Field Search is a suite of free software products developed by the National Law Enforcement and Corrections Technology Center (NLECTC). The software rapidly locates and reports on Internet histories, images, multimedia files and results from text searches.

Click here for Field Search video

How it works!

The Field Search software is deployed from a USB or “thumb” drive by officers in the field and the report is saved back onto the FIELD SEARCH USB drive each student receives. The software provides a quick and efficient examination of a suspect’s computer. Officers with little, or no computer experience will be able to safely and easily use the software.

Officers can then examine the results live in the offender/suspect's home or work and select files they want in their report. Students of all computer skill levels walk out of this one day class able to confidently search digital devices, create court worthy reports, and hold offenders accountable for their electronic actions. 

In a matter of a few minutes, Field Search provides a detailed record of Internet websites visited, images and videos, most recently used files (MRUs), and the contents of the recycle bin. This tool can also conduct robust keyword searches for victim names, telephone #s, email addresses, and other case critical information. 



  1. Field Search for Windows® (FS-Win) runs live in a native Windows environment. 
  2. Similarly, Field Search for Macintosh (FS-Mac) runs live in the native Mac OS X® environment.
  3. Recover URL records (i.e., even some records the suspect believes he deleted!
  4. Images (Pictures) several different formats....JPEG, GIF, BMT, PNG, and many more.
  5. Videos (Movies) several different formats....WMV, MPEG, FLV etc.
  6. Files in the recycle bin (user believes they deleted these files, date and time they were deleted).
  7. “Keyword Search” allow the investigation to look for specific words, email addresses, victim names, telephone numbers, stolen credit card numbers, etc.
  8. Search files on the computer hard drive, removable flash drives, CD’s, Muti-media cards, digital cameras, etc.
  9. Produce .PDF reports which are password protected for case confidentiality and sensitive investigations. Easily generate a finished report for court in any format (.pdf, .xls, .doc, etc).
  10. Freeware diagnostic tools include; Metadata Analysis-Geo Tag Tracing, Hash Value Analysis, Wi-Fi sourcing, etc.

Field Search Version 5 just added and updated the following capabilities:


Field Search software allows officers to accomplish the following tasks within 30 to 45 minutes:

1.  Search logical URL and Cookie histories (listings of places web browsers have gone) 

     (FS v 5 now handles Edge Browser)

 2.  Find all logical images (pictures which still exist as files on the computer). 

 3.  Retrieve all MRUs (most recently used).

 4.  Retrieve all Link files from system.

 5.  Search logical files for text or phrases in all languages. 

 6.  Ability to scan single folders.

 7.  Opens and searches for images and text in Office 2007+ files.

 8.  List media available to the user on the system.

 9.  Copy seized evidence onto removable media.

10.  Immediately produce an exportable report which contains system configuration and all evidence       

       tagged for inclusion in the report (with associated path and MAC dates).

11.  Export all information into a spreadsheet for further examination.

12.  Extract browser (URL) histories from file slack space and volume free space (listings which have    

       been deleted but remain on the drive). This function adds significant time to the examination.

13.  Extensive manual in PDF format accompanies the software. 

14.  Find all logical multi-media files - capture screen shots for the report 

15.  Extract and sort data from the Recycle Bin 

16.  Built-in Evidence Zipper Function - zips up files tagged for inclusion in the report. Zip file can be        

       saved on removable media.

17.  Easily change the GUI to any language.

18.  Powerful Registry Tool now built into Field Search.

19.  Examine registry hives on attached volumes.

20.  Review chat activity within four popular chat clients.

21.  Do a HASH comparison against known HASH sets.

22.  Automatically checks for encryption (Truecrypt, PGP, DiskCryptor and Bitlocker). 

23.  Lists all running processes, can select and put in Final Report. 



We'll come to you.  On-site training is available.   

Please contact an E-Kit Representative 

for  more information.  815-245-8476