Windows, Mac and iOS Automated Analysis
We understand that some examiners actually like their families and would like to see them sometimes. For those examiners who want to be home in time for dinner we built-in automated parsing of hundreds of Windows, Mac and iOS artifacts.
Additionally, we added crazy Timeline Analysis not found anywhere else to "tell the story" in the order as it occurred. Our timeline is constructed with over 90 timestamps! We also added graphs to help you visually find and report on the artifacts recovered.
Mac Magic... Apple Extended Metadata
All Mac operating systems since April 2005 have been creating an additional database of information about its files that can answer important questions and solve cases. Apple Extended Metadata can tell you the origins of a file, who sent it, when it was downloaded, how it was received, when it was viewed, opened by a human and more.RECON was the first to identify, parse and report on Apple Extended Metadata natively.
Reports for the 21st Century
Bookmark, report... Bookmark, report... Bookmark, report... so draconian.
Imagine a new type of reporting where you have control over the report... the entire report and anything in it! RECON LAB includes a fully functional integrated report editor called Story Board.
Not only does Story Board allow you to edit anything in your report inside RECON LAB it can also sort your bookmarked or tagged data chronologically! This way you can tell the "story" from its beginning to its end in the proper order.
Hex, SQLite, Plist, Text, Strings, Exif, Geodata... Viewers Galore!
No shortage of viewers in RECON LAB!
RECON LAB contains integrated viewers for every type of data. Additionally, advanced viewers such as our SQLite Viewer allow you to run SQLite queries inside RECON LAB for advanced analysis and reporting!
Fancy macOS Plists? We have a viewer for that as well with built-in search, bookmark and reporting tools.
Recon Imager Pro
RECON IMAGER PRO allows you to customize what is imaged by selecting whatever files or folders that are of interest to you.
Additionally, we have added the ability to automatically collect macOS artifacts for all user accounts or just one which can be processed automatically in RECON LAB!
New with Version 4! Image across a network to an evidence server or NAS!
Please contact us below for more information.