Overview

W4 is a powerful forensic triage tool designed to enable investigators to review digital evidence rapidly, locate items of interest quickly, and report their findings efficiently. It supports a broad range of forensic disk image and cellphone extraction formats, allowing investigators to preview and search artifacts during indexing. W4 is ideal for field investigations, providing the ability to create AFF4 images, index live machines, and search data during the indexing process.

Features

• Rapid Review and Indexing: W4 allows investigators to quickly review and index digital evidence, providing first results within minutes of starting the indexing process.
• Live Data Capture: The tool can capture live data from powered-on machines, preventing data loss and preserving evidence for further investigation.
• Broad Format Support: Supports a wide range of forensic image formats, including S01, E01, Ex01, L01, Lx01, AD1, ISO, and DD, as well as Cellebrite, XRY, and Oxygen Forensic Suite reports.
• Automatic Artifact Extraction: Automatically extracts notable registry artifacts, saving examiners many hours of manual extraction and data conversion.
• Customizable Search Profiles: W4 uses customizable search profiles to identify pertinent information quickly, with out-of-the-box recipes for common crimes and the ability to create custom recipes.
• Geolocation and Timeline Visualization: Provides geolocation features to locate items with geodata on a zoomable world map and a detailed timeline view of user activity.
• Links and Events Features: The Links feature helps find connections between artifacts, while the Events view visualizes and annotates events in chronological order.
• Powerful Reporting Capabilities: Offers customizable reporting options, including item, category, tag, and custom field reports, with hyperlinks to exported files and the ability to include link graphs.

Benefits

• Efficiency: W4's rapid review and indexing capabilities save time and allow investigators to focus on critical evidence quickly.
• Flexibility: The tool's support for a wide range of formats and live data capture makes it versatile for various investigative scenarios.
• Accuracy: Automatic artifact extraction and customizable search profiles enhance the accuracy and thoroughness of investigations.
• Visualization: Geolocation and timeline features provide intuitive visualizations of data, improving the understanding of evidence.
• Collaboration: The Links and Events features facilitate collaboration by making connections between artifacts and visualizing events.
• Comprehensive Reporting: Powerful reporting capabilities ensure that findings are presented clearly and comprehensively, suitable for court or client purposes.