Autopsy vs. FTK

[Greg Freemyer]

My company uses FTK as it's normal analysis tool, but we image in Linux.

One of the main reasons we use FTK is the indexed search capability,
but we all know FTK has had stability issues in the past.

I went to a SMART lecture Wed. and was told that SMART does not have
an indexed search capability, but I see that Autopsy does.

Is there a webpage that compares FTK and Autopsy. I'm very
comfortable in Linux, so the OS is not an issue in and of itself.

FYI: Yes I know Autopsy is just a GUI wrapper around Sluethkit and other tools.

Greg

[subscribe]

Post by Greg Freemyer
My company uses FTK as it's normal analysis tool, but we image in Linux.
One of the main reasons we use FTK is the indexed search capability,
but we all know FTK has had stability issues in the past.
I went to a SMART lecture Wed. and was told that SMART does not have
an indexed search capability, but I see that Autopsy does.

Correct. But 'glimpse' is available and hard to beat. I'm not sure ASR
Data wants to reinvent the wheel with respect to indexing.

Post by Greg Freemyer
Is there a webpage that compares FTK and Autopsy.

Probably....somewhere....GOOGLE... :)


(I haven't seen one, but I feel silly say 'Nope' - because someone,
somewhere, probably has a listing for just this very question!)


FTK and Autopsy are very different animals. Since you have FTK and you
are comfy within Linux it shouldn't be hard to grab The Sleuth Kit and
Autopsy and do a comparison for yourself. Areas I'm sure you'll find
'different' include;
- Registry viewing
- Ability to import image formats of different types
- E-mail parse
- Encryption ID
- etc.

Of course, most of those are in a Win32 environment. So target OS
analysis plays a key role in deciding which of these two programs to
use.


regards,

farmerdude

www.crazytrain.com




-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[Greg Freemyer]

Post by subscribe

Post by Greg Freemyer
My company uses FTK as it's normal analysis tool, but we image in Linux.
One of the main reasons we use FTK is the indexed search capability,
but we all know FTK has had stability issues in the past.
I went to a SMART lecture Wed. and was told that SMART does not have
an indexed search capability, but I see that Autopsy does.

Correct. But 'glimpse' is available and hard to beat. I'm not sure ASR
Data wants to reinvent the wheel with respect to indexing.

Post by Greg Freemyer
Is there a webpage that compares FTK and Autopsy.

Probably....somewhere....GOOGLE... :)
(I haven't seen one, but I feel silly say 'Nope' - because someone,
somewhere, probably has a listing for just this very question!)
FTK and Autopsy are very different animals. Since you have FTK and you
are comfy within Linux it shouldn't be hard to grab The Sleuth Kit and
Autopsy and do a comparison for yourself. Areas I'm sure you'll find
'different' include;
- Registry viewing
- Ability to import image formats of different types
- E-mail parse
- Encryption ID
- etc.
Of course, most of those are in a Win32 environment. So target OS
analysis plays a key role in deciding which of these two programs to
use.
regards,
farmerdude
www.crazytrain.com

Okay, assuming linux-based tools and ignoring imaging:

do you mind walking me thru what I hope is a simple scenario.

We have a 300GB disk basically full of docs, zip files, jar files,
etc. (no PSTs).

We need to produce all docs that have one of 20 search terms in them.
The search terms have simple boolean logic. (ie. word1 and not word2)

Using FTK, we would simply load the case with indexing set, perform
our searches, add the results to a bookmark, export the bookmark.

With Linux / Smart / Glimpse?

And with Linux / Autopsy / new indexing patch, what would be the process?

Thanks
Greg

[Brian Carrier]

Post by Greg Freemyer
do you mind walking me thru what I hope is a simple scenario.
We have a 300GB disk basically full of docs, zip files, jar files,
etc. (no PSTs).
We need to produce all docs that have one of 20 search terms in them.
The search terms have simple boolean logic. (ie. word1 and not word2)
Using FTK, we would simply load the case with indexing set, perform
our searches, add the results to a bookmark, export the bookmark.
With Linux / Smart / Glimpse?
And with Linux / Autopsy / new indexing patch, what would be the process?

The current version of indexing in the Autopsy / TSK patch does not
support regular expressions, so it will not help you. It will probably
be a feature at some point, but not yet.

brian


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[Jason Coombs]

If you aren't carving data out of unallocated clusters or file slack,
but are only interested in locating the search terms inside logical
files, then why do you need to use a special "forensic tool" at all?

Just search the files. Use Google Desktop Search or anything else for
that matter... Even Windows Explorer search will get you some results.

Assuming linux-based tools, use grep -R

You'll truly never know if you have found ALL of the results possible to
obtain from the drive, so if your question has you stumped to the point
that you can't make progress at all, rethink your basic premise. You're
not doing yourself or your client a good service by trying to force
something that is simple into the framework of a fancy "forensic
investigation" using "forensic tools" ...

All tools are "forensic" when they are used by a "forensic technician"
in conjunction with a "forensic investigation".

Don't get stuck on making your work appear to be "forensic" -- what you
should care about most, at all times, is making sure that your work is
competent and expert.

Regards,

Jason Coombs

Post by Brian Carrier

Post by Greg Freemyer
do you mind walking me thru what I hope is a simple scenario.
We have a 300GB disk basically full of docs, zip files, jar files,
etc. (no PSTs).
We need to produce all docs that have one of 20 search terms in them.
The search terms have simple boolean logic. (ie. word1 and not word2)
Using FTK, we would simply load the case with indexing set, perform
our searches, add the results to a bookmark, export the bookmark.
With Linux / Smart / Glimpse?
And with Linux / Autopsy / new indexing patch, what would be the process?

The current version of indexing in the Autopsy / TSK patch does not
support regular expressions, so it will not help you. It will probably
be a feature at some point, but not yet.
brian
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management and
tracking system please see: http://aris.securityfocus.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[Greg Freemyer]

Post by Jason Coombs
If you aren't carving data out of unallocated clusters or file slack,
but are only interested in locating the search terms inside logical
files, then why do you need to use a special "forensic tool" at all?
Just search the files. Use Google Desktop Search or anything else for
that matter... Even Windows Explorer search will get you some results.
Assuming linux-based tools, use grep -R
You'll truly never know if you have found ALL of the results possible to
obtain from the drive, so if your question has you stumped to the point
that you can't make progress at all, rethink your basic premise. You're
not doing yourself or your client a good service by trying to force
something that is simple into the framework of a fancy "forensic
investigation" using "forensic tools" ...
All tools are "forensic" when they are used by a "forensic technician"
in conjunction with a "forensic investigation".
Don't get stuck on making your work appear to be "forensic" -- what you
should care about most, at all times, is making sure that your work is
competent and expert.
Regards,
Jason Coombs

Jason,

I partially agree with your response, but it fails to address the
complexities of zip/compressed tar/jar files.

We ended up using dtSearch for Windows, but I must admit that I
expected there to be a Linux solution that could be competitive. I'm
a Linux bigot and would prefer to work in that environment.

Our Logic:

FTK can only handle 2,000,000 objects, and we hit that at the 50 GB
point because of zip, tar, and jar files. Just too many sub-objects.

We considered Encase, but we had thousands of the above collections
that needed to be searched. I think we could have written scripts to
handle them in an automated fashion, but Encase out of the box does
not automatically search compressed archives, so we moved on.

dtSearch is incorporated within FTK so we had confidence in the
product. And the standalone version does not have FTK's 2,000,000
object limit. Surprisingly, it seems to index slower than the FTK
version, but such is life. The good news is that it does expand zips
and search them. A pretty basic requirement for any "forensic"
analysis in my book.

Greg

[Michael Cohen]

Hi List,
If I may point people toward the PyFlag project (im a little
biased). Although the project is still in early stages, it is designed
to search recursively through zip files, pst files etc. Basically the
tool has a concept of a virtual filesystem (VFS). Scanners are run
over the files creating new VFS nodes, so if the scanner hits a zip
file it creates virtual files in the vfs for each file in the archive,
then these files are indexed etc...

The result is the ability to search through compressed files, pst
files and their attachments and any other virtual file
you would care to write a plugin for.

Im not sure about the current limits for sizes etc, but the tool uses
a mysql database to manage the data so theoretically there should be
no object limit.

http://pyflag.sourceforge.net/

Michael.

Post by Greg Freemyer

Post by Jason Coombs
If you aren't carving data out of unallocated clusters or file slack,
but are only interested in locating the search terms inside logical
files, then why do you need to use a special "forensic tool" at all?
Just search the files. Use Google Desktop Search or anything else for
that matter... Even Windows Explorer search will get you some results.
Assuming linux-based tools, use grep -R
You'll truly never know if you have found ALL of the results possible to
obtain from the drive, so if your question has you stumped to the point
that you can't make progress at all, rethink your basic premise. You're
not doing yourself or your client a good service by trying to force
something that is simple into the framework of a fancy "forensic
investigation" using "forensic tools" ...
All tools are "forensic" when they are used by a "forensic technician"
in conjunction with a "forensic investigation".
Don't get stuck on making your work appear to be "forensic" -- what you
should care about most, at all times, is making sure that your work is
competent and expert.
Regards,
Jason Coombs

Jason,
I partially agree with your response, but it fails to address the
complexities of zip/compressed tar/jar files.
We ended up using dtSearch for Windows, but I must admit that I
expected there to be a Linux solution that could be competitive. I'm
a Linux bigot and would prefer to work in that environment.
FTK can only handle 2,000,000 objects, and we hit that at the 50 GB
point because of zip, tar, and jar files. Just too many sub-objects.
We considered Encase, but we had thousands of the above collections
that needed to be searched. I think we could have written scripts to
handle them in an automated fashion, but Encase out of the box does
not automatically search compressed archives, so we moved on.
dtSearch is incorporated within FTK so we had confidence in the
product. And the standalone version does not have FTK's 2,000,000
object limit. Surprisingly, it seems to index slower than the FTK
version, but such is life. The good news is that it does expand zips
and search them. A pretty basic requirement for any "forensic"
analysis in my book.
Greg
--
Greg Freemyer
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[Greg Freemyer]

On Mon, 14 Mar 2005 11:25:28 -0600, Evidence Technology

Greg, I know you've already solved your original issue, but I'm almost
certain I saw something in the notes for the latest release of FTK about
getting rid of that 2,000,000-item search limit. I just skimmed the list of
new features, but you might want to check it when you have a minute.
Best,
Jerry Hatchett, CCE

We called and talked to their support. The limit will be eliminated
in the 2.0 version. It requires an upgrade of the database they are
using to hold objects, so I assume they are waiting for a major
release to make such a big internal change.

That will be nice because we are seeing more and more cases where
2,000,000 does not meet the need.

Greg

[Jack Seward]

Indeed, if your not interested in unallocated space, perhaps the best
forensic tools are those that provide data to the forensic technologist.
And if you use the forensic program Mount Image Pro or MIP you can mount the
drive image and use any windows programs.
Consider the best windows search tools by my standards are dtSearch or ISYS.
BTW the FTK search engine uses a version of dtSearch! Also a great
on-the-fly and budget minded windows search tool is Examine32. If you do
need unallocated space searched, and I can't remember them all, WinHex and
it's big forensic brother X-Ways Forensics right along with Parben's Text
Searcher do the job.

Regards,

Jack

Jack Seward
***@msn.com
New York City
917-450-9328
Fax: [phone]



----- Original Message -----
From: "Jason Coombs" <***@science.org>
To: "Brian Carrier" <***@sleuthkit.org>
Cc: "Greg Freemyer" <***@gmail.com>; "Forensics"
<***@securityfocus.com>
Sent: Sunday, March 13, 2005 5:05 PM
Subject: Re: Autopsy vs. FTK

Post by Jason Coombs
If you aren't carving data out of unallocated clusters or file slack,
but are only interested in locating the search terms inside logical
files, then why do you need to use a special "forensic tool" at all?
Just search the files. Use Google Desktop Search or anything else for
that matter... Even Windows Explorer search will get you some results.
Assuming linux-based tools, use grep -R
You'll truly never know if you have found ALL of the results possible to
obtain from the drive, so if your question has you stumped to the point
that you can't make progress at all, rethink your basic premise. You're
not doing yourself or your client a good service by trying to force
something that is simple into the framework of a fancy "forensic
investigation" using "forensic tools" ...
All tools are "forensic" when they are used by a "forensic technician"
in conjunction with a "forensic investigation".
Don't get stuck on making your work appear to be "forensic" -- what you
should care about most, at all times, is making sure that your work is
competent and expert.
Regards,
Jason Coombs

Post by Brian Carrier

Post by Greg Freemyer
do you mind walking me thru what I hope is a simple scenario.
We have a 300GB disk basically full of docs, zip files, jar files,
etc. (no PSTs).
We need to produce all docs that have one of 20 search terms in them.
The search terms have simple boolean logic. (ie. word1 and not word2)
Using FTK, we would simply load the case with indexing set, perform
our searches, add the results to a bookmark, export the bookmark.
With Linux / Smart / Glimpse?
And with Linux / Autopsy / new indexing patch, what would be the process?

The current version of indexing in the Autopsy / TSK patch does not
support regular expressions, so it will not help you. It will probably
be a feature at some point, but not yet.
brian
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management and
tracking system please see: http://aris.securityfocus.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[J***@ey.com]

Jason said:

<<
All tools are "forensic" when they are used by a "forensic technician"
in conjunction with a "forensic investigation".
Jason,

Perhaps you could elaborate on this definition of a "forensic" tool. Taken
at face value, I disagree with it.

In my mind, some tools have no "forensic" function whatsoever and should
never be called a "forensic" tool. As just one example, Windows Explorer
is not a "forensic" tool. If a "forensic technician", in conjunction with
a "forensic investigation", uses Windows Explorer to make copies of data
from an unprotected original hard drive, that is not forensically sound.
Putting the original hard drive on a hardware write blocker and then
copying the files from the drive using Windows Explorer may be a
"forensically sound process". But that process merely compensates for
forensically unsound Windows environment and Explorer. Explorer itself is
never a forensic tool.

That's how I look at it.

James

==============================================================
James O. Holley Cell: 914.320.4874
Ernst & Young Office: 212.773.2902
Investigative & Dispute Services Lab: 212.773.7784
5 Times Square Fax: [phone]
New York, New York 10036 Mobile Fax: [phone]
Pager: 888.620.5275
Pager Email: 6205275 at skytel dot com
==============================================================


________________________________________________________________________
The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer.

Notice required by law: This e-mail may constitute an advertisement or solicitation under U.S. law, if its primary purpose is to advertise or promote a commercial product or service. You may choose not to receive advertising and promotional messages from Ernst & Young LLP (except for Ernst & Young Online and the ey.com website, which track e-mail preferences through a separate process) at this e-mail address by forwarding this message to no-more-***@ey.com. If you do so, the sender of this message will be notified promptly. Our principal postal address is 5 Times Square, New York, NY 10036. Thank you. Ernst & Young LLP


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[Brian Carrier]

Post by Greg Freemyer
I went to a SMART lecture Wed. and was told that SMART does not have
an indexed search capability, but I see that Autopsy does.

It is actually not yet part of the main distribution. Paul Bakker has
developed it as a patch, and I am currently trying to work it into TSK
v2.

Post by Greg Freemyer
Is there a webpage that compares FTK and Autopsy. I'm very
comfortable in Linux, so the OS is not an issue in and of itself.

Are you referring to a comparison of general features or indexing in
particular? I actually don't know of any pages that compare any tools.
If you are looking for more information on indexing, Paul wrote an
article for The Sleuth Kit Informer on the basic design and
functionality.

http://www.sleuthkit.org/informer/sleuthkit-informer-16.html#search

As for general differences, farmerdude is correct that FTK has more
application-level and encryption features.

brian


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

[Cooper, Christopher]

Also take a look at: http://swish-e.org

Both Swish-e and Glimpse have great on-line documentation, which talks about the switches and plugins. It is as simple as changing a few files to customize your search.

-C...
-----Original Message-----
From: Greg Freemyer [mailto:***@gmail.com]
Sent: Tuesday, March 08, 2005 2:06 PM
To: ***@crazytrain.com
Cc: Forensics
Subject: Re: Autopsy vs. FTK

Post by subscribe

Post by Greg Freemyer
My company uses FTK as it's normal analysis tool, but we image in Linux.
One of the main reasons we use FTK is the indexed search capability,
but we all know FTK has had stability issues in the past.
I went to a SMART lecture Wed. and was told that SMART does not have
an indexed search capability, but I see that Autopsy does.

Correct. But 'glimpse' is available and hard to beat. I'm not sure ASR
Data wants to reinvent the wheel with respect to indexing.

Post by Greg Freemyer
Is there a webpage that compares FTK and Autopsy.

Probably....somewhere....GOOGLE... :)
(I haven't seen one, but I feel silly say 'Nope' - because someone,
somewhere, probably has a listing for just this very question!)
FTK and Autopsy are very different animals. Since you have FTK and you
are comfy within Linux it shouldn't be hard to grab The Sleuth Kit and
Autopsy and do a comparison for yourself. Areas I'm sure you'll find
'different' include;
- Registry viewing
- Ability to import image formats of different types
- E-mail parse
- Encryption ID
- etc.
Of course, most of those are in a Win32 environment. So target OS
analysis plays a key role in deciding which of these two programs to
use.
regards,
farmerdude
www.crazytrain.com

Okay, assuming linux-based tools and ignoring imaging:

do you mind walking me thru what I hope is a simple scenario.

We have a 300GB disk basically full of docs, zip files, jar files,
etc. (no PSTs).

We need to produce all docs that have one of 20 search terms in them.
The search terms have simple boolean logic. (ie. word1 and not word2)

Using FTK, we would simply load the case with indexing set, perform
our searches, add the results to a bookmark, export the bookmark.

With Linux / Smart / Glimpse?

And with Linux / Autopsy / new indexing patch, what would be the process?

Thanks
Greg
--
Greg Freemyer

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com