Extend your reach
Acquire and analyse remote computers reliably and efficiently.
Acquire remote computers without travel.
Ship a boot disk and evidence storage drive to a remote location, and have it phone home to the lab. Control the acquisition remotely.
Start analysing physical devices immediately..
Examine and triage while you acquire bare metal devices and dead disks via the Deadboot agent. Leverage your preferred forensic toolset for live analysis and triage while you acquire, via a virtual disk device view of your live acquisition.
Simple, secure workflow.
Evimetry uses robust, industry standard TLS 1.2 encryption for security in a simple to deploy and manage form.
Works with your regular toolset.
Evimetry's AFF4 images are directly accessible from your regular forensic toolset without any need for conversion.
Respond to incidents immediately by pushing our live agent to Windows, Mac and Linux. Remote live analysis and acquisition of Physical Disk and Volatile memory.
Faster, targeted acquisitions.
Acquiring across WAN links is slow. Evimetry never transfers the same data across the network twice, storing evidence in the forensic image as you analyse. Remote live analysis results in a partial forensic image that can be opened in your regular forensic tools. It contains all filesystem metadata, and file content for the files you acquired.
Fastest remote forensics.
Evimetry Remote enables rapid and reliable acquisition and analsysis of live computers. Supports Linux, MacOS, and Windows, on the LAN, across a WAN, or in the Cloud.
All the features.
Evimetry Responder contains all of the features of Evimetry Remote and Evimetry Advanced Imager.
Store your evidence closer to the source device.
Acquiring across WAN links is slow. Position your evidence storage in locations close to target computers for faster and more reliable acquisitions. For example, spin up an instance of the cloud agent in the same datacentre as a target server, or ship an appliance instance of the Deadboot agent to a branch office.