VMWare (or something like it) is a good investment because you can play around with multiple OS installs and use one piece of hardware. So you can do a lot of imaging that way.
TomOf course, VirtualBox is free, and even given a choice between a paid up version of VMWare and the freebie software I'd choose VB any day of the week lol /plug
Also USB write blocker reg keys and cheapy USB -> IDE/SATA adapters are great for students and cost peanuts; the only downside of course being poor transfer rates.
ddewildt - That scholarship sounds amazing, it really got your foot in the door. Aside from the vendor courses, sometimes on-the-job training is the best kind of training because you have it day-in day-out from your colleagues who have that experience. How does the job market compare with Australia?
CforPro - I think it takes alot to go back to school especially after losing your job, being in a different career and it's great you had the ambition to do that. It sounds like you've really worked for it. Good luck with your business and your job hunt!
redcat - To be honest, I think the vendor courses are going to be the way i'll have to go. I never went to university (or got the grades to get in even if I wanted to) and at the moment, I can't afford not to work. I'm hoping that work experience will do me well for now. Thanks for the recommendation on USB write blocker reg key, i'll have a look into that until I can afford a hardware write blocker, I'll put up with poor transfer rates if it gets me started.
Tom - I think I have the SIFT workstation from the SANS website around somewhere but I haven't got round to playing around with it just yet. I think X-Ways is a bit pricey for me at the moment, but WinHex is well priced, as is the F-Response Field Kit. I've got virtual box already and I've got a VMWare server edition at work to play with so hopefully when I get some free time, I can get to work so to speak.
I see you both recommend the Weibetech writeblockers. Is there any difference between the ultradock and the forensic edition? Both are cheaper than some others i've seen. I think these bits are going to be something that I gather over time as I'm trying to buy a house at the moment which has to take priority, but it's good to know what's out there in terms of getting started.
Thanks once again guys!
Of course, VirtualBox is free, and even given a choice between a paid up version of VMWare and the freebie software I'd choose VB any day of the week
True, I've just been using VMWare since version 1 so it's the one I'm comfortable with. Also I'm not aware if VirtualBox let's you use physical devices for images like VMware does.
But hey, I'll never argue with free. p
Tom
Tom - I think I have the SIFT workstation from the SANS website around somewhere but I haven't got round to playing around with it just yet. I think X-Ways is a bit pricey for me at the moment, but WinHex is well priced, as is the F-Response Field Kit. I've got virtual box already and I've got a VMWare server edition at work to play with so hopefully when I get some free time, I can get to work so to speak.
I see you both recommend the Weibetech writeblockers. Is there any difference between the ultradock and the forensic edition? Both are cheaper than some others i've seen. I think these bits are going to be something that I gather over time as I'm trying to buy a house at the moment which has to take priority, but it's good to know what's out there in terms of getting started.
Yes, as I accidentally discovered, a big difference. The standard ultradock just let's you connect the drive to your machine (IDE or SATA). But there is no write blocking whatsoever (not gonna say how I found it out, but it's always a good idea to TEST your devices first p).
The forensic version will write block the device, so ideally that would be the one you would want to get.
The SIFT workstation is great for starting out, because you really get a sense of the fundamentals or what's going on "under the hood" so to speak. It's like doing everything with a CLI interface instead of a GUI interface (a bad analogy I know, but you get the idea).
Tom
ddewildt - That scholarship sounds amazing, it really got your foot in the door. Aside from the vendor courses, sometimes on-the-job training is the best kind of training because you have it day-in day-out from your colleagues who have that experience. How does the job market compare with Australia?
Yeah the schorlarship was pretty sweet, again I was lucky to get it, as I wasn't actually in the course originally but was asked to change into it. I can't really talk too much about the job market in Australia as my first job was really natural progression into the grad position, then my second I was actually approached for directly. I do know that a lot of the consultancies are hiring at the moment, and also have seen some of the Police forces looking for people.
The UK job market on the other hand, as we all know, has been pretty tight lately. Again I was lucky to get a position about a week and a half after arriving, just the right place at the right time I guess. I'm in London and it seems (for some reason) that almost 2/3 jobs I see are in the midlands. Having said this, it does seem to be picking up a little now - so its not all doom and gloom!
I thought so, when I looked at them on the Weibetech site, the ultradock made no reference to actual write blocking by default, but I thought maybe i'd missed something.
I've got a clear weekend ahead so i'm going to have a go with SIFT then, i'll let you know how I get on.
ddewildt - Yeah i'm hoping that things start to pick up in time for when I start looking for my first forensics position. I lived in greater london (zone 6) for a while and I remember there not being as many jobs in London compared to other counties. I'm currently living in Oxfordshire and there are a couple here and in Berkshire. Like you said, being in the right place at the right time is the key.