±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 6
New Yesterday: 2
Overall: 26983
Visitors: 56

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

What goes in a forensic toolkit?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

What goes in a forensic toolkit?

Post Posted: Thu Dec 06, 2012 11:52 am

Hi all,

I'm in the process of setting up a computer forensic service and am putting together a complete toolkit - hardware and software. Does anyone have a list of equipment that should constitute a toolkit?

Thanks and regards.  

nat038
Newbie
 
 
  

Re: What goes in a forensic toolkit?

Post Posted: Thu Dec 06, 2012 12:16 pm

Are you a competitor of mine?  

keydet89
Senior Member
 
 
  

Re: What goes in a forensic toolkit?

Post Posted: Thu Dec 06, 2012 2:39 pm

nat038,

This list is by no means exhaustive, but hopefully will give you some ideas. There is not a set list of hardware and software and many factors attribute to what is contained in your arsenal (Budget, OS familiarity, Type of Work, etc).

Check out the various forensic boot CDs (CAINE/Helix/SIFT/DEFT/etc.)
-These are linux based but contain just about every tool you would need to perform an examination. That being said it is linux and a majority of the tools are CLI but, they are FREE!

Writeblockers

-Tableau/Wiebetech (SATA/Firewire/USB/etc)
-USB Registry Key Registry Edit Writeblock (google it) (always test)

Hard Drive Acquisition Software/Hardware

-Tableau TD1/TD2 (Hardware -There are several others, I am familiar with Tableau - which are great)
-FTK Imager (Free)(Software)
-Forensic Boot CDs (CAINE/DEFT/HELIX/etc.) - all have multiple linux imaging applications (AIR/guymager/dd)

Hard Drive Forensic Analysis Suites
Each suite has its own pros and cons, you need to decide which one(s) is/are best for you (you should have at least two for findings validation).
-Autopsy/TSK (free)
-X-ways Forensics(Commercial - 1/3 of the price of FTK and EnCase)
-AccessData FTK (Commercial - last time I checked roughly $3k - $3.5k)
-Guidance Software EnCase (Commercial - you want version 6, I have personally used version 7 and it is full of bugs)

Email Tools
-Nuix Proof Finder (Great tool - 15gb mailbox limit)
-Paraben Email Examiner or Network Email Examiner
-Aid4Mail
-Advanced Outlook Repair/Advanced Exchange Repair

Metadata Tools
-ExifTool (free)
-metadata assistant
-metadataminer

Cell Phone Forensic Acquisition/Analysis
-Cellebrite UFED (Excellent, but expensive)
-XRY (i have never used it but I've heard good things from others)
-Paraben Device Seizure
-Oxygen Forensics
-Via Forensics (Android) also has (Santoku - bootable forensic cd for mobile device analysis) Santoku is fairly new so I'm sure the guys at Via Forensics will continue to develop it.

Random
-Tools (screw drivers (magnetic tips), pill cases (for holding screws), Apple compatible screw drivers (pentalobe)
-Digital Camera
-Chain of Custody forms
-Evidence Tags
-Labels

As I mentioned this list is not exhaustive. The main thing to remember is that in forensics, you always need to validate your findings. So you depending on your experience, you may want to have a commercial tool and an open source tool to validate. If you are comfortable with Linux and CLI than you do not "need" a commercial tool. There are tons of open source tools which work extremely well. Forensic Control has an entire list of free tools posted on their website.

Remember GOOGLE IS YOUR FRIEND!  

LilPopps21
Newbie
 
 
  

Re: What goes in a forensic toolkit?

Post Posted: Thu Dec 06, 2012 9:55 pm

Lilpops, I know you are new around here. However, we try to foster a nice, wonderful, almost aromatic peach type environment where Jamie will not let anyone say "Google is your friend" and especially not in caps.
_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 

armresl
Senior Member
 
 
  

Re: What goes in a forensic toolkit?

Post Posted: Thu Dec 06, 2012 10:31 pm

- armresl
Lilpops, I know you are new around here. However, we try to foster a nice, wonderful, almost aromatic peach type environment where Jamie will not let anyone say "Google is your friend" and especially not in caps.


I apologize as I meant no disrespect by it, just trying to inform the OP that there are numerous great resources out there.  

LilPopps21
Newbie
 
 
  

Re: What goes in a forensic toolkit?

Post Posted: Thu Dec 06, 2012 10:37 pm

I know you didn't. Just telling you so you don't get a nastygram from mods

- LilPopps21
- armresl
Lilpops, I know you are new around here. However, we try to foster a nice, wonderful, almost aromatic peach type environment where Jamie will not let anyone say "Google is your friend" and especially not in caps.


I apologize as I meant no disrespect by it, just trying to inform the OP that there are numerous great resources out there.

_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 

armresl
Senior Member
 
 
  

Re: What goes in a forensic toolkit?

Post Posted: Thu Dec 06, 2012 11:11 pm

I appreciate the heads up!  

LilPopps21
Newbie
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 3
Go to page 1, 2, 3  Next