Filter, categorize and keyword search registry keys. Work with physical or forensically imaged RAID media, including software and hardware RAID, JBOD, RAID 0, RAID 5, RAID 6. Full access to deleted, system, unallocated, etc. Mount forensic image files as a Windows drive letter (Mount Image Pro). Investigators can search and view data in native language format such as Dutch or Arabic.įEX GUI language can be set to EN, DE, ES, FR, ID, TR, ZH on install (language option set in registry).Įxtract and report file metadata, including EXIF, GPS, MS Office and more. Hash individual files for analysis.Ĭluster, sector, or byte level keyword search of entire media using text, regex or hex expressions.įorensic Explorer is Unicode compliant. Save and load personal work-space configurations to suit investigative needs.Īpply hash sets to a case to identify or exclude known files. L01 forensic evidence files.ĭetach drag and drop views for a customized work-space on multiple monitors. Byte Plot and Character Distribution: Examine individual files using Byte Plot graphs and ASCII character distribution.Įmail support for PST, OST, EDB, MBOX formats. Full keyword and index search capabilities for email.Įxport files to disk, or direct to.File Extent: Quickly locate the location of files on disk with start and end sector runs.Automatically decode values with the data inspector. Text and Hexadecimal: Access and analyze data at a text or hexadecimal.

Filesystem Record: Easily access and interpret FAT and NTFS records.

Display: Display more than 300 file types.

Gallery: Thumbnail photos and image files.

Zoom in and out to graphically map disk usage.

Disk: Navigate a disk and its structure via a graphical view.

File List: Sort and multiple sort files by attribute, including, extension, signature, hash, path and created, accessed and modified dates.Inbuilt data carving tool to carve more than 300 known file types. View and analyze system files, file and disk slack, swap files, print files, boot records, partitions, file allocation tables, unallocated clusters, etc. No major version upgrade costs (valid maintenance give access to the latest build).īookmark, flag, or categorize potential evidence.Īccess all areas of physical or imaged media at a file, text, or hex level.Forensic Explorer includes a stand-alone license of Mount Image Pro.Key Features forensic-explorer-facts-sheet (English)

Encase forensics software