Evimetry Remote


Evimetry Remote accelerates remote forensics, bringing forensically reproducible triage, security and speed to remote and live analysis.



A lightweight forensic agent.

The core of Evimetry Remote is the Evimetry Live Agent, a lightweight forensic agent remotely deployable to live operating systems. The agent gives write-blocked access to the Disk and RAM of the remote system.

A single pane for control.

Evimetry Remote pairs the Evimetry Live Agent with the Evimetry Controller. The Controller is used to manage acquisitions from remote live agents, and to enable live analysis via a virtual disk.

Simple, secure, and fast access.

Evimetry’s secure network protocol uses compression to speed evidence access. Any evidence accessed is stored in a partial forensic image, with following accesses read from the image, preserving limited network resources. Evimetry uses robust, industry standard TLS encryption for security in a simple to deploy and manage form.

Complete, live, and profile based acquisition.

Evimetry’s technical advance is the partial physical forensic image. Acquire the highest-value evidence by category first, widen the scope of acquisition by live analysis via virtual disk, or take a complete image. The choice is yours.

Analyse immediately.

Evimetry closes the gap between acquisition and analysis, with examination and triage activities to occurring at the same time as acquisition. Leverage your preferred forensic toolset for live analysis and triage while you acquire, via a virtual disk device view of your live acquisition.

Works across platforms.

The Live Agent runs on live Windows, MacOS and Linux systems.

Easy to provision.

The Evimetry Live Agent is a console application, enabling straightforward push and pull deployment using remote shell, application deployment tools, and lateral movement techniques. No GUI is presented by the agent.

Works with your current toolkit.

Evimetry’s physical images are simply accessible from your current forensic toolset (even partial images), using our freely available filesystem bridge. Or if you prefer, convert into existing format in the time it takes to copy an image from an evidence drive to an analysis workstation.

Start analysing live devices immediately.

Examine and triage while you acquire a remote live devices via our live agent. Leverage your preferred forensic toolset for live analysis and triage while you acquire, via a virtual disk device view of your live acquisition.

Remote IAAS live cloud acquisition and analysis.

This screencast demonstrates remote live acquisition and analysis of a cloud based server using the Evimetry system. A cloud storage agent is provisioned in the same datacentre as the target server, and then a live agent deployed to the target server.

Acquire more devices at once.

Proceed to analysis quicker. Streamlined acquisition of multiple local and remote multiple devices managed from a single pane. Comprehensive documentation is collected by default.

Buy Evimetry Remote.

Please contact us to purchase at the following pricing. Prices are in US Dollars.

Evimetry Remote   Responder
$1,400   $2,500
Remote live analysis.   Local and remote accelerated
acquisition & live analysis.
Dead boot single destination acquisitions -  
Dead boot multi-destination striped acquisitions -  
Remote network control of acquisition operations  
Remote Live agent network based operations (Windows, Linux)  
Remote transient evidence storage agent -  
Concurrent advanced acquisitions 2   2
Remote Volatile Memory acquisition (Windows, Linux)  
Complete Physical Disk acquisition  
Partial Physical acquisition of allocated only  
Partial Physical acquisition (profile based)  
Convert AFF4 to EWF & RAW  
Mount local images as virtual file or disk  
Mount remote images as virtual file or disk  
Node to node image transfer  
Communications encrypted with strong TLS 1.2 crypto