GetData Forensic Explorer (FEX)

GetData Forensic Explorer (FEX) is advanced digital forensic software designed for law enforcement, IT experts, and security professionals. It combines an intuitive interface with powerful features.

Included Licenses:

• Comes with standalone licenses for: FEX-Triage, FEX-CLI, and Mount Image Pro (MIP).

• No major version upgrade costs; valid maintenance grants access to the latest build.​

Software Features:

• Anti-Virus: Integrated Cisco Clam anti-virus for scanning digital evidence.​

• Automated Analysis: Utilizes advanced image recognition with high detection accuracy and near-zero false positives. Includes a CSAM detection add-on for law enforcement.​

• Bookmarking: Bookmark, flag, or categorize potential evidence for easy reference.​

• Case Management: Create, save, and load case files to manage investigations efficiently.​

• Data Access: Access all areas of physical or imaged media at file, text, or hex levels. Analyze system files, file and disk slack, swap files, print files, boot records, partitions, file allocation tables, unallocated clusters, and more.​

• Data Carving: Built-in tool to carve over 300 known file types from unallocated space.​

• Data Views: Powerful data views including:

  • File List: Sort files by attributes like extension, signature, hash, path, and timestamps.

  • Disk View: Graphically navigate disk structures and map disk usage.

  • Gallery View: Thumbnail display of photos and image files.

  • Display View: View over 300 file types; zoom, rotate, copy, search, and play media files.

  • Filesystem Record: Access and interpret FAT and NTFS records easily.

  • Text and Hexadecimal View: Analyze data at text or hex levels with automatic value decoding.

  • File Extent: Locate file positions on disk using start and end sector runs.

  • Byte Plot and Character Distribution: Examine files using byte plot graphs and ASCII character distribution.​

• Email Analysis: Support for PST, OST, EDB, and MBOX formats with full keyword and index search capabilities.​

• Export Options: Export files to disk or directly to .L01 forensic evidence files.​

• Graphical User Interface (GUI): Customize workspace with detachable, drag-and-drop views across multiple monitors. Save and load personal workspace configurations.​

• Hashing: Apply hash sets to identify or exclude known files. Supports:

  • Cryptographic Hashes: MD5, SHA1, SHA256, CRC.

  • Similarity Hashes: Fuzzy, Differential.

  • Other: PhotoDNA, ProjectVic.

• Indexing: Built-in DTSearch indexing for efficient data retrieval.​

• Keyword Search: Perform keyword searches at cluster, sector, or byte levels using text, regex, or hex expressions.​

• Language Support: Unicode compliant, allowing investigators to search and view data in native languages (e.g., Dutch, Arabic).​

• GUI Language Options: Interface available in EN, DE, ES, FR, ID, TR, ZH (set during installation).​

• Metadata Extraction: Extract and report file metadata, including EXIF, GPS, MS Office, and more.​

• Mounting Images (MIP): Mount forensic image files as Windows drive letters with full access to deleted, system, and unallocated areas. Includes full CLI capabilities.​

• RAID Support: Work with physical or forensic images of RAID media, including software and hardware RAID configurations (JBOD, RAID 0, RAID 5, RAID 6).​

• Data Recovery: Recover deleted folders and partitions effectively.​

• Registry Analysis: Open and examine Windows registry hives; filter, categorize, and perform keyword searches on registry keys. Automate registry analysis.​

• Reporting: Custom report builder with predefined templates for comprehensive reporting.​

• Scripting: Powerful built-in Delphi scripting language with scripts for metadata extraction, registry analysis, skin-tone detection, and timeline creation.​

• Network Servlet: Connect to and examine remote drives using a deployable network servlet.​

• Shadow Copy Analysis: Easily add and analyze shadow copy files for comprehensive investigations.​

• File Signature Verification: Automatically verify file signatures and identify mismatches between file extensions and actual content.​

• Triage Functionality: Automatically triage and report on common forensic search criteria.​

• Virtual Live Boot: Virtualize Windows and Mac forensic images and physical disks using VirtualBox or VMWare for in-situ analysis.​

• Yara Rules Integration: Quickly identify malware and other malicious software within digital evidence using customizable Yara rules.​

Distributor:

Multi-COM Sp. z o.o., ul. Krzaklewskiego 31b, 36-100 Kolbuszowa, e-mail: biuro@multi-com.pl, tel. +48172270025

Safety Warnings and Usage Guidelines

Based on the requirements of Regulation (EU) 2023/988 on General Product Safety (GPSR), we present a list of safety warnings. The aim is to protect users from potential hazards resulting from improper use of products/devices.

1. General Safety Measures

* Use the device only in accordance with its intended purpose and the manufacturer's instructions.
* Before first use, read the user manual carefully.

Hazards for children:
* Keep the product/device out of reach of children. Children are unable to assess existing risks.

2. Mechanical Hazards

* Check that all components are properly assembled before operating the device.
* Avoid using tools that may damage the product or contribute to its damage. Do not modify the product: do not open/disassemble it!

3. Electrical Hazards
* Connect only to a socket with the appropriate voltage, in accordance with the manufacturer’s requirements.
* Improper handling of products powered by mains voltage may result in fatal electric shock! If the product and/or the connection cable are damaged, do not touch them; there is a risk of fatal electric shock! Never use the device if the power cord is damaged, frayed, or cut. Avoid touching the power cord or plug with wet hands.
* Product with a separate power supply: before connecting the device to a plug-in or external power supply, ensure that the voltage, polarity (plus/+ and minus/-), and plug dimensions (e.g., inner/outer diameter) match the device.
* Product with a mains plug: the power outlet used for connection must be located near the product and easily accessible. Always unplug the power cord by pulling the plug, not the cable.
* Product with a power cord: the power cable must not be pinched, bent, or damaged by sharp edges. Do not place any objects on the power cord or step on it. The cable should always be arranged carefully to prevent tripping.
* Product intended for soldering: use only appropriate electronic solder and an electronic soldering iron. The soldering process should be performed quickly to avoid overheating and possible damage to the product.

4. Usage Precautions

* Place the product on a stable, flat surface to prevent it from tipping over.
* Always maintain sufficient space around the device (as recommended by the manufacturer) to ensure proper ventilation.
* The operation of certain products (e.g., machines or tools) requires the use of personal protective equipment to minimize health or other risks. This includes, for example, suitable hearing protection, an appropriate respirator/dust mask, or safety goggles, as well as proper gloves, safety footwear, and clothing.

5. Maintenance and Cleaning
* Before performing maintenance or cleaning, read the product’s user manual.
* Improper cleaning agents may not only damage the product but also cause other hazards — follow the manufacturer’s guidelines.

6. User Warnings
* Elderly persons or individuals with limited mobility should exercise particular caution when operating the product and, if necessary, seek assistance from another person.
* If the device operates abnormally (e.g., emits smoke, overheats, or produces unusual sounds), immediately switch it off, disconnect it from power, and contact authorized service.
* Store the product in a dry and cool place to prevent mechanical and electrical damage.

7. Disposal
* All electrical and electronic equipment placed on the European market must be properly disposed of. This means that, at the end of its service life, the device must be disposed of separately from unsorted household waste.

8. Importance of Following the Warnings
Following the above warnings minimizes the risk of personal injury, device malfunction, and material losses. Ignoring these recommendations may lead to serious health and material hazards. Protect yourself and your loved ones by following the indicated safety measures. Detailed warnings or product safety information are available in the user manual supplied with the product or in PDF format on the manufacturer’s/supplier’s website.