ILook Investigator Computer Forensics Software

IRS-CI Electronic Crimes

IXimager version 2.1 dated 2/1/2006

The IXimager is tested by the National Institute of Standards and Technology (NIST).

The IXimager is designed to meet Law Enforcement digital media acquisition needs. IXimager supports imaging devices which cannot otherwise be imaged in a Windows environment, including notebooks and server RAID systems. It supports hot swappable and plug-n-play devices such as, tape drives, USB and Firewire devices, as well as SCSI, IDE and fiber channel.

The Imager produces an Authenticated Image Format. This format is unique to the IXimager. The IXimager makes an evidence container subject to the same requirements for authenticity as other Judicially admissible evidence. Because the purpose was to produce Authenticated data output for ILookv8, only ILookv8 or later can authenticate the files produced directly by the application. The application creates three main forms of direct data output in order to accomplish these goals:

1. ILook Default Image Format (IDIF) - A compressed default form which includes protective mechanisms to detect data changes from the source image entity to the output form. The logging of user actions within the confines of that event are also accounted for.

2. ILook Raw Bitstream Format (IRBF) - A raw bitstream variant of IDIF, except the data payload itself is not compressed.

3. ILook Encrypted Image Format (IEIF) - A fully encrypted data payload output which associates user keys to the extraction of the data in a subsequent V8 analysis session or a subsequent operation of transformation by IXimager.

NOTE: All three image formats listed above are proprietary to ILook and can be subsequently converted to raw bitstream format using IXimager. Once converted to raw bitstream format, the image files can then be used by other forensic software.

The IXimager can function both as a bootable CD-ROM and as a bootable floppy diskette.