Title: 2. Computer Forensics Software Tools
Course: IN 2005 Digital Forensics > Section: Module 7: Chapter 7 - Current Computer Forensics Tools

Computer Forensics Software Tools

1. The following sections explore some options for command-line and GUI tools in both Windows and UNIX/Linux.

Command-Line Forensic Tools

1. The first tools that analyzed and extracted data from floppy disks and hard disks were MS-DOS tools for IBM PC file systems.  Norton DiskEdit was one of the first MS-DOS tools used for computer investigations.
2. One advantage of command-line tools is that they require few system resources because they’re designed to run in minimal configurations.

UNIX/Linux Forensic Tools

1. *nix platforms have long been the primary command-line OSs.  Some of these tools are SMART, Helix, Autopsy with Sleuth Kit and Knoppix-STD.
2. SMART was designed to be installed on numerous Linux versions. You can analyze a variety of file systems with SMART.  A number of plug-in utilities are included with SMART.
3. Another useful option in SMART is its hex viewer.
4. Helix is one of the easiest suites to begin with.  You can load it on a live Windows system and it loads as a bootable Linux OS from a cold boot.
5. Sleuth Kit is a Linux forensics tool, and Autopsy is the GUI/browser interface used to access Sleuth Kit’s tools.
6. Knoppix Security Tools Distribution (STD) is a collection of tools for configuring security measures, including computer and network forensics.  Knoppix-STD is forensically sound, so it doesn’t allow you to alter or damage the system you’re analyzing.
7. Knoppix-STD is a Linux bootable CD.

Other GUI Forensic Tools

1. GUI forensics tools simplify computer forensics investigations and help training beginning investigators. Most of them come in suites of tools.
2. The advantages of using GUI forensic tools, including:
  - Ease of use
  - Multitasking
  - No need for learning older OSs
3. The disadvantages of using GUI forensic tools, including:
  - Excessive resource requirements
  - Produce inconsistent results
  - Create tool dependencies