PeerLab

One thing I would like this tool to do, Besides the examine the E01 file without mounting it.., would be able to point it at a folder I created, with a Mess of DAT' files etc, that I pulled from a drive (or an EnScript Tagged for me) and have it process whatever is in the folder..

Just a query, does anyone know how does this compare to another P2P examination software, P2P Marshal?

@rjpear You can scan individual folders and process the found files in the wizard but batch-processing is only implemented for Google Hello. Mostly there are only 1 or 2 files of interest (known.met, library5.dat, library.dat…) which IMHO do not require such an option. Can be implemented in future versions if needed ).

Jonathan ! How could you ! 😉

"I inserted the CD and nothing; no auto-start routine which I think may suit some people."

As a control, I would expect that auto-run would be disabled on any machine that needed to be secure, forensic examination machines too !

See http//news.cnet.com/8301-13554_3-10027754-33.html for interest and Google "auto-run disable" for how to do it …

Si

Apologies, I wasn't very clear there. I meant that there's no AutoPlay dialogue box presenting options of what the user wants to do with the inserted media.

By default on Windows 7 (which I tested PeerLab on), and now also XP and Vista via Windows Updates, AutoRun is not an option in the AutoPlay dialogue for devices that are not removable optical media, such as the USB devices mentioned in the CNET link you posted. MSDN post on AutoPlay

… AutoRun is not an option in the AutoPlay dialogue for devices that are not removable optical media …

You may want to read this post over at f-secure

… AutoRun is not an option in the AutoPlay dialogue for devices that are not removable optical media …

You may want to read this post over at f-secure

That's since been addressed as f-secure acknowledge "It's quite evident that the folks at Microsoft are working very diligently on this issue. Our concerns have been addressed and the advisory no longer lists Windows 7 AutoPlay as a mitigation. We thank them for this clarification." http//www.f-secure.com/weblog/archives/00001994.html Do keep up! wink

Anyway, we're getting slightly off-track here. I'd like to think forensic specialists are mostly able to be trusted with their own equipment, know the consequences of their actions on a PC and know how to mitigate malware risks.

PeerLab v1.04 out now!

Version-history
http//www.kuiper.de/index.php?option=com_content&view=article&id=64&Itemid=67&lang=en

PeerLab v1.10 out now!

Evaluate ICQ and GigaTribe! Export to Excel (.xls)! …

Version-history @ http//bit.ly/9bhqM4