| Feature | Community | Professional |
|---|---|---|
| Process Individual Files/Folders | ✔ | ✔ |
| Process Logical Drives (excluding C:) | ✔ | ✔ |
| Process Live System | Y | ✔ |
| SYSTEM hive support | ✔ | ✔ |
| SOFTWARE hive support | ✔ | ✔ |
| NTUSER.DAT hive support | ✔ | ✔ |
| Setupapi log file support | ✔ | ✔ |
| Amcache.hve file support | ✔ | ✔ |
| ShellBags support | Y | ✔ |
| Event log support | Y | ✔ |
| LNK File Support | Y | ✔ |
| Jump List Support | Y | ✔ |
| Transaction Log support | Y | ✔ |
| Volume Shadow Copy support | Y | ✔ |
| Accepts multiple versions of all artifacts | ✔ | ✔ |
| Accepts individual files/folders as input | ✔ | ✔ |
| Accepts logical drive as input | ✔ | ✔ |
| Specify Case/Evidence Name | ✔ | ✔ |
| Check for Software Updates | Y | ✔ |
| View all sources for each data point | Y | ✔ |
| Verbose device view | Y | ✔ |
| Change consistency level options | ✔ | |
| Advanced timezone settings | ✔ | ✔ |
| View other connection/disconnection times | ✔ | ✔ |
| View device deletion times | ✔ | ✔ |
| Results grid reporting module | Y | ✔ |
| Verbose view reporting module | Y | ✔ |
| Timeline reporting module | Y | ✔ |
| Opened/Accessed Files reporting module | Y | ✔ |
| Individual Device Timeline Reports | Y | ✔ |
| Preserve consistency levels in reports | Y | ✔ |
| Preserve sources in reports | Y | ✔ |
| Change displayed sources in results grid | Y | ✔ |
| Export device volume boot record | Y | ✔ |
| Export device master boot record | Y | ✔ |
| Identify device/volume encryption type | Y | ✔ |
| Full verbose view | Y | ✔ |
| Commercial/Business Use | Y | ✔ |
| ————————————–USB Detective———————————————— | Purchase Professional |