Investigative Areas
In a biased opinion on my side, OSForensic tool serves best compared to other tools provided here for the following reasons which are not found in the later tools.
OSForensic lets one find files very fast by use of search algorithms by size, by name, content and even time it was modified.
Identifying suspicious activity in this tool is made easier and efficient especially by the use of MD5, SHA-1 and SHA-256 hashes as we all know hashing is a quick and efficient process also providing an added security feature since hash cannot be easily decoded.
OSForensic has the capability of capturing online content for offline use.
Easy and professional management of one’s investigations by use features like Rebuild RAID arrays.
CONS:
Whereas other forensic tools can be installed and executed from the USB drive, OSForensic tool cannot be installed in this manner thus strictly requires a legitimate operating system.
OSForenscic is limited to three cases at a time and a maximum of ten items per case unlike the ProDiscover tool.
OSForensic tool cannot view NTFS $130 directory entris.
Does not sort files by color as it is with the ProDiscover.
Having been given two computer hard drives claimed to be of the same computer there is no express conclusion that they belong to the same computer whatsoever. The drives are seemingly alike in almost every aspect however they are not the same but the fact is they belong to the same computers. The images on drive are convincingly the original files found on the computer of the suspect who is m57 employee Jo. Naturally anyone would try to cover his or her traces especially if whatever the person did is a crime, mr Jo could have in one way or the other erased the traces of the evidence related to the drug from the drive to try hide his actions, however very unfortunate for him information deleted from a computer does not entirely disappear as we think, it instead taken to the disk’s slack space and can be retrieved by forensic tools incase needed like it is in this case.
Drive images could be cloned very easily by freely available programs, programs primarily made for back up purposes could serve a great role in doing this, for instance they could use the DriveImage XML which is used to create images of logical drives. DriveImage XML uses Microsoft’s Volume Shadow Service (VSS)
Features of OSForensic
As it is with humans, we do things either voluntarily or involuntarily but either way the thing is that everything we do has consequences regardless of whether it is intentional or not. For a case of crime it is natural that one can claim the offence was committed unwanted thus involuntary hence draws some little bit of mercy from the law enforcing team. It is aggregable that unintended crime cannot be committed repeatedly from a person of sound mind. Unless the perpetrator is not of sound mind the deed remains to be intentional and a crime too. To ascertain this it is important to get a report from the psychiatrist on mind-check of the perpetrator. From a humane point of view there are things which are convincing inwardly that this is right or otherwise for a sane person thus if the person is sane we need to consider if he or she is acquitted well with the laws regarding drug which seems to be in the public knowledge anyway hence we conclude that the crime was committed intentionally and with a person of sound mind of sound decision thus can be dealt with according to the laws of the land.
Luttgens,Pepe and Mandia.(2014) documents that the use of digital photography has amplified over the past few years, a tendency which opens the chances for new and innovative ways to hearth images. The management of images through forgery influences the insight an observer has of the depicted scene, possibly resulting into ill concerns if created with malevolent purposes. Schneier, & Kelsey,. (1999). Writes that it calls for a need to prove the genuineness of images patenting from unknown sources in absence of any prior digital watermarking or verification technique. Vacca(2005) found out that this research sightsees the ability to alter the original digital image. The common technique is by the use of software ranging from professional to basic software for casual users. For example by the use of Microsoft paint for windows we can edit an image as follows;
Open Microsoft Paint by clicking on the Windows “Start” menu, pointing to “All Programs, choosing “Accessories” and click on “Paint.”
select the “File” menu and click “Open” to open a digital image you had previously saved.
Use the “Look In” menu in the “Open” dialog box to browse to where you have saved the digital files Click on the file to select it and click the “Open” button to open the selected file.
Limitations of OSForensic
Use the “Free-form Select” or “Select” tools to select the part of the digital photo you want to remove. Use the “Delete” key on the PC’s keyboard to erase these selections or mouse to move the selections to a different portion of the photo.
Add or enhance the colors of the digital photo by use of the “Pencil,” “Brush” or “Airbrush” tools from the Microsoft Paint toolbox. You can select the colors you wish to use at the bottom of the Paint application.
References.
Luttgens, J. T., Pepe, M., & Mandia, K. (2014). Incident response & computer forensics. McGraw-Hill Education Group.
Vacca, J. R. (2005). Computer Forensics: Computer Crime Scene Investigation (Networking Series)(Networking Series). Charles River Media, Inc..
Schneier, B., & Kelsey, J. (1999). Secure audit logs to support computer forensics. ACM Transactions on Information and System Security (TISSEC), 2(2), 159-176.
Kruse II, W. G., & Heiser, J. G. (2001). Computer forensics: incident response essentials. Pearson Education.
Nelson, B., Phillips, A., & Steuart, C. (2014). Guide to computer forensics and investigations. Cengage Learning.
Walden, I. (2007). Computer crimes and digital investigations(p. 01). Oxford: Oxford University Press.
Reith, M., Carr, C., & Gunsch, G. (2002). An examination of digital forensic models. International Journal of Digital Evidence, 1(3), 1-12.
Giova, G. (2011). Improving chain of custody in forensic investigation of electronic digital systems. International Journal of Computer Science and Network Security, 11(1), 1-9.
Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response. NIST Special Publication, 10, 800-86.
Sencar, H. T., & Memon, N. (2013). Digital image forensics. Counter-Forensics: Attacking Image Forensics, 327-366.
Dykstra, J., & Sherman, A. T. (2012). Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques. Digital Investigation, 9, S90-S98.
Rafique, M., & Khan, M. N. A. (2013). Exploring static and live digital forensics: Methods, practices and tools. International Journal of Scientific & Engineering Research, 4(10), 1048-1056.
Sadiq, M., Iqbal, M. S., Sajad, M., Naveed, K., & Malip, A. (2016). Mobile devices forensics investigation: process models and comparison. Theoretical & Applied Science, (1), 164-168.
Ware, S. (2012). Hfs Plus File System Exposition And Forensics.
Couldry, N. (2012). Media, society, world: Social theory and digital media practice. Polity.
Fenton, N., & Neil, M. (2012). On limiting the use of Bayes in presenting forensic evidence.
Carvajal, L., Varol, C., & Chen, L. (2013, May). Tools for collecting volatile data: A survey study. In Technological Advances in Electrical, Electronics and Computer Engineering (TAEECE), 2013 International Conference on (pp. 318-322). IEEE.
Börner, K. (2010). Atlas of science (Vol. 2). Cambridge, MA: Mit Press.
Schrenk, G., & Poisel, R. (2011, August). A discussion of visualization techniques for the analysis of digital evidence. In Availability, Reliability and Security (ARES), 2011 Sixth International Conference on (pp. 758-763). IEEE.
Zhang, D. D. (Ed.). (2012). Biometric solutions: For authentication in an e-world (Vol. 697). Springer Science & Business Media.