Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
eaders to have better understanding <strong>of</strong> the functionalities <strong>of</strong> the <strong>for</strong>ensic s<strong>of</strong>tware<br />
mentioned in this study.<br />
Table 2.2<br />
List <strong>of</strong> digital <strong>for</strong>ensic s<strong>of</strong>tware (Barbara, 2006, p.1)<br />
Product Name<br />
DD<br />
<strong>Disk</strong>Edit®<br />
DIBS®<br />
EnCase®<br />
S<strong>of</strong>tware<br />
Type<br />
<strong>Disk</strong><br />
Imaging<br />
File<br />
Recovery<br />
<strong>Forensic</strong><br />
equipment<br />
<strong>Forensic</strong><br />
Toolkits<br />
FTK® <strong>Forensic</strong><br />
Toolkits<br />
Helix® Linux based<br />
<strong>for</strong>ensics<br />
Live CD<br />
NetAnalysis® <strong>Forensic</strong><br />
toolkits<br />
NetIntercept® Host-based<br />
Network<br />
<strong>Forensic</strong><br />
<strong>Tools</strong><br />
SilentRunner® Network<br />
Analyser<br />
Description<br />
DD is a common UNIX® program whose primary purpose is the low-<br />
level copying and conversion <strong>of</strong> raw data.<br />
Recover deleted files<br />
Industrial recognised <strong>for</strong>ensic hardware toolkits. Evidences generated<br />
using these toolkits have never been rejected so far by court. (Adopted<br />
from DIBS, 2010)<br />
Its ability to support different operating systems and file systems<br />
finding, parsing, analyzing, displaying, and documenting various types<br />
<strong>of</strong> digital evidences<br />
Automatic report generation<br />
Customize script language called EnScript to allow users to design<br />
their own scripts to fulfil individual needs.<br />
(Adopted from Guidance, 2010)<br />
Cutting-edge analysis, decryption and password cracking. Per<strong>for</strong>m<br />
network-based, secure, single-system <strong>for</strong>ensic acquisition <strong>of</strong> physical<br />
devices, logical volumes and RAM (Adopted from Access<strong>Data</strong>, 2009).<br />
With more than 35 <strong>for</strong>ensic tools that can be used <strong>for</strong> incident response<br />
and <strong>for</strong>ensic investigation. It‟s also able to wipe, recover data from slack<br />
space, and view the Windows registry. Open source applications are also<br />
included in Helix 3 to help digital investigation (Adopted from E-fence,<br />
2009).<br />
Provides Internet history analysis, view cache data, auto investigate<br />
feature and recover <strong>of</strong> deleted data (Adopted from Detective, 2010).<br />
Capturing and storing network traffic, rebuilding and analysing <strong>of</strong><br />
network sessions, retrieve data stored and view analysis results (Adopted<br />
from Sandstorm, 2009).<br />
It has state-<strong>of</strong>-war analysis and data-visualization tools. SilentRunner<br />
store selected packets and parses their contents to rebuild the files. The<br />
program can combine logs networking equipments like switches, routers<br />
and firewalls with saved in<strong>for</strong>mation to provide complete and accurate<br />
16
Change language