LINDON, Utah--(BUSINESS WIRE)--AccessData announced the release of Forensic Toolkit® (FTK ®) 3.2, which offers yet another industry-first capability. Previous releases of FTK® placed AccessData's flagship product ahead of other computer forensics solutions by delivering distributed processing, integrated RAM analysis, integrated optical character recognition, and integrated decryption of encrypted archives. This 3.2 release of the industry-standard computer forensics solution delivers several new enhancements, and is now the only commercial computer forensics product to analyze 64-bit Windows memory. "We at AccessData are committed to providing the most advanced computer forensics technology to aid law enforcement, government and corporate investigators, as well as consultants, with complex investigations and burgeoning workloads. We pride ourselves on having the best product in the industry," said Brian Karney, President and COO of AccessData. New features of FTK® include the following:
NEW FILE SYSTEM, FORENSIC IMAGE AND FILE SUPPORT
- Create and process Advanced Forensic Format (AFF) images.
- Process and analyze DMG (compressed and uncompressed), Ext4, exFAT, VxFS (Veritas File System), Microsoft VHD (Microsoft Virtual Hard Disk), and Blackberry IPD backup files.
- Sophos Enterprise and S/MIME decryption support with proper credentials.
ENHANCED WINDOWS MEMORY ANALYSIS:
- AccessData now offers the first and ONLY commercial computer and enterprise forensics products with 64-bit memory analysis.
- Ability to identify/display kernel structures involved with network miniport and file system filter drivers.
- SSDT/IDT/IRP hook detection.
EVEN GREATER PROCESSING SPEED AND FLEXIBILITY:
- Processing speed for email archives, such as PSTs, EDBs and NSFs, has been increased by more than 200%. (Processing performance is dependent on the hardware being used.)
- New selective archive expansion allows a user to define "drill down" options and specify which files are expanded during processing (i.e. only ZIP and PST files).
ADVANCED EMAIL ANALYTICS:
The email items tree view is completely refreshed:
- Email By Date -- organized by Year, then by Month, then by Date for both Sent and Received.
- Email Addresses -- organized by Sender/ Recipient, and subcategorized by Date, Email Domain, Display Name and Email Address.
PHYSICAL AND VIRTUAL DEVICE MOUNTING
- Safely mount a forensic image (AFF/DD/E 01/S01) as a physical device. Any tool that enumerates devices can find it, such as FTK® Imager. Forensic images can also be booted in VMWare.
- Mount a logical image (AD1/L01) and physical image (AFF/E01/DD/S01) as a virtual device or volume. Once mounted, the read-only media is available to any third-party Windows application and exposes the same file system artifacts as FTK®. For example, you can mount an HFS+ image, and it will show up as a volume on the examiner's machine in the explorer view.
- Quickly restore a forensic image to media for distribution or processing with other tools, etc. This feature works with several types of forensic images.
AccessData has pioneered digital investigations for more than twenty years, providing the technology and training that empower law enforcement, government agencies, and corporations to perform thorough computer investigations of any kind with speed and efficiency. Recognized throughout the world as an industry leader, AccessData delivers state-of-the-art computer forensics, cyber security, eDiscovery, password cracking and decryption solutions. Its Forensic Toolkit® and network-enabled enterprise solutions allow organizations to preview, search for, forensically preserve, process and analyze electronic evidence. AccessData’s solutions address criminal and internal investigations, incident response, eDiscovery, and information assurance. In addition, AccessData is a leading provider of digital forensics training and certification with its much sought after AccessData Certified Examiner® (ACE®) program. For more information on AccessData visit www.accessdata.com.