Fill and Sign the Cameroon Gce Board Syllabus PDF Form

Forensic Toolkit Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR What is AccessData’s Forensic Toolkit®? Also known as FTK®, this application enables you to perform complete and thorough computer forensic examinations. FTK features powerful filtering and search functionality, and is recognized by law enforcement and corporate security professionals as the leading forensic tool for e-mail analysis. We’ll Help Your Investigation AccessData’s Forensic Toolkit advances your investigation by giving you more time, power, and insight to each case. FTK provides you the following advantages: • Simple Users’ Interface • Fast Searching • EFS Decryption • Bookmarking • Reporting • Password Dictionary Creation Uncomplicated Users’ Interface FTK makes evidence and easy to analyze. Our database architecture sorts and categorizes all graphics, e-mails, bad extensions, and encrypted files more quickly and simply. A click of the mouse on the Graphics category, for example, allows you to see a list of every graphic found on the hard drive. E-mail Display Most forensic software requires yet another utility to allow the investigator to view emails in readable HTML format. FTK allows you to view e-mail in a user-friendly HTML. You can view native formats such as AOL IP addresses, POP3 servers, and view attachments. You can also document them in HTML reports. © AccessData Corp. Page 2 FTK can print or export e-mail messages and all associated attachments. It recognizes the source of the e-mail messages based on e-mail archives and special headers. FTK supports these e-mail applications: • • • • • AOL* Earthlink Eudora Hotmail MSN E-mail • • • • Netscape Outlook Outlook Express Yahoo FTK can recover encrypted instant messaging chat logs and additional information such as buddy lists. FTK supports these instant messaging applications: • AOL Instant Messenger • Yahoo MessengerReporting Fast Searching Full-text indexing makes searching for keywords instantaneous. The index file is a * FTK includes extended support for AOL, including buddy lists, global settings, user history, URL history, thumbnail extraction, and address book extraction. © AccessData Corp. Page 3 the case evidence. The indexed search uses the index file to find the search term. Evidence items may be indexed when they are first added to the case, or later on. Full-text indexing makes searching much more efficient. All keyboard-related characters in the case evidence are indexed, allowing you to data carve and search by Internet keywords. KFF Database The Known File Filter (KFF) is an FTK utility that compares file hashes of your evidence against a database of hashes from files known to be irrelevant (such as known system and program files). It also checks for duplicate files. • You can expand the power of your KFF by importing hashes from other databases, or updating the KFF database. • A KFF Alert Editor allows you to edit the Alert/Ignore status of every hash set contained within the KFF library. • KFF includes the NDIC/NIST database, which is updated periodically and is available for download on the FTK update page (http://www.accessdata.com/downloads.htm). EFS Decryption The Encrypting File System, or EFS is part of the Microsoft NTFS file system. EFS is a transparent public key encryption technology that works in conjunction with the user’s logon process to grant and deny users access to files and folders in Windows NT (excluding NT4), 2000, XP (excluding XP Home Edition) and Vista operating systems. © AccessData Corp. Page 4 Important: FTK requires the PRTK license to decrypt EFS files. EFS uses a public key and a private key for encryption. If the user does not have a key pair, the EFS generates one automatically. Files can be encrypted individually, or a folder can be designated as encrypted so that any file written to that folder is automatically encrypted. Because EFS’s encryption technology integrates into the file system, once initiated it is transparent to the user as it is based on the logon authentication. These EFS encrypted files or folders can be viewed only by the user who encrypted them, or by the user who is the authorized Recovery Agent. When the user logs in, encrypted files and folders are seamlessly decrypted and the files are automatically displayed. Forensic Toolkit (FTK) can break the file encryption so that additional evidence can be uncovered. When evidence is added to a case and Decrypt EFS Files is selected in the New Case Wizard, FTK launches PRTK and decrypts EFS files. Windows 2000 and XP Systems Prior to SP1 FTK automatically decrypts EFS files on Windows 2000 systems and Windows XP systems prior to Service Pack 1. Select the Decrypt EFS Files option when adding evidence to a case and FTK will launch PRTK and decrypt the EFS files. Windows XP SP1 or Later For Windows XP systems with Service Pack 1 or later, FTK needs the user’s or Recovery Agent’s password before it can decrypt EFS files. The decrypted information is displayed in the Explore window. The decrypted file is displayed as a sub-item to the encrypted file. The metadata and full path name is also displayed, including a note that shows that the file is decrypted For example, if you have a decrypted file named “Jupiter Statistics.xls,” then the decrypted version would be “Jupiter Statistics[decrypted].xls” is listed as a child of “Jupiter Statistics.xls” in the File List. Bookmarking The end result of a successful investigation is a list of bookmarked data to be used as evidence. A bookmark contains a group of files that you want to reference in your case. Bookmarks help organize the case evidence by grouping related or similar files. For example, you can create a bookmark of graphics that contain similar images. © AccessData Corp. Page 5 You can add checked files, highlighted files, and currently listed files simply by right-clicking and selecting “add to bookmark,” FTK will show you a list of current bookmarks to select from. Reporting After you complete the case investigation, you can create a report that summarizes the relevant evidence of the case. FTK provides a thorough report wizard that allows customization of reports, including the placement of one’s own logo on the title page. The final report is in HTML format and is viewable in a standard Web browser. © AccessData Corp. • You can create a section in the report that lists the bookmarks that were created during the case investigation. You can also choose to not create a bookmark section. • You can create a section in the report that displays thumbnail images of the case graphics. • You can create a section in the report that lists the file paths of files in selected categories. The List by File Path section simply displays the files and their file paths; it does not contain any additional information. However, you can export and link to the files in the File Path list by checking the Export to the Report box. • You can create a section in the report that lists file properties for different file types in selected categories. Page 6 • You can add files such as supplementary reports, search warrant information, and photos of the crime scene to the report. You can also add the case log to the report. The case log documents activities and events that occur in the case during investigation and analysis. Included files only require that the applications to view them must be installed on the computer the report is being viewed . Password Dictionary Creation FTK uses the full-text index for instantaneous keyword results. It can also be exported for use as a dictionary for password recovery processes in the Password Recovery Toolkit (PRTK). With Full Text Index, you create a dictionary of every alpha numeric string located on the hard drive. This dictionary that you create in FTK becomes pivotal in cracking passwords. Every alpha numeric string ever recorded onto the hard drive is placed into a database for PRTK to search through and decrypt passwords from. You can export the index by selecting Tools, and then Export Word List. © AccessData Corp. Page 7 Conclusion FTK Applies a database methodology to digital analysis. With its built in viewers, filters, and other utilities, FTK is very fast and very efficient at case analysis. Contact Us: Sales AccessData 384 South 400 West Suite 200 Lindon, UT 84042 USA sales@accessdata.com 800.574.5199 © AccessData Corp. Page 8