Difference between ftk and prodiscover basic cissp

#Difference between ftk and prodiscover basic cissp code#
#Difference between ftk and prodiscover basic cissp windows#

In order to find the malicious code capabilities and its aim, we have to do the malware executable analysis. According to this case study, there are malicious activities present in their network system and it is also been confirmed by our initial analysis. Then we will develop a further strategy for the forensic investigation, such as complete analysis of memory, complete analysis of file systems, event correlation, and timeline analysis (Nelson, B., et. By the outcome of those analyses, we will come to know whether any malicious activities are presented or not. We will also find the patching level system, whether it is been updated or not. Then we will check the account, whether any unusual account is presented or not. We will also look if any application requests occurred unusually. Then if there is any unusual process running and if there are any sockets opened unusually.

We will look into the data to see whether any hidden files or unusual files are presented or not. Initially we need to analyze the evidences which we gathered and examined. A data stream file can be stored as follows: NTFS disks are a data stream, which means they can be appended into another existing file. NTFS is more efficient than FAT, as it is faster in reclaiming its deleted space. But if a file is deleted from the Recycle bin, then associated clusters are marked as available for new data. OS stores information about the original path and original file name in info2 file.

#Difference between ftk and prodiscover basic cissp windows#

When a file is deleted in Windows NT, the file will be renamed by OS and moved it to Recycle bin with a unique identity. A file which is less than 512 bytes can be accommodated in MFT as resident files and a file which is more than 512 bytes can be stored outside the MFT as non-resident files. Files can be stored in MFT in two ways: resident and non-resident. Metadata is data about data (Nelson, B., et. The records in the MFT are also called metadata. MFT is the Master File Table which contains information about all files and disks, and it is also the first file in NTFS. NTFS is the New Technology File System and NTFS Disk is a file. Forensic imaging will hash with MD5 or SHA-2 to ensure the integrity of digital evidence (Nelson, B., et al., 2008). Forensic imaging contains metadata ie., hashes and timestamps and it compresses all the empty blocks. Hard drive cloning contains only a raw image, and every bit will be copied, and no other extra content will be added. The difference between forensic imaging and hard drive cloning is that forensic imaging canвЂ™t be accessed without forensic tools, but hard drive cloning can easily be accessed with a mount drive. Hard drive cloning is nothing but to make a duplicate of the entire system. A forensic investigator uses a write blocker to connect to the target system and copy the entire contents of the target drive to another storage device by using any of those forensic tools. Forensic imaging will be created by forensic tools such as EnCase, ProDiscover and FTK. Imaging helps to preserve the original data as evidence without any malfunction or changes in data which occurs during the forensic investigation. The first step in non-volatile data collection is to copy the content of entire target system. Once the volatile data have been captured, then we will look into the non-volatile data. This report will be focused on private investigations, since an incident occurred at a new start-up SME based in Luton. Public investigations will be conducted by government agencies, and private investigations will be conducted by private computer forensic team. According to Nelson, B., et al., (2008), Public Investigations and Private or Corporate Investigations are the two distinctive categories that fall under Computer Forensics Investigations. Windows, Linux) and network operating systems (e.g.

Computer Misuse Act 1990, the UK) and various computer operating systems (e.g. A successful Computer Forensic Investigator must be familiar with various laws and regulations related to computer crimes in their country (e.g. ProDiscover or Encase) to ensure the computer network system is secure in an organization. Computer Forensics Investigators work as a team to investigate the incident and conduct the forensic analysis by using various methodologies (e.g. A Computer Forensic Investigation generally investigates the data which could be taken from computer hard disks or any other storage devices with adherence to standard policies and procedures to determine if those devices have been compromised by unauthorised access or not.