E3:COMPUTER

Computer forensics in the context of the artifacts

File system forensics for Windows, Mac and Linux, with email, messaging, browser and registry artifacts sorted and ready for review on the E3 Forensic Platform.

Start a Free Trial Live Demo Request a Quote

Laptop connected to a write blocker with a hard drive for forensic imaging

Capabilities

File system forensics that saves review time

E3:COMPUTER focuses on file system forensics and the artifacts that live inside them. It uses the E3 Platform to categorize data in the context of each artifact, so investigators review email, messages, browser history, documents and images instead of hunting through folders.

FAT, NTFS, EXT (Linux), HFS and HFS+ and APFS
EnCase, AD1, DD and other disk image formats
Imager for computers, files and media included
Windows data triage

Request a Quote Licensing Options

Artifacts

Every artifact category in one review

Email

Local and network mail archives
MBOX, MS Exchange and message tracking logs
Office 365 email and NST
Export to EML, EMX, PST, HTML and MSG
Batch export and native attachments

Messaging and browsers

Chat databases
Internet browser data
SQLite databases and archives
Slack, Discord and Teams Business cloud data

System and social

Registry data and Windows artifacts
Google Takeout
Compliance archive processing
Instagram, Facebook, Twitter, Snapchat, LinkedIn and TikTok backups

Interoperability

Bring in data from the tools you already use

Volatility

Import memory analysis results alongside disk evidence.

KAPE

Load triage collections straight into an E3 case.

IPED

Review IPED processed data with E3 search and reporting.

Relativity

Export load files for legal review platforms.

General capabilities

Search, review and report

Review and bookmarks

Multi-level bookmarksBookmark by tagColor customizationTime zone customizationAdvanced analysis gridsOCRViewers for 100+ file typesHex, text, chat and email viewers

Search and filter

Full-text indexingBooleanKeywordRegular expressionEmoji and emoticonAdvanced multi-parameterNIST and custom hash setsSkip listsSorting by file headerData carving

Export and reporting

Native file exportForensic container exportSpreadsheet and XML outputHTML investigative reportSummary, CSV, TXT and RTF reportsRelativity load file export

Automation

PythonC#PowerShellMalware scanning

Supported File System ArtifactsSpreadsheet E3 Feature Data SheetPDF

Time to take action

Start processing computer evidence now

Run a 10-day E3:UNIVERSAL trial on evidence from your own case mix, with expert technical support and implementation guidance. Every E3 purchase includes operator level certification training.

Start a Free Trial Live Demo Request a Quote

FAQ

Frequently asked questions

What file systems does E3:COMPUTER support?

E3:COMPUTER parses FAT, NTFS, EXT (Linux), HFS and HFS+ and APFS file systems, and opens common disk images such as EnCase E01, AD1 and DD.

Which computer artifacts does E3 parse?

Email (local, network, MBOX, MS Exchange and Office 365 including NST), chat databases, internet browser data, registry data, Windows artifacts, SQLite databases, archives, Google Takeout, compliance archives and social media backups.

Can E3 import data from other tools?

Yes. E3 imports Volatility memory data, KAPE triage data and IPED data, and exports Relativity load files for review platforms.

Is an imager included with E3:COMPUTER?

Yes. An imager for computers, files and media is included. Remote computer imaging over TLS 1.2 encryption is available with E3:UNIVERSAL and the Premium membership level.

Can I try E3:COMPUTER before buying?

Yes. The 10-day trial gives you full access to E3:UNIVERSAL, which includes every E3:COMPUTER capability, with expert technical support.

Ready to advance your digital investigations?

Talk to Paraben about Membership Bundles, Perpetual Prices, AI solutions or training, or start a trial and see E3 on your own evidence.

Start a Trial Live Demo Contact sales