AWARD-WINNING ENGINE ARCHITECTURE
LTR Digital Evidence Management Software of the Year • NVIDIA Inception Program
Defensible, cloud-native remote collection paths engineered specifically for enterprise workstations, mobile artifacts, and automated chain of custody.
Full sector-by-sector physical or logical compressed E01 imaging. Leverages Volume Shadow Copy (VSS) to capture open files and locked system volumes without rebooting.
E01 FORMAT
VSS SUPPORT
FULL DISK & LOGICAL
Extracts BitLocker recovery keys directly from volatile RAM in seconds. Automatically captures hardware serial numbers, BIOS metadata, network configs, and OS details into audit logs.
BITLOCKER KEYS
HARDWARE SERIAL #
BIOS AUDIT
Scope forensic acquisition across Windows user profiles, custom file paths, extensions, date ranges, and hash matches. Package acquired ESI in forensically sound 7zip containers or deliver it through Drop&Send links for controlled evidence transfer.
PROFILE SEARCH
FORENSIC 7ZIP
DROP&SEND
Remote iTunes-style logical backup acquisitions executed over-the-air. No hardware shipping, dongles, or custodian downtime required.
OVER-THE-AIR
ITUNES BACKUP
ZERO-HARDWARE
Target any SQLite database on device. Filter communications by Whitelist or Blacklist rules (phone number, email, or name), date ranges, and target time zones across SMS, WhatsApp, and WeChat.
WHITELIST/BLACKLIST
SQLITE SCOPING
TIME ZONE FILTER
Collect iOS Keychain records, Safari history, cookies, GPS locations, notes, call logs, and full user-installed app inventories. Generates court-admissible PDF forensic reports automatically.
KEYCHAIN & GPS
APP INVENTORY
PDF REPORTING
Built-in engine resilience automatically detects machine shutdowns or network outages and seamlessly resumes collections without data corruption or spoliation risk.
FAULT TOLERANT
AUTO-RESUME
Acquire and route forensically sound ESI directly to any cloud storage, an internal network share, or locally attached physical media (encrypted USB). Preserve destination control with AES-256 encryption at rest, TLS 1.3 in transit, and cryptographic chain-of-custody verification.
BYOS S3 DIRECT
FIPS 140-2
TLS 1.3
Executes purely in volatile RAM with no installed software, persistent drivers, or background daemons—leaving target endpoints completely untouched.
ZERO-FOOTPRINT
RAM EXECUTABLE
FRE 901 READY