Paraben’s DS 7.x is designed to acquire devices both logically and physically all within a single tool and single case. DS has support for not only the device itself but also for all the associated accessories that can come with mobile devices including SIM cards, media cards, Call Detail Records, and so much more.
DS was designed to not only support smartphone devices with support for all smartphone operating systems, but also for feature phones (CDMA and GSM), eReaders, smart tablets, and GPS devices. DS maintains a variety of key features that are crucial to any investigator working with mobile devices. These features as well as unique custom features that you will only find in DS make it a powerhouse in the mobile forensic tool arena.
More than 50 plug-ins for working with more than 25 types of devices including:
Device auto-detection during acquisition with both logical and physical acquisitions makes it easy for the user to immediately start an acquisition once the device is plugged in. All drivers are automatically loaded. As a backup option, the user can also manually select drivers as needed.
This automation makes DS one of the easiest tools to use where investigators can go from acquisition to report all in 3 simple steps. USB, serial, and Bluetooth connection options are available for devices.
DS smartphone support
DS smartphone support includes both logical and physical support for a variety of devices. These devices are constantly changing so the supported list is updated with each release. DS has a minimum of three releases in a calendar year with enhancements to support and features.
DS Secure imaging
DS Secure imaging is the ideal format for forensic investigators with MD5 and SHA1 hash values calculated with each data piece in the case but also a full encrypted image to ensure that image integrity is maintained. In addition, the database driven case format allows for 64 TB of data in a single case. When processing through devices, the support of the device is not the only crucial feature. DS has more deleted data recovery than any other tool in market and allows for the automated carving of data from unallocated memory. DS has a unique function with the sorter option that carves this data and also allows the data to be displayed in easy to reference categories for quick analysis triage. Other data such as GPS coordinates can also be seen easily in the DS interface.
- Special Hex and Text viewers for viewing data in hex and text representation
- Image viewer for convenient viewing of all types of images
- File viewer for viewing files of different types (*.html, *.doc, etc.)
- Grid viewer for an easy-to-read format of SMS, Phonebook, Calendar, etc.
- Data Sorter function for sorting thousands files from the acquired data by file types
- EXIF data viewer for graphic files including adding EXIF data to reports
- Quick export functions for exporting media file types from case data.
- Bookmarking for easy navigation and review of data.
- Comprehensive data acquisition of text messages, address books, call logs, and more
- Built-in recovery of a variety of passwords from devices
- Windows CE registry viewer
- Acquisition of complete GSM and CDMA SIM card information including deleted data
- Full flash download for certain models of cell phones, PDAs, and smartphones
- SIM Cards cloner
This primary support also includes support of smartphone data that can be found on the desktop.
- RIM BlackBerry Backup (IPD & BBB) including BlackBerry 10
- Apple iPhone Backup (Including encrypted back-ups)
- KLM and GPS maps
Integrated Google Earth makes viewing coordinates from GPS and KML files seamless.
DS offers enhanced analysis capabilities for devices to include the unique Case Comparison feature that allows for easy review of a device from both parties in an investigation. This function is a quick and easy way to show changes between the original image and the returned device when two parties are involved in an investigation. With 3 clicks, the data can be displayed and reported.
Malicious content can be difficult to spot in the sea of data on a smart device. However, DS has tackled and conquered this with the App suspicious activities display. This is an easy
way to have the investigator see what Apps on the device might be causing problems or harm to the data on the device.
- Exporting of the acquired data to the PC
- Search within the acquired data including file search, Hex, and Text (including Unicode) searches
- Import of databases acquired with PDA Seizure, Cell Seizure, SIM Card Seizure, CSI Stick, and Deployable DS
- Import of data from other tools
- Cellebrite cases
- Tarantula back-ups (Chinese Phone Support)
- Viewing acquired data with external viewers
- Comprehensive HTML, Text, CSV, XLS, and PDF reporting, including Timeline report
- Data saving to CD/DVD. You can easily take your case with you without using any external applications
- Cell Tower Import for viewing call locations within Google Maps