Windows, Mac and iOS Automated Analysis
We understand that some examiners actually like their families and would like to see them sometimes. For those examiners who want to be home in time for dinner we built-in automated parsing of hundreds of Windows, Mac and iOS artifacts.
Additionally, we added crazy Timeline Analysis not found anywhere else to "tell the story" in the order as it occurred. Our timeline is constructed with over 90 timestamps! We also added graphs to help you visually find and report on the artifacts recovered.
Mac Magic... Apple Extended Metadata
All Mac operating systems since April 2005 have been creating an additional database of information about its files that can answer important questions and solve cases. Apple Extended Metadata can tell you the origins of a file, who sent it, when it was downloaded, how it was received, when it was viewed, opened by a human and more.RECON was the first to identify, parse and report on Apple Extended Metadata natively.
Reports for the 21st Century
Bookmark, report... Bookmark, report... Bookmark, report... so draconian.
Imagine a new type of reporting where you have control over the report... the entire report and anything in it! RECON LAB includes a fully functional integrated report editor called Story Board.
Not only does Story Board allow you to edit anything in your report inside RECON LAB it can also sort your bookmarked or tagged data chronologically! This way you can tell the "story" from its beginning to its end in the proper order.
Hex, SQLite, Plist, Text, Strings, Exif, Geodata... Viewers Galore!
No shortage of viewers in RECON LAB!
RECON LAB contains integrated viewers for every type of data. Additionally, advanced viewers such as our SQLite Viewer allow you to run SQLite queries inside RECON LAB for advanced analysis and reporting!
Fancy macOS Plists? We have a viewer for that as well with built-in search, bookmark and reporting tools.
RECON LAB runs on a Mac to allow recovery of data missed by other forensic tools.
Minimum recommended system requirements is a Macintosh with an i7 quad-core processor and 16GBs of RAM.
- Three Stage Processing - Fully Automated, Semi-Automated and Manual analysis
- Automated Processing of Hundreds of Apps - Windows, macOS and iOS Artifacts
- See Everything - Recover and analyze Apple Extended Metadata missed by other Forensic Tools
- Save Time - Advanced Filters and Pre-Process settings let you begin your case faster.
- Advanced Sort and Filter Options - Sort and Filter by Automated Results, Metadata and Apple Extended Metadata
- Advanced Reporting with Integrated Built-in Editor
- RAM Analysis for Windows and Mac
Please contact us below for more information.