Tool Box Needed

[madwarlock2011]

Hey everyone!

I need to build my tool box and need some advise on current software. Working only on PC and laptops, no networks,  Any assistance will help. Thank you in advance!

I have tried a few data recovery software but, they have been limited on their recovery. Need Instant Message history, email, url, picture, video, etc… The information I am able to recover may be used in court. Hope this helps……thanks again……

[seawolve1]

Wow….. 131 views and nobody can assist……… ???

[seawolve1]

there are several on the market that you can purchase that will work well.

1. Disk Doctors Instant File Recovery- Disk Doctors Instant File Recovery recovers deleted files emptied from Recycle Bin or lost while accidental formatting or re-partitioning of a hard drive or lost due to virus attacks and unexpected system or software malfunction. It’s about $60.00

2. Easy Drive Data Recovery- can be used to recover data from corrupted or accidentally formatted disks. The program uses powerful unique algorithms that even allow the recovery of files that are not present in file system entries. Just select a disk with data to be analyzed, preview file content and select the file(s) to be recovered. It does not matter in what circumstances data has been lost—the program will recover as many files as possible. Again, about $60.00 bucks

3. LeKuSoft Data Recovery- is an advanced recovery solution that will easily recover lost or deleted files from the recycle bin, partition losses, or mistaken deletion. It can effectively recover lost data in hard drives, flash drives and memory cards (such as SD cards, MMC cards), etc., and quickly help you solve the trouble caused by the loss of data, files or pictures. About $65.00

hope this helps……..let me know if you have any further questions….

[AndyB67]

Have used EASEUS Data Recovery on my windows system for the last few years.  Had a lot of sucess with it over other software i’ve tried.

I also use Hirens Boot CD (free) as that has a lot of usefull tools that work in windows, linux and DOS

[madwarlock2011]

Thanks for your advise Andy and seawolve…..gonna try andys suggestion….I’ll keep ya posted!

[rattis]

If ti is something that is going to be used in courts, you’ll want to get some real world training too.

However, I’ve used Helix in the past (Don’t know the status of the program). The training manual that went with it was pretty good at the time. I liked that it include a chain of evidence form (actually used it once).

I’ve heard good things about some other programs. Encase, mostly because a trainer used to be involved in the local security group I’m a member of. Might also want to look in to Sleuth Kit and DD.

Edited to add:
One last thing one I couldn’t remember the name of until now. The Coroners Took Kit. (although TCT says that they’ve been replaced by sleuth kit).

[R3B005t]

Helix is still alive and kicking. I would strongly recommend getting your hands on Encase or FTK both are insanely expensive however they are by far the best forensic suite out there.  I’d also get an Ubentu box up and running becasue there are some wonderful file analysis tools that are built specifically for that platform.  Sans has their free forensics toolkit that has some great timeline analysis programs built into it as well.  I currently use all 4 plus a random assortment of scripts and tools I’ve picked up along the way.  Sans ftk is free after registering here:  http://computer-forensics.sans.org/

[jsm725]

+1 for Helix, Encase and FTK imager. Encase can get expensive depending on what flavor you want.

[skitch]

+1 for Helix, Encase and FTK imager. Encase can get expensive depending on what flavor you want.

Alternatives / additions
Autopsy, Sleuth kit, foremost / scalpel, dd, Sys internals suite, volatility memory framework, hex editor, Caine live cd, prodiscover basic, a sandbox, regedit, strings, physical write blocker, l0phtcrack, PRTK, TCT

The information I am able to recover may be used in court.

You should be careful with this though, if you’ve handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.

I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.

[R3B005t]

You should be careful with this though, if you’ve handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.

I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.

I overlooked that handy little sentance, without proper training your entering a hazy area regarding gathering forensic data for use in court cases. From your initial post you sound relatively new to the field if thats the case I would be more concerned with getting a great lab set up to train yourself instead of building a forensic lab for evidence collection.  If I’m wrong I apologize and mean no offense its just that forensic examination for court cases can be extremely tricky.

[Joshsevo]

Also to add onto what R3 said.  If you come across a Hard Drive that has CP and don’t immediatly give it to the LEO then you can be charged with possesion and distribution. 

Tred carefully.

[Anonymous]

If its going to be used in court you wont be able to use hirens CD.

I have used password kit Forensic what is pretty good and get most passwords but at a price of around $700

[fuzed]

tools I use on a daily basis are –

FTK Imager
Helix

encase
netanalysis
IEF
Media Detective
WinHex
Windows File Analyzer
VFC (virtual forensic computing)
Live View
Mount image pro
VMWare Workstation

plus AV software to scan the systems for virus’s which I always report on.

Alot of the software above will cost a bit.  If using in court then you really need to know what your doing, are you based in the US? UK? or OTHER?

[Author]

Posts