ntuser.dat live acquisition

Why purchase a product like that when you have all the tools available to build one of your own?

I've never really understood the need for so many folks, particularly in IT and high-tech fields, to buy commercial products for everything, when all they need is sitting right in front of them…

Oh yeah? If I were working for myself I wouldn't be buying everything like you say. When you work for an establishment it's a different ball game. And don't forget, this is forensics. You can play about with tools in your lab but the evidence you produce will be useless if you can't show that they're standard tools used AND accepted by everybody else. Wait till an attorneys asks you for your software licenses and you'll understand why wallets have to be made slimmer.

What is it right in front of us that we have?

Ive heard about Guidance Software testifying for people when their tool has been called into question in court before. It's great if you can write a script to do the same thing as a commercial product but I'd much rather use something thats a standard in the industry. Why reinvent the wheel……

Why purchase a product like that when you have all the tools available to build one of your own?

I've never really understood the need for so many folks, particularly in IT and high-tech fields, to buy commercial products for everything, when all they need is sitting right in front of them…

Oh yeah? If I were working for myself I wouldn't be buying everything like you say. When you work for an establishment it's a different ball game. And don't forget, this is forensics. You can play about with tools in your lab but the evidence you produce will be useless if you can't show that they're standard tools used AND accepted by everybody else. Wait till an attorneys asks you for your software licenses and you'll understand why wallets have to be made slimmer.

The real danger is that opposing counsel will try to undermine your credibility. Attorney Craig Ball has written a must-read about the vulnerabilities of those he refers to as "Tool Tykes", folks who know how to use a piece of software but who have no clue as to how it works.

This is not a trivial issue. I saw Craig execute a withering cross-examination (and I do mean "execute") of digital forensics expert Andy Rosen, who wrote what later became known as EnCase. Fortunately (for Andy!), we were in Moot Court.

As Andy himself says on his corporate web site, "Having nifty software is great, but nifty software doesn't win cases. Integrity, experience and credibility are fundamental ingredients in successful litigation."