Title: 1. Evaluating Computer Forensics Tool Needs
Course: IN 2005 Digital Forensics > Section: Module 7: Chapter 7 - Current Computer Forensics Tools

Evaluating Computer Forensics Tool Needs

1. You should look for software that is versatile, flexible and robust.  Find the balance between price and number of features.
2. Some characteristics they should consider when buying forensic software.  The list should include:
  - OS
  - Supported file systems
  - Script capabilities
  - Automated features
  - Vendor’s reputation

Types of Computer Forensics Tools

1. Two major categories of forensic tools:
  - Hardware
    - Single-purpose component
    - Complete computer systems and servers
  - Software
    - Command-line
    - GUI

Tasks Performed by Computer Forensics Tools

1. Computer forensics tool functions are divided into the following five major categories:
  - Acquisition
  - Validation and discrimination
  - Extraction
  - Reconstruction
  - Reporting
  - Acquisition is the task of making a copy of the original drive.
  - The acquisition subfunctions, including:
    - Physical data copy
    - Logical data copy
    - Data acquisition format
    - Command-line acquisition
    - GUI acquisition
    - Remote acquisition
    - Verification
2. There are two types of data-copying methods are used in software acquisitions: physical copying of the entire drive and logical copying of a disk partition.
3. The formats for disk acquisitions vary from raw data to vendor-specific proprietary compressed data. You can view the contents of a raw image file with any hexadecimal editor.  See Figure 7-1.
4. Creating smaller segmented files is a typical feature in vendor acquisition tools.  All computer forensics acquisition tools have a method for verification of the data-copying process that compares the original drive with the image.
5. Validation is ensuring the integrity of data being copied. Discrimination involves sorting and searching through all investigation data.
6. IMajor subfunctions for data validation and discrimination, including:
  - Hashing
  - Filtering
  - Analyzing file headers
7. National Software Reference Library (NSRL) has compiled a list of known file hashes for a variety of OSs, applications and images.  See Figure 7-2.
8. Many computer forensics programs include a list of common header values. With this information, you can see whether a file extension is incorrect for the file type.  See Figures 7-3 through 7-5.
9. Most forensics tools can identify header values.
10. Extraction represents the recovery task in a computing investigation.  It is the most demanding of all tasks to master. Recovering data is the first step in analyzing an investigation’s data.
11. See Figures 7-6 and 7-7 to view the subfunctions of the extraction phase, including:
  - Data viewing
  - Keyword searching
  - Decompressing
  - Carving
  - Decrypting
  - Bookmarking
12. From an investigation perspective, encrypted files and systems are a problem.  Many password recovery tools have a feature for generating potential password lists for a password dictionary attack.  If a password dictionary attack fails, you can run a brute-force attack on the encrypted file.
13. Reconstruction is the task of re-creating a suspect drive to show what happened during a crime or an incident.
14. Several techniques you can use to re-create a suspect’s disk drive. You should include:Disk-to-disk copy
  - Image-to-disk copy
  - Partition-to-partition copy
  - Image-to-partition copy
15. To complete a forensics disk analysis and examination, you need to create a report.

Tool Comparisons

1. See Table 7-1 to compare various forensics tools functions.

Other Considerations for Tools

1. Some additional considerations for your forensic tools when planning for your lab such as flexibility, reliability and expandability.
2. The need to keep a library with older versions of your tools as a backward compatibility measure.