Training and reference
Worked procedures for 65 situations, and the complete command reference for every product: 195 commands and 942 parameters, each with the business condition for using it. Generated from the shipping build, so it describes the version you have.
Learn to use it, feature by feature
Three complete how-to guides. Every feature, the exact steps and menu path, every option and what to choose, the menus and modals you will meet, and real situations with marked-up screenshots.
Data recovery
Recover, image, RAID assembly, CCTV, ransomware, databases, mail, encrypted volumes and certified disposal.
Digital forensics
Examination workbench, the enhancement lab, metrology, authenticity, steganalysis, the DVR recorders registry and the report.
Phone data
Guided acquisition and the method choice, locked and dead devices, app decoders and deleted messages, and the forensic sealing wrapper.
Start from the situation, not the switch
Each entry states which product covers it, which workspace to open, the procedure with the reason for each step, the exact commands, the options that apply and the condition for each, and the honest limit.
Everyday file loss
One computer, one card, one phone. Deletion, formatting and media that has stopped presenting its files.
Servers, arrays and virtual infrastructure
Storage that a business runs on: RAID sets, NAS units, storage pools, virtual machine disks and machines that cannot be dismantled.
Recovery bench procedure
How a professional handles the media itself: imaging first, assembling unknown arrays, repairing what came back, and working a mixed case.
Ransomware and incident response
Working an active incident, from identifying the strain to stating what can and cannot be recovered.
Database files
Getting tables and rows out of a data file when the engine will not start or will not attach it.
Mail stores
Reading and exporting mail from a store the client refuses to open.
Evidence and investigation
Acquisition, examination and reporting where the method has to be produced alongside the conclusion.
Sanitisation and disposal
Removing data on purpose, and being able to prove it was removed.
Cases that cross the boundaries
Work that does not fit one product, or changes character part way through.
Which feature do I need? How to do the job, step by step All 65 scenarios When you need hardware help In the app, no command line
Every parameter, and when a business uses it
One page per product, listing only the commands that product contains. The help text says what a switch does; these pages say when you would reach for it and what it costs.
Standards-aligned training
Eight modules across the four phases of NIST SP 800-86, aligned to ISO/IEC 27037, SWGDE, ASTM E2916 and E3016, NIJ guidance and Federal Rules of Evidence 702 and 902(14). Each module states what you must have, what you do, what it produces for the case file, and where it stops.
Coverage in detail
File systems, image formats, RAID and pool types, database engines and forensic artefacts, listed in full, with a category comparison against the products a lab would otherwise buy.