Recover data from social networking communications, instant messenger chats, cloud-based artifacts, P2P file sharing apps, mobile backups, webmail, web browser history, pictures and videos
Mount & Search volume shadow copies on a live system
Proprietary carving technique recovers more data from unallocated space & RAM
Searches entire logical or physical drives: E01, Ex01, L01, Lx01, AD1 and dd images
Searches Files including the pagefile.sys, hiberfil.sys, and more
Ability to search multiple drives, images, file & folders in a single search
Leave no digital footprints on target computer with “Stealth mode”
Use “Quick Search” preset to see what’s there and focus the investigation
Review results in real-time without having to wait for search to complete
Target search by artifact type, keyword and location on hard drive
Multi-threaded support for multi-core processors improving search speed
Rebuild web pages in their original format on the date they were visited
Parsed search queries for user keyword searches on major search engines
Web history categorization - dating, cloud, classified, chat and social media sites, malware sites, pornographic sites, or create your own custom categories
Search, filter, and bookmark important evidence
Export report in html, pdf, excel, csv, and tab-delimited formats
Share “Portable Case Folder” with other investigators and stakeholders
View results in a visual graphical timeline
Developed by a former police officer & forensic examiner
Validated by DOD Cyber Crime Center
Validated by the National Institute of Justice
Trusted by thousands of organizations in over 90 countries
Integrity of file metadata maintained- no data is altered
IEF provides the file offset/physical location of data to manually verify all results
Be confident in the results when testifying in court
