E-Investigations Develops Proprietary IPTheft™ v1.0.6, EImager™ & Baylexx™ Forensic Suites

Commercial digital forensics suites were built as general-purpose monoliths that require hours of upfront database indexing before an investigator can answer urgent client questions—and they frequently dump raw, uncorroborated tables of artifacts that opposing experts easily challenge in court. To solve these operational and evidentiary limitations, E-Investigations founder Gary Huestis engineered a specialized suite of proprietary forensic engines:

1. IPTheft™ & IPTheftWorkbench™ v1.0.6: 7-Domain Corporate & Employee Misconduct Engine

• Native C17 EImagerBridge.dll Interop: Combines random-access libewf chunk streaming (with zero-fill fault tolerance on damaged sectors), native SQLite 3.51.2 Write-Ahead Log (-wal) replay and B-tree slack carving, Windows ESENT (esent.dll) dynamic page-size SRUDB.dat upload bandwidth telemetry, and kernel ntdll.dll Xpress Huffman (MAM\x04) Windows 10/11 Prefetch decompression.
• 5-Layer Deleted, Shift-Deleted & Emptied Recycle Bin Recovery: Carves resident $Ixxxxxx headers from unallocated 1,024 bytes (1.02 KB / 1.00 KiB) $MFT records after the Recycle Bin has been emptied, verifies carvable clusters in $Bitmap (MFT Record #6) in O(1) time, reconstructs full paths from $Extend\$UsnJrnl:$J while flagging Mass-Deletion Bursts (≥25 files in 5 minutes), and carves $I30 (INDX) 4,096 bytes (4.10 KB / 4.00 KiB) B-tree slack pages.
• Dual-Pass Binary Registry Engine (regf + HvLE .LOG1/.LOG2 + Unallocated hbin Carving): Unions unreplayed base hives with dirty transaction log pages and carves deleted cells so reg delete and CCleaner cannot erase historical USB device connections.
• Automated Exculpatory Verification Badges ([EXC-001]–[EXC-008], [EXC-PST-EMPTY]): Proactively isolates zero-interaction USB charging ([EXC-001]), IT provisioning media ([EXC-002]/[EXC-004]), corporate sanctioned OneDrive tenants ([EXC-005]), upstream originator print timestamps ([EXC-008]), and 271,360 bytes (271.36 KB / 265.00 KiB) default empty Outlook .pst skeletons.

2. EImager™ & Baylexx™: End-to-End Bit-Stream & Mobile Forensics

Alongside IPTheft™, E-Investigations’ proprietary EImager™ acquisition suite binds every disk image into our 4-Tier Evidentiary Hierarchy (Case → Custodian → Parent Host EV-001 → Storage Sub-Items EV-001-A/B/C), while Baylexx™ executes deep unallocated SQLite carving and monotonic ROWID spoliation analysis across iOS and mobile devices.