SLAMorris Final Thesis After Corrections.pdf - Cranfield University

obtain and analyse evidence [Helix, 2011]. Forensic live boot CDs do not
automatically mount the media and ensure write access is only granted if
specifically selected in order to protect the reliability of the evidence. The set of
tools provided are useful both during the analysis of a case and when an
analyst is performing experiments; they allow the media to be analysed in an
appropriate way.
A common open source forensic tool used by analysts and found on live boot
CDs is the Sleuth Kit. It allows a forensic analysis of a variety of different file
structures including NTFS and FAT systems [Galvao, 2006]. The Sleuth Kit
provides tools that can assist in finding forensic artefacts both in case work and
experiments. Whilst the Sleuth Kit is a command line set of tools, a graphical
interface is provided in the form of the Autopsy browser, this assists analysts in
accessing the tools they require, making it easier to understand the
functionality.
A closed source forensic tool commonly used by analysts is Encase, this tool
encompasses a wide range of forensic applications such as the ability to write
object-orientated scripts, analyse files and generate reports [Guidance
Software, 2011]. Encase is an intuitive tool that provides the analyst with a wide
range of functionality; however it is a closed source application and does not
provide the complete information on files it has recovered. Therefore an analyst
needs to be trained in how to interpret and verify its results using another
method. File recovery, also known as file carving is discussed further in
Chapter 7.
Hexadecimal [Hex] editors like Winhex are a useful tool when performing a
forensic analysis and when trying to establish the structure of data
[Fleischmamn, 2008]. Viewing data in a hex editor allows an analyst to see the
file as it is stored and allows the analysis of individual fields to identify their
Page 18