digital forensics techniques windows linux mac os

In this process, it ignores the file system structure, so it is faster than other available similar kinds of tools. It scans the disk images, file or directory of files to extract useful information. The E3:Universal offering provides all-in-one access, the E3:DS focuses on mobile devices and other license options break out computer forensics, email forensics and visualization functionality.īulk Extractor is also an important and popular digital forensics tool. The Paraben Corporation offers a number of forensics tools with a range of different licensing options. It collects information about running processes on a host, drivers from memory and gathers other data like meta data, registry data, tasks, services, network information and internet history to build a proper report. Mandiant RedLine is a popular tool for memory and file analysis. Within the tool, a forensic investigator can inspect the collected data and generate a wide range of reports based upon predefined templates. It offers support for evidence collection from over twenty-five different types of devices, including desktops, mobile devices and GPS. Additionally, FTK performs indexing up-front, speeding later analysis of collected forensic artifacts.ĮnCase is a commercial forensics platform. It claims to be the only forensics platform that fully leverages multi-core computers. AccessData FTKĪccessData Forensics Toolkit (FTK) is a commercial digital forensics platform that brags about its analysis speed. Despite this, it boasts an impressive array of features, which are listed on its website here.

The company also offers a more stripped-down version of the platform called X-Ways Investigator.Ī major selling point of the platform is that it is designed to be resource-efficient and capable of running off of a USB stick. X-Ways Forensics is a commercial digital forensics platform for Windows. As a result, they include functionality from many of the forensics tool categories mentioned above and are a good starting point for a computer forensics investigation.Īutopsy and The Sleuth Kit are available for both Unix and Windows and can be downloaded here. These tools are designed to analyze disk images, perform in-depth analysis of file systems and include a wide variety of other features. Autopsy/The Sleuth KitĪutopsy and The Sleuth Kit are probably the most well-known and popular forensics tools in existence.

This is a core part of the computer forensics process and the focus of many forensics tools. Forensic disk and data capture tools focus on analysis of a system and extracting potential forensic artifacts, such as files, emails and so on.

Digital forensics techniques windows linux mac os