Virtual Live Boot

Boot forensic image files and view electronic evidence in-situ in a forensically sound virtual environment.

Boot both Windows (all versions) and Macintosh computers.

Live Boot gives the investigator a unique perspective into a suspects computer use. It is both an effective investigations tool as well as a means by which compelling evidence can easily be presented to a client, judge or jury.

Common uses of Live Boot are:

  • Bypass or break Windows user-account passwords;
  • Quickly analyze desktop layout and organizational structure;
  • Run installed programs, including proprietary software such as accounting packages;
  • View in situ MRU lists and other forensic artifacts;
  • Revert to Windows Restore Points;
  • and more.

Do you need support on our products?

Our support team is available by email or phone Monday to Friday from 8:30 am to 5:30 pm. We aim to respond to new tickets within 24 hours or the next business day.

Contact our support team

Live Boot utilizes Mount Image Pro (included with a Forensic Explorer purchase) and VMWare or VirtualBox to give fast and reliable access to the virtual environment of forensically imaged computer.

Live Boot Password Recovery:

Virtual Live Boot of a MAC:

Stand Alone Deploy

Create a stand-alone deploy-able Live Boot for non technical investigators to review a suspects computer (see video below). The deployed Live Boot Session requires only Mount Image Pro (MIP) and VirtualBox to

be installed.