please wait
close window
top menu - tab edge
Home      members Customer Portal     corporate Corporate     partners Partners
Reseller Application
Map and Directions
G-FLASH Mobile Malware Investigation

See what our customers have to say!

I would like to take this opportunity to thank all the people at WetStone Tech for their excellent work on Stego Suite and Gargoyle forensics software. It has become standard practice for the Erie County District Attorney's High Tech Crime Investigation Unit to run your Gargoyle program as the first forensics program on each and every case in the anticipation of a malware defense. Prosecutors, defense attorneys and the courts all readily accept the easy to read HTML reports which has saved countless hours of trial testimony in criminal cases. In one recent case Gargoyle proved to be an extremely valuable tool.

The Erie County Adult Probation and Parole Department utilizes a random polygraph test to assist in the supervision of convicted sex offenders. Earlier this year a defendant was sent a notice to show up for a mandatory interview and polygraph. The defendant showed up for the appointment six hours early and was allowed take the test after a discussion among the Probation and Parole Officers. The polygraph indicated the defendant was not being truthful during the testing process but he was allowed to leave upon completion. The defendant anticipated that Probation and Parole officers would soon be showing up at his girlfriend's apartment and asking questions so he downloaded and ran seven different anti-forensics programs in an attempt to completely erase any trace evidence of recent child pornography searches and viewing activity.

When the officers showed up at the apartment the girlfriend and actual owner of the computer, authorized the officers to take the computer to a forensics lab for a quick analysis. Gargoyle identified seven different anti-forensics programs with date and time stamps that indicated use the evening before the defendant's appointment and immediately following the polygraph test. A subsequent forensic analysis was unable to find child pornography graphics or the actual anti-forensics programs (except for the last evidence eliminating program run) but did uncover search terms indicating searches for child pornography related content. Gargoyle provided the best evidence that the defendant engaged in activities designed to hide any evidence that he had violated terms of his parole and hinder the ability of the parole officers to effectively supervise the defendant. The defendant was charged with one felony count of manufacturing or tampering with evidence and eventually entered a guilty plea.

Larry Dombrowski, Chief County Detective
Erie County District Attorney's Office

Wetstone Technologies' online training is unbelievably impressive. Having top-level, expert instruction by seasoned, experienced professionals that are friendly, truly relevant, and extremely in-depth can rarely be obtained in a classroom environment much less in the comfort of your own home.

Louis M. Schlesinger, LPI, ACE, CFC, CIFI
CyForensics, LLC

I wanted to write to let you in on how successful your product is operating. Indeed, after a brief session of "operator errors" we had the Gargoyle program up and running at a proficient level. So successful in fact that we were able to find two hidden programs in a client's computer system.

This particular client was consistently missing out on projects because his bids being submitted were just a few dollars above competitor's bids. No one could account for the narrow loss of each so called "scaled secret bid". Then Gargoyle let us know that their close competitor was being notified by Keylogging software about the dollar amount of the secret bid well before bid submission.

Wisely, our client allowed us to leave the Keylogger running and false information was forwarded from that point on. Needless to say, the firms have now fair and equitable "truly secret" bidding process allowing the best work at fair market prices. Thanks to Gargoyle!

Dr. J. Bryan LeGwin
Computer Data Recovery, Inc

The purpose of Gargoyle is to have a fast and easy way to provide us with valuable information regarding the contents of a suspect s computer along with essential information about it s owner's computer use. How many times have we come across a program that was used and then uninstalled to cover the bad guy s tracks?

This gives us the capability to quickly determine both the benign applications, (standard desktop software) resident on the system, as well as to determine what doesn t belong there as well. Malware detection at this level provides an instant mini-profile of the user based on their use of a particular cyber weapon. Almost the same as finding a gun in a suspect s possession. It doesn t mean he used it, but he could have. And, that s important. This layer of digital environmental detection and analysis provides a solid foundation for further investigation.

A legitimate program that can be used for bad things will never show up in a McAfee or Norton scan.

Timothy Glantz, Senior Digital Forensic Investigator
Cingular Wireless

I am writing to let you know how happy we are with your software: Gargoyle Forensic Pro.

DataInquiry provides computer forensic discovery to lawyers, corporations, government agencies and law enforcement. For the past year we have employed the use of Gargoyle in our discovery process.

In all cases, after creating an image, we mount the image in Gargoyle and search for malware. Usually we are looking for IM, encryption, file splitters, evidence altering software, eraser programs and remote access program and graphic altering programs.

Each time Gargoyle comes through for us as we discover malicious programs on the image of the suspect's hard drive. We then generate a report and present the findings to the client. It is an advantage to know what malicious software is present on the suspect drive berfore we start discovery.

We save a great deal of time by eliminating lengthy Registry searches. With Gargoyle, we are able to focus in on suspicious events faster and more accurately than previously. The updated datasets you provide ensure we are up to date with malicious software signatures.

An additional benefit of the software is the inclusion of an image mounting program. To mount the image, we use Mount Image Pro, which is easy to use, integrates into Windows Explorer and is consistently flawless.

Brian Carne, Manager

Testimonial taken from Guidance EnCase Examiner Newsletter April 2004

"I have used EnCase since Version 1. We have all come a long way with v4.18. The latest features are nothing that I could have ever imagined in computer forensics in 8 years. With the load that we put on EnCase with our large cases on our new equipment, the added stability is very helpful. The new EnScripts are terrific and the amount of time that we are saving with the VFS modules is amazing. Our SOP requires that WetStone's Gargoyle, Norton AV and assorted encryption detection software be run against all of the media under investigation. VFS now makes these tasks painless."

Det/Sgt Bob Gagnon, Team Leader
Technical Operations, Ontario Provincial Police, Electronic Crime Section

Since my initial exposure to computer forensics in 1989, I have been a witness to an amazing evolution of tech savvy criminals; hard drive capacities and a plethora of media capable of holding potential valuable evidence. The Erie County District Attorney's High Tech Crime Unit now faces the challenge of processing computers and media holding potential evidence in unprecedented numbers and time constraints while getting analysis reports quickly to investigators. Gargoyle Forensic Pro has recently become my starting investigative tool for every investigation. The ability to automatically and quickly detect thousands of Malware related programs such as Spyware, Key Loggers, Password Crackers, Encryption Programs, Steganography Programs, Trojans, Denial of Service Tools, Virus Toolkits, Hacking Toolkits, Wireless Surveillance Tools, Drive Erasers and Hex Editors and then create a very nice HTML report that includes what was found, where it was found, datasets used for analysis, hashes and investigator information is worth its weight in gold.

I also have to commend WetStone Technologies for their Stego Suite and training program for both Gargoyle and Stego Suite. As the Chairman and Director of our Regional Cyberterrorism Task Force I have been charged with the task of enlightening and training other forensic examiners in the detection of covert communications. The two-day training presented by WetStone Technologies does a terrific job of explaining covert communications (comes in handy for court testimony) and then teaches the examiner how to run Stego Suite, programs that quickly identify possible steganography related files, assist in verifying the files and even helps crack passwords and phrases to keep the investigator on the fast track, uncover the evidence and move on to the next case. I really can't thank WetStone Technologies enough for their excellent training and tools.

Larry Dombrowski, Chief County Detective
Erie County District Attorney

Gargoyle, from Wetstone Technologies is one of the key tools that I use on each examination I perform. Gargoyle allows me to scan a hard drive quickly for Trojans,viruses, spyware, malware, etc. and determine whether anyof these are present. By scanning the drive with Gargoyle, I can usually quickly eliminate the potential defense of a Trojan put that file on my hard drive or similararguments. It s a valuable addition to any computer forensic examiner s toolbox.

Matthew Samuelson
Texas State Auditor's Office

Gargoyle is an excellent program that will improve your chances of detecting thousands of Malware related programs as it has done for me. Gargoyle Standard edition will find Malware such as Spyware, Key Loggers, Password Crackers, Encryption Programs, Steganography Programs, Trojans, Denial of Service Tools, Virus Toolkits, Hacking Toolkits, Wireless Surveillance Tools, Drive Erasers and Hex Editors to name a few.

The Forensic Pro edition provides the best-of-breeds forensic solution tools available, including the programs Mount Image Pro , Recover My Files , and Digital Evidence Time-stamping that I will not leave home without! Get to know Gargoyle Forensic Pro, and use it often because the product solution is remarkable with features such as traveling license, no installation necessary, datasets updated monthly, at-a-glance detection and detailed analysis and reporting.

Don t underestimate Gargoyle Forensic Pro, because it can help reduce the cost of the investigation by allowing you to rapidly triage corporate computer systems and related media. You will find just one draw back to using Gargoyle. After using the product for a short time, you are going to understand why the product is necessary for nearly all forensic investigations. After all, proving a negative is difficult indeed, and Gargoyle provides the real time detection and identification.

As a digital forensic accounting technologist and electronic data discovery professional, I understand that facts are facts. Gargoyle has played an important role during digital forensic investigations. And if you're willing, the program is relentless in tracking the existence of Malware that can cause great financial harm. Finding that second set of books and the hidden financial information can lead you to Where's the money! I have gained enormous respect for the software developers at WetStone Technologies, Inc. They listen first, and then put into action suggestions and requests.

May I suggest you need to take the necessary steps and tell the computer forensic community to do it right and give themselves a gift, Gargoyle Forensic Pro? When they do that, I can only speculate they will experience the same successes and the results will be unbeatable.

I am sure my story is not unusual, and had I failed to reflect on results of using Gargoyle Forensic Pro during the past year this story would be lost. This acknowledgment of Gargoyle is unsolicited, but perhaps I can ask those who now use Gargoyle to tell us about this product. After all, we should give credit where credit is deserved.

Jack Seward
Jack Seward Associates, LLC

I have been using Gargoyle for nearly a year. I have found the program to be extraordinarily useful -- the interface is intuitive so that users with limited computer experience can rapidly become functional with the tool and the output always provides useful pointers to interesting files on the system under investigation. The addition of data sets that detect potential malware other than steganography tools has enhanced its usefulness even more. As a preliminary investigation tool, Gargoyle has proven to be an important contribution to the suite of digital forensics software.

Gary C. Kessler, Director Program Dir.
Computer & Digital Forensics Champlain College

Seeing Stone has helped us identify vulnerabilities and threats quickly, giving us the exact information we need to improve our security posture. Our comfort level in the ever changing world has greatly improved since installation.

Marty Christofferson, State University of New York
Tompkins Cortland Community College

My compliments to you on your product Gargoyle. Thanks to this program, I was able to correctly identify the prescence of several "spyware" programs and a particularly nasty Trojan on a client s machine. In addition, your standards of customer service are to be highly commended. Abberline Investigations is now a major supporter of Wetstone Technologies, and based on this initial instance, will find your tools to be invaluable in future investigations.

William Simon, President
Abberline Investigations

I have known of Wetstone products for years and have used some of the stego products when the need arose. I was impressed with the capability of the software and the completeness of the tool suite. With that positive experience I had no reservations about obtaining and using Gargoyle when I had a case that required it. I am now using this as a standard part of all of my forensic examinations.

I have been able to use Gargoyle to great effect on several cases where the scan results have forced a resolution to an otherwise expensive action. In one particular case, an IT consultant ran a malware scan against a target computer. This scan provided a report showing all sorts of trojans, keyloggers, backdoors, and other dangerous software. When my team ran Gargoyle against the same drive image, those malware items were identified, but only in partially completed states. In fact, one of the remote access packages identified as one malware variant by the IT scan was actually part of the official corporate remote administration package. Both legitimate and illegitimate packages shared some common system libraries, which resulted in a false positive. This and other data from Gargoyle changed the tone of the case.

I would happily recommend Gargoyle to anyone in Forensics, IT, or anywhere that systems need to be scanned for the presense of malware or other types of software.

Bradley J. Bartram
Director, Forensics and Technology

Bradley J. Bartram

Screen Shots


Download Gargoyle Flash Datasheet