As a digital forensic investigator, you almost always have a variety of tools at your disposable. The trick becomes knowing which tool is best for the job. Let’s say you walk into the office on Monday morning and find an email from your supervisor, a case just came in and the client wants a detailed forensic examination in just a couple days. As usual, the first step is to decide which examination tool is the best option. In this case we need one that will help us meet the very tight deadline while not sacrificing on the quality of the examination.
This decision is never an easy one for a digital investigator to make so I decided to help make it a little easier by evaluating some of the most common digital forensics tools available and give a high level overview of how each one performed in this particular instance.
For this case I examined EnCase 6.18, EnCase 7.10, FTK 5.6 and X-Ways 18.0. Each of these tools was used to verify the integrity of a forensic image, conduct file signature analysis, conduct file hash analysis and lastly run a keyword search. All common digital forensics processes. I recognize there are different types of keyword searching (index and raw searching). In this evaluation I used a raw, non-indexed keyword search with uniform search settings across the tools.