Designed for investigators to do quick triage and analysis, on-scene or in the lab, Digital Collector is only digital intelligence solution on the market today that performs live and dead box imaging for Windows and Mac.
Triage Devices
Determine if relevant data exists prior to imaging
Browse through files and folders of the device and any connected storage
Search for data on devices with advanced search features
See file previews of images on Windows computers and all file types supported by Mac computers
Select files and folders to collect while triaging with the Browser and Search views
Perform Targeted Data Collection
Selectively acquire email, chat, address book, and other data on a per-user, per-volume basis
Create physical images of Macs with the Apple T2 chip
Target and forensically acquire files, folders, and user directories while avoiding known system files and other unneeded data
Authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash functions
Collect from Live Systems
Capture RAM, volatile memory, and targeted collections live on Catalina
Capture important live data such as Internet, chat, and multimedia files in real time
Save live collections to a forensically-sound destination device
Create Forensic Images
Support for imaging APFS Fusion drives
Automatically recognizes a combined volume from a Fusion Drive and presents it for imaging
Decrypt FileVault 2 volumes if the password, Keychain file, or recovery key is provided, and then mount the volume as read-only to allow triage, collection of specific files, or imaging
Write-protect source devices while maintaining read-write access on destination devices
From encrypted data to actionable intelligence, Cellebrite Physical Analyzer helps your forensic lab to uncover digital evidence and create court-ready exhibits.