Elcomsoft Quick Triage (EQT) is a digital forensic tool for law enforcement and incident response. It rapidly extracts and analyzes critical evidence from live Windows systems. It bypasses file locks using Volume Shadow Copies (VSS) and stores the extracted data in open VHDX containers.
EQT helps investigators quickly answer key questions about system usage in the field. Key features and capabilities include:
- Rapid acquisition and analysis of critical evidence
- Detailed system information, user activities and usage patterns
- Global search across select data categories
- Passwords from dozens of Web browsers and email clients
- Browsing history and search queries
- User communications, emails, documents, and pictures extracted and stored in a single open container