Computer Forensics: Tools of Evidence

Computer forensic tools now make it possible to more easily search for, and find, evidence on hard drives

If forensics is your businessrather than your hobbythen you will almost certainly want to get one of the professional tools on the market. Two of the best are EnCase, by Guidance Software (roughly $2,495 per user), and the Forensic ToolKit (FTK), by AccessData ($595).

Although EnCase and FTK are very different programs, they have a surprising amount of overlapping functionality. Both programs run on Windows and require that you have a dongle installed on your system to deter software piracy. (Ironically, law enforcement investigators have a terrible reputation when it comes to software piracy.) Both let you do searches for particular strings and file types. Both let you view regular files, deleted files or examine the part of the hard drive that isn't mapped to any file at all. Both will log the operator's actions and allow you to prepare a professional report. Indeed, both of these programs have a ton of functionality: Reading the manual is not enough. To get the best use out of these programs, you'll need to take the training offered by the companies.

To start using these programs, create a new investigation "case" and then add evidence. FTK lets you add images, files, directories or disks that are attached to the computer. EnCase allows you to acquire from a raw file or from another computer, either over a network or by using a special cable that the company provides. EnCase adds images quickly, allowing you to go about the business of hunting for data faster. FTK is much slower at adding evidenceit can take half an hour or longerbut it painstakingly searches through the entire disk, building a database, indexing all the text that it finds, and even looking inside Zip archives to see what files were zipped up.

Once the evidence is added, you can use these tools to search the disk image for keywords, e-mail messages, images and more. You can restrict your search to files that were or were not deleted, if you wish, as well as to a particular time range.

Not surprisingly, one of the primary uses of these tools is child pornography investigations. And although the programs can't automatically search out pornography, they have the ability to display a page showing all of the .gifs and .jpegs that were discovered in the image fileand the images of naked people tend to be obvious. You can also import a database of MD5 codes for known child pornography: If the program finds a file on the suspect drive image with a matching MD5 code, an alert will be raised.