LACE FORENSIC CARVER
Following law enforcement numerous requests, Bluebear is releasing a standalone version of its much acclaimed FORENSIC CARVER. Our Forensic Carver has been used in conjunction to our LACE Client-Server Solution for 8 years by partners all over the world to extract Pictures, Videos (and documents) from confiscated digital media.
The world of computer forensic has evolved and experts now use a variety of tools to extract, analyse, categorise/grade, manage digital evidence. By releasing our LACE CARVER as a standalone tool, forensic experts will be able to efficiently extract the evidence and import it using the JSON standard in all the various tools they choose to use to analyse and review the evidence.
Very Affordable, Easy to install, Simple to use, Super Fast and Rock-solid software for carving images and videos (and text documents) from any digital media in a forensically sound manner. The LACE FORENSIC CARVER recognizes over 180 file types covering image, video, text, archive, and database files.
LACE FORENSIC CARVER accepts the following inputs
- Physical drive allocated and unallocated space (compatible with write blockers)
- Windows Directory Structure (for CD/DVD, a specific drive or folder or to access Windows Shadow Copy)
- Any forensic Images resulting of the acquisition of a drive (EWF: E0*, Ex0*, L0*, Lx0*. RAW: DD, SMART: S0* and AFF)
LACE FORENSIC CARVER produces the following outputs
- LIA format
- light and simple proprietary format for import in the LACE solution
- Separate results for Images, Videos, and Text files.
- Include a log file to review the result of the carving
- Include a debug file in case of a problem with specific files
- Odata JSON format
- More robust and heavy standardized format to pass digital evidence along
- Supported by many forensic and media grading tools like: Xways, Magnet, Hubstream, Griffeye DI and others.
- Promoted by International Projects: Project Vic, UK-CAID, Interpol ICSE
LACE FORENSIC CARVER will extract the following files
- Pictures, Videos and Text digital files
- In Plain sight
- In Windows Volume Shadow Copies
- Deleted files (marked for deletion but still intact)
- In unallocated space (partially overwritten)
- Embedded in other files (PDF, Emails, Word, Powerpoint etc..)
- In containers (Zip, RAR, Pst, Sqlite, ISO, BIN, CUE and CD/DVD Images)
- Password protected ZIP/RAR files are automatically segregated for further investigation
- In Windows Thumbs.db, Thumbscache archives and OS X .DS_Store
LACE FORENSIC CARVER can also
- Be Fast and Thorough options
- very fast by checking only for file extensions
- more thorough by verifying the header of every file
- byte by byte review to extract embedded files
- Be very efficient
- capability to convert a cell phone forensic UFDR files to either LIA or JSON format.
- Can filter out irrelevant/junk files (gifs, icons, borders, edges that accumulate in temp directories)
- Ignore movies files when extracting images (multiple .jpg frames)
- Filter min/max file size, specific extensions, specific directories
- Queue multiple jobs. Save and Load Queue
- Batch mode for multiple forensic acquisition (E0*) and recursive batch mode
- Apply an Ignore List such as the NRSL Hash Set to exclude know irrelevant files
