Collecting Data fro...
 
Notifications
Clear all

Collecting Data from Microsoft Sharepoint

5 Posts
5 Users
0 Likes
1,917 Views
(@cs1337)
Posts: 83
Trusted Member
Topic starter
 

Hello Forensic Forum Members

I wanted to inquire on programs to Forensically collect data from Microsoft Sharepoint.

I did some searching on this forum and noticed quite a few older threads in regards to collecting data from Sharepoint.

I understand they have tools from X1 Discovery, Kroll OnTrack and Titan Collector for Sharepoint. I have inquired with all these company's for a demo and pricing.

I am curious to find out from the experts on this forum if anyone had any real world experience using any of these tools.

Please let me know if you have used any of these above or if you used something else. Was the tool user friendly? Was the data collected in a matter as you expected it to be?

I'm sure all these companies claim their program is the best so I want to hear all the nitty gritty about any experience you've had with them.

Thank you in advance for your help.

 
Posted : 06/02/2014 9:30 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

NUIX have a sharepoint collection tool (NUIX sharepoint collector)

I've not used it or seen it but generally NUIX produce quality software…at a price 😉

 
Posted : 04/03/2014 11:03 am
 Earn
(@earn)
Posts: 146
Estimable Member
 

I like the Sharepoint collector from PinPoint. It works very well.

 
Posted : 04/03/2014 11:35 pm
(@cults14)
Posts: 367
Reputable Member
 

Forensic collection from SharePoint - not sure exactly what you mean but as others here are ignoring the disk imaging options I'll do the same.

Sherpa Software's Discovery Attender for Exchange (don't let the title fool you) has a SharePoint Connector that I've used. I've always found it real easy to create the documentation using DAE, gives you everything you need i.e. who searched for what from where and when, and what they did with it (e.g. exported to specific destination). And the log files support the documentation

HTH

Cheers

 
Posted : 05/03/2014 5:29 pm
josh.lowery
(@josh-lowery)
Posts: 7
Active Member
 

F-Response also includes the ability to connect to a SharePoint site. You just need the database creds and either the IP address or server name. You can then mount the databases as read-only folders locally and collect with FTK Imager, EnCase, or whatever you use. It also puts the .aspx file in so you can get a view of each page. I like it a lot and would highly recommend checking it out. If you are unable to connect to the site for some reason, just contact the tech support and they are pretty good about working with you to debug any crashes. I don't think it is able to collect from SharePoint '03 though for some reason but I may be mistaken.

Also as a side note, Titan collector got bought out and is now the NUIX collector. Awesome tool in my opinion outside of the fact that you can only save to a mfs01 file.

 
Posted : 18/06/2014 6:45 pm
Share: