MAESTRO FORENSICS
Integrated forensic analysis tool for cloud storage evidence collection and analysis
MAESTRO WiSDOM Cloud
Cloud evidence collection and analysis platform
Cloud
[ Data Evidence Collection ]
Cloud
[ Data Evidence Analysis ]
Timeline Analysis
[ Timeline Analyzer ]
Correlation Analysis
[ Email, Image, and AI Correlation ]
OCR Text Extraction
[ Multilingual Translation ]
MAESTRO WiSDOM Cloud
going beyond the limitations of existing forensic tools
MAESTRO WiSDOM is a world-class integrated forensic analysis solution that is easy for anyone to use, from beginners to experienced forensic analysts.
While traditional forensic tools were limited to data collection and individual analysis, MAESTRO WiSDOM provides the following differentiated features to effectively respond to recent complex cyber threats and digital forensic issues.
Differences between Traditional Cloud Forensic Tools vs. MAESTRO WiSDOM Cloud
| item | Limitations of existing traditional cloud forensic tools | MAESTRO WiSDOM Cloud Advantages |
|---|---|---|
| Analysis accessibility | Requires high level of expertise (difficult for beginners) | With an intuitive UI, even beginners can easily analyze |
| Analysis scope | Focus on simple file recovery and artifact listing | Provides artifact-based in-depth analysis optimized for investigating cloud-related breaches and data leaks. |
| Evidence data collection method | Batch collection based on full data dump [ Extraction and analysis delayed due to inclusion of unnecessary data ] |
Prioritize securing key data through selective evidence extraction [ Minimize investigation time and maximize efficiency ] |
| Correlation analysis | Analysts manually identify links between evidence for analysis | Automatic scenario analysis through a specialized correlation analysis viewer |
| Unstructured data | Text search within images/videos unavailable | Secure clues within files using OCR text extraction and automatic translation features |
| Internet browser analysis | Artifact evidence analysis by web browser | Provides an integrated web browser artifact analysis viewer. Enables integrated analysis of cloud-connected web browsers. |
| Additional forensic tools required, purchased separately |
Open source or commercial tools required for timeline analysis, correlation analysis, password analysis, database
analysis, OCR extraction/translation, email viewer, image/video viewer, etc. (purchased separately) |
Built-in tools for timeline analysis, correlation analysis, password analysis, database analysis, OCR extraction/translation, email viewer, and image/video viewer [ Available without additional tool purchase costs ] |
MAESTRO WiSDOM Cloud
Integrated Analysis of Incidents & Digital Forensics
- Incident investigation
- Information leak investigation
- Internal Audit / Insider Confidentiality Leak
- Various digital evidence analysis with an intuitive UI and powerful features
MAESTRO WiSDOM Cloud - Key Features Shortcut
Collection and preservation of evidence
Collecting cloud evidence data while maintaining data integrity
Collection of data evidence distributed across various countries and regions, including AWS, Azure, and GCP
Generate hash values such as MD5 or SHA-256 immediately after collection to prove the identity of the evidence.
Collect live data from running virtual machines (VMs) when necessary.
Collect memory dumps and volatile data from virtual machines (VMs).
Analysis of cloud access information
Tracking and Analysis of Major Cloud Access Traces
Collection and analysis of user account information required for cloud access:
General user, administrator, and specific service account information
Cloud access key or ID.
Extracted and analyzed from log files and configuration files.
Extraction and analysis of IP addresses of connections and attempted connections, and geographical location information
Authentication Token / Session Information Analysis
STS (Security Token Service) Token Collection and Analysis
Collection and analysis of Refresh Tokens
Collection and analysis of browser cookies (Authentication Cookies)
Supports Session Hijacking attack analysis features
Analysis of cloud management tool generated files and configuration files
Analysis of file uploads to the cloud
Analysis of Cloud Storage Access and File Uploads
Extraction and analysis of file fragments or temporary file traces from files uploaded via a web browser
Analyze which files in which folders were selected through the analysis of key artifacts in the cloud.
Analysis of log files (sync.log, db.sqlite, etc.) of self-hosted apps such as OneDrive, iCloud, and Dropbox
Analysis of file upload success and filenames in the cloud
In-depth analysis of "who, when, where, through what route, and what was sent"
Analysis of file downloads to the cloud
Analysis of Cloud Storage Access and File Downloads
Extraction and analysis of file fragments or temporary file traces from files downloaded via a web browser
Analysis of Internet file inflow via Zone.Identifier (ADS) at the time of file download
Analysis of file opening, access, and execution history after cloud download
File download analysis through cloud access log collection and analysis
Analysis of evidence of secondary external transfer of downloaded files through analysis of USB copy records, email attachment records, etc.
Analysis via a dedicated database viewer
Supports analysis of various DB files such as SQLite.
Analysis of cloud access history, tokens, and file upload/download evidence
Cloud service access time, access to specific file paths
Check for the presence of a session maintenance token, determine whether the account has been compromised, and analyze
Analysis of email account information used for cloud login
Analysis of filenames and source URLs downloaded locally from the cloud
Analysis of cloud access tokens encrypted and stored in the browser DB
Allows verification of the database's internal structure and in-depth analysis through the viewer
Analysis via a dedicated email viewer
Supports analysis of various email file types such as Outlook, Mbox, and eml(x).
Emails can be viewed via a dedicated viewer
Analysis of references, blind references, attachments, body content, etc. is possible
ntegration with correlation analysis function possible
Provides a web browser integrated analysis viewer
Web browser integrated analysis support
Provides a process for detecting malicious files among downloaded files.
Provides threat detection capabilities using traces such as cookies and cache in addition to visited sites.
Provides a dedicated viewer for timeline analysis
Supports time series classification for all extracted artifacts
Provides filtering based on activity categories
Provides filtering such as key keywords
Anyone can easily derive results through advanced filtering features.
Evidence analysis using email correlation analysis tools
It identifies and analyzes hidden links and patterns between senders, recipients, CC recipients, body keywords, attachments, etc.
Visualize internal and external relationship networks like a map based on email sending and receiving relationships
Email sender-recipient correlation analysis
Email attachment correlation analysis, etc.
Provides a specialized viewer for correlation analysis
Provides correlation analysis features based on file name/path and user information
Provides correlation analysis capabilities for key cloud artifacts
Provides image/video file correlation analysis function
Provides network/process/device-based correlation analysis capabilities
Various graph layouts are possible to view intuitive data flow.
Support for information leakage investigation and analysis
Provides specialized artifacts for information leakage investigations
Collection of removable storage media activity history
Provides artifacts collected from suspected information leakage routes
Provides a list of files modified, executed, recently viewed files, etc.
USB precision investigation and analysis support
Investigation and analysis of USB usage records
USB Executable File Collection and Analysis
USB Deleted File Investigation and Analysis
Collection and Analysis of USB File Copy Traces
Support for Incident Investigation Analysis Artifacts
Providing specialized artifacts for incident investigation and analysis
Provides specialized artifacts including LotL, Fileless, PowerShell, WMI/WMIC, and ransomware infection investigation .
Provides a specialized viewer for detecting suspicious patterns in web logs, SQL injection, XSS, directory traversal, command injection, file uploads, etc.
Memory dump support
Support for the latest cloud system memory dumps
Supports remote memory dump function over network
(WiSDOM Remote required)
Fast memory dump feature (approx. 1 minute for 64GB)
Provides a specialized memory analysis viewer
Detection and extraction of cryptographic keys and critical malware information through memory analysis capabilities
Memory analysis is an essential feature for analyzing hacking and malware breaches.
Malicious file and process scanning detection function
Support for password-locked file detection / analysis
Supports various password-protected file types.
Supports detection/analysis of Hangul files below (hwp, hwpx).
Supports dictionary password decryption function
Supports brute-force encryption decryption
Hybrid encryption/decryption function support
Supports rule-based encryption/decryption functions
OCR Text Extraction / Translation Function
OCR text extraction from image, video, and audio files
Full support for Korean text
Multilingual translation feature provided (English, Japanese, Chinese)
Support for automatic translation of extracted text
Support for cryptocurrency detection and analysis features
Cryptocurrency wallet address detection
Collection of Hot/Cold Wallet Addresses
Chromium browser-based plugin wallet information collection
Detection and collection of virtual currency wallet addresses, such as documents or images
Provides various professional viewers
File System Viewer for File System Analysis
Event Logs Viewer dedicated to event log analysis
Web Artifacts Viewer for Web Browser Integrated Analysis
Email Viewer for full email analysis
DB Viewer for Database Analysis
Registry Viewer dedicated to registry analysis
Image & Video Viewer dedicated to image and video analysis
Provision of various viewers required for other forensic analyses
[ Viewer development and updates following feasibility review upon customer request ]
