forensic analysis android windows os x 2017

Forensic Analysis Android Windows Os X 2017 License Key Upon Initial

Yet, here I am. While Ive heard positive feedback from people in the information security community regarding BlackBags forensic software products, I have not had the opportunity to use one of their products on my own.

Thus, I was thrilled to review BlackBags BlackLight product.

In addition to analysis, it can logically acquire Android and iPhoneiPad devices.

The main reason I chose Mac was that most of the analysis that I have performed thus far has been with the traditional Windows Forensic Recovery of Evidence Device (FRED) and I figured this would be a great opportunity to try something different.

Forensic Analysis Android Windows Os X 2017 License Key Upon Initial

I simply downloaded the installation file from BlackBags website and entered the license key upon initial file execution.

The single installation file took care of all of the dependencies needed for the software, which I was glad to see.

Without any real experience with BlackLight, I focused on usability and intuitiveness.

I processed this image through BlackLight with all of the ingestion options available in the software and to my surprise, it took under 10 minutes to complete.

In fact, as the image was being processed in the background, I continued to perform normal operations such as browsing the web and using Open Office software with no problem.

The most useable applications are portable applications, but copying not-customized tools from a Program Files folder is often successful.

There have been numerous projects and volunteers, like BartPE or the WindowsFE (Forensic Edition), to make it possible to run a complete OS from removable media, but in every case, this takes time and a lot of customizing.

I do not recommend using such a Windows PE as your primary Digital Forensics toolset.

It is not a replacement for a dedicated Forensic Workstation in your Lab or the expense for a physical Writeblocker.

The great advantage of Windows PE on a USB thumb drive is speed If you need urgent access to drives and files without tampering with any file stamps, such a toolset is for you.

The most useful steps you can accomplish with Windows 10 PE are file carving, file extraction, malware analysis and investigation of all file-based artifacts.

Download the Windows ADK for Windows 10 setup file with the name adksetup.exe.

When it comes to the selection of the program features, you should select at least the options shown in the following screenshot.

The setup program installs Windows PE in 32-bit and 64-bit flavor.

You can start the Deployment console from the menu entry Start Windows Kits Deployment and Imaging Tools Environment with a right-click on Run as Administrator.

This is a shortcut to a batch file in the programs folder, which sets several important variables and opens a command prompt.

We will use this command prompt until all tasks are accomplished; it stays open all the time.

Just set the appropriate number as the last digit.

We proceed with number 3 since we are doing digital forensics and do not let Windows decide which drive to mount as writable automatically.

I have selected a subset of suitable packages for digital forensics and created a file with simple command strings to add them all to the PE media.

These command strings add the mentioned packages in the right order and meet all dependencies.

To keep this text short and readable, I have copied these command strings to Pastebin at.

The Windows program Dism.exe (Deployment Image Servicing and Management tool) installs all packages one after another as a batch job.

You can add a lot more language packages by adjusting the path to the.cab file and Dism.exe to install them.

French language support for Powershell Not a problem.

This reference is very valuable, especially if you need support for Asian languages.

The following command, for example, will set the input locale to German.

In this example, we will copy several tools and application suites to this folder.