- This topic has 12 replies, 10 voices, and was last updated 9 years, 11 months ago by
fuzed.
-
AuthorPosts
-
-
February 19, 2011 at 9:14 pm #6106
madwarlock2011
ParticipantHey everyone!
I need to build my tool box and need some advise on current software. Working only on PC and laptops, no networks, Any assistance will help. Thank you in advance!
I have tried a few data recovery software but, they have been limited on their recovery. Need Instant Message history, email, url, picture, video, etc… The information I am able to recover may be used in court. Hope this helps……thanks again……
-
February 21, 2011 at 11:02 pm #38189
seawolve1
ParticipantWow….. 131 views and nobody can assist……… ???
-
February 22, 2011 at 1:29 am #38190
seawolve1
Participantthere are several on the market that you can purchase that will work well.
1. Disk Doctors Instant File Recovery- Disk Doctors Instant File Recovery recovers deleted files emptied from Recycle Bin or lost while accidental formatting or re-partitioning of a hard drive or lost due to virus attacks and unexpected system or software malfunction. It’s about $60.00
2. Easy Drive Data Recovery- can be used to recover data from corrupted or accidentally formatted disks. The program uses powerful unique algorithms that even allow the recovery of files that are not present in file system entries. Just select a disk with data to be analyzed, preview file content and select the file(s) to be recovered. It does not matter in what circumstances data has been lost—the program will recover as many files as possible. Again, about $60.00 bucks
3. LeKuSoft Data Recovery- is an advanced recovery solution that will easily recover lost or deleted files from the recycle bin, partition losses, or mistaken deletion. It can effectively recover lost data in hard drives, flash drives and memory cards (such as SD cards, MMC cards), etc., and quickly help you solve the trouble caused by the loss of data, files or pictures. About $65.00
hope this helps……..let me know if you have any further questions….
-
February 23, 2011 at 9:15 am #38191
AndyB67
ParticipantHave used EASEUS Data Recovery on my windows system for the last few years. Had a lot of sucess with it over other software i’ve tried.
I also use Hirens Boot CD (free) as that has a lot of usefull tools that work in windows, linux and DOS
-
February 25, 2011 at 1:03 am #38192
madwarlock2011
ParticipantThanks for your advise Andy and seawolve…..gonna try andys suggestion….I’ll keep ya posted!
-
February 25, 2011 at 3:10 pm #38193
rattis
ParticipantIf ti is something that is going to be used in courts, you’ll want to get some real world training too.
However, I’ve used Helix in the past (Don’t know the status of the program). The training manual that went with it was pretty good at the time. I liked that it include a chain of evidence form (actually used it once).
I’ve heard good things about some other programs. Encase, mostly because a trainer used to be involved in the local security group I’m a member of. Might also want to look in to Sleuth Kit and DD.
Edited to add:
One last thing one I couldn’t remember the name of until now. The Coroners Took Kit. (although TCT says that they’ve been replaced by sleuth kit). -
March 21, 2011 at 6:56 pm #38194
R3B005t
ParticipantHelix is still alive and kicking. I would strongly recommend getting your hands on Encase or FTK both are insanely expensive however they are by far the best forensic suite out there. I’d also get an Ubentu box up and running becasue there are some wonderful file analysis tools that are built specifically for that platform. Sans has their free forensics toolkit that has some great timeline analysis programs built into it as well. I currently use all 4 plus a random assortment of scripts and tools I’ve picked up along the way. Sans ftk is free after registering here: http://computer-forensics.sans.org/
-
March 22, 2011 at 3:37 pm #38195
jsm725
Participant+1 for Helix, Encase and FTK imager. Encase can get expensive depending on what flavor you want.
-
March 27, 2011 at 6:56 pm #38196
skitch
Participant+1 for Helix, Encase and FTK imager. Encase can get expensive depending on what flavor you want.
Alternatives / additions
Autopsy, Sleuth kit, foremost / scalpel, dd, Sys internals suite, volatility memory framework, hex editor, Caine live cd, prodiscover basic, a sandbox, regedit, strings, physical write blocker, l0phtcrack, PRTK, TCTThe information I am able to recover may be used in court.
You should be careful with this though, if you’ve handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.
I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.
-
March 28, 2011 at 11:32 am #38197
R3B005t
ParticipantYou should be careful with this though, if you’ve handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.
I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.
I overlooked that handy little sentance, without proper training your entering a hazy area regarding gathering forensic data for use in court cases. From your initial post you sound relatively new to the field if thats the case I would be more concerned with getting a great lab set up to train yourself instead of building a forensic lab for evidence collection. If I’m wrong I apologize and mean no offense its just that forensic examination for court cases can be extremely tricky.
-
March 28, 2011 at 5:32 pm #38198
Joshsevo
ParticipantAlso to add onto what R3 said. If you come across a Hard Drive that has CP and don’t immediatly give it to the LEO then you can be charged with possesion and distribution.
Tred carefully.
-
March 28, 2011 at 5:59 pm #38199
Anonymous
ParticipantIf its going to be used in court you wont be able to use hirens CD.
I have used password kit Forensic what is pretty good and get most passwords but at a price of around $700
-
April 1, 2011 at 12:56 pm #38200
fuzed
Participanttools I use on a daily basis are –
FTK Imager
Helixencase
netanalysis
IEF
Media Detective
WinHex
Windows File Analyzer
VFC (virtual forensic computing)
Live View
Mount image pro
VMWare Workstationplus AV software to scan the systems for virus’s which I always report on.
Alot of the software above will cost a bit. If using in court then you really need to know what your doing, are you based in the US? UK? or OTHER?
-
-
AuthorPosts
- You must be logged in to reply to this topic.