Triage-Investigator PRO

Deploy automated forensic tools to your frontline field agents to collect evidence on-scene with initial powerful forensic triage capabilities to determine which devices to collect, what to ask suspects, or to acquire victim or witness evidence. 

• Advanced logical acquisition of iOS/Android data up to 4GB per minute
• Live Preview Mode - View phone content immediately without waiting for a backup or imaging to finish
• Screen Recording for Android and iOS Devices (up to Android 14 and iOS 17)
• Auto-scroll when taking screenshots of long pages on Android
• Support for Developer Mode on iOS 17 and Android 14
• Scan and acquisition support for iOS 17 and Android 14
• Image live macOS computers via our remote agent and create an AFF4 logical image
• Capture and organize screenshots of connected mobile devices while navigating with automatic processing to extract and index text for search, annotation, and reporting
• Recover call records, messages, saved contacts, and calendar data
• Recover WiFi connections, installed applications and Android user accounts
• Recover pictures, videos, audio files, documents, and user-defined file types
• Recover database files and Property Lists for later review
• Recover browsers, browsing history, download history, search terms, form data, bookmarks, and more
• Capture Revolut mobile app data and organize it in a financial transactions table (iOS)
• Discover remote Mac OS agents automatically
  
• Search for specific information using keywords, regular expressions, hash values, and PhotoDNA
• Identify files or artifacts containing terms related to child exploitation
• iOS devices: Automatically encrypt backup to obtain more data
• Capture RAM and volatile memory
• Rapidly search suspect media using large hash sets (>100 million), including VICS 2.0 and CAID
• Find relevant files and artifacts using powerful keyword and regular expression search capability
• Collect password-protected and corrupted files for later review
• Collect iOS backups on target computers
• Recover deleted records from apps using the SQLite database
• Supports collection of artifacts from Windows and macOS (including T2 and M1 chips)
• Image drives out-of-the-box with image verification and imaging log file
• Recover images from unallocated drive space
• Recover and process deleted partitions
• Detect and warn of BitLocker and FileVault2-protected drives
• Search and collect emails: MS Outlook, Windows Mail, Windows Live Mail 10, Apple Mail
• Highly configurable artifact and file collection including web browser cached files, social media, P2P, Cryptocurrency, cloud storage, user login events, anti-forensic traces, saved credentials, files shared via Skype, USB history, user connection log, etc.
  
• Investigate attached devices, live powered-on computers, boot scans from powered-off computers, forensic images, contents of folders, and network shares (including NAS devices)
• Scan full mobile device acquisitions and detect keychain/keystore files (GrayKey, UFED)
• Create new log files for logical images
  
• Simplified data container to store Mac logical images 
• Deploy user-created Captures to the Collection Key when not using Search Profiles
  
• Use password and recovery key to decrypt and scan or image BitLocker volumes including those using the new AES-XTS encryption algorithm introduced in Windows 10
• Process APFS partitions, NTFS, FAT, HFS+, EXT, ExFAT, and YAFFS2 file systems, compute MD5 and SHA1 on collected files for integrity validation
• Leverage the powerful boot capability (including UEFI secure boot and Macs) to access internal storage that cannot easily be removed from computers
• Direct access to the Capture screen with the ability to define the time range of data collection, define collection per app in a Search Profile, select Captures and apps before a live or boot scan, and exclude folders