Recover images from unallocated drive space
• Recover deleted records from apps using the SQLite database
• Use password and recovery key to decrypt and scan or image BitLocker volumes including those using the new AES-XTS encryption algorithm introduced in Windows 10
• Process APFS partitions, NTFS, FAT, HFS+, EXT, ExFAT, and YAFFS2 file systems, compute MD5 and SHA1 on collected files for integrity validation
• Capture RAM and volatile memory
• Collect password protected and corrupted files for later review
• Collect iOS backups on target computers
• Detect and warn of BitLocker and FileVault2 protected drives
• Leverage powerful boot capability (including UEFI secure boot and Macs) to access internal storage that cannot easily be removed from computers
• Scan Setup: define the time range of data collection, define collection per app in a Search Profile, select Captures and apps before a live or boot scan and exclude folders from the scan
• Scan Setup: deploy user-created Captures to the Collection Key when not using Search Profiles
• Scan Setup: direct access to the new Capture screen
• Image: create new log files for logical images
• Scan: process logical images from the new data container
• Image: use new and simplified data container to store Mac logical images (no more experimental AFF4-L)