Forensic Toolkit - Revision history

Hydrocloricacid: adding AFF image type support

2012-04-04T23:43:55Z

adding AFF image type support

.FUF: correct links

2009-03-19T09:42:50Z

correct links

Jessek at 15:22, 27 February 2007

2007-02-27T15:22:31Z

Jessek: Fixed URL in infobox

2007-02-27T01:09:58Z

Fixed URL in infobox

Jessek: Merged with data that was on AccessData page

2007-02-27T01:08:20Z

Merged with data that was on AccessData page

Uwe Hermann: Infobox and categories.

2006-05-06T16:08:30Z

Infobox and categories.

Uwe Hermann at 21:04, 31 March 2006

2006-03-31T21:04:01Z

Uwe Hermann: Various fixes.

2006-03-21T21:10:30Z

Various fixes.

Pw at 17:29, 21 March 2006

2006-03-21T17:29:59Z

New page

=Forensics Toolkit=

This Fort Worth based company makes forensics software and packages it with portable hardware for investigators in the field with desktop workstations for offices.

[http://www.accessdata.com/ Website]

=Features=

==File Systems Understood==

* Outlook (PST)
* AOL
* Web based email like Yahoo and Hotmail.
* Eudora
* MSN Mail
* NTFS
* FAT
* Ext2, Ext3
* Compressed files iwth WinZip, GZip, Tar and others

==File Search Facilities==

* Lists allocated and unallocated files.
* Sorts files by type.
* Searches for keywords and regular expressions.
*

==Historical Reconstruction==

Can it build timelines and search by creation date?

==Searching Abilities==

* Can use basic keyword searching.
* Offers full-text indexing powered by dtSearch.
* Search can be focused on "internet text"

==Hash Databases==

* MD5
* Searches with "Known File Filter" (Nist and Hashkeeper)

==Evidence Collection Features==

Can it sign files? Does it keep an audit log?

=History=

==License Notes==

Is it commercial or open source? Are there other licensing options?

= External Links =

[http://www.accessdata.com/ Website}

==External Reviews==

@@ Line 12: / Line 12: @@
 =Features=
-The Forensic toolkit can parse a number of filesystems, including [[FAT]] 12/16/32, [[NTFS]], NTFS Compressed, [[Ext2]], and [[Ext3]]. It can use image files created by [[EnCase]], [[SMART]], [[Snapback]], some versions of [[Safeback]] and [[dd]].
+The Forensic toolkit can parse a number of filesystems, including [[FAT]] 12/16/32, [[NTFS]], NTFS Compressed, [[Ext2]], and [[Ext3]]. It can use image files created by [[AFF]], [[EnCase]], [[SMART]], [[Snapback]], some versions of [[Safeback]] and [[dd]].
 The program allows users to search with keywords or take advantage of [[drive indexing]] using  the [[dtSearch]] algorithm.

@@ Line 5: / Line 5: @@
    genre = {{Analysis}} |
    license = {{Commercial}} |
-   website = [http://www.accessdata.com/catalog/partdetail.aspx?partno=11000 accessdata.com] |
+   website = [http://www.accessdata.com/forensictoolkit.html accessdata.com] |
 }}
@@ Line 22: / Line 22: @@
 == External Links ==
-[http://www.accessdata.com/catalog/partdetail.aspx?partno=11000 Forensic Toolkit information from AccessData]
+[http://www.accessdata.com/forensictoolkit.html Forensic Toolkit information from AccessData]

@@ Line 12: / Line 12: @@
 =Features=
-The Forensic toolkit can parse a number of filesystems, including [[FAT]] 12/16/32, [[NTFS]], NTFS Compressed, [[Ext2]], and [[Ext3]]. It can use image files created by [[Encase]], [[SMART]], [[Snapback]], some versions of [[Safeback]] and [[dd]].
+The Forensic toolkit can parse a number of filesystems, including [[FAT]] 12/16/32, [[NTFS]], NTFS Compressed, [[Ext2]], and [[Ext3]]. It can use image files created by [[EnCase]], [[SMART]], [[Snapback]], some versions of [[Safeback]] and [[dd]].
 The program allows users to search with keywords or take advantage of [[drive indexing]] using  the [[dtSearch]] algorithm.

@@ Line 5: / Line 5: @@
    genre = {{Analysis}} |
    license = {{Commercial}} |
-   website = [http://www.accessdata.com/products/ftk/ accessdata.com/products/ftk/] |
+   website = [http://www.accessdata.com/catalog/partdetail.aspx?partno=11000 accessdata.com] |
 }}

@@ Line 1: / Line 1: @@
 The '''Forensic Toolkit''' ('''FTK''') is a commercial forensic software package distributed by [[AccessData]].
@@ Line 47: / Line 56: @@
 =External Links=
 ==External Reviews==

@@ Line 12: / Line 12: @@
 =Features=
-==File Systems Understood==
+The Forensic toolkit can parse a number of filesystems, including [[FAT]] 12/16/32, [[NTFS]], NTFS Compressed, [[Ext2]], and [[Ext3]]. It can use image files created by [[Encase]], [[SMART]], [[Snapback]], some versions of [[Safeback]] and [[dd]].
-* Outlook (PST)
+The program allows users to search with keywords or take advantage of [[drive indexing]] using  the [[dtSearch]] algorithm.
-* AOL
-* Web based email like Yahoo and Hotmail
-* Eudora
-* MSN Mail
-* [[NTFS]]
-* [[FAT]]
-* [[Ext2]], [[Ext3]]
-* Compressed files with [[WinZip]], [[GZip]], [[Tar]] and others
-==File Search Facilities==
+== Data Reduction ==
-* Lists allocated and unallocated files.
+The Known File Filter, or KFF, can be used to eliminate or highlight known files using [[MD5]] hashes generated by user or from [[National Software Reference Library|NIST]] or [[Hashkeeper]].
-* Sorts files by type.
-* Searches for keywords and regular expressions.
-==Historical Reconstruction==
+== External Links ==
-Can it build timelines and search by creation date?
+[http://www.accessdata.com/catalog/partdetail.aspx?partno=11000 Forensic Toolkit information from AccessData]
-−
-==Searching Abilities==
-−
-* Can use basic keyword searching.
-* Offers full-text indexing powered by [[dtSearch]].
-* Search can be focused on "Internet text".
-−
-==Hash Databases==
-−
-* [[MD5]].
-* Searches with "Known File Filter" ([[NIST]] and [[Hashkeeper]]).
-−
-==Evidence Collection Features==
-−
-Can it sign files? Does it keep an audit log?
-−
-=History=
-−
-==License Notes==
-−
-Is it commercial or open source? Are there other licensing options?
-−
-=External Links=
-−
-==External Reviews==

← Older revision		Revision as of 21:04, 31 March 2006
Line 1:		Line 1:
−	The '''Forensic Toolkit''' is a commercial forensic software package distributed by [[AccessData]].	+	The '''Forensic Toolkit''' ('''FTK''') is a commercial forensic software package distributed by [[AccessData]].

	=Features=		=Features=