W4 lets investigators review digital evidence rapidly, locate items of interest quickly, and report their findings easily. W4 also gives investigators the ability to create AFF4 images, index live machines, and search data during indexing. This powerful tool enables triage in the field prior to taking data back to the lab for more detailed processing.

Key features of W4

W4 places a wide range of functionalities in the forensic examiner’s hands. It supports a broad range of forensic disk image and cellphone extraction formats and allows investigators to preview and search artifacts during indexing. First results are usually available in a matter of minutes after the indexing has started. W4's automatic extraction of notable registry artifacts can save the examiner many hours of manual artifacts extraction and data conversion to a human readable format.

W4’s unique Search Profiles

Initiate automatic RAM capture on live systems

Index and/or image live machines

Search a case during the indexing process

Detailed timeline of user activity with W4’s unique Events feature

Display item connections with W4’s unique Links feature

Prepare cases for more detailed review with Intella

W4 Who? What? When? Where?

W4 lets investigators review digital evidence rapidly, locate items of interest quickly, and report their findings easily.

W4 also gives investigators the ability to create AFF4 images, index live machines, and search data during indexing. This powerful tool enables triage in the field prior to taking data back to the lab for more detailed processing.

Using W4

Recipes

W4 uses a fully customizable, pre-determined search functionality to give examiners the ability to identify pertinent information to their case at the click of a button. W4 comes with out-of-the-box recipes designed to locate artifacts for common crimes. Examiners can also create their own custom recipes. These recipes can be used in future cases to save the examiner time.

Triage

W4 can be run as a portable app straight from a USB stick, allowing investigative teams to triage machines in the field. No dongle is required; a license is embedded in the software. With W4, experts can capture live data from machines that are powered on to prevent data loss and preserve that data for further investigation later on.

Links

The Links feature allows the user to find direct and indirect links between artifacts such as USB devices, internet downloads, file access, emails, and documents with just a few clicks. Links provide the user with graphics depicting the connections and relationships between different artifacts. These graphics can be used with W4’s flexible reporting feature to produce easy to understand reports for client or Court purposes.

Events View

The Events View allows users to visualize and annotate individual events in chronological order. Colorized tags simplify the workflow, making it easy to find the pertinent evidence and assemble it for reporting.

Powerful Reporting Capabilities

Report by items, categories, tags, and custom fields
Customize timelines with colorized tags and comments
Report web history and images via configurable display types
Hyperlinks to the exported files will be included in the report
An unlimited number of link graphs can be included in the report
Original format files can be exported along with the report
Report settings can be reused via our customizable template mechanism

Intella-compatible

W4 cases can be directly ingested and integrated into Intella to expand on analysis and reporting.

W4 Demo

Meet the newest member of the Vound suite of digital forensic software products.
See firsthand how W4 can benefit you.

Visualizations

Geolocation

Locate items with geodata on a zoomable world map.

Events view

Unified view of activities and other events in chronological order.

Timeline

Zoom in on a date range and see items and events within that date interval.

Additional W4 Features

Triage

Quickly identify machines with pertinent case information while in the field using our portable app that can be run directly off a USB drive.

Live Indexing

Enjoy the mobility live indexing offers you. Save time and money by examining your machines in the field instead of waiting for them to be packed up and sent to the lab for investigation.

Data Acquisition

Use W4 to pull disk images, user-defined files and folders, RAM information, and other data types from the machines you are examining.

Recipes

Create custom recipes that allow you to examine specific case types with the click of a single button.

Search and preview

System settings, browser history, device usage, email, attachments, iTunes backups, archives, headers, documents, embedded images, and metadata.

Supported Sources

Support for a wide range of forensic image formats: S01/E01/Ex01/L01/Lx01/AD1/ISO and DD. Support for Windows and MacOS file systems, GPT and MBR partitions, ISO and others. Support for Cellebrite, XRY and Oxygen Forensic Suite reports

Fully customizable reporting

Wizard for reporting relevant artifacts in the case ready for Court, or for your client.

Intella-compatible

W4 cases can be directly ingested and integrated into Intella to expand on analysis and reporting.

Geolocation

Allows to quickly locate items with geodata on a zoomable world map. That includes pictures, emails, cellphone items and Google Maps URLs.

If you would like a more hands-on look at how W4 could help you, download the following Quick Start Guides and see just how quick and easy it can be.

The W4 Interface & Features

Once you have created a case, added evidence to it, and indexed it, the case is ready for review and the complete dataset can be searched. In this guide, we will look at the user interface for W4 and the features W4 has to offer.

Download

efficient powerful processing power software

Creating Your First Case

Once W4 has been installed, start the application, and W4 will open the Case Manager. This is where you can conduct different tasks such as opening an existing case, adding a case that has already been created, and creating a new case.

Download

affordable electronic investigations software

Detecting IP Theft via USB Device

A common type of investigation is to determine whether any intellectual property has been taken from the company by employees who are leaving. In this guide, we look at how W4 can be used to search for artifacts in relation to file access and USB devices being used on a computer.

Download

Misuse of Company Time

When discussing misuse of the company’s time, we are referring to using the company’s computer for personal uses during work hours. Some examples of this include the employee using the company’s internet for their personal use or the user using the company’s computer to work on another business that the user has outside of his normal job.

Download

W4 is the Ideal Solution for

Investigative teams that need to triage live machines in the field

Law enforcement, government, and corporate entities needing a quick overview of pertinent data

Investigators and analysts who need a triage to courtroom solution

Find out more

14 Day Trial

Fastest way to experience our great customer support and training options.

TRIAL DOWNLOAD

LIVE DEMO

The best way to see exactly how W4’s features will benefit your organization.

REQUEST DEMO

FACT SHEET

Have all the facts at hand with our PDF Fact Sheets.

DOWNLOAD FACT SHEET

Other Vound software products

Vound has you covered, from Triage to the Court Room. All Intella products can process ESI, search metadata and content, filter by a range of criteria and produce most standard load file formats.

Intella 10, 100 & 250 Intella Pro Intella Investigator Intella Connect