Handbook of Information Security: Threats, Vulnerabilities, Prevention, Detection, and Management, Volume 3

Evidence Collection and Analysis Tools

Christopher L. T. Brown, Technology Pathways

Introduction

Types of Investigations and Tool Selection

Tool Testing, Admissibility, and Standards

Tool Testing and Standards

Admissibility of Digital Evidence

Classes of Tools

Integrated Collection (Imaging) and Analysis Tools

Windows-Based Tools

UNIX-Based Tools

DOS/Command Line Tools

Data Recovery Utilities

Specialized Tools for E-mail and Internet History Analysis

PDAs and Other Devices

Evidence Collection Hardware

Disk and Media Imagers

Write Blockers

Collection and Analysis Workstation

Evidence Collection Field Kit

Conclusion

Glossary

Cross References

References

Further Reading

INTRODUCTION

In today's digital age, evidence of improprieties often lies deep within the corporate information technology infrastructure in such places as personal data assistants, the lowest levels of computer hard disks, and a litany of other storage devices. The old cliché, “the right tool for the job,” has never been so fitting than when selecting tools for the conduct of computer forensics.

This article intends to do more than simply list various tools and their use. It provides readers with a discussion of the unique natures of different types of computer forensics tools and selection criteria for each. Information on tool testing and certifications is also provided to assist readers in their own tool selection and testing. Self-validation of tools is considered a “best practice” in the computer forensics field. ...