FTK 2.0 and “evidence leakage”

“They are now allowing EVIDENCE outside of the forensic lab. Not in the sense of copying data, but viewing the data, which due to caching is essentially the same as copying. This is not what I would consider acceptable in the real world. The digital world needs to be treated no differently. The traditional forensic lab model has been violated by AccessData with the creation of their web based tools. This is what I’m calling Evidence Sprawl or Evidence Leakage and it needs to be treated very seriously…”

More (Forensic Incident Response Blog)

Leave a Comment