Elcomsoft Quick Triage 2.01.193 Portable

[SKIKDA]

File size: 274 MB

Elcomsoft Quick Triage is a tool designed to rapidly extract and analyze the most important evidence from a target computer or disk. It is equally effective during on-site operations and in laboratory environments, helping investigators make informed decisions at the earliest stages of an investigation.

Elcomsoft Quick Triage focuses on extracting the most forensically valuable data from Windows systems, covering hundreds of sources while prioritizing artefacts that are critical for early-stage investigations. The tool targets evidence that helps quickly answer key questions about how a system was used, by whom, when, and for what purpose. It processes data from the operating system itself as well as from a wide range of popular applications that may contain information about user activity, communications, file handling, connected devices, and network usage.

Data and Artefacts
With Elcomsoft Quick Triage, investigators can quickly review saved passwords, browsing history, and user activity of the currently logged-in account, examine data from other user profiles on the same system, and analyze evidence contained in mounted disk images. The product focuses on speed, relevance, and ease of use rather than exhaustive analysis.

The tool supports hundreds of system artefacts that allow investigators to reconstruct timelines and system behavior. EQT extracts and analyzes Windows Event Logs, Prefetch, Shimcache, SRUM, Task Scheduler data, application execution traces, crash reports, and other system logs. These artefacts provide insight into program launches, background activity, and overall system usage. The tool helps establish whether external devices were used by collecting information about connected USB storage devices, printers, displays, and other hardware.

Elcomsoft Quick Triage collects and processes a wide range of user-centric evidence. The tool extracts documents and files from user folders, recent files lists, Recycle Bin contents, and artefacts reflecting everyday user actions. It processes data from web browsers, including browsing history, search queries, and saved credentials, as well as data from email clients and instant messengers.

Finally, Elcomsoft Quick Triage pays special attention to credentials and protected data. The tool extracts Windows Vault entries, DPAPI-related data, cryptographic keys, certificates, and user and system credential stores. All artefacts are preserved with clear source attribution and context, allowing investigators to quickly focus on the most relevant evidence and make informed decisions without waiting for a full forensic examination.

System Requirements: Windows 10, 11

Screen :


What's New

SPOILER kinyit

Spoiler
New: Offline decryption support for passwords stored in Chrome and Chromium-based browsers with ABE protection
New: Support for browsers with master passwords (Yandex browser, and all Gecko-based including Firefox)
New: Support for Entra ID and Microsoft Accounts
Workaround: Implemented a workaround for Windows Defender
Workaround: Memory dumps are now temporarily skipped if the Memory Integrity Check is enabled
Improved: The container format, making it much faster, with new indexing
Improved: Data indexing in the Lucene indexing engine (less storage space, faster processing)
Improved: Faster search without the Windows API to skip "offline" files that are not actually synced
Improved: Global search improvements and fixes, alongside smoother progress on data indexing
New: An event viewer for .evtx files with faster search
New: A "data only" source type (when the OS is unknown)
New: Source data mapping in the container
New: Fast export into CSV format
New: Portable version creation
New: An ability to select files or folders to be saved to the container
New: Calculating the disk space needed for project storage
New: Source type information in smart folders
New: All fields now have a type description
New: A "Recent projects" menu
Fixed: Problems with smart folders (improper field names)

HOMEPAGE

A kódrészlet megtekintéséhez be kell jelentkezned, vagy nincs jogosultságod a tartalom megtekintéséhez.

A kódrészlet megtekintéséhez be kell jelentkezned, vagy nincs jogosultságod a tartalom megtekintéséhez.

A kódrészlet megtekintéséhez be kell jelentkezned, vagy nincs jogosultságod a tartalom megtekintéséhez.