Using Cyacomb Examiner Plus
Overview of how to utilize Cyacomb Examiner Plus in various Operating modes.
Installed mode
Installed mode is the most flexible option and runs on the examiner’s own forensic workstation.
Supports scanning of:
- Attached hard drives
- USB devices
- SD cards
- Connected mobile devices
- Forensic images
Best for:
- Controlled forensic workstations
- Mobile scanning
- Hardware/software write-blocked workflows
Live mode
Live mode runs directly from the Cyacomb USB on a powered-on, unlocked suspect computer.
Key points:
- Start from Windows File Explorer via the USB’s launch folder
- The UI displays LIVE to distinguish it from installed mode
- It is not as forensically sound as installed mode
- Minor system changes occur when the USB is inserted
- Metadata and evidence are said to remain unaffected
- Audit logs are available to justify changes
Important limitation:
- Mobile device scanning is not supported in Live mode
Bootable mode
Bootable mode starts a powered-off computer into a forensic operating system from the Cyacomb USB.
Advantages:
- No need to remove drives
- No need to boot into the suspect OS
- More forensically sound than Live mode
Limitations:
- Cannot scan encrypted partitions
- Requires some skill to boot different systems from USB
- Setup varies by manufacturer/model
Mobile device scanning
Mobile scanning is only supported in installed mode.
Newer mobile capabilities
The guide highlights:
- Similarity scanning for mobile devices, which can identify visually similar images even after alteration by apps or cloud services
- Enhanced iOS access via Apple File Conduit (AFC) replacing MTP
AFC improvements include access to:
- Cached media from other Apple devices
- Optimized versions of photos/videos
- Supporting metadata
- Deleted or synced content not visible in DCIM
Mobile scan requirements
For iOS:
- Device must be unlocked
- User must accept Trust this computer
- Auto-lock should be set to Never to avoid interruption
For Android:
- Device may need to be placed in USB/File Transfer Mode
- Users may need device-specific instructions by make/model
Troubleshooting note:
- If the device does not appear in File Explorer, it likely will not appear in Cyacomb either.
Mac support
Mac OS scanning is supported in Live mode only.
Notes include:
- Supports both Apple Silicon and Intel
- Logical file scanning alters Last Access times, but original values are recorded in reports
- Cloud-resident files are not scanned to avoid downloading/updating them
- Non-scanned files are identified in the UI and reports
- Reports are created in a directory structure
- File local/remote location is shown in the UI/report
- Remote files may show a cloud icon
- Dongle validation ignores files created by the user’s OS
Licensing
- The Cyacomb dongle ships with the license pre-loaded
- In installed mode, the dongle must remain inserted because it acts as the license key
- Removing it causes a “No license detected” message
- Teams may share a dongle, but multiple dongles are recommended for larger operations
Operational cautions
The guide stresses:
- Use an isolated computer when handling devices containing CSAM or other illegal content
- Keep the operational system off the internet or work network where appropriate
- Contact support if USB creation fails or if devices appear in File Explorer but not in Cyacomb
Short takeaway
The document is essentially a setup and operating guide for getting Examiner Plus ready, loading the right filters, preparing the Cyacomb USB, and understanding when to use Installed, Live, or Bootable mode. The biggest practical distinctions are:
- Installed mode = best for full functionality, including mobile
- Live mode = quick on-device scans, but less forensically sound and no mobile support
- Bootable mode = forensically sound startup from USB, but no encrypted partition scanning