Tool Box Needed

Viewing 12 reply threads
  • Author
    Posts
    • #6106
      madwarlock2011
      Participant

      Hey everyone!

      I need to build my tool box and need some advise on current software. Working only on PC and laptops, no networks,  Any assistance will help. Thank you in advance!

      I have tried a few data recovery software but, they have been limited on their recovery. Need Instant Message history, email, url, picture, video, etc… The information I am able to recover may be used in court. Hope this helps……thanks again……

    • #38189
      seawolve1
      Participant

      Wow….. 131 views and nobody can assist……… ???

    • #38190
      seawolve1
      Participant

      there are several on the market that you can purchase that will work well.

      1. Disk Doctors Instant File Recovery- Disk Doctors Instant File Recovery recovers deleted files emptied from Recycle Bin or lost while accidental formatting or re-partitioning of a hard drive or lost due to virus attacks and unexpected system or software malfunction. It’s about $60.00

      2. Easy Drive Data Recovery- can be used to recover data from corrupted or accidentally formatted disks. The program uses powerful unique algorithms that even allow the recovery of files that are not present in file system entries. Just select a disk with data to be analyzed, preview file content and select the file(s) to be recovered. It does not matter in what circumstances data has been lost—the program will recover as many files as possible. Again, about $60.00 bucks

      3. LeKuSoft Data Recovery- is an advanced recovery solution that will easily recover lost or deleted files from the recycle bin, partition losses, or mistaken deletion. It can effectively recover lost data in hard drives, flash drives and memory cards (such as SD cards, MMC cards), etc., and quickly help you solve the trouble caused by the loss of data, files or pictures. About $65.00

      hope this helps……..let me know if you have any further questions….

    • #38191
      AndyB67
      Participant

      Have used EASEUS Data Recovery on my windows system for the last few years.  Had a lot of sucess with it over other software i’ve tried.

      I also use Hirens Boot CD (free) as that has a lot of usefull tools that work in windows, linux and DOS

    • #38192
      madwarlock2011
      Participant

      Thanks for your advise Andy and seawolve…..gonna try andys suggestion….I’ll keep ya posted!

    • #38193
      rattis
      Participant

      If ti is something that is going to be used in courts, you’ll want to get some real world training too.

      However, I’ve used Helix in the past (Don’t know the status of the program). The training manual that went with it was pretty good at the time. I liked that it include a chain of evidence form (actually used it once).

      I’ve heard good things about some other programs. Encase, mostly because a trainer used to be involved in the local security group I’m a member of. Might also want to look in to Sleuth Kit and DD.

      Edited to add:
      One last thing one I couldn’t remember the name of until now. The Coroners Took Kit. (although TCT says that they’ve been replaced by sleuth kit).

    • #38194
      R3B005t
      Participant

      Helix is still alive and kicking. I would strongly recommend getting your hands on Encase or FTK both are insanely expensive however they are by far the best forensic suite out there.  I’d also get an Ubentu box up and running becasue there are some wonderful file analysis tools that are built specifically for that platform.  Sans has their free forensics toolkit that has some great timeline analysis programs built into it as well.  I currently use all 4 plus a random assortment of scripts and tools I’ve picked up along the way.  Sans ftk is free after registering here:  http://computer-forensics.sans.org/

    • #38195
      jsm725
      Participant

      +1 for Helix, Encase and FTK imager. Encase can get expensive depending on what flavor you want.

    • #38196
      skitch
      Participant

      +1 for Helix, Encase and FTK imager. Encase can get expensive depending on what flavor you want.

      Alternatives / additions
      Autopsy, Sleuth kit, foremost / scalpel, dd, Sys internals suite, volatility memory framework, hex editor, Caine live cd, prodiscover basic, a sandbox, regedit, strings, physical write blocker, l0phtcrack, PRTK, TCT

      The information I am able to recover may be used in court.

      You should be careful with this though, if you’ve handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.

      I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.

    • #38197
      R3B005t
      Participant

      You should be careful with this though, if you’ve handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.

      I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.

      I overlooked that handy little sentance, without proper training your entering a hazy area regarding gathering forensic data for use in court cases. From your initial post you sound relatively new to the field if thats the case I would be more concerned with getting a great lab set up to train yourself instead of building a forensic lab for evidence collection.  If I’m wrong I apologize and mean no offense its just that forensic examination for court cases can be extremely tricky.

    • #38198
      Joshsevo
      Participant

      Also to add onto what R3 said.  If you come across a Hard Drive that has CP and don’t immediatly give it to the LEO then you can be charged with possesion and distribution. 

      Tred carefully.

    • #38199
      Anonymous
      Participant

      If its going to be used in court you wont be able to use hirens CD.

      I have used password kit Forensic what is pretty good and get most passwords but at a price of around $700

    • #38200
      fuzed
      Participant

      tools I use on a daily basis are –

      FTK Imager
      Helix

      encase
      netanalysis
      IEF
      Media Detective
      WinHex
      Windows File Analyzer
      VFC (virtual forensic computing)
      Live View
      Mount image pro
      VMWare Workstation

      plus AV software to scan the systems for virus’s which I always report on.

      Alot of the software above will cost a bit.  If using in court then you really need to know what your doing, are you based in the US? UK? or OTHER?

Viewing 12 reply threads
  • You must be logged in to reply to this topic.

Copyright ©2021 Caendra, Inc.

Contact Us

Thoughts, suggestions, issues? Send us an email, and we'll get back to you.

Sending

Sign in with Caendra

Forgot password?Sign up

Forgot your details?