I'm looking at a training course which includes a copy of a piece of software. The two options are a current with 1 year of updates copy of Paraben's PS2 commander, the other option is a copy of FTK 3 where the maintenance has run out.
Obviously most of the talk on here is FTK or encase so I ask, is Paraben's software a legitimate option for a computer forensic lab or would I often find myself wishing I had gone another route.
Thanks so much for any help,
Matt
I've been using P2 Commander for ~2 years now. I initially purchased it for it's email conversion capabilities. If it worked as advertised it would be a really handy tool. I like that it supports pretty much every email format under the sun including EDBs. BUT…
It is unreliable and the support is SLOW (especially if you re in the world of eDiscovery and need immediate fixes). Some issues i've had with it
-Wouldn't allow me to export certain mailboxes from a large EDB. It would work on some but crash randomly on others.
-Wouldn't allow me to export certain messages that contained unicode or junk characters in the subject.
-Doesn't always allow you to export email to PST (will randomly crash)
-Doesn't handle Groupwise emails correctly. It nulls out some of the Date metadata on emails that are attached to other emails.
-Doesn't do a great job at recovery of double-deleted items. (it does recover some but I have had more success with other tools).
-From my experience (about 3 or 4 occasions) the support has always taken at least a day to respond and they don't work very quickly.
All-in-all it's a decent tool to have in your tool belt but it's not really that great.
Hope that helps.
Great info to know, thank you.
To the OP, IMHO yes it is a legitimate option for a forensic shop. I can't see why you'd regret it, I've not regretted it, and if you see the change log, the newest fixes and adds are pretty cool.
P2 Commander for Emails, it's an absolute no brainer it's in everyone's toolbox for just emails alone, but the product has matured much beyond just emails and is a legit tool for an entire case. Mounting, hives,
The user interface, is nice, not clunky, and on the whole is not a resource hog.
I personally like the file viewer, and in the newest version the exporting was tweaked so it allows for more exporting options, especially in the email realm. Also, it's really good with pictures as well as any EXIF data.
Most all of isth's problems would revolve around corruption which happens when the archive gets bigger. E-discovery would deal with a lot of EDB files and the files would be be larger in nature.
With regards to support isth it honestly appears that anything short of an answer immediately upon someone answering would fall short of your expectations. Their support department is not very big, but I don't have any idea how you can say they don't work quickly. I've had a few dealings with support, they answered the phone, actually can't say that's the case with another forensic software company (leave a message) and we walked through the issue. The tech wanted to replicate the problem and it took maybe 20 minutes of talking, and the tech said I need to call you back but promised me it would be soon. I was on-site and pretty worried because everything was totally halted. I got a call within 30 minutes with a link to download a file at and a walkthrough of the fix for my problem
All in all there is a demo and it says 30 days or 20 some executions. I'd get various images, load them, and see what you can find.
Hope this helps you.
I've been using P2 Commander for ~2 years now. I initially purchased it for it's email conversion capabilities. If it worked as advertised it would be a really handy tool. I like that it supports pretty much every email format under the sun including EDBs. BUT…
It is unreliable and the support is SLOW (especially if you re in the world of eDiscovery and need immediate fixes). Some issues i've had with it
-Wouldn't allow me to export certain mailboxes from a large EDB. It would work on some but crash randomly on others.
-Wouldn't allow me to export certain messages that contained unicode or junk characters in the subject.
-Doesn't always allow you to export email to PST (will randomly crash)
-Doesn't handle Groupwise emails correctly. It nulls out some of the Date metadata on emails that are attached to other emails.
-Doesn't do a great job at recovery of double-deleted items. (it does recover some but I have had more success with other tools).
-From my experience (about 3 or 4 occasions) the support has always taken at least a day to respond and they don't work very quickly.All-in-all it's a decent tool to have in your tool belt but it's not really that great.
Hope that helps.
I've owned a number of Paraben products over the years and can't think of a single one I'd recommend with the POSSIBLE exception of NEMX. They have always been clunky, troublesome, and while the support guys do try hard, in the end I've always just moved on to another tool that worked. To be certain, FTK has had its problems, but vs. Paraben Anything, it's not a close call. If it were me I'd choose FTK with no maintenance over Paraben with a decade of it. That's me.
Most all of isth's problems would revolve around corruption which happens when the archive gets bigger. E-discovery would deal with a lot of EDB files and the files would be be larger in nature.
This is not correct. The files themselves were not corrupted and this was proven by the fact that I eventually was able to extract the EDBs using other tools (NUIX in one instance; powercontrols in another). With the Groupwise conversion issue they flat out told me it's an issue with their tool.
With regards to support isth it honestly appears that anything short of an answer immediately upon someone answering would fall short of your expectations.
This is also not correct. While subjective, I don't really have high expectations. I do expect 1) they get back to me as soon as possible and 2) they eventually resolve my issue. When both of these expectations aren't met it is a sad day. It sounds like you had a much better experience with their support, which is great, but I can tell you mine have not been so fruitful.
The groupwise conversion issue I mentioned took them 4 weeks to "resolve" and their resolution was that their product can't export the information correctly. This was after I sent a number of follow-up emails.
Anywho, maybe I've just had bad luck. But if the question is "would you recommend this tool" my answer is "yes, but with the understanding it won't work as intended a lot of the time".
Point taken isth, I'm glad you were able to get it working. I was just giving my opinion also
Once again, thanks for all of this info to all of you who posted here.
I've owned a number of Paraben products over the years and can't think of a single one I'd recommend with the POSSIBLE exception of NEMX. They have always been clunky, troublesome, and while the support guys do try hard, in the end I've always just moved on to another tool that worked.
Same opinion here. Buggy software, poor support
-Doesn't do a great job at recovery of double-deleted items. (it does recover some but I have had more success with other tools).
I know this is an old post but I have a related question. I have been having trouble with Paraben support, but more that they can't answer why P2Commander is unable to access my .edb file while other software is.
You say other tools are better at recovering "double-deleted" emails, can you share which software is able to accomplish this?
I've found EnCase to be unreliable when dealing with .edb files and 'Kernel Data Recovery for Exchange Server' was able to export the psts but I didn't see an option for recovering deleted emails; I don't have much experience with other forensic/recovery tools and any suggestions would be appreciated.
Thank you.