Offline Mode

This mode allows the acquisition of .evtx files exported from the Windows Event Log of client machines.

An “Offline” directory is available within the program installation folder.

Previously saved .evtx files can be copied into this directory.
During the first scan, the system detects the files present and processes them as an offline scan.

NOTE:

This procedure is intended for extraordinary measures only. Standard scanning should be performed using online mode or RT.