CyberCheck is a web based forensic data recovery and analysis tool to enable Law
Enforcement Officers to quickly and efficiently analyse digital evidence files.
The tool has a simple to use web browser based user interface which can be used
by multiple users concurrently.
Data Recovery and Analysis
CyberCheck can analyse TrueBack Images, EnCase Images, Raw Images (dd, bin, raw,
001-Split raw images and Linux DD), Virtual Disk Images-VDI, Virtual Hard Disk-VHD
and VMware-VMDK. It can recover deleted files and folders in a volume and can
detect unallocated and disk slack areas. CyberCheck can perform data carving on
slack areas and has options to do analysis based on file hashes and file's
signature. It supports Unicode and Indian languages with multi lingual
File System Support
CyberCheck supports the analysis of FAT12/16/32, exFAT, NTFS, Linux EXT2/3/4,
UFS, HFS and YAFFS2.
Powerful Search Facility
CyberCheck supports data indexing. The text data in different document file
formats can be indexed. This index-based search gives faster results compared to
conventional search. The search facility of CyberCheck supports adding multiple
keywords, regular expression and fuzzy options with filtering based on date and
file size. CyberCheck has Unicode based searching to find data in any languages,
search based on file hash values and search based on filename with wildcard
Web browser based user interface.
Multiuser solution with multiple case
Sophisticated data carving facility to
carve documents, images, audio and video.
Disk Indexing with stop and resume
Browser analysis feature for extracting
forensically relevant information from Google Chrome, Firefox, Safari and
Communication App analyser for Microsoft
Shell bag Analysis & Anti Forensic
activities detection like Signatures Mismatch analysis and password
protected files detection.
Advanced Timeline Analysis with multiple
Known good file filtering using NSRL
Document language detection.
Recycle bin data extraction.
Recover images from thumbnail database.
Evidence hash verification using MD5,
SHA1, SHA256 and SHA512 algorithms
Can convert proprietary evidence file
formats to raw image.
Integrated viewer for file content, Meta
information, pictures and file hex-values.
Integrated Gallery view for viewing all
pictures in the evidence.
File hash computation in MD5, SHA1,
SHA256 and SHA512 algorithms