Forensic Software

This section details software tools and utilities commonly used during a Computer Forensic examination:

Disk Imaging Tools

Tools recommended for Forensic Disk Aquisition

• Encase
• Paraben - Forensic Replicator
• FAU - Forensic Acquisition Utilities
• Dd
• X-Ways Replica
• VDK (Disk Emulator)
• Mount Image (Disk Emulator)
• Paraben P2 Explorer (Disk Emulator)

Disk Examination Tools

Tools recommended for examination of disks and file systems

• Encase
• Paraben - Forensic Sorter
• Paraben - Registry Analyzer
• Paraben - Text Searcher
• Vogon GenTree Investigation Software
• The Coroner's Toolkit (TCT)
• OmniQuad Investigator
• Outlook Recovery

Password Crackers

Tools commonly used to remove password protection found on some files

• Ophcrack
• Paraben - Decryption Collection
• Office Key - MS Office Password Recovery
• Accent OFFICE Password Recovery
• AIM Password Decoder
• CMOS Recovery Tools
• Zip Password
• CrackPDF
• Cane and Abel
• Jack the Ripper
• RAR Password Recovery
• Advanced Archive Password Recovery
• AEFSDR (Advanced EFS Data Recovery)

Log & File Readers

Tools used to search the contents of large log files for evidence

• Grep

Phone Forensic Software

Tools recommeded for the forensic aquisiation and examination of mobile phones

• Paraben - SIM Card Seizure

PDA Forensic Software

Tools recommeded for the forensic aquisiation and examination of PDAs

• Paraben - Device Seizure

---

Sponsored by EWA Technology Services - Computer Forensic Services