Criminals hide evidence of their crimes, Application Developers hide data about you, Users misplace even their most important files and when our Devices Fail we scramble to recover our lost data.  The first steps are to discover where the data is hiding and what types of data are available for us to recover.

Dark Data Detective is that first responder that provides Pre-Collection Analysis in a data collection triage when the size of the crime scene is overwhelming.  Dark Data Detective is also that last “Hail Mary” when evidence isn’t found, the case is dying and Exception Bin Analysis may save the case.  Dark Data Detective is also the Data Research Platform, that helps investigators uncover Steganography, Malicious Objects and Trojan Objects within innocent looking files.  “Wait, I just want to open some mysterious files that a client sent to me!”  Dark Data Detective does that too.

Dark Data Detective is our multi-tiered platform for detecting, assessing and dissecting unstructured files in large legal collections all the way down to the individual bytes in each object that makes up the files.  30 years in the making, Dark Data Detective is the culmination of every product and research project that we have developed.    The core technologies are the same, as our FI TOOLS, Data Profiler Portable, File Investigator and File Expander, but the user interface, user experience and database are redesigned.  Dark Data Detective has recently been completely rewritten in 100% C#.NET managed code, and is now provided in 64 bit, to squeeze the maximum processing power from your CPU.  No more legacy code here.

Features

With a completely redesigned user interface layout and user experience, Dark Data Detective is designed to empower our users to search farther, deeper and more efficiently for hidden data.  Or as we prefer to call it, Dark Data.  Features are labeled by the tier that they are included in, ex: Business [Bus], Professional Investigator [Pro] & Advanced Researcher [Adv].  Each tier includes all of the features from the lower tier(s).

Pre-Collection

When starting the search of a device, one can use the Charts tab to assess whether the device will contain the data that matters to them. [Pro]  The Prioritized Folders list, located on the Search tab, ensures that the search will focus on the paths most likely to contain the pertinent data, first. [Pro]  By default, user data is prioritized.  The Details tab can also be used to monitor the predicted “Time Left” to search the device. [Bus]  If a device is not producing the desired statistical results, within the available window of time, then one can stop the search and move on to the next device.

Chain of Custody

We know how important it is to our legal and law enforcement professionals to maintain a proper Chain of Custody, so we provide a detailed form on the Case tab. [Pro]  The most commonly used fields are provided, as well as a Notes box for any additional information.

Targeted Collection

When one decides to collect filenames, metadata and the actual files, the Actions tab can be used to narrow down the collection(s) to just the files with selected attributes, content types and/or file type(s). [Pro]  By default, all files are designated for Metadata Collection, and none of them for File Collection. [Bus]

Filtered Review

While and after performing a search of a device, the Files tab can be used to analyze the files collected. [Bus]  The list of files includes many filters at the top of the window, for narrowing down one’s focus to just the files that are pertinent.  These filters can be hidden using the Filter menu.

By default only Content Type and File Type drop down boxes are visible, as they are the most commonly used.  One can change this default, using the Filter menu.

File/Data Carving

Leveraging our knowledge in file structures, we have added Data Carving “Dark Carving” of disk and memory images.  We start by scanning for header, body and footer signatures of the objects that act as the building blocks for every computer file.  In stage two, we step through the signatures found and build the objects.  Finally, we step through the objects found and build the files.  We expect that parts of many of the objects and files may be missing, which is why we use the more granular method of collecting the objects first.  While in BETA, we currently support a small list of file types with complete knowledge of every object and fields (within the object), which empowers us to recover these file types better than any other solution.  For the rest of the 4,900+ file types that we support, we use a brute force method utilizing file header, body and footer signatures along with fuzzy data block matching.  Our methods are far more advanced in comparison to the rest of the industry, and as we add complete knowledge of more file types with each quarterly release we will secure our position as the Best In Class solution for recovering all file types. [Adv]

Viewers

Once a file is selected in the Files tab, the Viewer window (at the bottom of the screen) is updated to display the contents (or metadata) of the file. [Bus]  These viewers can be used to take a deep dive into the contents of the file, preview it or learn more from the Metadata and Background tabs.  The File Types tab provides a searchable list of all file types that we support. [Pro]  The Objects tab displays the objects found in the currently selected file, the Objects Types tab shows a searchable list of all of our supported object types and the Visual tab displays the bits and bytes of the selected file with pixels. [Adv]

File Corrections & Security

In certain situations, file(s) may loose their filename(s) and/or have invalid file extension(s).  One or more file extension(s) can be corrected from the file context menu and the File > Fix File Extension(s) menu. [Bus]  The File > Rename File(s) with Metadata menu option can also be used to rebuild the filename(s), using metadata from inside the file(s). [Pro]  There may also be occasions where one needs to Wipe File(s) and/or Delete File(s), for security reasons.  For these occasions, we provide the ability to Wipe with Empty Disk Space, Random Data, Uninitialized RAM bytes and/or Zeros. [Pro]

 

Tiers

Business

The Business tier is provided for the Lawyers, Electronic Discovery data processors, Technology Savvy business people and Office Workers, who occasionally need to reorganize/assess a large number of files or sometimes just a few mystery files that were sent to them from a client.  This tier is a direct replacement for our FI TOOLS legacy product.

Professional Investigator

Top Digital Investigators, Incident Response experts, Law Enforcement, Private Investigators and Forensic Accountants have a collection of tools to cover all of the challenges that they encounter.  Dark Data Detective is a tool that all Digital Forensics experts need to have in their toolbox, for those cases where the evidence is so elusive that you need to go through the Exception Bin from your other tools.  The Exception Bin is the collection of files that the other tools failed to identify.  Dark Data Detective specializes in empowering you to identify the contents of all files.  We are quickly approaching the point of 100% file identification.  Even if we have never encountered a file type, Dark Data Detective can still identify the type(s) of data stored in a file.  This tier is a direct replacement for our Data Profiler Portable legacy product, and includes all of the features of the Business Tier.

Advanced Researcher

Elite Cyber Security, Digital Forensics and Research & Development professionals require the ability to look inside cases as well as files, and recognize the patterns that indicate Malicious Intent or new File Format Structures.  Dark Data Detective provides the ability to scan through the objects in files, as though searching for files on a hard drive, in order to detect new and Intentionally Hidden Data.  This same technology will also be leveraged to perform Data/File Carving, with higher accuracy than previously available for investigations and data recovery. [2026]  Dark Data Detective will also provide the ability to profile users’ data usage patterns, to detect inappropriate and malicious intent from within an organization. [2027]  This tier includes all of the features of the Professional Investigator tier.

 

Screen Shots

 

 

 

 

 

 

 

Online Manual

The Online Manual can provide some additional insight to how Dark Data Detective functions.

 

Compare Tier Features

Features	Business	Professional Investigator	Advanced Researcher
Identify 4,900+ File Types	X	X	X
Metadata Extraction	X	X	X
Fix File Extensions	X	X	X
Drag n Drop Files and Folders	X	X	X
Search Drives/Paths	X	X	X
Filter by Metadata	X	X	X
Save File Searches	X (as .CSV file)	X	X
Execute from USB Drive		X	X
Rename Files w/ Metadata		X	X
Wipe Files		X	X
Filtered File Collection		X	X
File Type Database Viewing		X	X
Object Type Database Viewing			X
Statistical Analysis
File Types		X	X
File Categories		X	X
File/Data Carving			BETA
File Threats			X
Malicious Code Detection			2026 Q2
Steganography Detection			X
Trojan Objects Detection			X
Viewers
File Metadata	X	X	X
File Background	X	X	X
File Hexadecimal	X	X	X
File Text	X	X	X
File BVD Chart (in Visual tab)	X	X	X
File Multimedia Player	X	X	X
File Web	X	X	X
File Visual (Charts & Plots)			X
File Objects			X
Product Tier	Business	Professional Investigator	Advanced Researcher
Legacy Product Replaced	FI Tools/FI Find	FI Data Profiler
Perpetual License + 1st Year of Support	$249	$499	$999
Renew 1 Year of Support     (for Perpetual License)	$50/yr	$100/yr	$200/yr
Subscription     (auto renewal) (Support included)	$20/mo	$40/mo	$80/mo
Temporary 1 Month License     (no auto renewal) (Support included)	$25/mo	$50/mo	$100/mo

You are welcome to try a Subscription for a month, to ensure that Dark Data Detective is a good fit for you, then apply that month’s payment to the purchase of a Perpetual license.  If you currently own FI TOOLS, or purchased a product from us in the past, you can upgrade to Dark Data Detective by renewing your annual Support on your current or past license(s).   We provide a reasonable upgrade path between tiers.  The value of your current tier (or older legacy product) can be applied towards the purchase of a higher Dark Data Detective tier.

 

Referral Rewards

Referrals are rewarded to both the new customer and to the person who made the referral.  The new customer gets a 10% discount on their first purchase, and the referrer gets that same 10% as a credit towards future purchases and renewals.  If you are saving up for your first purchase, you can build up your credits through referrals.  Simply tell your referral to contact us with your Full Name & Email Address in an email as “Referred By”, so that we may send them a discounted link to purchase through.  When their first purchase is completed, then we will notify you of your added credits.