FINALForensics is a PC forensic tool for data preservation, data recovery, data analysis, data search, and reporting. FINALForensics detects evidence data by recovering emails, photos, and databases that have been deleted.
The main functions of FINALForensics are as follows:
– Data Preservation
– Data Recovery
– Data Analysis and Search
– Data Analysis Report
■ Data Preservation
FINALForensics takes a hash value to ensure the identity of the data when creating a disk image as evidence. With the memory dump feature, customers can also save the current memory status as a memory dump file.
■ Data Recovery
ata recovery features include the recovery of deleted files, search capabilities for files of which the extension has been changed, recovery from a damaged partition, recovery of deleted email, database recovery, recovery of a Microsoft Office file, and RAID recovery.
■ Data Analysis and Search
File search features include directory search, timeline search, file name search, and specific keyword search. Timeline search is an analysis based on the data recorded within a specified period of time.
■ Data Analysis Report
FINALForensics can add an important evidence files to a bookmark and summarize them in a report. It also outputs the searched data in a summary report.