365 Computer Security Training

Forensic Tool

Type of Data Searched

Features

Cost

• Passwords
• Computer data and files
• Steganography
• E-mail

• Create images, analyze the registry, conduct an investigation, decrypt files, crack passwords, identify steganography, and build a report all with a single solution.
• Recover passwords from over 80 applications; harness idle CPUs across the network to decrypt files and perform robust dictionary attacks.
• KFF hash library with 45 million hashes.
• Supports the largest, most complex datasets.
• Never lose case data due to a crash.
• True multi-processor and multi-threading support that takes advantage of hardware advancements.
• Automated recovery during pre-processing ensures the job gets done.
• Easy-to-understand and easy-to-use GUI with pre-defined and customizable data views, advanced filtering, dockable windows and automated data categorization.
• Multi-data views allowing users to analyze a given file in a number of different ways, such as native, hex, text and filtered.

• Hard drives w/in the enterprise
• Any data on enterprise computers or servers
• Defined data criteria

• Electronic data discovery (EDD) and computer forensics, including imaging and examination of hard drives
• Information Security personnel can monitor each computer or server on the network from a central administration tool when a tiny agent is installed.
• Helix3 Enterprise simplifies the issues by allowing information security personnel to search for defined data criteria, and either copy the data to a central store or report its presence.
• Allows you to quickly detect, identify, analyze, preserve and report giving you the evidence to reveal the truth and protect your business.

• Computer data and files

• Acquire data in a forensically sound manner using software with an unparalleled record in courts worldwide.
• Works on Windows, Linux, AIX, OS X, Solaris and more.
• Save days, if not weeks, of analysis time by automating complex and routine tasks with prebuilt modules, such as Initialized case and event log analysis.
• Find information despite efforts to hide, cloak or delete.
• Easily manage large volumes of computer evidence, viewing all relevant files, including deleted files, file slack and unallocated space.
• Transfer evidence files directly to law enforcement or legal representatives as necessary.
• Review options allow non-investigators, such as attorneys, to review evidence with ease.
• Reporting options enable quick report preparation.

$2,850 for a government/law enforcement license, plus support.

• Computer data and files

• Allows teams to securely investigate and analyze multiple machines simultaneously over a network, at the disk and memory level.
• Acquires data in a forensically sound manner, with bit-stream imaging and more.
• It has an unparalleled record in courts worldwide.
• Allows for immediate response, limiting impact and system downtime.
• Works on Windows, Linux, AIX, OS X, Solaris and more.
• Proactively audit large groups of machines for sensitive or classified information, as well as unauthorized processes and network connections.
• Silently and invisibly helps to identify fraud, security events and employee integrity issues wherever they are taking place.
• Finds and corrects zero-day events, injected dlls, rootkits and hidden/rogue processes.

• Reactive: all typical functions of a forensics suite

• Allows for complete examination and investigation over any network.
• Drive acquisition, volatile data acquisition, network searching, client snapshot, reporting and more.
• All monitoring and data acquisition activities are completely invisible to the user, as they run silently and with complete stealth on Windows 2000, XP, 2003, Vista, and 2008 machines.
• Works with other forensic suites on a network to allow organizations to fully watch over their systems and provide digital evidence when needed.
• Adheres to strict forensic practices, Sarbanes-Oxley, and many other laws and requirements by ensuring that data integrity is maintained.

• Proactive: all typical functions of a forensics suite, in real-time
• Reactive: all typical functions of a forensics suite

• Live network forensic tool for proactive protection of digital evidence to guard against risks of intellectual property theft, embezzlement, employee lawsuits, or any general insider threat.
• Drive acquisition, network monitoring, volatile data acquisition, telnet (through the secure proxy server), network searching, client snapshot, P2 Navigator, reporting and more.
• Rather than waiting to learn of an incident requiring forensics, proactive forensics actually constantly monitors for the occurrence of an incident with an immediate forensic response to ensure evidence is preserved.
• Proactive capabilities include the ability to monitor and track system logins, running processes, file activity, event logs, network sniffing, hardware monitoring, application installs/uninstalls, data copied to internal systems, deleted activity, and more.
• Also provides reactive forensics in case the protection was breached, allowing organizations to automatically acquire images, take snapshots, or mount systems.
• All monitoring and data acquisition activities are completely invisible to the user, as they run silently and with complete stealth on Windows 2000, XP, 2003, Vista, and 2008 machines.
• Works with other forensic suites on a network to allow organizations to fully watch over their systems and provide digital evidence when needed.
• Adheres to strict forensic practices, Sarbanes-Oxley, and many other laws and requirements by ensuring that data integrity is maintained.

• Reactive: all typical functions of a forensics suite

• Remotely investigate the disk contents of systems over a network.
• Stealth operation to avoid detection by users.
• Preview and search suspect files to find evidence quickly and without altering any data or metadata.
• Create a bit-stream image of the target system disk and physical memory to preserve evidence and restore the system quickly with MD5, SHA1, or SHA256 hashes of evidence files to prove data authenticity and integrity.
• Captures volatile data images of RAM, Bios, and CMOS memory to find evidence.
• Examines multiple disk formats such as any FAT or NTIFS file systems.
• Integrated viewers for graphics, Internet history, registry, email, documents, and more.
• Quick and easy to use.