W4 (Who, What, Where, When) is a tool for fast review and investigation of computer forensic images and evidence. The goal of W4 is to allow investigators to rapidly review a set of evidence and locate items of interest. The main interface of W4 allows for timeline filtering and linking items such as:
Operating System files
Files and Folders
Communications (Email, SMS, Chat)
While W4 is still in the development stage we are looking for a number of beta testers to assist with how the program works in different environments.
W4 differs from Intella type products as the goal is to look at system setting, browser history and device usage to detect any items of interest. While there is some overlap with Intella's Insight tab this differs from Intella where the user is focused more on user created data and email content.
Common usage of W4 is detecting what devices, such as USB devices, were connected to a system and what data was copied to them. Another usage is filtering by time and date to only certain file or record types. An example would be all Internet Explore history from Jan to Feb.
A great deal of development time has gone into simplifying time-consuming tasks such as decoding dates and categorizing registry entries.
W4 has a category to highlight Notable items. This category automatically populates on processing and lists any references to Cryptocurrencies, Darknet and BitTorrent.
As with all Vound products, we focus on the visual presentation of results. To facilitate this W4 uses a number of visual elements to better understand the evidence.
The visual timeline:
This allows the user to select a date range but also understand how much data is in that range.
Events overtime log:
This view allows the user to visually see in chronological order every event in order. This view can be filtered to only certain events and is very useful to tracking user activity over time.
Item linking map:
This view uses item metadata to link items together. This is extremely useful to see ownership of data and what accounts or devices had access to the data at some stage in its lifespan on that system.
A simple quick start set of images is located at: https://www.vound-software.com/W4/
A sample image below.
How can you help:
We are looking for beta users to run W4 on a range of images and environment. Let us know what you like and what could be better. We are looking for ideas on what other features would be needed to make it your go-to tool for this type of work. If you would like to be a beta tester please contact us directly.