First Forensic Suit...
 
Notifications
Clear all

First Forensic Suite Advice Please

11 Posts
8 Users
0 Reactions
1,653 Views
(@larrydaniel)
Reputable Member
Joined: 17 years ago
Posts: 229
 

A couple of thoughts MacForensics Lab i.m.h.o. is very pricey for what you get as you can do everything with other tools. I know I can't justify the expense for that tool when we have others that work just fine for MAC forensics.

You might want to consider P2Commander suite as it handles email extremely well and does chat and some other parsing. I consider P2 commander to be a "semi-automatic" suite as it is closer to Xways than it is to FTK or EnCase. You can get a free demo copy of P2 Commander from Paraben. They have demos of most of their forensic software and their email tools are outstanding.

If you move into a commerical job, chances are you will need to use FTK or EnCase if that is the shop standard. You already have FTK in some form, so don't neglect it.

You can get a feel for EnCase by going through the EnCE Study Guide as I think it has a student version included with some sample evidence. At least it used to.

As you get down the road in your career, you will find that you will tend to use either the best tool for the job based on what you have available, or the only tools you are allowed to use based on where you work.

So keep your horizons broad and while you have the luxury of time, play with and learn all you can with a critical eye as to what gives you the best results and the most production.

Once you get into the workplace you will find the greatest limit on your ability to perform examinations is not tools but time and money. There is always a limit to how much you can spend on a case, either time, money or both, so what really matters is how efficient you can be, regardless of which tool you choose to employ. Whether you are in private practice, working for law enforcement or doing internal investigations, the idea is to turn cases as quickly and efficiently as possible without compromising quality.


   
ReplyQuote
Page 2 / 2
Share: