ProDiscover^® Investigator is a powerful computer forensic tool that enables corporate security professionals to remotely investigate the disk contents of systems throughout your network to check for illegal activity or for compliance to company policy and to gather evidence for potential use in legal proceedings.

Features and Benefits:

• Speed investigations and save travel costs by forensically examining live systems throughout your network.
• Utilizes remote agent to read suspect disk at bit level, enabling you to examine all the contents of the suspect disk, including HPA and Windows NT/2000 Alternate Data streams.
• Remote agent may be pushed out, installed, and run remotely in Stealth mode (with System Administrator privileges) to avoid detection.
• All data transferred over the network may be protected with 256 bit AES or Twofish encryption.
• Preview and search suspect files to find evidence quickly and without altering any data or metadata.
• Automatically creates and records MD5, SHA1, or SHA256 hashes of evidence files to prove data integrity.
• Image live memory and entire suspect disk, including hidden HPA section (patent pending), for further analysis.
• Maintains multi-tool compatibility by reading and writing images in the pervasive UNIX® dd format.
• Examine FAT12, FAT16, FAT 32 and all NTFS file systems including Dynamic Disk and Software RAID for maximum flexibility.
• Examine Sun Solaris UFS file system and Linux ext2 / ext3 file systems.
• Integrated graphics thumbnail viewer and registry viewer.
• Integrated Windows log file viewer.
• Extract Internet history.
• Utilize Perl scripts to automate investigation tasks.
• Extracts EXIF information from JPEG files to identify file creators.
• Linux boot disk provided to image systems without removing hard disk drive.
• Automated report generation in XML format saves time, improves accuracy and compatibility.
• GUI interface and integrated help function assure quick start and ease of use.
• Designed to NIST Disk Imaging Tool Specification 3.1.6 to insure high quality.

ProDiscover^® Investigator is a key tool for effective internal investigations. It is not possible to hide data from ProDiscover as it reads the disk at the sector level, circumventing the standard file system. This allows ProDiscover to recover deleted files, look in slack data and even the HPA section of disk as well as examine Windows Alternate Data Streams. This unique approach also allows you to examine the files without altering any valuable metadata such as last time accessed. ProDiscover^® Investigator will not alter any data on the disk - period!

ProDiscover^® Investigator lets you search through the entire disk for keywords and phrases with full Boolean capability to find the data you want. You can use the hash comparison capability to find known illegal files or to weed out known standard operating system files utilizing data provided by the National Drug Intelligence Center in their Hashkeeper database. ProDiscover^® Investigator's powerful search capability is fast and flexible, allowing you to search for words or phrases anywhere on the disk, including the slack space. The extensive on-line help capability and easy to use GUI interface allow you to quickly start using ProDiscover^® Investigator.

ProDiscover^® Investigator automatically creates evidentiary quality reports needed to document your results, complete with every file and hash signature where evidence was found. This saves time and prevents errors which might compromise your case.

Questions and Answers:

ProDiscover^® Investigator Questions and Answers

Support Policy:

ProDiscover^® Investigator Product Support Policy

Downloads:

Download the ProDiscover^® Investigator Product Information Sheet

Download the ProDiscover^® Investigator Remote Analysis and Imaging Application Note

Download the ProDiscover^® Family Guide

Download the ProDiscover^® Investigator Product Demo

Independent Validation:

ProDiscover^® has been utilized by professionals to find evidence for civil and criminal proceedings. An Independent Review of Forensic Tools was recently published by Mark Scott on the SANS web site validating the ProDiscover imaging process.

Read the review: Independent Review of Forensic Tools

The Dartmouth Institute for Security Technology Studies report Law Enforcement Tools and Technologies for Investigating Cyber Attacks - Gap Analysis Report ranks ProDiscover^® as meeting the greatest number of needs for Preliminary Investigation and Data Collection.

Read the report: Law Enforcement Tools and Technologies for Investigating Cyber Attacks - Gap Analysis Report

Order:

Order ProDiscover^® Investigator

System Requirements:

• Windows 98SE/NT/2000/2003/XP
• 800 MHz or higher Pentium-compatible CPU
• 256 MB RAM (512 MB recommended)
• 25 MB available hard-disc space
• CD-ROM or DVD-ROM drive
• VGA or higher resolution monitor
• Keyboard and Mouse (or compatible pointing device)

Includes Technology From:

License:

Each copy of ProDiscover^® Investigator is licensed to be installed on up to three systems but only one copy may be operated at a time. The PDServer remote agent is licensed to be used on an unlimited number of systems, but only one copy may connect with the ProDiscover console at a time. Site, Enterprise and Source licenses are also available for ProDiscover^® Investigator.