Computer Forensics Software

Posted by steve on Jan 13, 2012 in Articles | Comments Off

Computer Forensics Software

Every detective needs his tools of the trade to ferret out clues and evidence.  That isn’t any different for computer forensics professionals, even though it might not quite look like a detective at first glance.  Even a computer forensics professional needs a set of good, solid tools to do a proper investigation.  With the way the internet and computer technology continues to expand and evolve, this list of programs could change very quickly.  What we list out here are just some of the basic tools and the basic Computer Forensics Software that are used in the field today.

Computer Forensics Software: Not like on TV

As you often see on television, on those police and FBI shows, there is usually a ‘geek’ that they turn to who can break out a DOS prompt and uncover that the suspect has been illegally purchasing bomb making materials from the general store and has been shipping it to people all over the country who are in the process of …. You get the idea.  But in most cases, computer forensics software doesn’t look anything like that picture you are given.  The computer forensics software today has the ability to scan a system and identify potential evidence in a matter of minutes to hours, versus what would before take sometimes days to discover.  But even all the automated software isn’t as effective if you don’t have a person who knows what they are doing running it.

Computer Forensics Software: Closer Look

One of the most commonly used computer forensics software is EnCase.  This is considered the gold standard by most investigators.   It is extremely powerful and has a wide range of customizations that allow you strictly tailor your searches.  You can use the software to do keyword searches, e-mail searches and Web page carving.  They even have versions of the software tailored for mobile devices and even full network analysis tools.

Another popular computer forensics software package is the Forensic Toolkit (FTK).  The company who created this software, AccessData, has done a fantastic job at making a one button software package that is fairly inexpensive and easy to use.  By taking often used functions and automating many of them, it allows the investigator to be more effective in their search and it helps to generate well laid out reports.

Device Seizure is another tool that makes a great package to have in a computer forensics software toolkit.  This software package allows you to look at most mobile devices that are on the market today.  With the movement of more and more people to smart phones and mobile devices, this type of tool is essential for a computer forensics professional.  It allows you to access most information on a mobile device, including text messages, email and other user data.

There are also many different physical devices used in computer forensics such as the Forensic Recovery of Electronic Device (FRED), which has just about every available interface on it to gather data.  There is also the WiebeTech Forensic Field Kit, which is smaller and easier to carry on site.  Using these devices you can easily pull data from device drives and store them securely and on media that is write protected.

So there are many different options available of computer forensics software packages that will help you become a fantastic computer forensic professional and allow you to do your best to represent your clients in court.