Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

iLook® Disk
imaging
Pcap Network
traffic
SafeBack® Disk
capturing
imaging
Sleuthkit Forensic
Toolkits
SMART® Linux
Forensic
Toolkits
Snort® Host-based
Network
Forensic
Tools
TcpDump Network
The Coroner‟s
Toolkit (TCT)
Forensic
Tools
UNIX®
forensic
toolkits
XtreeGold® File
recovery
network analysis (Adopted from PCMag, 2002).
Two major components IXimager and ILook v8. IXimager supports disk
imaging of Windows and non-Windows devices. ILook v8 will run on
both 32/64 Bit platforms and supports multiple file systems including
FAT 12/16/32, NTFS, and Linux Ext2/Ext3 (Adopted from
ForensicsWiki, 2010)
pcap (packet capture) is network capturing tools that can isolate packets
headers and other information.
SafeBack is a DOS-based utility for backing-up and restoring hard disks.
SafeBack can be used to create mirror-image (bitstream) backup files of
hard disks. It can also make a mirror-image copy of an entire hard disk
drive or partition.
The Sleuth Kit (previously known as TASK) is a collection of UNIX-
based command line file and volume system forensic analysis tools.
"Knock-and-talk" inquiries and investigations
on-site or remote preview of a target system
post mortem analysis of a dead system
testing and verification of other forensic programs
conversion of proprietary "evidence file" formats
baselining of a system
Snort® is a free and open source network intrusion prevention system
(NIPS) and network intrusion detection system (NIDS) capable of
performing packet logging and real-time traffic analysis on IP networks.
Snort performs protocol analysis, content searching/matching, and is
commonly used to actively block or passively detect a variety of attacks
and probes, such as buffer overflows, stealth port scans, web application
attacks, SMB probes, and OS fingerprinting attempts, amongst other
features (Adopted from Sourcefire, 2010).
TcpDump is a command line tool used for network monitoring, protocol
debugging, and data acquisition.
TCT components are the
grave-robber tool captures file information
ils and mactime tools can visualise and access patterns of files
including deleted files
the unrm and lazarus tools recover deleted files
findkey tool recovers cryptographic keys from a running process or
from files.
XTree contained features like listing all files of a branch including
subdirectories, listing of all files on a disk, or viewing a file's contents in
17