GFE Stealth™ - Forensics Graphics File Extractor

GFE Stealth - Graphics File Extractor

NTI's Forensic Graphics Image File Extractor is a computer forensics software tool which was designed to automatically extract exact copies of graphics file images from ambient data sources and from SafeBack bit stream image backup files. The latter process has the potential of quickly identifying all graphics file images stored on a computers hard disk drive. The resulting output image files can be quickly evaluated using a graphics file viewer, e.g, Firehand Ember Millennium by Firehand Technologies which NTI recommends. Firehand Ember Millennium fits limited law enforcement budgets, e.g., priced at under $50 and it is an ideal product for investigations involving computer graphic images. At your option you can purchase FireHand Ember software from the manufacturer or NTI (at a slight discount). Click here for more specific information about how this software can be used to save time in computer related investigations.

NTI's Graphics Image File Extractor software was developed with our law enforcement friends in mind and it has been priced accordingly. Law enforcement computer crime specialists spend much of their valuable time in the investigation of computer crimes involving the possession and distribution of graphic image files which involve child pornography and identity theft. This computer forensics tool saves time and it was specifically created to accurately and quickly reconstruct evidence grade copies of "deleted" image files. The software can also be used effectively to identify and reconstruct residual graphics file images which passed through Windows Swap/Page files during Internet web browsing sessions. An "after-the-fact" analysis of such files can quickly determine how a computer may have been used. Such information is invaluable to corporate investigators and law enforcement computer crime specialists alike. NTI's Graphics Image File Extractor also provides benefits in internal audits involving the misuse of corporate computers by employees and in corporate due diligence reviews of computers.

Forensic Graphics File Extractor - Primary Uses:

  • Used to find evidence in corporate, civil and criminal investigations which involve computer graphics files, e.g., investigations which potentially involve child pornography and/or inappropriate Internet web browsing in a corporate or government setting.

  • Used with other computer forensic software to quickly reconstruct and view previously deleted BMP, GIF and JPEG graphics files stored on computer storage media.

  • Used to quickly identify and view BMP, GIF and JPEG image files stored anywhere on a computer hard disk drive when used with NTI's SafeBack evidence grade backup software and Firehand Embers.

  • Used effectively in computer investigations involving the distribution of child pornography and identity theft.

  • Used "after-the-fact" to determine what files may have been viewed over or downloaded from the Internet.

  • Used very effectively in the recovery of deleted graphics files from computer hard disk drives and/or digital flash memory chips when it is used with NTI's GetFree software which can be purchased separately.

Forensic Graphics File Extractor - Program Features and Benefits:

  • Operates under DOS, Windows 98, NT, 2000 and XP for ease of operation and speed.

  • No Software Dongle! - We know that software dongles get in the way and they restrict your ability to process several computers at the same time. That is why NTI does not use software dongles and our licensing of this software allows you to process multiple computers at the same time. NTI's goal is to make your life easier and this software was designed with ease of use in mind.

  • Compact program size which easily fits on one floppy diskette with other forensic software utilities for portability.

  • Searches a targeted Windows Swap File or a file created from erased file space for patterns of BMP, GIF and JPG file images and it reconstructs partial or complete image files in one highly accurate operation. The accuracy of this process is dependant upon the degree of fragmentation involved, etc.

  • When complete image files are identified and reconstructed by the program the output of restored graphics images files is exact. Our tests indicate that a majority of reconstructed files will pass a CRCMD5 hash test when restored image files are compared with the original files prior to deletion. This feature makes the software ideal for evidence reconstruction in criminal cases. It also allows for the exact reconstruction of graphics image files which may contain hidden files or other messages through the use of steganography.

  • Partial image file patterns (caused due to fragmentation and/or file corruption) can be automatically reconstructed and viewed in many cases.

  • The highly accurate graphics file identification search engine ensures that every byte is checked for integrity.

  • The software operates in batch file mode for automatic processing when combined with other NTI software processes.

  • The software operates at a blinding rate of speed and therefore saves time when compared to other computer forensics approaches in the evaluation of graphics image files.

  • It automatically creates a complete log of the processing steps taken by the program to help document the process and to assist with possible trial testimony concerning the use of the program and/or findings.

  • Free Upgrades for one year from the date of purchase.

  • Quantity discounts and site licenses are available.

The current release is Version 2.02, U. S. Government clients should click here for information about GSA purchases.

Call NTI at 503-661-6912 today for details.

Direct E-Mail to