• Advanced logical acquisition of iOS, Android, and Chrome OS data up to 4GB per minute
• Scan and Image Chrome OS computers such as Chromebooks
• Live Preview Mode – View phone content immediately without waiting for a backup or imaging to finish
• Highly configurable artifact and file collection including web browser cached files, social media, P2P, Cryptocurrency, cloud storage, user login events, anti-forensic traces, saved credentials, files shared via Skype, USB history, user connection log, etc.
• Screen Recording for Android, iOS, and Chrome OS Devices (up to Android 14 and iOS 17)
• Auto-scroll when taking screenshots of long pages on Android
• Support for the Developer Mode on iOS 17 and Android 14
• Scan and acquisition support for iOS 17 and Android 14
• Discover remote Mac OS agents automatically
• Image live macOS computers via our remote agent and create an AFF4 logical image
• Capture and organize screenshots of connected mobile devices while navigating with automatic processing to extract and index text for search, annotation, and reporting
• Recover call records, messages, saved contacts, and calendar data
• Recover WiFi connections, installed applications and Android user accounts
• Recover pictures, videos, audio files, documents, and user-defined file types
• Recover database files and Property Lists for later review
• Recover browsers, browsing history, download history, search terms, form data, bookmarks, and more
• Recover and process deleted partitions
• Capture Revolut mobile app data and organize it in a financial transactions table (iOS)
• Search for specific information using keywords, regular expressions, hash values, and PhotoDNA
• Identify files or artifacts containing terms related to child exploitation
• Automatically encrypt backup to obtain more data on iOS devices
• Capture RAM and volatile memory
• Rapidly search suspect media using large hash sets (>100 million), including VICS 2.0 and CAID
• Find relevant files and artifacts using powerful keyword and regular expression search capability
• Collect password-protected and corrupted files for later review
• Collect iOS backups on target computers
• Recover deleted records from apps using the SQLite database
• Supports collection of artifacts from Windows and macOS (including T2 and M1 chips)
• Image drives out-of-the-box with image verification and imaging log file
• Recover images from unallocated drive space
• Detect and warn of BitLocker and FileVault2-protected drives
• Search and collect emails: MS Outlook, Windows Mail, Windows Live Mail 10, Apple Mail
• Investigate attached devices, live powered-on computers, boot scans from powered-off computers, forensic images, contents of folders, and network shares (including NAS devices)
• Prepare a Collection Key without Search Profiles to select Captures just before a scan
• Protect the Collection Key with BitLocker
• Ability to borrow license tokens for Collection Keys
• Scan full mobile device acquisitions and detect keychain/keystore files (GrayKey, UFED)
• Deploy user-created Captures to the Collection Key when not using Search Profiles
• Process logical images from the data container
• Create new log files for logical images
• Simplified data container to store Mac logical images
• Use password and recovery key to decrypt and scan or image BitLocker volumes including those using the new AES-XTS encryption algorithm introduced in Windows 10
• Process APFS partitions, NTFS, FAT, HFS+, EXT, ExFAT, and YAFFS2 file systems, compute MD5 and SHA1 on collected files for integrity validation
• Leverage the powerful boot capability (including UEFI secure boot and Macs) to access internal storage that cannot easily be removed from computers
• Direct access to the new Capture screen with the ability to define the time range of data collection, define collection per app in a Search Profile, select Captures and apps before a live or boot scan, and exclude folders from the scan

• Leverage facial analysis age detection to quickly sort and identify infants, toddlers, children, and adults
• View results while a scan is running
• View chat conversations with bubbles to easily identify the senders and receivers with “Message Thread” hyperlink to select individual conversations
• Filter search results with sorting and search capabilities (dates, hash values, tags, text filters, and more)
• Search scan results using keywords, with results categorized by record type
• View pictures and videos organized by visual classes such as people, faces, currency, weapons, vehicles
• View links between files of interest and user’s activities such as recently accessed files, downloaded files, attachments, and more
• View highlighted encrypted files in the scan summary
• Redact previews when exporting a report
• The ability to Undock Frames panel tab
• Inspect video using comprehensive video preview and frame extraction
• Automatically tag hash and keyword matches
• Define new file types and select individual ones to be processed
• Display provenance, including comprehensive metadata, of all relevant files and artifacts
• Reorder or disable post-scan tasks (classification of pictures, videos, or entity extraction) to run in the Viewer
• ADD-ON: Entity Extraction and Language Translation Gisting (230 languages) available

Triage-G2^Ⓡ  PRO lets you export intelligence and evidence and create reports for military prosecutors and other field investigators.

• HTML, PDF, and CSV Reporting Options
• Customize your report to show specific columns and redact pictures
• Precisely select which files and artifacts to export
• Present information in a table or list
• Include original files or previews only
• Share portable reports with a standalone viewer (no license required to view, analyze, and tag)
• Export in JSON format
• Export to other forensics applications with VICS / Project VIC (JSON) or CSV formats