Computer Forensics Software

Looking for an alternative to Encase or FTK?

Forensic Explorer is a tool for the preservation, analysis and presentation of electronic evidence. Primary users of this software are law enforcement, government, military and corporate investigations agencies.

Forensic Explorer combines a flexible graphic user interface (GUI) with advanced sorting, filtering, keyword searching, previewing and scripting technology. It enables investigators to:

  • Manage the analysis of large volumes of information from multiple sources in a case file structure;
  • Access and examine all available data, including hidden and system files, deleted files, file and disk slack and unallocated clusters;
  • Automate complex investigational tasks;
  • Produce detailed reports; and,
  • Provide non forensic investigators a platform to easily review evidence.

Forensics Explorer supports the analysis of the following file formats:

  • DD or RAW;
  • EnCase® (.E01, .L01 formats [Ex01 coming soon] );
  • FTK® (.E01, .AD1 formats);
  • Forensic File Format .AFF
  • SMART®
  • ISO (CD and DVD image files);
  • VMWare®
  • ProDiscover®
  • Microsoft VHD
  • Apple DMG

Forensic Explorer supports analysis of:

  • Windows FAT12/16/32/exFAT, NTFS,
  • Macintosh HFS, HFS+
  • Hardware and Software RAID: JBOD, RAID 0, RAID 5

Key Forensic Explorer features include:

Fully Customizable Interface: The forensic explorer interface has been designed for flexibility. Simply drag, drop and detach windows for a customized workspace. Save and load your own workspace configurations to suit investigative needs.

International Language Support: Forensic Explorer supports Unicode. Investigators can search and view data in native language format such as Dutch or Arabic.

Complete Data Access: Access all areas of physical or imaged media at a file, text, or hex level. View and analyze system files, file and disk slack, swap files, print files, boot records, partitions, file allocation tables, unallocated clusters, etc.

Powerful Scripting language: Automate analysis using a provided script library, or write your own analysis scripts. Automate tasks such as:

  • Locate and interpret Windows link files;
  • Run skin tone analysis on graphics files;
  • Pull time user, hardware and time zone information from the registry;
  • Locate and analyze transcripts from Internet chats; etc.

Data Views: Powerful data views including:

  • Table: Sort and multi sort files by attribute, including, extension, signature, hash, path and created, accessed and modified dates.
  • Disk: Navigate a disk and its structure via a graphical view. Zoom in and out to graphically map disk usage.
  • Gallery: Thumbnail photos and image files.
  • Display: Display more than 300 file types. Zoom, rotate, copy, search.
  • Filesystem Record: Easily access and interpret FAT and NTFS records.
  • Text and Hexadecimal: Access and analyze data at a text or hexadecimal. Automatically decode values with the data inspector.
  • File Extent: Quickly locate the location of files on disk with start and end sector runs.
  • Byte Plot and Character Distribution: Examine individual files using Byte Plot graphs and ASCII character distribution.

RAID Support: Work with physical or forensically imaged RAID media, including software and hardware RAID, JBOD, RAID 0 and RAID 5.

Filters: Filters enable the investigator to reduce the amount of information visually displayed. They are script driven and custom filters can easily be created and applied.

Hashing: Apply hash sets to a case to identify or exclude known files. Has individual files for analysis.

Keyword search: Sector level keyword search of entire media using GREP expressions.

Keyword index: Built in DTSearch index and keyword search technology.

Case Notes and Reporting: Add case notes to identify evidence and include case notes in a custom report builder.

Data Recovery and Carving: Recover folders, files and partitions. Use an inbuilt data carving tool to carve more than 300 known file types or script your own.

File Signature Analysis: Forensic Explorer can automatically verify the signature of every file in a case and identify those mismatching file extensions.