The first case is okay, since you only play around and do not make any money, but experience from it.
Or in other words, using pirated/cracked software for acquiring the experience and competence that will later allow you to make money is OK
It is at least a diference for me….somehow he has to make some experience. Any better ideas? Not all vendors offer a trial version. And if he later buys it before he makes money from it`s a usage I really think is "understandable".
I still think you'd learn more by pulling down ftk imager, Eric's tools, and the nirsott web browser stuff and running that over a system.
You'd get a bunch done and learn a lot
If you want to carve first then photorec is also free
It is an interesting question - training providers ( university & others ) quite often have site licenses for a particular product. How do you evaluate other tools if evaluation versions aren't available ?
I would be a complete hypocrite to condemn someone who is using it for training purposes - I'll eat my hat ( wool, flat ) if there is a single person here who hasn't used an unlicensed/pirated bit of software ( or broken the terms of licensing ) or hasn't illicitly copied a film/piece of music/academic paper in breach of copyright - I hate to say it, but the IT industry ( and by extension Digital Forensics ) is built on such things.
Until job adverts stop saying "Experience of EnCase" and start saying "Experience of Forensics Tooling" this is always going to be an issue.
Catch-22
Answering the OP title "About legality of usage of unlicensed forensics tool", there is no other answer to this then NO. The usage of unlicensed forensics tools is illegal. Using an unlicensed forensic tool related to a live case remains an illegal activity, no matter of any kind of explanations.
Learning or training from "illegal" sources is up to everybody's own conscience to do it or not.
It is at least a diference for me….somehow he has to make some experience. Any better ideas? Not all vendors offer a trial version. And if he later buys it before he makes money from it`s a usage I really think is "understandable".
The whole point that a few members pointed out, is that there is seemingly noone with a gun forcing you to use Commercial or non-free (or non freeware) software (and BTW, as it was pointed out, the use of such "simpler" and "free" tools often have more learning value for the beginner).
But there are several possible views on this.
One is the "moral" view, where
cracked software is a no-no (independently from the actual usage) ,
another one is
OK for tests/training or if you are poor/cannot afford to buy a license but not for professional usage,
the third one is the "immoral" one
everything is fine as long as "they" don't catch you.
Of these I personally find the two extremes more valid than the middle one (which I call the Robin Hood approach).
As a matter of fact quite a few of the Robin Hood theory supporters point out how piracy is a good thing for the software developers, as the user of cracked software may later become a legit customer, whilst if he/she had took the "moral" approach he/she would have had no occasion to try and get familiar with the given software and that there is no loss for the maker of the software because the user would not have bought it anyway.
In digital forensics there is however a further step, you may happen to be called as an expert witness in a case where the use of counterfeit/pirated/cracked software is the actual object of the case, would you be able to use data gathered through the use of your own pirated/cracked software to certify the illicit use of some software by the suspect (keeping a straight face, I mean)?
Some may say that since all job offers are for people with experience with Encase, Nuix and *whatnot* [1], it is fair to use the cracked software to get at least familiar with them.
Everyone should take the stance he/she thinks better (and consider the consequences - if any - of the choice made).
jaclaz
[1] besides the other "basic" requirements wink
https://www.forensicfocus.com/Forums/viewtopic/t=13579/
You know forensics tools are very expensive. I am new in this field and I can not afford to buy them at the moment. However there are some forensics tools around whose dongles are emulated or which are cracked.
I know it is illegal to emulate dongles or crack but my question is a bit different.
As I am newcomer to forensics field I wonder if the courts interrogate used programmes for reports are licensed or not.
Must I refrain to use such programmes or not?Regards
I saw video of the voir dire of an expert in a murder trial where they did ask him whether he had a license for EnCase. It turned out that he had used someone else's license. It might have been legal, I think he went to their facility and used their computer, but it did lead to some uncomfortable follow-up questions. So, you could get asked and it's going to look really bad if you have to say you pirated it.
The opposing counsel could use the piracy to impugn your honesty and undermine your testimony. They could also use that to raise questions about the validity of your examination. E.g. was the software up to date? Is the software authentic? How do you know? Since you didn't get it from the vendor, how do you know that the program you used is actually a fully-functional copy of EnCase, AXIOM? Did you receive training on the software? [Unlikely since you didn't buy it]. Do you have access to the help and support resources that paying customers have? [if not] How do you know that you're using the software correctly? How do you get assistance if the software doesn't behave properly?
If you can't afford commercial programs, use free/open-source tools to start with. Build some of your own tools (many DFIR books include scripts and programs that you can modify or extend). If really want to get your hands on some commercial tools to learn and experiment, request a demo version or take a class at a college/university that has access to one or more of them.
How do you get assistance if the software doesn't behave properly?
… AND you are capable of noticing that it doesn't behave properly …
jaclaz
Consider this, especially if you work or want to work in the legal profession, as in digital forensics
1-Pirating is illegal (it is a crime, because it is stolen software).
2-Cracked software is broken (because you can't trust it, since it is broken).
Do you really want to commit a crime (by using pirated software), while investigating a legal matter with broken software (that may potentially give inaccurate results), all of which will have an impact on a defendant's due process?
As far as arguing whether or not cracked/pirated software is reliable (maybe it is, maybe it isn't), you will lose a legal argument, simply because the software is broken, and for any legal purposes, it is stolen property.
All it takes is one time in court to ruin your future of ever coming to court again as a reliable witness, which practically is the end of a digital forensics career.
Just sayin' D
Consider this, especially if you work or want to work in the legal profession, as in digital forensics
1-Pirating is illegal (it is a crime, because it is stolen software).
2-Cracked software is broken (because you can't trust it, since it is broken).Do you really want to commit a crime (by using pirated software), while investigating a legal matter with broken software (that may potentially give inaccurate results), all of which will have an impact on a defendant's due process?
As far as arguing whether or not cracked/pirated software is reliable (maybe it is, maybe it isn't), you will lose a legal argument, simply because the software is broken, and for any legal purposes, it is stolen property.
All it takes is one time in court to ruin your future of ever coming to court again as a reliable witness, which practically is the end of a digital forensics career.
Just sayin' D
PREACH!
1-Pirating is illegal (it is a crime, because it is stolen software).
Technically piracy is not theft
wink
jaclaz
