RECON for Mac OS X was simply the fastest way to conduct Mac Forensics. It automated what an experienced examiner would need weeks to accomplish in minutes. That was until we released RECON LAB and RECON TRIAGE which are the successors to RECON for macOS. These are a few popular digital forensics tools used by various law enforcement agencies in performing crime investigations. In this post, I added all kind of tools like premium, free, open source, computer forensics, mobile forensics and others. Computer forensics is a very important branch of computer science in relation to computer and Internet related crimes. Earlier, computers were only used to produce data but now it has expanded to all devices related to digital data.
Forensic Software: Everything You Need to Know About Computer Forensics
When the average person hears the phrase “computer forensics” or “forensic computing”, an image of a shadowy figure wearing mirrored glasses immediately comes to mind. But is it an accurate representation of what computer and digital forensics are really all about? It’s not, as you’ll soon find out in this article.
- PALADIN – Version 7 includes Autopsy! Autopsy is a FULL Featured GUI Forensic Suite with all the features that you would expect in a forensic tool. Autopsy even contains advanced features not found in forensic suites that cost thousands.
- Elcomsoft iOS Forensic Toolkit: complete forensic acquisition of encrypted data stored in iOS. The tool will automatically configure the system with a temporary password (“123”) in order to be able to decrypt keychain items (password will be reset after the acquisition). IOS Forensic Toolkit for Mac OS X requires an Intel-based Mac.
Even though the same tools used by a real computer forensic specialist are used by his or her underground counterpart, the essence of digital forensics is data recovery and preservation. If you ever used a computer data recovery tool, such as Disk Drill, to recover lost files from your computer, you already have a rough idea about one aspect of the forensic computer science and the life of a computer forensic investigator. In this article, you are going to learn the rest.
Computer Forensics Definition
Techopedia defines computer forensics as “the process of uncovering and interpreting electronic data”. The main goal of this process is to “preserve any evidence in its most original form while performing a structured investigation by collecting, identifying and validating the digital information for the purpose of reconstructing past events”.
In other words, digital forensics is a branch of the same old forensic science that you know from old crime TV shows. You know how they usually go: a horrendous murder is committed. Police officers arrive at the scene with the chief investigator leading the pack in his Ford Galaxie 500. As soon as they step out their vehicles, somebody yells “Don’t touch anything! We need every piece of evidence we can find”.
Back in the day, such evidence would often be someone’s diary or a fingerprint on a glass of water. These days, it’s digital metadata, log files, IP addresses, and leftover chunks of ones and zeros. Some of the very first digital crimes can be traced back to the late 1970s and early 1980s. In those days, computer security and privacy were the subjects of interest to only a very small group of geeks and innovators.
A major turning point occurred in 1978, with the 1978 Florida Computer Crimes Act, which recognized the first computer crimes in the United States and included legislation against unauthorized deletion or modification of computer data. Other acts, such as the US Federal Computer Fraud and Abuse Act of 1986 and the British Computer Misuse Act of 1990, followed soon after that.
Before the arrival of the new millennium, the discussion still revolved mostly around recognizing computer crimes as serious threats to personal, organizational, and national security. Since 2000, a new need for standardization arose, leading to the production of “Best practices for Computer Forensics” and the publication of ISO 17025 by the Scientific Working Group on Digital Evidence (SWGDE).
These standards and guides helped established a set of best practices for computer forensic specialists to follow and ignited computer forensics companies to produce capable forensic data recovery software solutions that would be able to meet the complex demands of the modern age.
The typical forensic process has several distinct stages: the seizure, forensic acquisition, analysis, and the production of a report based on the collected data. There are special free forensic software tools as well as paid forensic tools for each stage. A list of digital forensics tools can be found later in this article.
Sub-Branches of Computer Forensics
Computer forensic specialists either deal with the private or the public sector. With the public sector, their work is usually to support or refute a hypothesis before criminal or civil courts. The bread and butter of private sector forensic investigators are corporate investigations and intrusion investigations.
As the complexity of modern technology increases, computer forensic specialists often focus on one or a number of sub-branches of digital forensics, to gain expert-level knowledge. Digital forensics is typically divided according to the type of devices involved. The major branches are computer forensics, mobile device forensics, network forensics, forensic data analysis, and database forensics.
The one branch that has seen the most growth over the past few years is mobile device forensics. As people replace laptops and desktop computers with smartphones and tablets, the need for cell phone forensic software capable of forensic cell phone data recovery rises dramatically.
Computer Forensic Tools and Equipment
To describe some of many computer forensic tools used by computer forensic investigators and specialists, let’s imagine a crime scene involving child pornography stored on a personal computer. In most cases, investigators would first remove the PC’s HDD and attach with a hardware write blocking device. Such device makes this completely impossible to alter the content of the HDD in any way while allowing investigators to capture and preview the content of the disk.
PROTEGGA USES THE MOST MODERN COMPUTER FORENSIC DETECTION TOOLS
A bit-accurate copy of the disk can be made with a variety of specialized tools. There are large digital forensics frameworks and software solutions, alongside countless smaller utilities. The former group includes Digital Forensics Framework, Open Computer Forensics Architecture, CAINE (Computer Aided Investigative Environment), X-Ways Forensics, SANS Investigative Forensics Toolkit (SIFT), EnCase, The Sleuth Kit, Llibforensics, Volatility, The Coroner’s Toolkit, Oxygen Forensic Suite, Computer Online Forensic Evidence Extractor (COFEE), HELIX3, or Cellebrite UFED.
These large software solutions and forensic suites include a wide range of forensic data services in a single package. However, many professional forensic specialists prefer to build their own customized toolboxes from individual tools and utilities that exactly fit their needs and preferences. The options are plentiful for every stage of the forensic data recovery process, including hard drive forensics and file system forensic analysis.
Data capture can be done with the help of EnCase Forensic Imager, FTK Imager, Live RAM Capturer, or Disk2vhd from Microsoft. Emails are analyzed with tools such as EDB Viewer, Mail Viewer, or MBOX Viewer. Some tools are made specifically to target certain operating systems, while others support multiple platforms. Popular tools for Mac OS X include Disk Arbitrator, Volafox, and ChainBreaker, which parses keychain structure and extracts user’s information. Needless to say that no forensic analyst can be without a sizable assortment of internet analysis tools, including Dumpzilla from Busindre, Chrome Session Parser, IEPassView, OperaPassView, and Web Page Saver from Magnet Forensics.
Features of Professional Forensic Tools
Features of professional forensic tools vary greatly depending on what aspect of forensic analysis they target and what market they are aimed at. Generally, large forensic software suites have to be able to do the following:
- Support hashing of all files, which allows comparative filtering
- Full disk hashing to be able to confirm that the data has not changed (typically one tool is used to acquire and another is used to confirm the disk hash)
- Exact pathway locators
- Clear time and date stamps
- Have to include an acquisition feature
- Search and filtering of items
- The ability to load iOS backups and parse their data
Compared to law enforcement agencies, corporations are usually not concerned with volatile RAM captures. They want to acquire the evidence for private investigation and/or turn over to Law Enforcement. They are also usually not interested in previewing ability.
Major Forensic Software Providers
The field of forensic software analysis is filled with forward-thinking innovators and prolific, existing software companies that are ready to expand their operation. Large forensic software providers tend to appear at large industry gatherings, such as the High Tech Crime Investigation Association Conference, but there are many of these conferences across North America.
Let’s take a look at some of the most prolific forensic software providers and their products.
BlackBag Technologies https://www.blackbagtech.com
BlackLight by BlackBag is the premiere Mac Forensic Tool on the Market right now and costs approximately $2600. BlackLight started 5 years ago, developing a Mac-only forensic tool. It has now become a good Windows examination tool as well. It will analyze all iOS devices as well as Android. However, it is not capable of analyzing BlackBerry devices. One thing that Blacklight doesn’t do on its own is the forensic acquisition of bit for bit clones. They have an additional tool called MacQuisition.
MacQuisition runs a stripped down version of iOS 10 and costs over $1000 USD because of licensing to Apple. It does a very good job of discovering encryption and can join together fusion drives into one volume.
AccessData https://accessdata.com
AccessData is the leading provider of E-Discovery, Computer and Mobile Device Forensics for corporations, law firms, and government agencies. Their digital forensics solutions include Forensic ToolKit (FTK), which provides comprehensive processing and indexing up front, so filtering and searching are faster than with any other solution on the market.
The company is widely known for their mobile forensics tools, including Mobile Phone Examiner Plus (MPE+) and nFIELD. The former allows mobile forensic examiners to quickly collect, easily identify and effectively obtain the key data other solutions miss. The latter is an agile solution that allows users to perform logical and physical acquisitions of all MPE+ supported mobile devices in just 5 steps.
Guidance Software https://www.guidancesoftware.com
Guidance Software, founded in 1997, develops EnCase Forensic Software, which is a PC-only forensic tool that has been the mainstay of forensics for over a decade. The tool has made the headlines in 2002 when it was used in the murder trial of David Westerfield to examine his computers to find evidence of child pornography, and when French police used EnCase to discover critical emails from Richard Colvin Reid, also known as the Shoe Bomber.
EnCase Forensic Software is capable of acquisitions, hard drive restoration (cloning bit for bit and make a cloned HDD), complete a comprehensive disk-level investigation, and extensive reporting, among many other things.
Magnet Forensics https://www.magnetforensics.com
Developed by a former police officer and programmer, Magnet Forensics is a complete digital investigation platform used by over 3,000 agencies and organizations around the world. Originally, it started as an Internet-only carving tool but has now expanded to become a full-fledged forensic suite. Magnet Forensics can make physical data acquisitions of phones where possible (most Android and iPhone 4 and below, and BlackBerry). These physical acquisitions can be then loaded into tools such as Cellebrite.
X-Ways https://www.x-ways.net
X-Ways is a relative newcomer to forensics, but the company is quickly becoming popular due to its speed of innovation. Developed by a team of German Engineers, forensic tools from X-Ways do a fantastic job when it comes to disk imaging, disk cloning, virtual RAID reconstruction, remote network drive analysis, remote RAM access, cloud storage access, and more. The downside is that they require considerable experience to use.
Cellebrite https://www.cellebrite.com
A subsidiary of Japan’s Sun Corporation, Cellebrite Mobile Synchronization is an Israeli company that is considered to be the leader when it comes to mobile forensic software. Their premier mobile tool comes with a very high price tag of $12,000 USD and a yearly license around of $4000. With the high price goes a top-notch service that provides deep insight into mobile devices through Cellebrite’s Unified Digital Forensics Platform.
CERT
CERT stands for computer emergency response teams. In the United States, the organization was established in 2003 to protect the nation’s Internet infrastructure against cyber attacks. They have developed several tools used by law enforcement, including CERT Triage Tools. Triage Tools are used to capture RAM and make on-scene acquisitions. The product also includes a GNU Debugger extension called “exploitable” that is able to classify Linux application bugs by their severity. Currently, CERT Triage Tools is being publicly developed on GitHub.
Disk Drill’s Take on Forensic Data Recovery
Disk Drill is a proven data recovery tool that has been successfully used by countless users from all around the world to recover documents, images, video files, and other types of data from a variety of different storage devices.
Paint Tool For Mac
Data recovery for free
Your Companion for Deleted Files Recovery
Your Companion for Deleted Files Recovery
CleverFiles, the company behind Disk Drill, is currently working on a new version of the software, one that will include an assortment of useful forensic tools. This upcoming player on the forensic market is expected to bring to it their signature user-experience characterized by a high degree of user-interface polish and remarkable ease of use.
Forensics have been an area that has been receptive to technology and the achievements made out of this are great. The number of tools available for this category is a clear indication of the level of acceptance as well as the acceptance by the scientists involved.
Related:
Development is also expected to go further, and more complex and intelligent tools released into the market with time and it surely be interesting to make observations of the trends to come.
![Mac Mac](/uploads/1/2/6/4/126405654/937784889.png)
SANS Investigative Forensic Toolkit (SIFT)
SIFT is a forensic tool by SANS DFIR that is designed by an international team of forensic experts for use in digital forensics. This is a serious professional tool that produces impressive results. SIFT is free to use, and training on it is offered at SANS. The tool demonstrates advanced capabilities in incident response.
ProDiscover
ProDiscover is a forensic tool developed by ARC Group for the purposes of checking the security of your hard drive so that you can undertake the necessary measures to protect your data. With this tool, you can finally be in charge of your own data security and at a very low cost.
Autopsy
This is a GUI – based program that allows users to do analysis of their smartphones and disk drives. The tool is very easy to use and at the same time effective. On the background, it partially rides on another command line based tool called The Sleuth Kit.
Other Platform
The tools available for forensics heavily depend on the desktop environment and thus the core of them lie on the PC, Linux, and Mac platforms. However, it can be noted that there are a lot of support applications available on the portable gadgets and certainly in their platform.
CD/DVD Inspector for Windows
CD/DVD Inspector is a forensic tool that is dedicated to the assessing data from cyber-crime cases that are stored on CDs and DVDs. The software is very professional and conducts extensive extraction and analysis from these sources to ensure you get to the bottom of the case.
MACQUISITION for Mac
BlackBag Technologies is a company that is dedicated to the creation of forensic soft wares. The company has a collection of these, and they are all aimed at bringing efficiency to those keen on the security of their systems. Some of the tools created by BLACKLIGHT, MOBILYZE, MACQUISITION and SOTFBLOCK.
![Tool Tool](/uploads/1/2/6/4/126405654/159965881.png)
Apple Forensic Tools
SMART for Linux
SMART is a tool designed and optimized for the sole purpose of giving data forensic practitioners and information security professionals the best kind of support. With this tool, professionals in this industry can effectively achieve their goals and duties. SMART for Linux offers more than just the forensic support and makes users be efficient.
Most Popular Software for 2016 – Responder PRO
Responder PRO is a tool by CounterTack is a forensic tool that aims the preferred big data endpoint response and detection program. Responder PRO offers advanced physical memories forensics as well as malware analysis. It is also an ideal tool for reverse engineering.
Forensic Tools For Macintosh
What is a Forensic Tool?
A forensic tool is a software product that is aimed at helping scientist establish the cause of an event, especially crime. In most case, they tend to look at the outliers but also heavily depend on statistics as well as intelligent information.
The functionality of these tools greatly depends on the field of forensics that they tend to investigate, and the different fields rely on different tools. For example, cyber security forensics looks at how computer resources and data are accessed by unauthorized and even in some of the occasions track down the perpetrators of the crime.
It is rather impressive what some of these tools can be able to achieve. This is the reason why it is great to encourage their development as well as their utilization. It is good to observe that they are available across all platforms, and this enables all users to enjoy these tools.