Spyware detection tools
Spyware detection tools can find the presence of spyware (but not always). Some tools will only find spyware on the running system; others can find it on any disk.
It is useful to know if there is spyware on a system you are investigating.
If you are trying to prove guilt of the system's primary user:
- You need to understand what the spyware on the system can do and what it can't do
If you are trying to prove innocence:
- The presence of spyware can mean that someone else is running system
One way to find spyware is to set up a virtual machine with a disk image of the captured system, install the spyware detector, and then
Tools recommended for finding spyware in a forensic context:
- Spyware Doctor (in Google Pack)