What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?
locked by Jeff Ferland♦ Oct 18 '12 at 16:23
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.
Read more about locked posts here.
The majority of my forensics work is done after the fact in a lab environment, so by the time I get involved on-line work is too late, i.e. no memory analysis.
Historically I would use
Recently I have started moving away from that combination and on to
- Autopsy - For aquisition and system analysis
- BackTrack (Forensics Mode)
- sed/awk/grep/last, etc
In both cases acquisitions are performed using whichever write-blocker is appropriate, most of the ones I use are made by Tableau. One reason I have moved to Autopsy is the support for hash databases, such as NSRL. Another is that it is free. EnCase is a great tool, but expensive.
I have not delved much into the topic, but perhaps this site might help you - http://www2.opensourceforensics.org/home.
Take a look at
bulk_extractor, a program that automatically finds email addresses, credit card numbers, and other information from disk images. It then produces a histogram which lets you identify the primary use of the hard drive and that person's primary contacts. It even searches in compressed files.
I haven't seen FTK by access data mentioned. I've used both Encase and FTK a few years ago, they both have their pluses and minuses, but it's another commercially supported and court accepted forensics tool.
I'm partial to write blockers from weibetech, but don't have much experience with other vendors. You might look at the NIST verification for write blockers. There are also verification reports on additional software/hardware from NIST forensic tool testing as that web site.
I always used EnCase and the Coroner's Toolkit (these day's it's the Sleuthkit) along with dd. To be honest now the Helix and BackTrack LiveCDs are pretty much there for technical forensics, internally within an organisation, or if you have no intention of involving law enforcement or courts.
The problem you will have comes if you need to present in court.
At that point, depending on your jurisdiction, EnCase wins hands down - simpley because police forces tend to know about it so can vouch for it in court. If you can't get certified approval for your favourite toolkit, go with EnCase.
You can check this article from NIST http://www.cftt.nist.gov/, Although it is not toolbox but a way to perform tests.