WebMail Reconstructor(CacheBack)

CacheBack® features:

• Bookmarks now allow users to categorize various artifacts discovered during their analysis (new in Version 2.8 Beta RC2).
• New consolidated thumbail Gallery viewer displays thumbnails of cached web pages AND pictures!
• Accurately rebuilds cached web pages for all five top browers in just seconds!
• CacheBack currently supports IE (5-8), Firefox (2-3), Opera (9), Safari (3) and Google Chrome (1, 2, 3 and 4) (Chrome updates available in Version 2.8 Beta RC2).
• Produce compelling, rich HTML reports for rebuilt web pages, and pictures, complete with thumbnails and metadata.
• Rebuild lost web pages from Unallocated Clusters using new Templates feature!! (coming soon).
• Import older NetAnalysis project files and leverage the superior reporting features in CacheBack.
• Supports importing of NetAnalysis' Hist-Ex URL recovery tool (for IE).
• Expedite case examinations using the CacheGrab® EnScripts for EnCase V5 and V6.
• Comes with our CacheGrab® (for Windows) tool to quickly collect history and cache artifacts from any local drive (or VFS) and make them ready for import by CacheBack.
• Displays timestamps in any time zone using Coordinated Universal Time (UTC). Accurately applies Daylight Savings (DST) changes to "each individual timestamp" (for the selected time zone option). This is extremely important if an investigator's place of origin (city, country) is observing DST WHEN the actual timestamp evidence originated outside of DST!!
• Fully integrated SQLite3 database support for examining browser history files for Firefox 3 and Google Chrome!
• Supports the extraction of GNU Zip (GZip) compressed data found in browser cache data files.
• Uses a proprietary Photographic Aspect Ratio Differential value to dramatically create smaller, more relevant picture galleries for investigations involving child exploitation! (or any other picture-based investigations)
• UTC option takes into account new DST rules and Southern hemisphere differences (eg: Australia).
• System-clock-independent, multiple Time Zone and customizable timestamp formatting options for accurate timeline analysis.
• Powerful Link Analysis to identify matches between history URLs and hyperlinks found in web pages (eg: which links might have been clicked or visited).
• Familiar user interface similar to Windows Explorer or Outlook provides a consistent user experience for forensic investigators.
• Each URL is extracted and broken down into multiple artifacts (metadata) which can then be used within custom queries to create finer (smaller) results sets.
• Filter results based on file type, file extension, domain/host name.
• Create user-defined SQL queries and save them for future use.
• Pre-defined queries now available for common type investigations (eg: Child Exploitation, Web Mail, Social Networks, etc).
• New Quick Queries makes it easier to filter out specific data types (eg: Show Only Web Pages, Show Only History, Show Activity for Last Month, etc).
• Built-in offline browser to view web pages with convenient context (right-mouse-click) menu to access common IE browser features (eg: Print, View Source, etc).
• Rebuilds web pages on the fly without altering the original files. Ingredient files stored back inside database so that web pages only need to be rebuilt once!
• Project files (.CBP) use the Microsoft Access database engine. This allows examiners the flexibility of using Microsft Access and Microsoft Excel to leverage custom reporting features and data formatting, outside of CacheBack!
• Export TableView columns as plain text files.
• Built-in picture viewer with new Zoom In/Out and Print functionality.
• Multiple tabbed views of the same evidence (Browser, Text, Hex, Picture, Audit and Links).
• Comes with a 200+ page, comprehensive and fully illustrated User Reference Manual. This guide will certainly round-out any examiner's experience working with Internet cache and history artifacts.
• *** Free technical support and unlimited upgrades to all dot releases (eg: 2.7, 2.8, etc).