2

I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in a court of law due to a lack of proof of reliablity, integrity, etc.

This is bothersome, as I find Autopsy to be the better option of the two digital forensics tools that I have used. I know their are other options out there like EnCase, but I really find Autopsy to be a nice system to work with. Has anyone here presented digital forensics findings that were derived from Autopsy or Sleuth Kit in a court of law, or found literature/precedence regarding this question.

I see that Autopsy received early funding from the U.S. Army and currently receives funding from the DHS, so I have to think it is at least somewhat regarded as a professional grade tool.

closed as off-topic by Mark, Jens Erat, Eric G, schroeder, M'vy Feb 23 '15 at 8:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Mark, Jens Erat, Eric G, schroeder, M'vy
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm flagging this question as off-topic as this is a legal question, not IT security question. – user42178 Feb 22 '15 at 5:55
  • Is there no overlap between law and information security? – JTW Feb 23 '15 at 0:02
1

The reliability & expertise in court is the responsibility of the examiner, not the tool. Voir dire will audit your training, experience, past testimony, etc. You can't audit or voir dire a tool, only a person (examiner). Use whatever tool you like, validate it with other tools as needed, update your tools regularly and don't be afraid to make a change if one tool isn't working for you. I used EnCase for years. I switched to Xways for a number of reasons. I also will use Autopsy to validate & for supplemental reasons. I may almost use Autopsy exclusively, but it doesn't create the forensic image, so that's a challenge. Anyway, that's my 2 cents. Good luck!

Not the answer you're looking for? Browse other questions tagged or ask your own question.