WindowsSCOPE is an incident response tool which enables memory forensics for Windows computers. It performs reverse-engineering of the entire operating system from physical memory as well as all running software. It automatically identifies all processes, threads, and drivers running on the system as well as other system activity including open files, registry keys, and network sockets. It supports the latest Windows versions through Windows 10 and also has advanced data search capabilities to find URLs, credit cards, names, etc. in captured memory. It is the next generation in live memory forensics tools and memory forensics technologies — with customers in 20 countries including US, Canada, Europe, and Asia. It provides the most sophisticated memory forensics analysis for security breaches.  Now offering cloud rentals and node-locked version.

CaptureGUARD and Phantom Probe hardware accessories provide memory acquisition and magical access to locked computers (access live memory and encrypted disks without needing password).