Feature | Community | Professional |
---|---|---|
Process Individual Files/Folders | ✔ | ✔ |
Process Logical Drives (excluding C:) | ✔ | ✔ |
Process Live System | Y | ✔ |
SYSTEM hive support | ✔ | ✔ |
SOFTWARE hive support | ✔ | ✔ |
NTUSER.DAT hive support | ✔ | ✔ |
Setupapi log file support | ✔ | ✔ |
Amcache.hve file support | ✔ | ✔ |
ShellBags support | Y | ✔ |
Event log support | Y | ✔ |
LNK File Support | Y | ✔ |
Jump List Support | Y | ✔ |
Transaction Log support | Y | ✔ |
Volume Shadow Copy support | Y | ✔ |
Accepts multiple versions of all artifacts | ✔ | ✔ |
Accepts individual files/folders as input | ✔ | ✔ |
Accepts logical drive as input | ✔ | ✔ |
Specify Case/Evidence Name | ✔ | ✔ |
Check for Software Updates | Y | ✔ |
View all sources for each data point | Y | ✔ |
Verbose device view | Y | ✔ |
Change consistency level options | ✔ | |
Advanced timezone settings | ✔ | ✔ |
View other connection/disconnection times | ✔ | ✔ |
View device deletion times | ✔ | ✔ |
Results grid reporting module | Y | ✔ |
Verbose view reporting module | Y | ✔ |
Timeline reporting module | Y | ✔ |
Opened/Accessed Files reporting module | Y | ✔ |
Individual Device Timeline Reports | Y | ✔ |
Preserve consistency levels in reports | Y | ✔ |
Preserve sources in reports | Y | ✔ |
Change displayed sources in results grid | Y | ✔ |
Export device volume boot record | Y | ✔ |
Export device master boot record | Y | ✔ |
Identify device/volume encryption type | Y | ✔ |
Full verbose view | Y | ✔ |
Commercial/Business Use | Y | ✔ |
————————————–USB Detective———————————————— | Purchase Professional |