• Physical drive allocated and unallocated space (compatible with write blockers)
  
• Windows Directory Structure (for CD/DVD, a specific drive or folder or to access Windows Shadow Copy)
  
• Any forensic Images resulting of the acquisition of a drive (EWF: E0*, Ex0*, L0*, Lx0*. RAW: DD, SMART: S0* and AFF)
  

• light and simple proprietary format for import in the LACE solution
  
• Separate results for Images, Videos, and Text files.
  
• Include a log file to review the result of the carving
  
• Include a debug file in case of a problem with specific files
  

• More robust and heavy standardized format to pass digital evidence along
  
• Supported by many forensic and media grading tools like: Xways, Magnet, Hubstream, Griffeye DI and others.
  
• Promoted by International Projects: Project Vic, UK-CAID, Interpol ICSE
  

• Pictures, Videos and Text digital files
  
• In Plain sight
  
• In Windows Volume Shadow Copies
  
• Deleted files (marked for deletion but still intact)
  
• In unallocated space (partially overwritten)
  
• Embedded in other files (PDF, Emails, Word, Powerpoint etc..)
  
• In containers (Zip, RAR, Pst, Sqlite, ISO, BIN, CUE and CD/DVD Images)
  
• Password protected ZIP/RAR files are automatically segregated for further investigation
  
• In Windows Thumbs.db, Thumbscache archives and OS X .DS_Store
  

• very fast by checking only for file extensions
  
• more thorough by verifying the header of every file
  
• byte by byte review to extract embedded files
  

• capability to convert a cell phone forensic UFDR files to either LIA or JSON format.
  
• Can filter out irrelevant/junk files (gifs, icons, borders, edges that accumulate in temp directories)
  
• Ignore movies files when extracting images (multiple .jpg frames)
  
• Filter min/max file size, specific extensions, specific directories
  
• Queue multiple jobs. Save and Load Queue
  
• Batch mode for multiple forensic acquisition (E0*) and recursive batch mode
  
• Apply an Ignore List such as the NRSL Hash Set to exclude know irrelevant files
  

• You can choose to install Lace Server on any current Windows machine running WIN7, WIN8, WIN10, Server2007, or Server2012. Duo-Core CPU minimum, i7 (8 core) recommended, more is better.
  
• 8GB RAM minimum, 16GB recommended, more is better
  
• 2TB HD minimum, more may be required depending upon how you manage your original evidence
  
• Adding a 500GB SSD for use by the database is recommended, reduces case processing time by ~50%, but can be upgraded at any time in the future.
  
• Lace Client will run on any Windows machine, at least 2GB RAM recommended.
  

Idézet:A kódrészlet megtekintéséhez be kell jelentkezned, vagy nincs jogosultságod a tartalom megtekintéséhez.

Idézet:A kódrészlet megtekintéséhez be kell jelentkezned, vagy nincs jogosultságod a tartalom megtekintéséhez.

Idézet:A kódrészlet megtekintéséhez be kell jelentkezned, vagy nincs jogosultságod a tartalom megtekintéséhez.