ok i am not too sure if this is the correct thread for this post so i have posted it in another thread. its a bit on the long side so please bear with me.
i have just completed an MSc in forensics in the UK and i am looking to relocate to my country. There are no digital forensic companies except one or two freelancers i know of so most cases are sent to other countries for examination so i think there is an opportunity to make some money there.
I am looking to start a forensics business when i return home though i want to start by jumping into the data recovery end before i really go into the investigation end of forensics. I plan to do hard drive analysis eventually or if possible even start with it but just recovering data.
I will want to start by recovering deleted text messages and data from mobile devices. I think i have read of a way of recovering data direct from the flash of completely bricked devices though i havent tried that.
I have been playing with a few tools and have trial versions of mobileedit, oxygen and parabens device seizure for mobile.i have used the encase trial version and ftk on my uni course and have a version of the SIFT workstation, though i have not had much time with that. you will notice that there are a lot of mobile tools listed here since i believe that data recovery on mobiles in africa will make me a name and money more quickly due to the high mobile penetration rate. On testing oxygen with my rooted android phones it couldnt even image any of the devices and i couldnt get a trial for XRY, which i believe does both logical and physical examination. i also downloaded a version of ftk and accessdata's mobile phone examiner though those require me to purchase the dongle so i havent been able to try that.
Currently i am registered to take the encase CF1 certification which i will complete next month and also taking the (CFE)certified fraud examiner and CISA examinations. I want to take the Acessdata ACE certification though i am not too sure i can do that without an FTK license. The CFE and CISA are just for insurance, just in case my forensic ambitions fall through and i have to find a job in security or assurance.
here are my questions
1. can i get some advice on purchasing a software each for mobile and for hard drive analysis that wouldnt cost me an arm and a leg.
2. will anyone advice me to take this path since i have very little experience but i have the passion and i sitting down to learn is something i can do.
3. i was looking at purchasing the accessdata softwares; that is FTK and MPE but because i dont have access to them now that im out of school im not really confident. especially for the mobile phone examiner software.
4. are there any free tools for mobile which are capable of recovering deleted text messages ( not only sim-deleted messages).
5. If you will advice me to get any of the paid analysis tools, which do you think will be the best and how much will they cost.
6. can anyone point me to some good tutorials on the tools included in the SIFT workstation and some good write blockers.
7. Can anyone list a cheap, basic set of equipment and tools which i might need to startup. software, hardware etc… i have read on the write blocking registry hack but wouldnt really want to use that, so please include write blockers too. An example budget will be nicely.
thanks in advance for your help.
Greetings,
What country are you returning to?
1) Asked and answered in a lot of postings on this forum. Further, you're not really providing enough detail to properly answer the question.
2) Again, read through this forum in detail. The answers are here, and answering your overly general question would require a book.
3) There's no question here. That said, X-Ways has more bang for the buck. SIFT and TSK are free. None of them do mobile phones. Cellbrite UFED seems to be the best mobile phone package, but you probably need several.
4) Yes. There's a post in the forums pointing to free software. With mobile phones, the options are very limited.
5) It depends on what you want to do. X-Ways is the best bang for the buck, but you'll still want to add other tools like IEF, for example.
6) Have you considered taking SANS 408 rather than AccessData's FTK class? You'll learn how to use SIFT in detail, and it is a superb course.
7) Doing CF on the cheap is non-trivial. Again, the answers are already here in the forum for you to read.
You're asking us to write part of your business plan for you without giving us much information, and without doing market research, or even basic research on this forum.
And, let me add
1) Do you know what services are needed in your country, not just what you want to offer?
2) Have you considered partnering with someone who has the experience and tools to get you started?
-David
Thanks david.
I am returning to Ghana in west Africa and most jobs from west africa are sent to kenya and south africa.
I do have a highly experienced mentor but he is more interested in going it alone. he can be a guide, But not a partner.
Currently in my country digital investigation services are not required but i believe it will grow. the digital investigation jobs are few and far between. Data recovery, on the other hand is in high demand and i have a friend who makes a decent living and even refuses work sometimes, and he is very amateur at this.
I have already spoken to xways and they have given me a quote on their prices but i wanted to shop around a bit first.
About the SANS course. there is currently no scheduled class taking place in London.
Greetings,
One of the universities in Ghana seems to be starting up a new program - http//
Here's an old article with some names of people involved with cybercrimes in Ghana - http//
This consulting company offered training courses in Ghana last year, perhaps they would hire you? - http//
Those were just some of the hits I found with "Ghana computer forensics".
-David
thanks david.
Already seen those and i am in contact with one of the guys advising for the telecom university, "the first link".
with the training, i have had experience of course offerings in Ghana and i do not trust them. I think i will try to take the SANS480 on demand course, though i was a bit surprised at the cost of it. Like you said CF is not cheap -).
Thanks so much for your help.
Greetings,
If you end up spending the time to create a business plan - market research, budget, etc - feel free to run it past me, I might be willing to invest a bit. But, seriously, you'll need to make a good effort at a business plan.
-David
If I was in your position I would explore -
getting a full time teaching position with a local university
making business presentations to local businesses
moonlighting as a small forensics investigative business
You get a steady income and credentials by teaching, and create a symbiotic relationship with the university for the presentations and possibly your business.
Picking up on your mention of SANS, if traveling to a class is prohibitive, SANS vLive and OnDemand are very good options. Yes you miss out on the personal interaction and it requires a bit more perseverance to get the most out of the class, however the training is still top notch.