ISSC_621 WK 3 Forum Word 400

Topic:
                   Computer Electronics & Investigation Tools

 
Question:
Create an investigative toolkit.  What tools would you have in your toolkit?  Document the following:
*  the features of each tool
*  how much does each tool cost (if applicable)
*  advantages/disadvantages

Feel free to ask me if you need help
Example of someone  if you need

1 example
 
The investigative toolkits that I am currently planning to acquire is an advanced mobile forensic toolkits. The kit is a laptop with various hardware and software needed for various forms of examinations. The kit will cost, aproximately,  $18,500.00-with first year SMS for each paid software.
The softwares I chose (to post on the forum) are EnCase and Forensic Toolkit (FTK). This post covers the pros, cons and cost of each software. 
EnCase is a product which has been designed for forensics, digital security, security investigation, and e-discovery use. It is customarily utilized to recoup proof from seized hard drives. It enables the examiner to direct a top to bottom investigation of client records to gather digital evidence can be used in a court of law. The benefits of using EnCase as opposed to other tools are that: It is a very user-friendly tool with user-friendly interface. Its’ paid version supports all utilities; it has a free version, which can be used for evidence acquisition-very easy to use. The tool has good reporting functionalities built into it. Encase has built in support for almost all types of encryption. It has a good keyword searching capabilities and scripting features are available. Most users have expressed the following concerns about Encase: This is a very expensive tool. Price range from $3, 500 to $4,000 excluding annual subscription fee. EnCase processing can take a lot of time in case of very large compound files and mailboxes. Some examiners have reported that the latest versions of Encase sometimes are not compatible with other forensic based tools.
The Forensic Toolkit (FTK) examines a hard drive by searching for different information. It can find deleted emails and can scan the disk for content strings-used as a secret key word reference to break any encryption. It incorporates an independent disk-imaging program called the FTK Imager. It saves an image of a hard disk in one document or in different segments, which can then be recreated later. It computes MD5 hash values and affirms the integrity of the information before closing of the documents. The outcome is an image file(s) that can be saved in a several formats. FTK’s main advantages had been: simple user interface and advanced searching capabilities, supports of EFS decryption, production of case log file, and bookmarking and salient reporting features. Some of the disadvantages of using FTK include: high cost ($3900.00), not having multi-tasking capabilities, no progress bar to estimate the time remaining, and no  timeline view.
Source:
Infosec Institute: Retrieved from https://resources.infosecinstitute.com/category/computerforensics/introduction/commercial-computer-forensics-tools/tool-comparison/#gref

Second Example  

 
Hello Professor and Class,
The business objective for having a forensics’ toolkit is to remotely, simply, and without disrupting business operations, conduct the following in response to potential incidents and/or litigation.  The aim is to provide remote forensics and incident response capabilities to support HR or Legal requests for discovery of electronic data  (Belton, 2018).

Forensic examination
Incident response triage and threat assessment
Proactive cyber threat hunting
Litigation hold; collection and preservation of evidence

I was able to interview an IT Security Forensic Engineer.  His experience (likes/dislikes/pricing) with the EnCase suite of digital investigations products by Guidance Software is captured here.
EnCase Endpoint Security                  $128,245

Likes

The ability to quickly collect volatile data from multiple endpoints at once

Active network connections
Running processes
Open DLLs
RAM

Ability to collect files for further analysis from multiple endpoints at once
Ability to perform threat hunting across the enterprise network (or subsets of the network)
Ability to integrate threat intelligence to score indicators of compromise, giving the ability to prioritize analysis
Ability to schedule

Dislikes

The software installs several processes as services.  Several of the services stop running arbitrarily

EnCase eDiscovery

Likes

Ability to collect files and documents from multiple platforms, such as email servers, SharePoint, and cloud-based repositories

Dislikes

Interface is not very user friendly

EnCase Endpoint Investigator                        $35,145

EnCase Endpoint Investigator

Likes

Ability to perform sweeps across the network for endpoint volatile data
Ability to forensically acquire physical hard drives, logical files, and volatile data remotely.
Ability to preview the file system of remote workstations before acquisition

Dislikes

Unable to manage the remote agent from a centralized platform

Place your order
(550 words)

Approximate price: $22

Calculate the price of your order

550 words
We'll send you the first draft for approval by September 11, 2018 at 10:52 AM
Total price:
$26
The price is based on these factors:
Academic level
Number of pages
Urgency
Basic features
  • Free title page and bibliography
  • Unlimited revisions
  • Plagiarism-free guarantee
  • Money-back guarantee
  • 24/7 support
On-demand options
  • Writer’s samples
  • Part-by-part delivery
  • Overnight delivery
  • Copies of used sources
  • Expert Proofreading
Paper format
  • 275 words per page
  • 12 pt Arial/Times New Roman
  • Double line spacing
  • Any citation style (APA, MLA, Chicago/Turabian, Harvard)

Our guarantees

Delivering a high-quality product at a reasonable price is not enough anymore.
That’s why we have developed 5 beneficial guarantees that will make your experience with our service enjoyable, easy, and safe.

Money-back guarantee

You have to be 100% sure of the quality of your product to give a money-back guarantee. This describes us perfectly. Make sure that this guarantee is totally transparent.

Read more

Zero-plagiarism guarantee

Each paper is composed from scratch, according to your instructions. It is then checked by our plagiarism-detection software. There is no gap where plagiarism could squeeze in.

Read more

Free-revision policy

Thanks to our free revisions, there is no way for you to be unsatisfied. We will work on your paper until you are completely happy with the result.

Read more

Privacy policy

Your email is safe, as we store it according to international data protection rules. Your bank details are secure, as we use only reliable payment systems.

Read more

Fair-cooperation guarantee

By sending us your money, you buy the service we provide. Check out our terms and conditions if you prefer business talks to be laid out in official language.

Read more
Use the discount code "30OFFNOW" today and get a 30% offOrder Now