Digital Forensics Tools by Digital Forensics Experts

Making maximum exploitation of electronic evidence more accessible
Buy Now

Registry Recon

Registry Recon is not just another Registry parser. We developed powerful new methods to parse Registry data so that Registries which have existed on a Windows® system over time can be rebuilt, providing unique insight into how Registry data has changed over time. Registry Recon provides access to an enormous volume of Registry data which has been effectively deleted, whether that deletion occurred due to benign system activity, malfeasance by a user, or even re-imaging by IT personnel.

Hibernation Recon

Hibernation Recon supports active memory reconstruction from Windows XP, Vista, 7, 8/8.1, and 10 hibernation files and also extracts massive volumes of information from the multiple types (and levels) of slack space that often exist within them. Additional features of Hibernation Recon include the automatic recovery of valuable NTFS metadata and parallel processing of multiple hibernation files.

Arsenal Image Mounter

Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows. As far as Windows is concerned, the contents of disk images mounted by Arsenal Image Mounter are real SCSI disks, allowing users to benefit from disk-specific features like integration with Disk Manager, access to Volume Shadow Copies, launching virtual machines, and more.

Registry Recon

R

One-Click Harvesting

Efficient collection of active, backed-up, and even deleted Windows Registry hives from forensic images

Registry Reconstruction

Automatic rebuilding of not only the active Registry, but Registries from previous Windows installations

Recon View

Harness the power of huge volumes of Registry information to see how Registries changed over time

Hibernation Recon

Active Memory

Reconstruction of active memory from Windows XP, Vista, 7, 8/8.1, and 10 hibernation files

Hibernation Slack

The only tool that properly supports the extraction of multiple types and levels of hibernation slack

NTFS Metadata

Automatic recovery of valuable NTFS metadata

Arsenal Image Mounter

Complete Mounting

Mount contents of disk images and virtual machines as complete or “real” disks on Windows

l

Forensic Features

Temporary write support, “fake” disk signatures, CLI version, and more

*

Volume Shadow Copies

Quickly mount all Volume Shadow Copies (VSCs) within a disk image

What People Are Saying

Hibernation Recon has become DoD’s must-have tool for extracting digital artifacts from Windows hibernation files. Not only does Hibernation Recon properly reconstruct active memory for all versions of Windows when other tools fail, it is the only tool that extracts various types of “slack space”, which has yielded critical forensic artifacts for DoD’s foreign intelligence mission that could not have been obtained any other way.

United States Department of Defense

I am thoroughly impressed with Registry Recon’s capabilities. Working in law enforcement, I can see how valuable it is to know how a suspect’s computer interacted with particular networks, documents, and storage devices over time.

Sean Maloney

Trooper, Massachusetts State Police

Hibernation Recon allowed us to determine that remnants of a Skype chat involving child pornography existed in hiberfil.sys slack space (related to a previous hibernation) and to correct the date and time related to those remnants provided by another tool. Within the recovered chat the sender discussed not only possessing illegal material, but having over 70GB more to send, which was important to obtaining a search warrant.

Torben Strand

Special Consultant, Danish National Police Cyber Crime Center (NC3)

 Pricing & Plans

Each of our subscription options includes access to all the Arsenal tools, both those that exist now and those we release while the subscription is active! Pick the subscription that works for you without the hassle of maintenance fees.

1 Month

$49
$49
  • Great for applying Arsenal’s tools on an important case, with zero commitment.
  • Email Support
  • Renew Anytime
  • Zero-Commitment
  • Locked-in Pricing

1 Year

$570
$570
  • Perfect for investigators that need to purchase tools on an annual budget cycle.
  • Includes 3% Discount
  • Email Support
  • Renew Annually
  • Locked-in Pricing

3 Years

$1,605
$1,605
  • Great for investigators who want to lock-in a low price long term.
  • Includes 9% Discount
  • Email Support
  • Renew Every 3 Years
  • Locked-in Pricing

5 Years

$2,499
$2,499
  • Lock-in a low price and get the largest discount.
  • Includes 15% Discount
  • Email Support
  • Renew Every 5 Years
  • Locked-in Pricing

You can extend or renew an existing license here.
If you need more assistance, follow our Extending/Renewing Arsenal Recon Subscriptions Guide.

Please note: by selecting a subscription button above (or following the link to extend/renew an existing subscription) you will leave the ArsenalRecon.com website and be directed to our e-commerce partner Avangate, an authorized reseller of Arsenal Recon products.

Looking for additional plans?

Looking for the latest versions of our tools?

Meet Our Team

 

Our team is led by Mark Spencer, whose philosophy is “Don’t settle for the easy way, strive for the right way.” We are digital forensics experts from Arsenal Consulting and world-class developers who live and breathe operating system internals. We are passionate about digital forensics and dedicated to the preservation and analysis of electronic evidence using the most powerful technologies available. In our quest to dig deeper, we got tired of waiting for solutions to meet our needs – so we began building our own.

Mark Spencer

Mark Spencer

President

Brian Gerdon

Brian Gerdon

Digital Forensics Examiner

Emina Doherty

Emina Doherty

Digital Forensics Examiner

Olof Lagerkvist

Olof Lagerkvist

Software Development

Joakim Schicht

Joakim Schicht

Software Development

Arm Yourself!

Join our mailing list to arm yourself with updates about Arsenal tools, training, and research. Our mailing list is double opt-in so you will need to check your email and confirm your subscription before receiving our mailings.

22 Willow Street Chelsea, MA 02150

sales@ArsenalRecon.com

(617) ARSENAL

or (617) 277-3625

Site Map

\

Home

\

Products

\

Pricing

\

Training

\

Testimonials

\

Insights

\

Contact

\

FAQ

Legal

\

Privacy Policy

\

Terms & Conditions

\

Cookie Policy

Follow Us

LinkedIn

Twitter

Facebook