BlueBear Forensic Carver 12.12.65.0

Following law enforcement numerous requests, Bluebear is releasing a standalone version of its much acclaimed FORENSIC CARVER. Our Forensic Carver has been used in conjunction to our LACE Client-Server Solution for 8 years by partners all over the world to extract Pictures, Videos (and documents) from confiscated digital media.

The world of computer forensic has evolved and experts now use a variety of tools to extract, analyse, categorise/grade, manage digital evidence. By releasing our LACE CARVER as a standalone tool, forensic experts will be able to efficiently extract the evidence and import it using the JSON standard in all the various tools they choose to use to analyse and review the evidence.

Very Affordable, Easy to install, Simple to use, Super Fast and Rock-solid software for carving images and videos (and text documents) from any digital media in a forensically sound manner. The LACE FORENSIC CARVER recognizes over 180 file types covering image, video, text, archive, and database files.

LACE FORENSIC CARVER accepts the following inputs
- Physical drive allocated and unallocated space (compatible with write blockers)
- Windows Directory Structure (for CD/DVD, a specific drive or folder or to access Windows Shadow Copy)
- Any forensic Images resulting of the acquisition of a drive (EWF: E0*, Ex0*, L0*, Lx0*. RAW: DD, SMART: S0* and AFF)

LACE FORENSIC CARVER produces the following outputs

LIA format
- light and simple proprietary format for import in the LACE solution
- Separate results for Images, Videos, and Text files.
- Include a log file to review the result of the carving
- Include a debug file in case of a problem with specific files

Odata JSON format
- More robust and heavy standardized format to pass digital evidence along
- Supported by many forensic and media grading tools like: Xways, Magnet, Hubstream, Griffeye DI and others.
- Promoted by International Projects: Project Vic, UK-CAID, Interpol ICSE

LACE FORENSIC CARVER will extract the following files
- Pictures, Videos and Text digital files
- In Plain sight
- In Windows Volume Shadow Copies
- Deleted files (marked for deletion but still intact)
- In unallocated space (partially overwritten)
- Embedded in other files (PDF, Emails, Word, Powerpoint etc..)
- In containers (Zip, RAR, Pst, Sqlite, ISO, BIN, CUE and CD/DVD Images)
- Password protected ZIP/RAR files are automatically segregated for further investigation
- In Windows Thumbs.db, Thumbscache archives and OS X .DS_Store

LACE FORENSIC CARVER can also

Be Fast and Thorough options
- very fast by checking only for file extensions
- more thorough by verifying the header of every file
- byte by byte review to extract embedded files

Be very efficient
- capability to convert a cell phone forensic UFDR files to either LIA or JSON format.
- Can filter out irrelevant/junk files (gifs, icons, borders, edges that accumulate in temp directories)
- Ignore movies files when extracting images (multiple .jpg frames)
- Filter min/max file size, specific extensions, specific directories
- Queue multiple jobs. Save and Load Queue
- Batch mode for multiple forensic acquisition (E0*) and recursive batch mode
- Apply an Ignore List such as the NRSL Hash Set to exclude know irrelevant files

Technical Requirements
- You can choose to install Lace Server on any current Windows machine running WIN7, WIN8, WIN10, Server2007, or Server2012. Duo-Core CPU minimum, i7 (8 core) recommended, more is better.
- 8GB RAM minimum, 16GB recommended, more is better
- 2TB HD minimum, more may be required depending upon how you manage your original evidence
- Adding a 500GB SSD for use by the database is recommended, reduces case processing time by ~50%, but can be upgraded at any time in the future.
- Lace Client will run on any Windows machine, at least 2GB RAM recommended.

Home Page - https://bb-les.ca/solutions/forensic-carver/