Read-only from top to bottom
Query commands only, disks opened with read access, and file contents read from the disk itself - so even last-access dates stay put.
All programs › Heirloom Evidence Triage › More information
Why people choose Heirloom Evidence Triage
Collect the evidence. Leave the computer untouched.
When a workstation looks wrong, the first hour matters. Evidence Triage gathers what an investigator needs from a USB stick in one pass - and proves, with hashes and a signed custody report, that it changed nothing.
Heirloom Evidence Triage$149one time - yours to keepteam of 5: $399
0writes to the examined drive
2 hashesSHA-256 and MD5 for every file
$149once - or $399 for a team of 5
What makes it special
Six reasons Heirloom Evidence Triage earns its place in your toolkit
Gets the locked files
Registry hives Windows keeps locked are copied straight from the disk, with their transaction logs.
Every sector accounted for
Each file's start sector, length, and fragments, plus a map of used and unused space - checked against the physical disk.
Custody built in
Case number, examiner, UTC times, a hash manifest, and a PDF with signature lines, ready to print.
Old computers too
Runs on Windows 7 through 11 with nothing to install - the computers that need checking are rarely new.
Bench or background
A plain window for hands-on work, a command line for scripts, and a hidden mode for scheduled runs.
The difference
Before and after Heirloom Evidence Triage
Before
- Screenshots and notes taken by hand
- Tools that change the dates they're meant to record
- No record of who collected what, or when
After
- One evidence folder, every part hashed
- The examined drive left as it was
- A signed chain-of-custody report
Our promise
Made the old-fashioned way
- Pay onceNo subscription, no yearly fee - it's yours.
- No ads, no accountsNothing to sign up for and nothing trying to sell you more.
- Stays on your computerYour files and information never leave home.
- A real person answersCall or text (606) 521-7093 - a family business in Williamsburg, Kentucky.
Ready to try Heirloom Evidence Triage?
Read the guide free, then keep it for $149 once - or $399 for a team of five.
See the full feature list and common questions · Runs on Windows 7, 8, 10, and 11 from a USB stick or any folder - nothing to install.