Desktop Triage
- Supports Windows systems in a booted state to collect key digital evidence.
- Quickly performs a thorough search of the hard drive to uncover any suspicious areas.
- Automatically captures web pages and scrolling screenshots, preserving firsthand information.
Desktop Triage is a field evidence collection and trace analysis tool designed to minimize the impact on target evidence while quickly and thoroughly collecting critical digital evidence to external devices. It generates file hashes to ensure the data's integrity as evidence. For hard drives, it searches for and copies deleted and important files. Special focus is placed on collecting both non-volatile and volatile evidence, constructing a timeline to understand potential criminal activity. Screenshots, OCR technology, and step-by-step recording procedures are also employed to generate valid reports, preventing future disputes.
- Supports a Chinese-language user interface.
- Supports the collection of volatile digital evidence, including data
that
disappears after shutdown, such as:
- Processes
- Network Resources
- Network Connections
- Opened Files
- ARP Cache
- Supports the collection of non-volatile digital evidence, including:
- System Services
- Detailed System Services
- Startup Programs
- Wireless Information
- Installed Software
- System Info
- USB Device Info
- Shortcuts
- User Profiles
- MUI Cache
- Prefetch
- Security Logs
- Application Logs
- System Logs
- Task Scheduler
- User Assist
- ShellBags
- Recent Files
- JumpList
- Windows Activity
- Network Usage
- Browser support:
- Firefox: Login credentials, browsing history, bookmarks, cache, and cookies
- Chrome: Login credentials, search history, download and browsing history, bookmarks, cache, and cookies
- Edge: Login credentials, browsing history, bookmarks, cache, and cookies
- Internet Explorer: Cache and browsing history
- Collected host information supports overall timeline analysis, displaying a graphical timeline, and allows for time range filtering by dragging directly on the timeline.
- Includes the ability to create critical logical images, packing key files from critical paths on the hard drive.
- Supports exporting collected evidence results in CSV format.
- Provides analysis capabilities for both physical and logical disk data.
- After analysis, file information can be searched by keywords, file size, time, and other related data.
- Includes functionality to recover deleted files and copy regular files.
- Includes a Windows step-recording program to track and record operations.
- Supports single screenshots, webpage captures, and other types of screenshots, with OCR capabilities for text recognition in captured images.
- The software can be run directly without installation.