------- Forwarded message follows -------
Date sent: Fri, 29 Dec 2000 15:02:02 -0500
Send reply to: James Holley <[email protected]>
From: James Holley <[email protected]>
Subject: Re: [cfid] Testing Forensic Tools {01}
Originally to: [email protected]
To: [email protected]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
All,
Ok. 2 messages in 2 days. Sorry if I confused anyone. I know Fred
Cohen's Linux based tool set is called ForensiX, but my spell checker
did not like that word and I missed the change from "ForensiX" to
"Forensics". And I am such a horrible typist that I must have a spell
checker on my email.
I also got a reply earlier about including DIBS in the review, so I
have asked the editors at SC Magazine to contact the DIBS developers
to inquire about including their tools.
Thanks,
James :-)
> -----Original Message-----
> From: [email protected] [mailto:[email protected]]On Behalf Of
> James Holley
> Sent: Friday, December 29, 2000 11:36 AM
> To: cfid List Member
> Subject: [cfid] Testing Forensic Tools {01}
>
>
> {* The following is provided for educational purposes, no claims of
> *} {* copyright are made and opinions are those of each author
> only & *} {* may not reflect the position of his/her
> organization. Your reply *} {* to this message will be redirected
> to the listserv. To unsubscribe *} {* from the list, send a
> plain-text message to [email protected] *} {* with UNSUBSCRIBE
> [email protected] in the body of the message. *}
>
>
>
> *** PGP Signature Status: good
> *** Signer: James O. Holley <[email protected]>
> *** Signed: 12/29/2000 11:35:35 AM
> *** Verified: 12/29/2000 11:48:42 AM
> *** BEGIN PGP VERIFIED MESSAGE ***
>
> All,
>
> We are beginning our review, research and testing for an article to
> be published in SC Magazine (http://www.scmagazine.com/index2.html)
> in March-April 2001 reviewing computer forensics analysis tools .
> This is a follow-up to an article we wrote detailing the results of
> some testing we did on forensic imaging tools in September of this
> year, which was a follow-up to an article introducing Computer
> Forensics that we wrote for the Sept 99 issue. The editors of SC
> Magazine have asked the following developers to participate by
> providing fully functional versions of their commercial tools for
> review and testing:
>
> Elliot Spencer - iLook
> Mares & Company LLC - MaresWare
> Guidance Software – EnCase
> NTI – the NTI forensic analysis tools
> Tech Assist – ByteBack
> Vogon – the Vogon forensic analysis tools
> ASR Data – Expert Witness 2000
> Fred Cohen & Associates – Forensics
> Access Data – The Forensics Tool Kit
>
> Did we miss some tools you use?
>
> Besides these tools, we plan to review other publicly available
> freeware tools from Dan Farmer (the Coroner’s Toolkit), Foundstone
> (Forensic Toolkit), Sysinternals, and others you may mention to us.
> And of course we’ll also preview some basic Linux forensics
> methodologies made up of capabilities inherent in the free
> operating system.
>
> While we have already designed most of the testing scenarios, if
> there is any specific aspect of a particular tool you’d like us to
> review or test, or any specific set of circumstances under which
> you think a test would benefit our community, please relay your
> thoughts on that to me. I’d appreciate your input, and we’ll
> endeavor to
> include those aspects and circumstances in our tests and in the
> article.
>
> We also plan on attending TechnoSecurity 2001 and will be helping
> on the Forensic Tools Shootout there. We'll also be available there
> to discuss the results of this review project with anyone
> interested in details on our methodology or results.
>
> Thanks,
>
> James :-)
>
> James O. Holley
> Advanced Research Projects Team
> Fiderus Strategic Security & Privacy Services
> (w) 703.684.3140
> (p) 888.620.5275
> Emergency 24 hour response: 1-877-595-8491
>
>
> *** END PGP VERIFIED MESSAGE ***
>
> {* Computer Forensic Investigators Digest Listserv
> *} {* Designed for discussions in the field of high technology
> crime *} {* investigations. To unsubscribe, send a message
> with UNSUBSCRIBE *} {* [email protected] in the body of the
> message to [email protected] *} {* For comments/subscription
> information, E-mail: [email protected] *} {*
> WWW: http://www.infobin.org/cfid *}
>
search: