blackbag forensics compared to oxygen forensics

Also gives you the option of memory capture including page files.

Create hashes of files to check the integrity of the data by using either of the two hash functions available in FTK Imager: Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1).See and recover files that have been deleted from the Recycle Bin, but have not yet been overwritten on the drive.Export files and folders from forensic images.Preview the contents of forensic images stored on the local machine or on a network drive.Preview files and folders on local hard drives, network drives, CDs and DVDs, thumb drives or other USB devices.Create forensic images of local hard drives, CDs and DVDs, thumb drives or other USB devices, entire folders, or individual files from various places within the media.It also offers various options such as file size and the format of the images. FTK Imager can create forensic imagesof computer data without making changes to the original evidence. FTK ImagerįTK Imager is a free data preview and imaging tool developed by AccessData that helps in assessing electronic evidence to determine if further analysis with a forensic tool such as AccessDataForensic Toolkit (FTK) will be required.

Some of the most prevalent tools, both open source and proprietary, with their features have been listed below: 1. These includes write-blocking, i.e., permitting read-only access to data storage devices without compromising the integrity of the data imaging and disk cloning or making bit stream copies of the original drive authentication and evidence preservation using hash algorithms recovery of files and folders, whether hidden or deleted live acquisition (when the computer/device is in switched on mode) as well as RAM and swap/paging file analysis keyword searching metadata searches and filtering carving or locating fragments or entire file structures decrypting and password cracking and ultimately automatic generation of the final report. These digital forensic tools, whether hardware or software or a combination of both, perform various functions. As digital evidences can be comparatively more fragile in nature and easier to alter and tamper with, there are various digital forensic tools that helps to simplify the process and gets the job done.ĭigital forensic tools can either be open source or proprietary: open source tools are free and provides access to their source code whereas proprietary tools are costly and users either have limited or no access to their source code.

Blackbag forensics compared to oxygen forensics