Chapter 23: Tool Kits to Aid in Forensic Analysis

---

Overview

In Chapters 21 and 22, we reviewed tools that can acquire a forensic duplication of a source hard drive. That is the first phase of a two-phase process to perform a successful forensic investigation. The second phase is the analytical component. This chapter discusses the tools used to analyze the data we previously acquired. All of the forensic analysis tool kits we review are capable of importing more than one forensic image format. The most useful format, a dd image, can be used with all of these tools, and since it is open-source, it costs nothing to create (other than your time).

---