Internet Evidence Finder IEF


INTERNET EVIDENCE FINDER® (IEF®) is a digital forensics software solution used by thousands of forensics professionals around the world to find, analyze and present digital evidence found on computers, smartphones and tablets.

The tool supports Windows and Mac OSX File systems!

The Internet Evidence Finder editions available:

  • IEF Standard
  • IEF Standard as Network license

Which you can than custumize by adding-on three (optional) modules :

Mobile Artifact Module

  • Recover 165+ types of mobile artifacts from iOS and Android powered smartphones and tablets, including more 3rd party mobile apps than you can recover with traditional mobile forensic tools (because of our innovative approach to carving evidence from deleted space) 
  • This module is designed to analyze images acquired from mobile phones via popular mobile forensic tools like Cellebrite’s UFED, Micro Systemation’s XRY and AccessData’s MPE+ 

Business Applications & OS Artefacts Module

  • Recover Business and OS artifacts from computers and mobile devices, including: corporate email and instant messaging artifacts like Outlook OST & PST files, mbox email archives, and Microsoft Lync/OCS IM; documents like .pdf, .doc, .docx, .xls, .xlsx, .ppt, .pptx; and operating system artifacts like user accounts, USB device history, lnk files, prefetch files, shellbags, jumplists, event logs and more 
  • This module extends IEF’s search capabilities to include recovery of business application artifacts, so you can get a more complete view of the user’s activity on a computer and/or mobile device. 

Triage Module

  • Runs from a USB dongle to enable forensic examination of live systems.  Capture live RAM, collect data from live system artifacts and run an IEF search to recover hundreds of different types of digital forensic artifacts from Windows and Mac OSX powered computers.
  • Collects volatile data from live system artifacts: network connections, running processes, connected network shares – drives and remote connections, network interfaces, logged on users, scheduled tasks and services. 
  • Quick and an easily conduct on-scene searches and pre-screen evidence to qualify computers for seizure and further examinations. 
  • Maintains forensics integrity of data

Back to top