SubRosaSoft MacForensicsLab

(OS: MacOSX)

SubRosaSoft MacForensicsLab™ is the most powerful and cost-effective forensic tool on the market and the ONLY cross platform application specifically designed to meet the demands of modern law enforcement and digital forensic investigators. In a world of limited resources and increasing demands, you may want more than one tool in your investigative toolbox, but you only need one; MacForensicsLab from SubRosaSoft.

Trial agreements are now available. If you would like to trial this solution please contact to have a copy of the trial agreement sent to you for your signature. Please include your credentials in your email as the agreement will not be available to members of the public.




Evidentiary integrity is maintained and protected with the utmost care. Fast, fault tolerant, verifiable acquisitions produce a reliable bit-for-bit exact replica of the original media, while maximizing data recovery, even with corrupted media. These forensic images are created with integrated segmenting and granular hashing. Inline processing allows for the creation of dual output images and associated hash files, reducing the time the forensic examiner spends in the data acquisition phase.

Featuring the most powerful data recovery engine on the market. MacForensicsLab allows forensics professionals to find and recover deleted and embedded files - then preview and recover them. Even swap space and unallocated space can be explored for evidence. MacForensicsLab finds the evidence you need.

A multi-threaded application. Optimized for use with either industry standard SQL database servers or the built-in database engine enables investigative collboration by allowing investigators to simulataneously access and process any given case. Logs are kept of every action performed, every item found, and freeform notes can be taken during the case to tie them all together with your thoughts during the process. These can then be exported in standardized, customizable, easy-to-share, template-driven HTML reports at any stage of the investigation.

Advanced image analysis technologies. Allows thumbnails and previews of graphic images to be automatically filtered by skin tone content, image, and file sizes, to quickly expose suspicious material. This greatly reduces the time spent manually processing the tens of thousands of graphic images associated with every forensic examination. Files of interest can be bookmarked with a simple key stroke for more in depth analysis.

Keyword analysis and cataloging is performed in multiple languages and includes MD5, SHA-1, and SHA-256 checksum calculations. This allows the investigator to seek out items of interest across entire devices, within folders of files, and directly inside specific files. The catalog function has pattern matching for hash lists and searches for possible SSN numbers and Credit Card numbers.

Powerful auditing of the user’s preferences and settings greatly reduces the time spent by the investigator collecting and collating information of evidentiary value. This enhances and speeds up the process of tying the suspect to the machine or specific actions, into a single click of the mouse. Investigators can use this function to tell what the suspect has been using and doing on their system, including Wi-Fi connections, iPods, web history and bookmarks, and general system preferences.

  • Extremely fast and verifiable media acquisition and data recovery.
  • Multiple operations/tasks can be done at the same time.
  • Perfect acquisition of devices that retain every detail of the original media.
  • The most powerful data recovery engine on the market increases the chance of recovering data, even when the drive is damaged.
  • Perform forensic acquisition and analysis on drives from Mac, MS Windows, Linux, and other operating systems.
  • Highly detailed logs to provide the investigator with as much information as possible when reporting.
  • The unique Skin Tone Analyzer and fast traversal with file filtering means you don’t waste critical time searching unrelated files, allowing you to quickly find files of evidentiary value.
  • Built-in SQL database engine for speed and collaboration.
  • The bootable DVD supports machines ranging from first-generation iMacs to the latest Intel-based machines.

System Requirements for Macintosh:

  • System 10.3.9 or higher
  • Macintosh CPU with G3, G4, G5, or Intel processor
  • Second hard disk for storing recovered data

System Requirements for Windows Subversion:

  • Windows 2000, Windows XP, Windows Vista
  • 2 GB RAM
  • 2.0 GHz Processor

Note: The Windows version does not include direct device level access for acquisition, analyze, and salvage. Access to files and folders (including image files) are as similar as possible to the Mac OS X version. Users of the Windows version can collaborate and cooperate with users of the other operating systems. For more information about the Windows version please contact us on


Selección: SubRosaSoft MacForensicsLab

N.º de producto OS Precio
PROD00050100-0002 MacOSX

También recomendamos

Examine esta categoría: Mac Forensics