Real Detector

Real Detector is a write blocked tool which allows an investigator to safely examine non volatile data. The function of Real Detector is to quickly collect the following:

(1) Data Collect:

(2) Imaging and Wiping

• Supports Bit-Stream Image
• Image files can be imported into EnCase or FTK.
• Automatically calculate the MD5 hash value of acquired image
• Options to acquire only the file slack or disk unallocated areas.
• Provides wipe function

(3) Information Search

• Provides keyword search functions.
• Provides the search by file name, file size, file signature, last access time, last modified time, file creation time.
• Support the wildcard ‘*’ and Boolean (And/OR/Not) expression.
• Supports Keyword list import/export.
• Supports Important information search pattern:
• IP, URL, Email, ID, Phone number, Name search
• MSN talk records research
• Picture search
• Log search
• Exchange EDB/Lotus Notes NSF files locate
• Thumbs.db file locate
• Support multi-language

(4) Files viewer:

• File viewer up to 100 file formats.
• Quick View for file contents.
• HexCode Viewer.
• Exam the Office document meta data.
• Exam the EXIF meta data for pictures.

(5) Deleted files recovery

• Deleted files recovery for both NTFS and FAT file system.
• Recycle Bin files recovery.
• Display the overwritten files list.
• Support to carve the deleted files from Unallocated disk or Unallocated clusters area.

(6) Provides Analysis Report

(7) Options to burn only the collecting files list and each file’s MD5 hash value only.