No, it would be a Lotus so the 5 year old could reach the pedals 😉 <DOH!>
It's all just tools and as such is only as good as the professional sitting at the keyboard holding the mouse.
You can take a hammer and build a house or make furnature. You can swing the same hammer and wreck stuff too. It's just a tool.
So, am I correct in my understanding that "Encase Forensic (Not Responding)" is the full name for this software.
So, am I correct in my understanding that "Encase Forensic (Not Responding)" is the full name for this software.
lol
Utter nonsense. No court has opined that evidence can come in or stays out simply because an examiner used a particular tool. No court has rejected evidence on the grounds that FTK was used, and no court has admitted evidence that wouldn't otherwise be deemed competent because EnCase or something else was used.
There are no "court-approved" tools that assure evidence comes in. You, the expert, are the sponsor; and, if you can demonstrate the necessary competence of process and outcome, you can use a hex editor for your analysis and get your evidence admitted.
First let me start by saying that I don't work for AccessData, but I think that FTK has made significant improvements since FTK 2.0 has been released. Sure the software crashes at times, but some of those issues are not related to the software itself, but to hardware. (Bad HDD's - Not enough resources - Bad configuration of the Network and Examining machine etc…).
When I started using FTK, the only version available was 1.X. Now there is 3.x and Mobile 4.X. And I'm not even mentioning Registry Viewer, Password Recovery and the Free tool "FTK Imager".
Sure no "one tool" is enough. You must have other resources to confirm or dismiss your findings.
I will finish by asking "How many times has your Windows machine crashed in which FTK runs on?"
Just my 2 cents
I had FTK 1.81 crash repeatedly during a case I worked on. Twice, we had to re-create the index (which took hours). Fortunately the second time we figured out how to recover the bookmarks.
Very irritating, but we still got it done.
If FTK is under review by certain forces then SURELY EnCase is too as that crashes more than a drunk 5 year old, texting on his phone, while driving a Lotus Diablo.
Would that be a Lamborghini Diablo?
;0)
Very colorful quote but I don't think 5 year olds should be texting while driving, drunk or not. If they are they should try a Smart Car.
However EnCase almost never crashes on me. We have 8GB RAM on a 64 bit system and unless we demand EnCase to do too many things at once, which is really a result of a five year old drunk using Encase and lacking patience, it sails right along.
Could something be up with your forensic box, I wonder.
Ciao!
So, am I correct in my understanding that "Encase Forensic (Not Responding)" is the full name for this software.
ROFL. This is the best quote of the week!
If FTK is under review by certain forces then SURELY EnCase is too as that crashes more than a drunk 5 year old, texting on his phone, while driving a Lotus Diablo.
Would that be a Lamborghini Diablo?
;0)
Very colorful quote but I don't think 5 year olds should be texting while driving, drunk or not. If they are they should try a Smart Car.
However EnCase almost never crashes on me. We have 8GB RAM on a 64 bit system and unless we demand EnCase to do too many things at once, which is really a result of a five year old drunk using Encase and lacking patience, it sails right along.
Could something be up with your forensic box, I wonder.
Ciao!
To carry this a bit further, EnCase is as stable as a drunk one-legged centipede whose wife has just left him for his brother.
I've used EnCase on several computers over the last few years and it is the same in every instance. I don't think that FTK is perfect by any means but it seems more stable than EnCase. On the other hand, I've never seen X-ways crash.