designed for
computer forensic examiners to help organize and speed up the examination of the contents of a hard drive,
forensic sorter allows you to sort the contents of entire hard drives into categories such as video, audio, spreadsheets, etc. so you can easily find what you're looking for. filter out common
windows files,
recover deleted files or
file fragments in slack, deleted, and unallocated space. supports
drive images in raw, pfr (forensic replicator), safeback, and encase
image files. compatible with paraben's p2
forensic examination technology. sorts
files by header not by
file extension. sorts
files from unpartitioned space. identifies encrypted
files for easy
recovery using paraben's decryption collection. all
data output is non-proprietary so any
tool can be used for analysis post sorting. designed for use with paraben's case agent companion. efs
file detection. reads
ntfs compressed files.
ntfs streams support. html reporting. ext 2 & ext 3
partition support. sorts compressed archives such as zip, rar, etc. sorts drives with bad sectors. unicode support.
removable disk support. ole
storage support.palm os
file detection.
chat log
file detection. e-mail examiner & network e-mail examiner supported
file detection. xml output validation.