Unify your investigation.

Forensic agents for DFIR teams. Load disk images, memory, logs, mailboxes, and extractions. Find out what happened, then produce verified findings and reports fast.

Book a demo

For incident response

Load evidence from every affected system during a breach and get a timeline of what the attacker did, with each step linked to its source.

For digital forensics

Put disk images, phones, and mailboxes from an examination in one case, and get findings you can cite in your report.

Works with any evidence.

Bring evidence straight from your collection tools: disk images, memory, cloud and endpoint logs, mailboxes, phone extractions, and network captures. Mobasi reads each one in its native format and puts it all in one case.

Engineered for speed and depth.

Mobasi orchestrates open-source forensic tools and fast native parsers across every source in the case, so large evidence opens in seconds.

embedded forensic tools: 100+; embedded forensic tools
faster memory analysis: 5–100×; faster memory analysis
indexing logs, decompressed: 1.5 GB/s; indexing logs, decompressed

Results you can verify.

Mobasi links every finding to the record behind it, whether it's in a log, a disk image, memory, a database, or a parsed artifact. Open in one app.

Data type	Replaces
Disk images	FTK Imager
Phone extractions	Cellebrite Reader
AXIOM cases	AXIOM Examine
Mailboxes	Outlook, PST viewers
SQLite databases	DB Browser for SQLite
Logs and CSV files	Timeline Explorer, Excel

For evidence review.

Did the attacker reach the finance share?

The file server's event log records a sign-in by svc_backup at 2:09 AM , then the same account opening Q3_forecast.xlsx on the finance share four minutes later . That is consistent with the attacker reaching the share. The log alone doesn't show whether the file left the server.

Event logFIN-SRV-02

Time	Event	Account
2:07:51 AM	Sign-in failed	svc_backup
2:09:12 AM	Signed in1	svc_backup
2:13:40 AM	Opened Q3_forecast.xlsx2	svc_backup
2:26:10 AM	Started cmd.exe	svc_backup

Was the file staged to be taken?

A copy of Q3_forecast.xlsx appears in svc_backup's temp folder at 2:22 AM , and an archive named q3.7z is created beside it two minutes later . That sequence is consistent with staging the file for transfer.

FilesFIN-SRV-02 disk image · Temp

Name	Size	Created
~DF3A2.tmp	12 KB	1:58 AM
Q3_forecast.xlsx1	84 KB	2:22 AM
q3.7z2	79 KB	2:24 AM
rclone.conf	1 KB	2:26 AM

What was running as svc_backup?

The memory capture shows rclone.exe running as svc_backup with an open connection to 203.0.113.24 on port 443 . rclone copies files to cloud storage, so this indicates an upload was likely under way when memory was captured.

ProcessesFIN-SRV-02 memory

PID	Process	User	Connection
3912	cmd.exe	svc_backup
4120	rclone.exe12	svc_backup	203.0.113.24:443
4388	conhost.exe	svc_backup
1044	svchost.exe	SYSTEM

Where did the data go?

The browser history database on the file server records a visit to a file-sharing upload page at 2:29 AM , while rclone was running. With the open connection in memory, this suggests the archive was uploaded there. The history doesn't confirm the upload finished.

Browser historyChrome History (SQLite)

Time	Page	Site
2:15 AM	Sign in to your account	login.microsoftonline.com
2:29 AM	Upload files1	upload.example.com
2:41 AM	New tab

When did these tools first run?

Prefetch records show 7z.exe ran once, at 2:24 AM , and rclone.exe ran once, at 2:27 AM . Single runs inside the incident window point to the attacker rather than a scheduled job.

PrefetchFIN-SRV-02 parsed artifacts

Program	Runs	Last run
CMD.EXE	214	2:26 AM
7Z.EXE1	1	2:24 AM
RCLONE.EXE2	1	2:27 AM
SVCHOST.EXE	1,032	2:30 AM

“We loaded every image from the engagement into one case and had the attacker's path mapped the same day.”

Name Surname · Director of incident response, IR firmPlaceholder

Built for sensitive evidence.

Mobasi runs in your environment. Case data isn't retained or used for training.

Security details →

01Runs in your environmentMobasi runs on hardware or cloud accounts you control, next to your evidence.
02No data retentionMobasi doesn't store your prompts or results, and its model providers don't train on them.
03SOC 2 Type IIOur controls are audited. We share the report with customers under NDA.

Try it on a real case.

Built for incident response firms, forensic service providers, and corporate investigation teams.