Live Boot

Boot forensic image files and view electronic evidence in-situ in a forensically sound virtual environment.

Boot both Windows (all versions) and Macintosh computers.

Live Boot gives the investigator a unique perspective into a suspects computer use. It is both an effective investigations tool as well as a means by which compelling evidence can easily be presented to a client, judge or jury.

Common uses of Live Boot are:

  • Bypass or break Windows user-account passwords;
  • Quickly analyze desktop layout and organizational structure;
  • Run installed programs, including proprietary software such as accounting packages;
  • View in situ MRU lists and other forensic artifacts;
  • Revert to Windows Restore Points;
  • and more.

Live Boot utilizes Mount Image Pro (included with a Forensic Explorer purchase) and VMWare or VirtualBox to give fast and reliable access to the virtual environment of a suspects computer.

Stand Alone Deploy

Reduce case load by creating a stand-alone deploy-able Live Boot for non technical investigators to review a suspects computer (see video below). The deployed Live Boot Session requires only Mount Image Pro (MIP) and VirtualBox to be installed. Additional MIP "Live Boot Deploy" licenses are available on purchase of Forensic Explorer or at

AFP Secret Service DHS Deloitte NYS Police NSW Police Microsoft SA Police DOJ InterPol HK Customs