Re: Best Forensic Tools?

["O'Callaghan, Daniel" <Daniel.OCallaghan () SINCLAIR EDU>]

> It would be good to have a tool box of good tools to do at least the
first phases of evidence gathering and preservation for the experts.<

I use Helix Pro for basic acquisition and imaging. For the price (about
$240), it is fairly robust and intuitive, particularly for acquisition.
The latest version also has tools for volatile data acquisition.

As stated previously, as long as the individual performing the
acquisition does so properly and understands, documents, and can explain
the who, what, why, and how, an image obtained (and hash verified) using
the Helix tools is acceptable as evidence and will likely stand up in
court. 

I also recommend the SANS forensics courses 408 & 508 for training. They
emphasize using low-cost and/or open source tools for acquisition and
analysis.  You can sometimes find some outstanding deals via their .edu
partnerships.  

___________________________________
Daniel V. O'Callaghan, Jr., MBA, CISSP, GCFA
Chief Information Security Officer
Sinclair Community College
444 W Third St, 13-000F
Dayton, OH 45402
937-372-3005