field forensic software configuration.

Field Forensic offers the forensic investigator a powerful and versatile platform for forensic data seizure and analysis. Field Forensic comes with necessary software required for Forensic acquisition of data, Software Write Blocker, Cloning Software with hashing and Drive Sanitization so you are prepared for your next case.

MOBILedit Forensic Express is a phone extractor, data analyzer and report generator all in one solution. A powerful 64-bit application using both the physical and logical data acquisition methods, MOBILedit is excellent for its advanced application analyzer, deleted data recovery, live updates, wide range of supported phones including most feature phones, fine-tuned reports, concurrent phone processing, and easy-to-use user interface. With the password and PIN breaker you can gain access to locked ADB or iTunes backups with GPU acceleration and multi-threaded operations for maximum speed.

Forensic Express offers maximum functionality at a fraction of the price of other tools. It can be used as the only tool in a lab or as an enhancement to other tools through its data compatibility. When integrated with Camera Ballistics it scientifically analyzes camera photo origins.

Write Blocker

Write Blocker: Field Forensic comes equipped with Write blocker software. Faster Than Hardware. SAFE Block allows for write locked, Windows- based, disk imaging speeds that are significantly faster than imaging in Windows using commercially available hardware-based write blockers. Programmable "Suspect" Drive Ports: The flexible design allows any Evidence port to be configured as the "Suspect" port.

SAFE Block Is Application Independent:
SAFE Block is application independent and works with all forensic acquisition, triage and analysis applications that run on your Windows forensic workstations.

SAFE Block Blocks Multiple Devices.
SAFE Block provides the ability to simultaneously write block as many disk devices as are connected to a computer without the need for multiple expensive hardware write blocking devices. Attach 20 hard drives and rebuild a RAID all while write-blocked. There is no limit to what you can protect!

SAFE Block Does Automatic Write Blocking.
SAFE Block provides automatic write blocking of every directly attached flash and disk media, attached with any interface, including IDE (PATA & SATA), SCSI, FC, SAS, M.2, NVMe, USB, USB-C and IEEE1394. The user controls automatic write blocking policies for fixed and/or removable disks. The user can have SAFE Block remember individual device's blocked or un-blocked status for ease of use on media repeatedly used on a workstation.

SAFE Block Blocks Multiple Devices.
SAFE Block provides the ability to simultaneously write block as many disk devices as are connected to a computer without the need for multiple expensive hardware write blocking devices. Attach 20 hard drives and rebuild a RAID all while write-blocked. There is no limit to what you can protect!

SAFE Block Is Simple.
SAFE Block is a simple Windows GUI interface that allows the user the ability to block and un-block any disk or flash storage device detected by Windows. Devices are listed in a tree by type (USB, SCSI, IDE) and, where appropriate, by controller and channel.

SAFE Block Passes every NIST validation test.
SAFE Block is used throughout the world by law enforcement and is the only Windows software write blocking tool in the industry that is forensically sound and passes every NIST validation test. Confirm this yourself using the freely available CRU write block validation tool and compare the results with any other software write blocking tool or method available.

SAFE Block Is Faster Than Hardware:
SAFE Block allows for write blocked, Windows-based, disk imaging speeds that are significantly faster than imaging in Windows using commercially available hardware-based write blockers.

Forensic Imaging

Miray Evidence: Field Forensic is equipped with Miray Evidence forensic imaging, cloning software, which create forensic images to secure, analyses and process evidence with other tools you will find in other traditional forensic file formats, including verification, checksums, and PDF reports. Miray Evidence support Checksums: SHA-1, SHA-256, SHA-512, MD5, CRC32

Miray Evidence: For special use cases, file system-oriented formats such as VMDK, VHD, VHDX and VDI are available, as well as SmartImage. These formats are especially efficient when it comes to storage space and time requirements, if the legal securing of evidence is not a priority.

File Format

Forensic formats: AFF, E01, Ex01
VM Image Formats: VMDK, VHD, VHDX, VDI
Proprietary Formats: SmartImage, BitImage
File systems: NTFS, FAT, ExFAT, HFS+

With Miray Evidence images can be created in the formats RAW/ DD, BitImage (with compression optional), as well as various virtual machine formats. These are also bit-wise identical to the master.

Extensive Software Features

The software package includes additional tools for reconciling disks and existing images, separate checksum calculations, etc.

Checksums and Verification

Data verification and various checksums calculations are available to ensure imperative reliability, evidence security and verifiability of the forensic work.

Checksums: SHA-1, SHA-256, SHA-512, MD5, CRC32