| Product Type |
|---|
W4 lets investigators review digital evidence rapidly, locate items of interest quickly, and report their findings easily. W4 also gives investigators the ability to create AFF4 images, index live machines, and search data during indexing. This powerful tool enables triage in the field prior to taking data back to the lab for more detailed processing.
Key features of W4
W4 places a wide range of functionalities in the forensic examiner’s hands. It supports a broad range of forensic disk image and cellphone extraction formats and allows investigators to preview and search artifacts during indexing. First results are usually available in a matter of minutes after the indexing has started. W4’s automatic extraction of notable registry artifacts can save the examiner many hours of manual artifacts extraction and data conversion to a human readable format.
- W4’s unique Search Profiles
- Initiate automatic RAM capture on live systems
- Index and/or image live machines
- Search a case during the indexing process
- Detailed timeline of user activity with W4’s unique Events feature
- Display item connections with W4’s unique Links feature
- Prepare cases for more detailed review with Intella
W4 Who? What? When? Where?
- W4 lets investigators review digital evidence rapidly, locate items of interest quickly, and report their findings easily.
- W4 also gives investigators the ability to create AFF4 images, index live machines, and search data during indexing. This powerful tool enables triage in the field prior to taking data back to the lab for more detailed processing.
Using W4
Recipes
W4 uses a fully customizable, pre-determined search functionality to give examiners the ability to identify pertinent information to their case at the click of a button. W4 comes with out-of-the-box recipes designed to locate artifacts for common crimes. Examiners can also create their own custom recipes. These recipes can be used in future cases to save the examiner time.
Triage
W4 can be run as a portable app straight from a USB stick, allowing investigative teams to triage machines in the field. No dongle is required; a license is embedded in the software. With W4, experts can capture live data from machines that are powered on to prevent data loss and preserve that data for further investigation later on.
Links
The Links feature allows the user to find direct and indirect links between artifacts such as USB devices, internet downloads, file access, emails, and documents with just a few clicks. Links provide the user with graphics depicting the connections and relationships between different artifacts. These graphics can be used with W4’s flexible reporting feature to produce easy to understand reports for client or Court purposes.
Events View
The Events View allows users to visualize and annotate individual events in chronological order. Colorized tags simplify the workflow, making it easy to find the pertinent evidence and assemble it for reporting.
Powerful Reporting Capabilities
- Report by items, categories, tags, and custom fields
- Customize timelines with colorized tags and comments
- Report web history and images via configurable display types
- Hyperlinks to the exported files will be included in the report
- An unlimited number of link graphs can be included in the report
- Original format files can be exported along with the report
- Report settings can be reused via our customizable template mechanism
Intella-compatible
W4 cases can be directly ingested and integrated into Intella to expand on analysis and reporting.
W4 Demo
Meet the newest member of the Vound suite of digital forensic software products. See firsthand how W4 can benefit you.
Geolocation
Locate items with geodata on a zoomable world map.
Events view
Unified view of activities and other events in chronological order.
Timeline
Zoom in on a date range and see items and events within that date interval.
Additional W4 Features
- Triage
Quickly identify machines with pertinent case information while in the field using our portable app that can be run directly off a USB drive. - Live Indexing
Enjoy the mobility live indexing offers you. Save time and money by examining your machines in the field instead of waiting for them to be packed up and sent to the lab for investigation. - Data Acquisition
Use W4 to pull disk images, user-defined files and folders, RAM information, and other data types from the machines you are examining. - Recipes
Create custom recipes that allow you to examine specific case types with the click of a single button. - Search and preview
System settings, browser history, device usage, email, attachments, iTunes backups, archives, headers, documents, embedded images, and metadata. - Supported Sources
Support for a wide range of forensic image formats: S01/E01/Ex01/L01/Lx01/AD1/ISO and DD. Support for Windows and MacOS file systems, GPT and MBR partitions, ISO and others. Support for Cellebrite, XRY and Oxygen Forensic Suite reports - Fully customizable reporting
Wizard for reporting relevant artifacts in the case ready for Court, or for your client. - Intella-compatible
W4 cases can be directly ingested and integrated into Intella to expand on analysis and reporting. - Geolocation
Allows to quickly locate items with geodata on a zoomable world map. That includes pictures, emails, cellphone items and Google Maps URLs.
W4 is the Ideal Solution for
- Investigative teams that need to triage live machines in the field
- Law enforcement, government, and corporate entities needing a quick overview of pertinent data
- Investigators and analysts who need a triage to courtroom solution
