Hi
I'm a second year student in Digital Forensics. Our lecturer has told us to find hash calculating software, secure disk wiper software (to prepare test drives for analysing) and software write blocker software which is approved by NIST or similar bodies for use in Digital Forensics to use in our assignments, can you recommend any free software which I can use. I have had no luck finding an approved list online.
Is there a checklist of things to do in an investigation, eg step 1 take image, step 2 etc.
Thank you for any help you can give me.
why approved by NIST? you should be the one validating your own stuff as it will be you, not NIST, on the stand (so to speak) when asked about your work.
dban is a good wiping tool that you can boot to
winhex is useful for wiping from windows (and a ton more)
theres a million hashing programs out there. a very easy to use one is cyohash, http//
checklists really depend on the organization and what kind of case you are working. the basics will be the same, but isnt that what your courses should cover?
…which is approved by NIST…
It may be that your professor wants you to look beyond simple Google searches and actually research this information.
And I did find a good deal of what you were looking for…oddly enough, by doing a simple Google search! 😉 So I may have missed the boat with my first statement.
An interesting comment you made was 'nist or similar bodies.'
I would argue YOU can be that body by testing and articulating your findings. A 1 is a 1 and a 0 is a 0 regardless of who tests it.
Great response, Eric. I'm surprised at how often analysts ask questions for which the answer simply requires some minimal action on their part…
About wiping if the device provides internal ATA commands Secure Erase and/or Sanitize, use them.
It will be faster (and approved by NIST).
See
http//
http//
I doubt that NIST can/will (ever) "certify" or "approve" a software write blocker 😯 or that it will do so in a timely fashiion
http//
at the most it will test it and publish the result, with a disclaimer such as
It documents results against four top-level tool requirements identified by the specification and several test assertions related to those requirements, describes the testing environment, provides an interpretation of the test results, and includes test results summary log files for numerous test cases. The results provide the information necessary for developers to improve tools, users to make informed choices, and the legal community and others to understand the tools' capabilities.
jaclaz
Hashtab is one of the hash calculating software support many hash algorithms such as MD5, SHA1, SHA2
http//