NETANALYSIS

This is by far the most powerful Internet history retrieval and search tool available. NetAnalysis is used by law enforcement agencies worldwide. NetAnalysis contains powerful searching, filtering, and discovery capabilities such as automatically searching for possible passwords, Google search criteria, and specific file types. NetAnalysis also automatically rebuilds HTML web pages from an extracted cache, adding the correct location of graphics. You can view the web page as the suspect saw the page. Another nice feature about NetAnalysis is that the offline viewer can also be used as a viewer for forensic software such as EnCase and iLook. You can find NetAnalysis at http://www.digital-detective.co.uk. You can download a demo version there that will last for 30 days and that has some functions disabled.

Implementation

Installing and using NetAnalysis is easy. Simply select the folders or hard drive containing Internet history files, and NetAnalysis will do the rest.

The Host List window and Column Filter bar are demonstrated in the following example. The Host List window shows the hosts the suspect was accessing. The powerful Column Filter bar quickly allows the investigator to search for common terms and narrow the dates. Our search term was shoe in this example.

The support for SQL queries is built into NetAnalysis. Advanced users performing repetitive complex operations will appreciate this flexibility.

NetAnalysis also rapidly builds reports for use during interviews, depositions, and as case materials. Here is a quick summary of one such report.