english | bahasa indonesia

BlackBag BlackLight

BlackLight quickly analyzes computer volumes and mobile devices. It sheds light on user actions and now even includes analysis of memory images. BlackLight allows for easy searching, filtering and otherwise sifting through large data sets. It can logically acquire Android and iPhone/iPad devices, runs on Windows and Mac OS X, and can analyze data from all four major platforms within one interface. It’s simply the best option available for smart, comprehensive analysis.

Easily Uncover User Actions
BlackLight’s Actionable Intel view allows examiners to view various data points that can be attributed to a user's actions. Traces of potentially important user activity from many disparate locations are organized for practical, efficient examination. Elements include:
• Windows Registry artifacts - recently executed files and programs, link files, jumplists, Prefetch and Superfetch data
• Device connection data for all devices previously connected to the system, including USB device connection dates/times and the associated user account
• iOS device backups
• Recent file downloads
• Trash (for Mac OS X volumes) and Recycle Bin (for Windows volumes)
• Current and deleted user account info

Analyze Windows Memory Files
• Analyzes several types of memory files, including raw dumps, Hibernation files (Windows Vista to Windows 10), pagefile.sys, and crash dumps (full, from Windows
Vista or 7)
• Performs file carving and bulk extraction content searches (for numerous items such as URLs, addresses, phone numbers, etc.)
• Features a Memory subview for analyzing processes, libraries, sockets, handles, and drivers
• Processes memory files many times faster than traditional open-source forensic tools

Efficiently Sift Through Large Data Sets
BlackLight's signature File Filter view includes examiner-defined filter options to quickly pinpoint relevant data within large data sets. Filter criteria include:
• File name, kind, size, or extension
• Date created, modified, or accessed
• Picture metadata attributes, including GPS coordinates and camera (iPhone/iPad device) type
• Positive and negative hash set filtering

Examiners may apply any number of filters or inverse filters to quickly isolate important data from system files or base application files. BlackLight comes with several pre-set file filters, including those that filter by file type, file attribute, geolocation coordinates, and source device type.

Find the Picture and Video Evidence You Need
BlackLight's Media view has built-in support for all commonly used picture and video file types, and it includes several helpful and examiner-oriented analysis features, such as:
• Built-in GPS Mapping
• Proprietary Skin Tone Analysis Algorithm
• Video Frame Analysis

Recover Every Message from the Most Common Source
The Communication view in BlackLight allows examiners to see a full log of calls, voicemail, social media activity, and more. Most importantly, examiners can view messaging threads in list view or in their native format, with support for data from:
• Text Services (SMS/MMS, iMessage)
• Messaging Apps (Skype, Kik, TextPlus, TextFree, Tango)
• Social Media (Facebook, Twitter, LinkedIn, Foursquare/Swarm)

Customize Your Report
BlackLight is designed to make reporting incredibly flexible. Examiners may export large data sets in an easily readable format, and can export reports in a variety of formats to enable easy information sharing with all interested third parties. With BlackLight's Report view, you can:
• Easily tag evidence and include any and all relevant metadata in the examiner report
• Export your report in your choice of formats, including .pdf, .html, .docx, and .txt
• Export eDiscovery data to a generic Concordance load file that is compatible with all major review platforms
• Mask (blur) sensitive data contained within examiner reports that may be shared with non-authorized third parties