Recommended forensi...
 
Notifications
Clear all

Recommended forensic hardware

77 Posts
27 Users
0 Reactions
65.1 K Views
(@kovar)
Prominent Member
Joined: 18 years ago
Posts: 805
 

And support for Thunderbolt to appear in Windows, Bootcamp, Fusion, and Parallels…..

-David


   
ReplyQuote
(@jonathan)
Prominent Member
Joined: 20 years ago
Posts: 878
 

And support for Thunderbolt to appear in Windows, Bootcamp, Fusion, and Parallels…..

-David

Yep, will happen the around the same time as the peripherals become available. Luckily, I'm in no rush. lol


   
ReplyQuote
(@inspectaneck)
Trusted Member
Joined: 19 years ago
Posts: 58
 

Regarding my previous post, I ended up ordering a few days later when the Streak Deal had expired. The same laptop cost about $1300. We ended up ordering two for a total of $3000, including shipping and tax.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

There is a software solution called IX Imager, it is created within a licenced users copy of ILookIX from Perlustro.

Since you seem in contact with the good guys at Perlustro
http//www.forensicfocus.com/Forums/viewtopic/t=9743/

Could you ask some clarification on these (copied verbatim from the site, points numbered for clarity)
http//www.perlustro.com/solutions/e-forensics/iximager

Certified by NIST as THE STANDARD among all other tools

  1. Only forensic imaging tool in existence that exceeds NIST Test Criteria
  2. Only forensic imaging tool in existence that made 100% on the NIST CFTT Certification Tests, the most stringent test existing at any Federal Level
  3. Only forensic imaging tool used by NIST to test over 20 (all to date) write block devices, establishing itself as the NIST standard.
  4. Only forensic tool in existence that does NOT require a physical writeblock device for forensics imaging

I know that I am picky, but I have to understand

#1 would IMHO need a list of the NIST criteria and how/where the tool "exceeds it" (I mean if the idea is that NO data is written you cannot exceed this requirement by writing less than NO data)
#2 would as well need some document about the CFTT certification test
but they all in all are OK, the other two are more unclear
#3 to me the fact that the tool is used by NIST to test hardware blockers, means that it is used by NIST to test hardware bolockers, and does not establish anything
#4 good, but this also does not completely explain the title, if the nice thingy is certified as Standard, I would have expected a piece of paper titled "Certificate" signed by Mr. NIST. wink

I have no doubt about the thingy being a good tool, but maybe some advertising hype made it's way into the cited text?

jaclaz


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

ASK AND YOU SHALL RECIEVE

Sure.
I see nothing where the tool exceeds anything, and not any mention of it being a certified "standard" by NIST.

BTW the test was made in 2007 and was performed on version 2.0, whilst currently it seems like being version 3.0 and for all it matters, any kind of regression bugs could have been introduced.

But, given the quickness with which you replied (partially and to the least signifcant parts of my doubts) I am now more convinced than before (and possibly very wrongly) that you are not - as you seemed originally - a "casual" user of the thingy, but you are somehow connected with the software house producing this tool.

As said, I personally have no doubts about the tool being actually a good one, but there are few things that I hate more than "fake reviews" and/or "masked advertising" x , let alone "vague" statements about tests and certification of "standard".

jaclaz


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Jaclaz,
…..
3. I have used other forensic tools since early 2000, I was looking for a cheaper option LEO for forensic unit and found Ilook, later called Ilookpi,….

Good, and I am very happy that you found such a nice tool, what - no offence intended - was and still is perplexing (in my perverted mind) is how come that one day after at least 12 years of profession as forensic professional (LE or not) you decided to join Forensic Focus and post the same day three times within less than half an hour
http//www.forensicfocus.com/Forums/viewtopic/t=9742/
http//www.forensicfocus.com/Forums/viewtopic/p=6562154/#6562154
http//www.forensicfocus.com/Forums/viewtopic/p=6562155/#6562155
about this wonderful tool.

I understand how good it is, but why did you feel this need/urge to spread the news (which are not news if not - maybe - in the part that is now not anymore LE Only)?
This was the doubt I had.

with XFR—Xtreme file recovery I can see files that no other software can, and thats without using VSC—Volume shadow copy.

That could be a nice one here
http//www.forensicfocus.com/Forums/viewtopic/t=2222/postdays=0/postorder=asc/start=0/
but maybe a bit too similar to the one I proposed at the time
http//www.forensicfocus.com/Forums/viewtopic/p=6519578/#6519578

jaclaz


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

EXPLANATION

The reason is very simple, you are all using tools that claim many things but don't deliver. Most forensic software companies make their money out of training, The company I referred too earlier don't believe in this approach.

1. I was oblivious to the fact that so many people were unaware of the products,
2. I am a representative of the company but not a paid employee, I volunteered initially as I believe in the solution,
3. I will be removing any branding from all posts and future posts, if users want to know the name they can ask,
4. I have total belief that the tools can stand on their own.

Regards,

Cressida

Very good, this explains nicely how you suddenly felt the need/urge to communicate about your discovery, as said i don't doubt in the least how good the tool is and that you are in good faith convinced that it is the second best thing after ice cream ) .

Basically you are now saying that most of the members of this forum, in large part expert digital forensic examiners, were unaware of that tool and use instead antiquate/outdated/ineffective or simply not "adequate"

you are all using tools that claim many things but don't deliver

For the ones that are actually LE there is of course NO excuse. (
For the ones that are private, maybe the reason is/was that it was LE only until recently. ?

Hey wait, maybe after all they were NOT ALL completely unaware of the thingy 😯
http//www.forensicfocus.com/Forums/viewtopic/t=8679/postdays=0/postorder=asc/start=0/

Still, and again with all due respect, I have seen better ways to promote a product or simply express your positive opinion on it.

jaclaz


   
ReplyQuote
Page 8 / 8
Share: