Ccsi Week 1 Ilab Report

CCSI460 Forensic Lab Report

Investigator’s Name: Matt Ferry

Date of Investigation: September 8, 2013

Lab Number and Title: 1 Survey of Forensic Toolkits

Summary of Findings:

All of the links provided go to forensic software packages that are readily available for use by the computer forensics industry. I was aware of Sleuthkit/Autopsy, FTK, and Encase, but did not know about STD and Helix

I particularly like that there are at least two open source packages available Sleuthkit /Autopsy and STD, although STD is more of a Linux live distribution than an individual software package.

In regards to these programs uses in the corporate world, I would think that because Sleuthkit/Autopsy, STD are free to use, that these software packages would be a great launching point for a small business or independent investigator that cannot afford the costs of FTK, Encase, or Helix. A larger corporation can afford FTK, Encase, and Helix. The use of these programs not only provide stronger features and more product support, but they will also allow investigators to be more consistent with the work and reports that are produced, increasing the viability and credibility of those reports as these software packages are widely used and therefore trusted as accurate.

At a minimum Encase costs approximately $3,000 plus a one year Software Maintenance Service plan, and both FTK and Helix Enterprise only offer options for calling for a quote, which indicates that their costs are just as costly as Encase if not even more.

A couple of things to note about FTK and Helix is that they each offer separate products for “Live Response” or the capturing of volatile data. FTK’s version does not list the price, but Helix’s Live Response software is $500.

The company behind the Helix software package also offers what I would call a hook package, in that they offer a particular version of their software for free (although this option is not as prominent, it is near the...