.

Tool Box Needed

<<

madwarlock2011

Newbie
Newbie

Posts: 2

Joined: Sat Feb 19, 2011 3:46 pm

Post Sat Feb 19, 2011 4:14 pm

Tool Box Needed

Hey everyone!

I need to build my tool box and need some advise on current software. Working only on PC and laptops, no networks,  Any assistance will help. Thank you in advance!

I have tried a few data recovery software but, they have been limited on their recovery. Need Instant Message history, email, url, picture, video, etc... The information I am able to recover may be used in court. Hope this helps......thanks again......
Last edited by madwarlock2011 on Sat Feb 19, 2011 4:36 pm, edited 1 time in total.
<<

seawolve1

User avatar

Newbie
Newbie

Posts: 6

Joined: Sun Aug 03, 2008 11:58 am

Post Mon Feb 21, 2011 6:02 pm

Re: Tool Box Needed

Wow..... 131 views and nobody can assist......... ???
<<

seawolve1

User avatar

Newbie
Newbie

Posts: 6

Joined: Sun Aug 03, 2008 11:58 am

Post Mon Feb 21, 2011 8:29 pm

Re: Tool Box Needed

there are several on the market that you can purchase that will work well.

1. Disk Doctors Instant File Recovery- Disk Doctors Instant File Recovery recovers deleted files emptied from Recycle Bin or lost while accidental formatting or re-partitioning of a hard drive or lost due to virus attacks and unexpected system or software malfunction. It's about $60.00


2. Easy Drive Data Recovery- can be used to recover data from corrupted or accidentally formatted disks. The program uses powerful unique algorithms that even allow the recovery of files that are not present in file system entries. Just select a disk with data to be analyzed, preview file content and select the file(s) to be recovered. It does not matter in what circumstances data has been lost—the program will recover as many files as possible. Again, about $60.00 bucks

3. LeKuSoft Data Recovery- is an advanced recovery solution that will easily recover lost or deleted files from the recycle bin, partition losses, or mistaken deletion. It can effectively recover lost data in hard drives, flash drives and memory cards (such as SD cards, MMC cards), etc., and quickly help you solve the trouble caused by the loss of data, files or pictures. About $65.00

hope this helps........let me know if you have any further questions....
<<

AndyB67

User avatar

Full Member
Full Member

Posts: 100

Joined: Fri Jan 14, 2011 7:13 am

Location: UK

Post Wed Feb 23, 2011 4:15 am

Re: Tool Box Needed

Have used EASEUS Data Recovery on my windows system for the last few years.  Had a lot of sucess with it over other software i've tried.

I also use Hirens Boot CD (free) as that has a lot of usefull tools that work in windows, linux and DOS
Net+ Sec+ More to come
<<

madwarlock2011

Newbie
Newbie

Posts: 2

Joined: Sat Feb 19, 2011 3:46 pm

Post Thu Feb 24, 2011 8:03 pm

Re: Tool Box Needed

Thanks for your advise Andy and seawolve.....gonna try andys suggestion....I'll keep ya posted!
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Fri Feb 25, 2011 10:10 am

Re: Tool Box Needed

If ti is something that is going to be used in courts, you'll want to get some real world training too.

However, I've used Helix in the past (Don't know the status of the program). The training manual that went with it was pretty good at the time. I liked that it include a chain of evidence form (actually used it once).

I've heard good things about some other programs. Encase, mostly because a trainer used to be involved in the local security group I'm a member of. Might also want to look in to Sleuth Kit and DD.

Edited to add:
One last thing one I couldn't remember the name of until now. The Coroners Took Kit. (although TCT says that they've been replaced by sleuth kit).
Last edited by rattis on Fri Feb 25, 2011 10:28 am, edited 1 time in total.
OSWP, Sec+
<<

R3B005t

Newbie
Newbie

Posts: 43

Joined: Wed Mar 09, 2011 9:03 am

Location: NVA/D.C.

Post Mon Mar 21, 2011 1:56 pm

Re: Tool Box Needed

Helix is still alive and kicking. I would strongly recommend getting your hands on Encase or FTK both are insanely expensive however they are by far the best forensic suite out there.  I'd also get an Ubentu box up and running becasue there are some wonderful file analysis tools that are built specifically for that platform.  Sans has their free forensics toolkit that has some great timeline analysis programs built into it as well.  I currently use all 4 plus a random assortment of scripts and tools I've picked up along the way.  Sans ftk is free after registering here:  http://computer-forensics.sans.org/
<<

jsm725

User avatar

Newbie
Newbie

Posts: 36

Joined: Mon Mar 22, 2010 5:13 pm

Post Tue Mar 22, 2011 10:37 am

Re: Tool Box Needed

+1 for Helix, Encase and FTK imager. Encase can get expensive depending on what flavor you want.
CISSP, PCI-QSA, OSWP
<<

skitch

User avatar

Newbie
Newbie

Posts: 5

Joined: Thu Oct 23, 2008 10:17 pm

Location: Southsea

Post Sun Mar 27, 2011 1:56 pm

Re: Tool Box Needed

+1 for Helix, Encase and FTK imager. Encase can get expensive depending on what flavor you want.


Alternatives / additions
Autopsy, Sleuth kit, foremost / scalpel, dd, Sys internals suite, volatility memory framework, hex editor, Caine live cd, prodiscover basic, a sandbox, regedit, strings, physical write blocker, l0phtcrack, PRTK, TCT

The information I am able to recover may be used in court.


You should be careful with this though, if you've handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.

I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.
<<

R3B005t

Newbie
Newbie

Posts: 43

Joined: Wed Mar 09, 2011 9:03 am

Location: NVA/D.C.

Post Mon Mar 28, 2011 6:32 am

Re: Tool Box Needed

You should be careful with this though, if you've handled the evidence incorrectly not only will good lawyers ripp you apart, there are cases of examiners being accused of frameups.

I strongly suggest you become proficient with the ACPO computer evidence guidelines and forensically sound techniques if this is your direction.


I overlooked that handy little sentance, without proper training your entering a hazy area regarding gathering forensic data for use in court cases. From your initial post you sound relatively new to the field if thats the case I would be more concerned with getting a great lab set up to train yourself instead of building a forensic lab for evidence collection.  If I'm wrong I apologize and mean no offense its just that forensic examination for court cases can be extremely tricky.
<<

Joshsevo

User avatar

Sr. Member
Sr. Member

Posts: 281

Joined: Tue Dec 29, 2009 11:00 pm

Post Mon Mar 28, 2011 12:32 pm

Re: Tool Box Needed

Also to add onto what R3 said.  If you come across a Hard Drive that has CP and don't immediatly give it to the LEO then you can be charged with possesion and distribution. 

Tred carefully.
Security+, Network+, C|EH, CHFI, CPT
<<

millwalll

Post Mon Mar 28, 2011 12:59 pm

Re: Tool Box Needed

If its going to be used in court you wont be able to use hirens CD.

I have used password kit Forensic what is pretty good and get most passwords but at a price of around $700
<<

fuzed

Newbie
Newbie

Posts: 1

Joined: Mon Jan 25, 2010 6:13 am

Post Fri Apr 01, 2011 7:56 am

Re: Tool Box Needed

tools I use on a daily basis are -

FTK Imager
Helix


encase
netanalysis
IEF
Media Detective
WinHex
Windows File Analyzer
VFC (virtual forensic computing)
Live View
Mount image pro
VMWare Workstation

plus AV software to scan the systems for virus's which I always report on.

Alot of the software above will cost a bit.  If using in court then you really need to know what your doing, are you based in the US? UK? or OTHER?

Return to Forensics

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software