The end of 2013

At the end of 2013 I can't say I'm Ok how 2013 was. To many unfinished things left open.

When I do some analyses basically I've spent 50% of all my working time on EnCase, actually preparing and testing class setups and materials. This is the trend which goes with EnCase v7 since it first day, it simply shows development cycle is yet not finished, there are rumors about v8 coming soon in 2014.
Rest of my time is spread over other preparations, other tools and training itself.  

What is missing from 2013 is enterprise level forensics for me. Since EnCase v7 done some drastic changes in user interface and functionality enterprise version went into stall in our patch of EMEA.  Hopefully there will be revival especially since with v7.05 and v7.08 some important improvements were introduced.

My favorite tool in 2013 was Silent Runner from Acess Data which was prepared and delivered during last quarter of 2013. It was a story for itself, when I think twice very typical for environment, country and whole digital forensic/security business.

Plenty of things can be said about digital forensics and security definitely there is a lot to be done. Tools, practice, industry, lack of standardization,  ideas .. to much resembles on networking ideas in pre-tcpip days
also there is a clash among forensic part and digital / computer part in digital forensic. I assume one key missing point in digital forensic is a digital forensic language (programming language) designed to describe digital forensic tasks and procedures, but this is issue for more elaborate discussion.



 

EnCase Macintosh-Linux Examinations - Guidance Software training

Recently I was in Slough on this training, it is very comprehensive one, where actual matter is always in front of printed materials .. 

Maybe a good idea is to do a two or even three separate training each dealing with closer to subject, like Mac only, Linux only and UNIX server systems. It is same core idea but approach, requirements are different so it needs different tools and approach.  

Olaf training

I'm doing training for OLAF program in Opatija, currently my courses are EnCase Forensic II and
EnCase Mac and Linux Forensics.  Preparations for this event was my occupation for last few weeks.

There are some very interesting experiences related to machines tools used. It is about 200 PC machines with same HW and SW configuration (there are difference in number of disks since EnCase v7 requires 3 disks to work efficiently). It a good statistical test sample actually. What is interesting is variations in the behavior of the forensic tools. HW is practically from same batch of serial numbers and SW is cloned installation  it is interesting to see how tools are acting, especially how reported errors are influencing outcomes of forensics tasks.  Up to this  moment we have only two such situations first when partition finder script failed and when evidence processor module reported error and were unable to finish processing and create required records folders. It was about 25% percent machines which had impact on correctness of the results.