Read the Eviquire product demonstration.

[Music]

This is the Eviquire Forensic Browser.

Eviquire is a specialized browser

designed to document and collect online material for

investigative and legal review.

Many types of online content that can be accessed

within an authorized workflow can be collected.

It can be a social media post, a simple web page,

or even a content on the Tor Dark Web Network.

Let's start at the beginning and see what makes Eviquire

unique.

We developed a customized interface

that supports documented forensic acquisition across

different investigative contexts.

Eviquire is designed to preserve a documented

acquisition record

for legal and professional review, subject to the relevant

jurisdiction and case requirements.

by recording how specific content was

collected

online.

At the center of the browser, we find the browser

itself,

which can open websites much like Edge, Chrome,

or Firefox.

For example, we can browse Wikipedia and search for

Europe.

At the top of the browser, we see key properties of

the acquisition.

We see the Eviquire version being used.

The current acquisition ID and the IP address from

which we are investigating.

And we also have the video duration,

because everything visible on screen is being video

recorded.

An important point to consider is that we put

significant focus

on the visual aspect of the evidence.

So the evidence is video recorded while the network

traffic is also collected

and, where enabled, evidence records can be time-stamped on multiple blockchains

during the acquisition process.

Finally, we have the video time and the current

system time.

And at the bottom, we have the chain of custody,

which is a digital adaptation of the traditional

chain of custody

for physical evidence adapted specifically for online

content.

For example, when I change pages, it is immediately

reflected in the chain of custody below.

Again, all of this is video recorded, helping create a

clear acquisition record for review.

But how do we collect this evidence?

On the left side, we have several options.

First, I can take a screenshot.

In this case, the tool collects everything visible on

the screen,

including the interface, but not content outside the

view.

In this case, the web page is very long.

So the screenshot captures only the visible portion.

If I want to capture the entire page, then I will use

a page shot

where the browser automatically scrolls through the

page

while taking screenshots and collecting additional

forensic data

to create a forensic package that can then be time-stamped

on multiple blockchains where enabled.

This is another acquisition option.

In addition, we can collect only a specific screen

region.

In this case, I select the area with the mouse, mark

it as evidence, and the process is complete.

Notice that the screen changes from blue to white,

and once it turns blue again,

it means the evidence has been fully acquired and

time-stamped on multiple blockchains where enabled.

Let's now go to YouTube, which is another common

source of evidence.

On YouTube, there are several important details to

consider.

First, we have the ability to expand comments and

replies.

This video contains, of course, the video content

itself.

Along with many comments, some of which are hidden.

Eviquire can automatically scroll, load additional

comments, and expand both comments and replies.

But first, let's collect the video itself.

Eviquire includes a dedicated function to collect

and download the video

without waiting for the full playback duration.

Here, we can download the video.

The video file itself is treated as evidence.

At the bottom left, we have a status update showing

everything that occurs during the video download.

We are now downloading the video.

While tracking not only the actual YouTube page,

but also the final URL from which the video was

downloaded.

If the video is delivered in segments, then it will

track the URLs of all video segments.

In this case, the video is quite long, so it takes

some time.

After that, we will expand the comments and replies.

We will use the autoscroll function with comments and

replies.

Now that the video has been collected, let's autoscroll

the page.

And we select, expand, comments and replies.

This is important because it allows the tool to

expand comments and replies,

while scrolling, taking screenshots and collecting

other forensic properties.

Let's press stop and review the results.

If we scroll up, we will see how the comments have

already been expanded by the tool.

Another useful capability is the web crawler feature.

The tool extracts all links and then visits and

can capture eligible pages behind those links according to the selected settings.

This is especially useful when you have, for example,

an online store with multiple products,

such as YouTube, eBay or Aliexpress.

And the tool can automatically crawl all related

product pages linked from the current page,

saving significant time for the investigator.

For example, we are already collecting the third page.

This is the fourth page, and so on until the selected URLs are

processed.

The tool can be configured to collect URLs only within the active domain.

It does not leave the domain.

Let's stop here and review the results.

Another useful feature is the ability to use a split

screen.

This is particularly useful when, for example, we

want to collect evidence

and demonstrate that the same page appears in two

different user agent views,

or when we want to compare two different websites

together at the same time in a single image

so a reviewer can better understand what is being

collected.

Again, we can take a screenshot.

That includes both pages left and right in the split

screen.

That completes the different options available for

collecting online evidence.

We can now stop the acquisition and return to the

case manager.

At this point, Eviquire is packaging the completed

acquisition we completed,

including the selected evidence, and a report can be

generated,

along with hashes of the files and other

acquisition properties that were recorded.

This is the acquisition review tool, which can also

be embedded in a case.

So investigators can review the evidence

independently.

Here we can see, for example, the chain of custody

and the recorded video of the acquisition.

Included is, and this is very important, a visual

indicator,

showing where the user clicked with the mouse.

This is important because it allows a reviewer to

clearly see it in the video.

We also have the screenshots collected

during the acquisition,

including different evidence types, along with the

acquisition report,

containing general acquisition information and

forensic data,

network details, the video recording,

and then a preview of each type of evidence that was

collected.

This is the chain of custody, where we can see all

details related to the URLs we visited.

We also have the download section.

In this case, one video was downloaded from YouTube,

along with all forensic information about the video,

including the actual URL from which the video was

downloaded.

In addition, we have the deep collection capability

that allows you to review request and response

content,

captured during the acquisition and, where authorized, makes it

possible to download specific resources directly.

This is particularly useful for JavaScript files or

other resources that you may want to download.

The forensic package can include additional

artifacts and context.

We collect a number of files for every piece of

evidence.

An evidence item may include source code and a

copy of the page HTML,

robots.txt, hash files, and other artifacts that may

not always be required for an investigation,

but can be available when a reviewer requests a

review during court proceedings

to verify the integrity and collection process of the

evidence.

I would say that is enough for today.

Thank you for watching.

Discover more about Eviquire at eviquire.com.

[MUSIC PLAYING]