Post Process

Everything to do with E-discovery & ESI

Archive for the ‘TreCorder’ Category

New Euro built computer a super forensics tool?

Posted by rjbiii on September 9, 2007

Well, it certainly is fast, if nothing else:

A European consortium has come up with a high-speed digital forensic computer dedicated to the task of quickly offloading and analyzing all computer records from email or picture files to database contents and file transfers.The TreCorder is a rugged forensic PC able to copy or clone up to three hard disks simultaneously, at a speed of up to 2 Gb/min. The same transfer would take 30 to 60 minutes using alternative equipment said Martin Hermann, general director of MH-services…

Speed isn’t the only thing the TreCorder’s makers brag about, however:

The PC not only provides a complete mirror image of the hard disk and system memory – including deleted and reformatted date – but also eliminates any possibility of falsification in the process, Hermann said.

Network World, who has the story, mentions its past article questioning the soundness of such widely used tools as EnCase and The Sleuth Kit (a subject about which Post Process has already posted):

[Security Company Isec Partners] has discovered about a dozen bugs [in the aforementioned forensic software kits] that could be used to crash the programs or possibly even install unauthorized software on an investigator’s machine, according to Alex Stamos, a researcher and founding partner with Isec Partners.

Advertisements

Posted in Articles, Computer Forensics, EnCase, The Sleuth Kit, TreCorder | Leave a Comment »