- Data capture, analysis, investigation and dissemination
- The most advanced imaging solution available
- An easy-to-use interface
- Five built-in, fast and thorough search engines
- Built-in development environment
- Built-in file viewers for hundreds of file types
- The leading salvage engine
- Extremely fast hash engines and automated data reduction techniques
- Built-in e-mail store processing, searching and viewing
- Filesystem, file and e-mail recovery
- Multiple categorization features
- Registry viewing and searching
- Virus/Trojan search and identification
- VMware virtual disk production from devices or images
- Context dictionary production for password cracking
- IVault data store preparation and production
- Support for all common archive file formats
- Deconstruction of evidentially useful file types
- Sorting, grouping and filtering of files and e-mail.
- Advanced analysis functions
- Advanced MS Outlook e-mail recovery
- Password protected file detection
What Our Customers Are Saying:
"Elliot Thanks. You have made it possible for an entire generation of forensic investigators to exist and have a tool that we could not have obtained in any other way."
- Federal Computer
Introducing ISeekImager, the world’s most unique real time imaging system. ISeekImager is the only software of its type that makes encrypted physical or logical device images in a forensics certifiable form, without requiring software installation or Admin permissions on the subject machine.
ISeekImager provides unparalleled access to systems that are encrypted, or cannot be rebooted in a typical forensics process and are unavailable otherwise.
Disk encryption mechanisms like Bitlocker, Securedocs, Safeboot and others are accessible by API’s, but the largest distribution of Disk encryption currently is Truecrypt which has no access API at all. ISeekImager works in any and all of these systems, including Bitlocker, if they are running, and a logged on user currently is on the machine. Or, where a machine can be booted with normal user status.
ISeekImager also provides clients the ability to define running temp file processes in real time, often active files not otherwise accessible, by allowing access to all data in real time, instead of post-boot analysis. Other methods require API’s because of system shutdowns that may be encountered, in addition to passwords that must be known post imaging, but ISeekImager requires neither. Even in Vista and System 7, the maximum requirement for ISeekImager to run may be knowledge of the Admin login account password. For the first time ever in the field of digital forensics, ISeekImager gives investigators the freedom of needing no installation on the system drive for imaging to occur.