Chapter 6 - Forensic Software and Hardware

Abstract

This chapter presents hardware and software-based forensic tools. Visual TimeAnalyzer is software that automatically tracks all computer usage, presenting detailed, richly illustrated reports. The program tracks work time, pauses, projects, costs, software, and Internet use, giving parents control over children's use of personal computers. The software has some privacy safeguards and does not monitor all user data such as passwords and personal documents. Unlike spyware, it does not record specific keystrokes or run screen captures as a background process. The features and advantages of hardware computer forensic tools are based on techniques that substitute software for processes and the use of equipment that is compact and easy to operate. These devices are often powered from the source or from the suspect machine. However, the forensic analyst who relies on forensic hardware must ensure that all possible connectors are available prior to starting a job. Hardware protection devices offer a simple method to acquire an image of a suspect drive with much less fiddling with the configuration settings in software. This makes the process simpler and less prone to error.