Computer Forensics: what is in your toolbox?

Question

What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?

Answer 1

The majority of my forensics work is done after the fact in a lab environment, so by the time I get involved on-line work is too late, i.e. no memory analysis.

Historically I would use

1. EnCase
2. Helix LiveCD
3. Argus

Recently I have started moving away from that combination and on to

1. Argus
2. Autopsy - For aquisition and system analysis
3. BackTrack (Forensics Mode)
4. sed/awk/grep/last, etc

In both cases acquisitions are performed using whichever write-blocker is appropriate, most of the ones I use are made by Tableau. One reason I have moved to Autopsy is the support for hash databases, such as NSRL. Another is that it is free. EnCase is a great tool, but expensive.

Answer 2

I have not delved much into the topic, but perhaps this site might help you - http://www2.opensourceforensics.org/home.

Answer 3

Take a look at bulk_extractor, a program that automatically finds email addresses, credit card numbers, and other information from disk images. It then produces a histogram which lets you identify the primary use of the hard drive and that person's primary contacts. It even searches in compressed files.

Answer 4

I haven't seen FTK by access data mentioned. I've used both Encase and FTK a few years ago, they both have their pluses and minuses, but it's another commercially supported and court accepted forensics tool.

I'm partial to write blockers from weibetech, but don't have much experience with other vendors. You might look at the NIST verification for write blockers. There are also verification reports on additional software/hardware from NIST forensic tool testing as that web site.

Answer 5

I always used EnCase and the Coroner's Toolkit (these day's it's the Sleuthkit) along with dd. To be honest now the Helix and BackTrack LiveCDs are pretty much there for technical forensics, internally within an organisation, or if you have no intention of involving law enforcement or courts.

The problem you will have comes if you need to present in court.

At that point, depending on your jurisdiction, EnCase wins hands down - simpley because police forces tend to know about it so can vouch for it in court. If you can't get certified approval for your favourite toolkit, go with EnCase.

Answer 6

You can check this article from NIST http://www.cftt.nist.gov/, Although it is not toolbox but a way to perform tests.

Answer 7

Collecting Evidence
network and http capture

1. Ethereal
2. Netmon 3
3. Fiddler
4. Firebug
5. httpwatch

Event logs

LogParser 2