Even at this price it is an order of magnitude under its competitors.EnCase is a product which has been designed for forensics, digital security, security investigation, and e-discovery use. However, we find it to be a good value for the money based on its ease of use and highly comprehensive feature set. At a price of almost US$13,000, this product seems a little pricey for just software. Reading the first few sections will provide the knowledge to perform basic tasks with the system. The help file is above average and covers most of the common usage of the product. The licence file was copied to the program directory and the installation was done. The solution installed from a downloaded file (around 100MB), which set up the ProDiscover program as well as ActivePerl for forensic scripting on the system. The installation was as easy as for any offering in this group. Since ProDiscover is designed to read an imaged system disk rather than individual files as inputs, we were unable to test it against VMWare disk files to ascertain if it would view the VMWare file as a flat file or a virtual file system. The picture files merely opened in picture preview. The product also did not detect the presence of any steganographed files. The password-protected files were not highlighted, and the investigator would only know their status after double-clicking on the file to open it in the external application. ProDiscover found many deleted executables, directory and picture files. ProDiscover recovered more deleted files than any other program, including some files that had supposedly been wiped using a program from a well-known manufacturer. Importing the image file into the tool was so quick that it was impossible to time. ProDiscover needed around three minutes to create a forensic image of a 1GB drive. The product is pretty feature-rich, but having internal viewers as opposed to loading the applications would be a time saver. The scripts can be handy to automate tasks that are routinely performed as part of a forensic investigation. ProDiscover allows for scripting of commands using Perl script programming language. Everything needed for forensic analysis is included in one clean interface that resembles Windows Explorer.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. Archives
December 2022
Categories |