Find someone that's been on an FTK 2.0 course and ask them if there are problems in the classroom with this.
I heard about this by virtue of a someone at AccessData speaking out saying that he/she did not know what to expect when they are teaching. When opening a folder from a computer image some students see one number of files, another sees more, another fewer, etc. The teachers of the course don't know why this is happening.
As for my other story, I'm waiting for permission to discuss it… (sorry)
Without permission from the third party to discuss the issue openly with colleagues on the forum, I would question the decision to start this type of thread in the first place. It's all a bit like Chinese Whispers for my liking. I don't think we, as a community, can really gain from this type of thing.
Isn't it best to wait until the facts are well established and an open discussion can take place?
Find someone that's been on an FTK 2.0 course and ask them if there are problems in the classroom with this.
Been there done that. No question that there were problems. However when I took Applied Decryption we had times that certain features would not work which in the field would appear to lead to erroneous results. And this was on machines that were loaded from an image. Of course on those same machines certain features of EnCase did not work either.
I heard about this by virtue of a someone at AccessData speaking out saying that he/she did not know what to expect when they are teaching. When opening a folder from a computer image some students see one number of files, another sees more, another fewer, etc. The teachers of the course don't know why this is happening.
Why does Vista do odd things? In my opinion, I believe this problem is endemic to the software industry. There is such a rush to release new features and versions that the public becomes the Beta or even Alpha testers. 'XYZ company just released this feature, what have we got to compete?' 'We're charging users a lot of money for maintenance (read MS Software Assurance), what can we give them?'
This is just a case where it is really coming back to bite the company on the a**e and has certainly damaged AD's reputation.
<SNIP> someone at AccessData speaking out saying that he/she did not know what to expect when they are teaching. When opening a folder from a computer image some students see one number of files, another sees more, another fewer, etc. <SNIP>
I suspect it has less to do with Access Data and more to do with the underlying OS and hardware as well as user interaction with them.. I see this in courses I teach where even minor differences between different (but identical model) computers will result in different results.
There is an old saying that in theory there’s no difference between theory and practice – but in practice there is.
Without permission from the third party to discuss the issue openly with colleagues on the forum, I would question the decision to start this type of thread in the first place. It's all a bit like Chinese Whispers for my liking. I don't think we, as a community, can really gain from this type of thing.
Isn't it best to wait until the facts are well established and an open discussion can take place?
Hear, hear!
I just spent quite a bit of time searching the forum and did not find and post similar to what you describe. Can you be a little more specific?
I believe it was posted sometime in april on the new forum, and I believe it was a reply inside of a thread, not a thread itself. Other than that, unfortunately I do not recall any other specifics, sorry.
I think I've confused people a bit.
There are two things that I recently learned, one that I can not discuss (sorry I brought it up now) and then there's the whole FTK issue.
In response to those that blame the underlying OS for any problems, try something for me…
Process a case using FTK 2.0, wait for the case to go to court and take the stand. Wait for the defence to ask you to replicate your initial findings…
I think you can see where this is going. This is why problems like this are so dangerous.
Process a case using FTK 2.0, wait for the case to go to court and take the stand. Wait for the defence to ask you to replicate your initial findings…
I think you can see where this is going. This is why problems like this are so dangerous.
I understand that a lot of people don't have the luxury of time, but if you are taking some findings to court, surely you should be validating your results with another tool. If you do this and they don't agree, you can take steps to resolve this, but I certainly wouldn't be comfortable presenting findings on the results of one tool.
This should be the same for all applications, not just when you are using FTK.
I think I've confused people a bit.
There are two things that I recently learned, one that I can not discuss (sorry I brought it up now) and then there's the whole FTK issue.
In response to those that blame the underlying OS for any problems, try something for me…
Process a case using FTK 2.0, wait for the case to go to court and take the stand. Wait for the defence to ask you to replicate your initial findings…
I think you can see where this is going. This is why problems like this are so dangerous.
In what way - do you have a specific example you can share?
Do you mean if 100 pictures are carved out of unallocated on your first sweep that subsequent sweeps would result in 80 or 120 or whatever number of pictures coming back?
Hopefully you have have shared your information with Access Data; if so what was their repsonse? If not and you don't have evidence of this occurence then they may have grounds for libel action, so you need to be careful what you say or be able to show excatly what happens.
Although there are very specific issues which need to be proved in a libel case (and I should state, I don't believe that any of them are relevant to this particular discussion - to the best of my knowledge) Jonathan's warning is appropriate in wider terms. We should all keep in mind that there's a difference between mounting a successful libel defence and being able to afford to do so in the first place! For those unfamiliar with such matters I can tell you that current legislation offers very little protection to website/forum owners involved in such actions.
There's a delicate balance to be struck between allowing open discussion and guarding against threats of legal action (regardless of whether or not such threats may be warranted). I'm confident we're still on the right side of that line but now is probably an appropriate time to strike a note of caution so we all remain there.
If anyone has any concerns, questions or comments about the above please feel free to contact me privately.
Jamie