<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Saw this: National Computer Forensics Institute: Demystifying
Cybercrime at:<br>
<a class="moz-txt-link-freetext" href="http://www.techrepublic.com/blog/it-security/national-computer-forensics-institute-demystifying-cybercrime/">http://www.techrepublic.com/blog/it-security/national-computer-forensics-institute-demystifying-cybercrime/</a><br>
<br>
Which showed a link, 'Forensic Recovery Device' to a pdf, which
mentioned Sleuth Kit and FTK Imager..<br>
<br>
So googled and found: <a class="moz-txt-link-freetext" href="http://www.sleuthkit.org/">http://www.sleuthkit.org/</a> about Autopsy and
The Sleuth Kit running on Windows, Linux, etc.<br>
Open source digital forensic tools to analyze disk images and
perform in-depth analysis of various file systems and several volume
system types.<br>
<br>
Sounded interesting so installed Autopsy on a XP PC.<br>
(It's a graphical interface to The Sleuth Kit and other
investigation tools)<br>
Used it to look at the PC's drive's software and it had a lot of
info.<br>
Turns out the PC should have been better (faster, more ram, etc.)
but good enough for a test.<br>
<br>
For real forensic work it looks as if it's best to use a 'Write
Blocker' (keeps drive intact) then make an image.<br>
Use Autopsy on the image.<br>
<br>
'General Information' tab at this link, shows what can be done.<br>
<a class="moz-txt-link-freetext" href="http://www.sleuthkit.org/autopsy/help/index.html">http://www.sleuthkit.org/autopsy/help/index.html</a><br>
<br>
There is also Autopsy 3 WinFE, a live boot environment to examine a
suspect computer in a forensically sound way.<br>
<br>
Image from the Autopsy WIKI.<br>
<img src="cid:part1.05080601.04000005@oplin.org" alt=""><br>
<br>
Enjoy, Bob<br>
<br>
<div class="moz-signature">-- <br>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="content-type">
<title>Email Signature</title>
<pre class="moz-signature" cols="80">R. W. (Bob) Neeper
<a href="http://sunbury.cool-cat.org" target="_blank">Community Library</a>
44 Burrer Dr. <a href="http://maps.google.com/maps?q=40.243961,+-82.863007">Map</a>
Sunbury, Oh 43074
Tel: (740)-965-3901
<a href="http://info.cool-cat.org"><img style="border: 0px solid ; width: 100px; height: 107px;" alt="cool-cat.org" src="cid:part4.03040804.04070503@oplin.org"></a></pre>
</div>
</body>
</html>