berlondon.blogg.se - Blackbag forensics compared to oxygen forensics

BLACKBAG FORENSICS COMPARED TO OXYGEN FORENSICS WINDOWS

Oxygen Forensic Suite 2013 Standard – If you are investigating a case that requires you to gather evidence from a mobile phone to support your case, Oxygen Forensics Suite (Standard Edition) is a tool that will help you achieve this.Features include a user-friendly GUI, semi-automated report creation and tools for Mobile Forensics, Network Forensics, Data Recovery and more. CAINE – CAINE (Computer Aided INvestigative Environment) is Linux Live CD that contains a wealth of digital forensic tools.This tool can be used for various digital forensic tasks such as forensically wiping a drive (zero-ing out a drive) and creating a raw image of a drive. Linux ‘dd’ – dd comes by default on the majority of Linux distributions available today (e.g.

BLACKBAG FORENSICS COMPARED TO OXYGEN FORENSICS WINDOWS

Using FTK Imager you can also create SHA1 or MD5 hashes of files, export files and folders from forensic images to disk, review and recover files that were deleted from the Recycle Bin (providing that their data blocks haven’t been overwritten), and mount a forensic image to view its contents in Windows Explorer. FTK Imager – FTK Imager is a data preview and imaging tool that allows you to examine files and folders on local hard drives, network drives, CDs/DVDs, and review the content of forensic images or memory dumps.It comes with features like Timeline Analysis, Hash Filtering, File System Analysis and Keyword Searching out of the box, with the ability to add other modules for extended functionality.

Autopsy is essentially a GUI that sits on top of The Sleuth Kit.

The Sleuth Kit (+Autopsy) – The Sleuth Kit is an open source digital forensics toolkit that can be used to perform in-depth analysis of various file systems.

Using Volatility you can extract information about running processes, open network sockets and network connections, DLLs loaded for each process, cached registry hives, process IDs, and more.

Volatility – Volatility is a memory forensics framework for incident response and malware analysis that allows you to extract digital artefacts from volatile memory (RAM) dumps.

You can also search for data using the Search node based on the criteria you specify. Once you add a forensic image you can view the data by content or by looking at the clusters that hold the data.

ProDiscover Basic – ProDiscover Basic is a simple digital forensic investigation tool that allows you to image, analyse and report on evidence found on a drive.

SIFT includes tools such as log2timeline for generating a timeline from system logs, Scalpel for data file carving, Rifiuti for examining the recycle bin, and lots more. It supports analysis of Expert Witness Format (E01), Advanced Forensic Format (AFF), and RAW (dd) evidence formats.

SANS SIFT – The SANS Investigative Forensic Toolkit (SIFT) is an Ubuntu based Live CD which includes all the tools you need to conduct an in-depth forensic or incident response investigation.

Computer forensics tools can also be classified into various categoriesįew popular forensics tools are listed below