MAESTRO FORENSICS
A world-class integrated forensic analysis solution designed for everyone from new investigators to experienced forensic examiners
MAESTRO WiSDOM Windows
Integrated Digital Forensics & Incident Response Platform
OS Artifacts
[ 550 or more ]
File System Analysis
[ File System Viewer ]
Timeline Analysis
[ Timeline Analyzer ]
Correlation Analysis
[ Email, Image, and AI Correlation ]
OCR Text Extraction
[ Multilingual Translation ]
Beyond the Limitations of Traditional Forensic Tools
MAESTRO WiSDOM Windows
MAESTRO WiSDOM is a world-class integrated forensic analysis solution that is easy to use for everyone,
from new investigators to experienced forensic analysts.
While traditional forensic tools are often limited to data collection and isolated analysis, MAESTRO WiSDOM provides differentiated capabilities to respond effectively to modern cyber threats and complex digital forensic cases.
Traditional Windows Forensic Tools vs. MAESTRO WiSDOM Windows
| Category | Limitations of Traditional Windows Forensic Tools | MAESTRO WiSDOM Windows Advantages |
|---|---|---|
| Analysis Accessibility | Requires advanced expertise, making it difficult for beginners | Intuitive UI enables easier analysis even for beginners |
| Analysis Scope | Focused mainly on simple file recovery and artifact listing | Provides artifact-based deep analysis optimized for incident response and data leakage investigations |
| Evidence Collection Method | Bulk collection based on full data dumps [ unnecessary data can delay extraction and analysis ] |
Prioritizes key data through selective evidence extraction [ minimizing investigation time and maximizing efficiency ] |
| Correlation Analysis | Analysts manually identify relationships between evidence items | Automated scenario analysis through a dedicated correlation viewer |
| Unstructured Data | Cannot search text inside images or videos | Finds clues in files using OCR text extraction and automatic translation |
| Historical Trace Analysis | Focused mainly on current-state data analysis | Recovers past files and tracks abnormal changes using Volume Shadow Copy (VSC) analysis |
| Additional Forensic Tools Separate Purchase |
Event logs, Volume Shadow Copy (VSC), password analysis, OCR text extraction / translation, web log analysis, and correlation analysis require open-source or commercial tools [ separate purchase ] |
Built-in event log viewer, Volume Shadow Copy viewer, password analyzer, OCR text extraction / translation analyzer, web log viewer, and correlation analysis tools. [ available without additional tool purchase ] |
MAESTRO WiSDOM Windows
Integrated Digital Forensics & Incident Response Analysis
- Incident Response Investigation
- Information Leakage Investigation
- Internal Audit
- Analyze diverse digital evidence with an intuitive UI and powerful features
MAESTRO WiSDOM Windows Key Features
Data Recovery / File Carving
Supports data recovery and file carving
Supports file carving for Korean document formats such as hwp(x), cell, and show
Supports carving for 1,400+ file types
Supports physical recovery of carved files and additional analysis in WiSDOM
Advanced Event Log Analysis
Automatically collects key event log files and provides analysis results
Classifies events by activity through the event log viewer
Provides event log classification and filtering by case or incident
Supports visual analysis such as user and login correlation
Windows Volume Shadow Copy Analysis
Supports historical system-state analysis based on Volume Shadow Copy (VSC)
Supports recovery analysis of deleted or modified files and event logs
Tracks change history and abnormal activity through point-in-time data comparison
Supports extraction and analysis of forensic investigation artifacts
OCR Text Extraction
Extracts OCR text from images, videos, and audio files
Fully supports Korean text
Provides multilingual translation (English, Japanese, Chinese)
Supports automatic translation of extracted text
Dedicated Timeline Analysis Viewer
Supports chronological classification of all extracted artifacts
Provides filtering by activity category
Provides filtering by key keywords and other criteria
Advanced filtering helps users easily derive results
Evidence Analysis with Email Correlation Tools
Finds and analyzes hidden connections and patterns among senders, recipients, CCs, body keywords, and attachments
Visualizes internal and external relationship networks based on email communication
Analyzes sender and recipient relationships
Analyzes relationships involving email attachments
Dedicated Correlation Analysis Viewer
Provides correlation analysis based on file names, paths, and user information
Provides correlation analysis for major Windows artifacts
Provides correlation analysis for image and video files
Provides network, process, and device-based correlation analysis
Supports multiple graph layouts for intuitive data-flow review
Information Leakage Investigation Support
Provides specialized artifacts for information leakage investigations
Collects removable storage activity history
Provides artifacts for suspected leakage paths
Lists file modification, execution, and recently opened files
USB Forensic Analysis Support
Analyzes USB usage history
Collects and analyzes USB executable files
Investigates and analyzes deleted USB files
Collects and analyzes traces of USB file copying
Incident Response Artifact Support
Provides specialized artifacts for incident response investigations
Provides specialized artifacts for LotL, fileless attacks, PowerShell, WMI/WMIC,
and ransomware infection investigations
Provides specialized viewers for detecting suspicious patterns such as web logs, SQL injection, XSS,
directory traversal, command injection, and file uploads
Ransomware Investigation Support
Automatically collects suspicious ransomware-related extensions
Automatically collects ransom note files
Collects artifacts based on ransomware behavior
Detects backup and volume snapshot disablement patterns
Web Shell Detection Analysis
Collects and classifies Web shell data
Provides a dedicated Web shell detection viewer
Provides Web shell analysis results using dedicated categories
Memory Dump Support
Supports memory dumps from the latest Windows systems
Supports remote Memory Dump over the network
( WiSDOM Remote required )
Fast memory dump capability (about 1 minute for 64GB)
Advanced Memory Analysis Support
Detects and extracts encryption keys, malware,
and critical information through Memory Analysis
Memory Analysis is essential for hacking, malware, and incident response investigations
Detects malicious files and processes through scanning
Password-Protected File Detection / Analysis Support
Supports various password-protected file types
including Korean document formats (hwp, hwpx)
Supports dictionary-based password recovery
Supports brute-force password recovery
Supports hybrid password recovery
Supports rule-based password recovery
BitLocker Volume Analysis Support
Supports analysis of forensic images with BitLocker enabled
Searches and detects BitLocker recovery keys in memory
Supports entering and unlocking keys when processing forensic images using discovered BitLocker keys
Thumbnail Cache / Icon Cache Analysis Support
Parses thumbnail cache files and provides a dedicated viewer
Parses icon cache files and provides a dedicated viewer
Proves that the file existed on the system through thumbnail cache
even if the original file was deleted
Identifies the existence and type of applications through icon cache files
Can identify traces of anti-forensic tool usage and malware execution
Web Browser Integrated Analysis Support
Web Browser Integrated Analysis Support
Provides a process for detecting malicious files among downloaded files
Detects threats using traces such as cookies and cache in addition to visited sites
Analysis through a Dedicated E-Mail Viewer
Supports analysis of various email file types including Outlook, Mbox, and eml(x)
Allows email review through a dedicated viewer
Analyzes CC, BCC, attachments, and message body content
Can be linked with correlation analysis features
Database Analysis Support
Collects and classifies database file types
Provides viewers for major Windows database files
Supports internal structure review and in-depth database analysis through viewers
Cryptocurrency Detection Analysis Support
Detects cryptocurrency wallet addresses
Collects and classifies hot and cold wallet addresses
Collects Chromium browser-based plugin wallet information
Detects and collects cryptocurrency wallet addresses from documents or images
Registry Analysis Support
Provides a dedicated Windows registry analysis viewer
Supports recovery analysis of deleted registry keys
Supports important registry filters
Digital Forensic Analysis Support
Fully supports Windows file systems (FAT32, NTFS, exFAT)
Provides forensic analysis for OS artifact information, internet activity, USB access, and more
Provides specialized artifacts for information leakage analysis
Provides artifacts for collecting personal information such as resident registration numbers, account numbers, and phone numbers
Provides intelligent artifacts for tracking downloaded files, USB usage traces, and more
Specialized Viewers
File System Viewer for file system analysis
Event Logs Viewer for event log analysis
Web Artifacts Viewer for integrated web browser analysis
Email Viewer for dedicated email analysis
DB Viewer for database analysis
Registry Viewer for registry analysis
Image & Video Viewer for image and video analysis
Provides various viewers required for forensic analysis
[ viewer development and updates are reviewed based on customer requests ]
Discover MAESTRO WiSDOM Through Video
Explore every capability of professional Windows forensic analysis through our demo videos.
