Forensics Thread

[kvs379]

Not sure if there is a section available for this discussion, but I thought it would be good to get a forensic thread going discussing tools, techniques, software etc..

 

[karnuffel]

I had forensics as part of my hons. was epic!! We played around with encase, but I imagine it must be kaaaaaak expensive.
http://www.guidancesoftware.com/encase-forensic.htm

 

[akescpt]

i want to be this when i grow up. hoping to do that part time certificate course.

 

[kvs379]

I did it in UK for two years. Well mobile phone forensics using XRY XACT, UFED, Oxygen Software. And also using EnCase and FTK for imaging and investigating memory cards.

I've just downloaded Caine 3.0 and have started playing around with that. Could be a good idea if others did the same and we could share tips and tricks back and forth

 

[kvs379]

I had forensics as part of my hons. was epic!! We played around with encase, but I imagine it must be kaaaaaak expensive.
http://www.guidancesoftware.com/encase-forensic.htm

Lank expensive - as far as I know a company called Risk Diversion have the rights to the distribution in SA

 

[Hamster]

Anybody here know of any good books/sites on the subject? Always liked the idea of forensics.

 

[karnuffel]

I just found it extremely hard to find a job in the field must be awesome to be the Horatio of the IT world !!!

 

[kvs379]

Anybody here know of any good books/sites on the subject? Always liked the idea of forensics.

www.forensicfocus.com Its a UK forum but by far the best forum imho wrt forensics. Wealth of information. Unfortunately the market in SA isnt very big when it comes to forensics but in the UK it's MASSIVE. Cops arrest people for anything there and submit their cellphones for analysis. I remember we used to charge about 200 pounds an hour for iPhone investigations.

 

[kvs379]

I just found it extremely hard to find a job in the field must be awesome to be the Horatio of the IT world !!!

I know of Nexus and Risk Diversion but as I mentioned previously its not that big here in SA. And those companies who do it, dominate.

 

[kvs379]

I just found it extremely hard to find a job in the field must be awesome to be the Horatio of the IT world !!!

Dead victim: gun shot in head
Horatio: Hmmm, Looks like someone was.......shot in the head......

 

[rrh]

I know of Nexus and Risk Diversion but as I mentioned previously its not that big here in SA. And those companies who do it, dominate.

Most forensic auditors offer a PC/mobile forensics service.

 

[kvs379]

True - Deloittes' etc

 

[Hamster]

Dead victim: gun shot in head
Horatio: Hmmm, Looks like someone .......went out with a bang.....YEEEEEAAAAAAHHHHHHHH

FTFY

 

[kvs379]

FTFY

Ta!

 

[SBSP]

Probably not totally forensics related but, as the old saying goes "Keep your friends close but Keep your enemy ......"

Backtrack5 is available.
http://www.backtrack-linux.org/

Most of the tools on the ISO is for hacking stuff but it also has some forensic tools as well.
If you know how stuffs done then you will find it easier to do forensics on it.

 

[kvs379]

SBSP: Best security/forensic distro out there, provided you know your way around linux and the tools. I've played around with it especially the Wifi hacking tools (my own network, relax ppl). Once you get the 4 way hand shake you can upload it to www.cloudcracker.com who can crack it and get the key for you! Quite cool if you wanted to do WIFI security audits etc

 

[d7e7r7]

Seems like some forensics is going to be needed to crack the encryption on Reeva's cell phone...

 

[garyc]

Probably not totally forensics related but, as the old saying goes "Keep your friends close but Keep your enemy ......"

Backtrack5 is available.
http://www.backtrack-linux.org/

Most of the tools on the ISO is for hacking stuff but it also has some forensic tools as well.
If you know how stuffs done then you will find it easier to do forensics on it.

An not forgetting http://www.kali.org/