Triage-Investigator PRO

Deploy automated forensic tools to your frontline field agents to collect evidence on-scene with initial powerful forensic triage capabilities to determine which devices to collect, what to ask suspects, or to acquire victim or witness evidence. 

• Advanced logical acquisition of iOS/Android data up to 4GB per minute
• Live Preview Mode - View phone content immediately without waiting for a backup or imaging to finish
• Screen Recording for Android and iOS Devices (up to Android 14 and iOS 16)
• Screenshots: auto-scroll when taking screenshots of long pages on Android
• Screenshot: support for the Developer Mode on iOS 16 and Android 14
• Scan and acquisition support for iOS 16 and Android 14
• Scan & Image: discover remote Mac OS agents automatically
• Image live macOS computers via our remote agent and create an AFF4 logical image
• Capture and organize screenshots of connected mobile devices while navigating with automatic processing to extract and index text for search, annotation and reporting
• Recover call records, messages, saved contacts and calendar data
• Recover WiFi connections, installed applications and Android user accounts
• Recover pictures, videos, audio files, documents and user-defined file types
• Recover database files and Property Lists for later review
• Recover browsers, browsing history, download history, search terms, form data, bookmarks, more
• Capture Revolut mobile app data and organize it in a financial transactions table (iOS)
• Search for specific information using keywords, regular expressions, hash values and PhotoDNA
• Identify files or artifacts containing terms related to child exploitation
• iOS devices: Automatically encrypt backup to obtain more data
• Capture RAM and volatile memory
• Rapidly search suspect media using large hash sets (>100 million), including VICS 2.0 and CAID
• Find relevant files and artifacts using powerful keyword and regular expression search capability
• Collect password protected and corrupted files for later review
• Collect iOS backups on target computers
• Recover deleted records from apps using the SQLite database
• Supports collection of artifacts from Windows and macOS (including T2 and M1 chips)
• Image drives out-of-the-box with image verification and imaging log file
• Recover images from unallocated drive space
• Recover and process deleted partitions
• Detect and warn of BitLocker and FileVault2 protected drives
• Search and collect emails: MS Outlook, Windows Mail, Windows Live Mail 10, Apple Mail
• Highly configurable artifact and file collection including web browser cached files, social media, P2P, Cryptocurrency, cloud storage, user login events, anti-forensic traces, saved credentials, files shared via Skype, USB history, user connection log, etc.
• Investigate attached devices, live powered on computers, boot scans from powered off computers, forensic images, contents of folders and network shares (including NAS devices)
• Use password and recovery key to decrypt and scan or image BitLocker volumes including those using the new AES-XTS encryption algorithm introduced in Windows 10
• Process APFS partitions, NTFS, FAT, HFS+, EXT, ExFAT, and YAFFS2 file systems, compute MD5 and SHA1 on collected files for integrity validation
• Leverage the powerful boot capability (including UEFI secure boot and Macs) to access internal storage that cannot easily be removed from computers
• Scan full mobile device acquisitions and detect keychain/keystore files (GrayKey, UFED)
• Scan Setup: define time range of data collection, define collection per app in a Search Profile, select Captures and apps before a live or boot scan and exclude folders from the scan
• Scan Setup: deploy user-created Captures to the Collection Key when not using Search Profiles
• Scan Setup: direct access to the new Capture screen
• Image: create new log files for logical images
  
• Image: use new and simplified data container to store Mac logical images (no more experimental AFF4-L)