±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36583
New Yesterday: 6 Visitors: 220

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Recommended forensic hardware

Discussion of forensic workstations, write blockers, bridges, adapters, disk duplicators, storage etc. Strictly no advertising of commercial products, please.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3 ... , 10, 11, 12  Next 
  

Jonathan
Senior Member
 

Re: Forensic Laptop for < $2000

Post Posted: Mar 21, 11 12:25

- inspectaneck
So, my last "mobile" build was a Shuttle system (posted earlier in this thread). I lug it around as need with a 20" LCD and battery backup. It actually works pretty well for anywhere I can drive to. I built it to recommended specs for FTK3, including separate SSD drive for Oracle.

Now it's time to replace my older laptop and get a new laptop...


The Mac Book Pro will be my next laptop. The Thunderbolt port is twice as fast as USB 3.0, is dual channel so can send and receive data at the same time which looks ideal for imaging from one external drive to another - or using one external SSD drive as an FTK db and another for image files.

Just waiting for Thunderbolt peripherals to to be released! Wink
_________________
Forensic Control
twitter.com/ForensicControl
St Bride Foundation, 14 Bride Lane, London, EC4Y 8EQ 
 
  

kovar
Senior Member
 

Re: Recommended forensic hardware

Post Posted: Mar 21, 11 17:17

And support for Thunderbolt to appear in Windows, Bootcamp, Fusion, and Parallels.....

-David
_________________
CISSP, CCE, EnCE, Licensed Private Investigator (CA) 
 
  

Jonathan
Senior Member
 

Re: Recommended forensic hardware

Post Posted: Mar 21, 11 18:00

- kovar
And support for Thunderbolt to appear in Windows, Bootcamp, Fusion, and Parallels.....

-David


Yep, will happen the around the same time as the peripherals become available. Luckily, I'm in no rush. Laughing
_________________
Forensic Control
twitter.com/ForensicControl
St Bride Foundation, 14 Bride Lane, London, EC4Y 8EQ 
 
  

inspectaneck
Senior Member
 

Re: Recommended forensic hardware

Post Posted: Mar 30, 11 17:06

Regarding my previous post, I ended up ordering a few days later when the Streak Deal had expired. The same laptop cost about $1300. We ended up ordering two for a total of $3000, including shipping and tax.  
 
  

jaclaz
Senior Member
 

Re: IX IMAGER

Post Posted: Oct 01, 12 16:53

- cressida

There is a software solution called IX Imager, it is created within a licenced users copy of ILookIX from Perlustro.

Since you seem in contact with the good guys at Perlustro:
www.forensicfocus.com/...ic/t=9743/

Could you ask some clarification on these (copied verbatim from the site, points numbered for clarity)
www.perlustro.com/solu...s/iximager
Certified by NIST as THE STANDARD among all other tools
  1. Only forensic imaging tool in existence that exceeds NIST Test Criteria
  2. Only forensic imaging tool in existence that made 100% on the NIST CFTT Certification Tests, the most stringent test existing at any Federal Level
  3. Only forensic imaging tool used by NIST to test over 20 (all to date) write block devices, establishing itself as the NIST standard.
  4. Only forensic tool in existence that does NOT require a physical writeblock device for forensics imaging


I know that I am picky, but I have to understand:

#1 would IMHO need a list of the NIST criteria and how/where the tool "exceeds it" (I mean if the idea is that NO data is written you cannot exceed this requirement by writing less than NO data)
#2 would as well need some document about the CFTT certification test
but they all in all are OK, the other two are more unclear:
#3 to me the fact that the tool is used by NIST to test hardware blockers, means that it is used by NIST to test hardware bolockers, and does not establish anything
#4 good, but this also does not completely explain the title, if the nice thingy is certified as Standard, I would have expected a piece of paper titled "Certificate" signed by Mr. NIST. Wink

I have no doubt about the thingy being a good tool, but maybe some advertising hype made it's way into the cited text?

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

jaclaz
Senior Member
 

Re: IX IMAGER

Post Posted: Oct 01, 12 19:27

- cressida

ASK AND YOU SHALL RECIEVE

Sure.
I see nothing where the tool exceeds anything, and not any mention of it being a certified "standard" by NIST.

BTW the test was made in 2007 and was performed on version 2.0, whilst currently it seems like being version 3.0 and for all it matters, any kind of regression bugs could have been introduced.

But, given the quickness with which you replied (partially and to the least signifcant parts of my doubts) I am now more convinced than before (and possibly very wrongly) that you are not - as you seemed originally - a "casual" user of the thingy, but you are somehow connected with the software house producing this tool.

As said, I personally have no doubts about the tool being actually a good one, but there are few things that I hate more than "fake reviews" and/or "masked advertising" Mad , let alone "vague" statements about tests and certification of "standard".

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

jaclaz
Senior Member
 

Re: Recommended forensic hardware

Post Posted: Oct 01, 12 22:03

- cressida
Jaclaz,
.....
3. I have used other forensic tools since early 2000, I was looking for a cheaper option LEO for forensic unit and found Ilook, later called Ilookpi,....


Good, and I am very happy that you found such a nice tool, what - no offence intended - was and still is perplexing (in my perverted mind) is how come that one day after at least 12 years of profession as forensic professional (LE or not) you decided to join Forensic Focus and post the same day three times within less than half an hour:
www.forensicfocus.com/...ic/t=9742/
www.forensicfocus.com/...4/#6562154
www.forensicfocus.com/...5/#6562155
about this wonderful tool.

I understand how good it is, but why did you feel this need/urge to spread the news (which are not news if not - maybe - in the part that is now not anymore LE Only)?
This was the doubt I had.

- cressida

with XFR—Xtreme file recovery I can see files that no other software can, and thats without using VSC—Volume shadow copy.

That could be a nice one here:
www.forensicfocus.com/...c/start=0/
but maybe a bit too similar to the one I proposed at the time:
www.forensicfocus.com/...8/#6519578


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 11 of 12
Page Previous  1, 2, 3 ... , 10, 11, 12  Next