- Support English and Mandarin operation interface.
- Support collection of volatile evidence (stored temporarily on the computer
and would be lost if the device shuts down):
- Process
- Network Resources
- Network
- Opened Files
- ARP Cache
- Support collection of non-volatile evidence:
- Service
- Service Detail
- Start Run
- Wireless
- Installed Software
- System Info
- USB Devices
- Shortcuts
- User Profiles
- MUI Cache
- Prefetch
- Security log
- Application log
- System log
- Task Schedule
- User Assist
- ShellBags
- Recent File
- About browser support:
- Firefox: Login to your account, browsing history, bookmarks, quick
access and cookies
- Chrome: Login password, keyword search history, download and browsing
history, bookmarks, quick access and cookies
- Edge: Login, browsing history, bookmarks, quick access and cookies
- IE: Quick access and browsing history
- It has the function of making key logical image files, which can be packaged
and taken away from the key path of the hard disk.
- Support TimeLine analysis with graphical presentation. Drag on the graph to
select specific time frame.
- Support exporting evidence reports as CSV files.
- Support data analysis of both physical and local disks.
- Collected evidence can be further analyzed by searching keywords, filesize,
time, etc.
- Able to retrieve recently deleted files d copy export.
- Able to start PSR to record operating activities.
- Support single, web and other screenshots, enabling users to capture
computer screen and to conduct further OCR analysis.
- Able to operate without installation.
|