FeatureCommunityProfessional
Process Individual Files/Folders
Process Logical Drives (excluding C:)
Process Live SystemY
SYSTEM hive support

SOFTWARE hive support

NTUSER.DAT hive support

Setupapi log file support

Amcache.hve file support

ShellBags supportY
Event log supportY

LNK File SupportY

Jump List SupportY

Transaction Log supportY

Volume Shadow Copy supportY

Accepts multiple versions of all artifacts

Accepts individual files/folders as input

Accepts logical drive as input

Specify Case/Evidence Name

Check for Software UpdatesY

View all sources for each data point

Y

Verbose device view

Y

Change consistency level options

Advanced timezone settings

View other connection/disconnection times

View device deletion times

Results grid reporting moduleY

Verbose view reporting moduleY

Timeline reporting moduleY

Opened/Accessed Files reporting moduleY

Individual Device Timeline ReportsY
Preserve consistency levels in reportsY

Preserve sources in reportsY

Change displayed sources in results gridY

Export device volume boot recordY

Export device master boot recordY

Identify device/volume encryption typeY
Full verbose viewY

Commercial/Business UseY

————————————–USB Detective————————————————  Purchase Professional