Forensics Software

---

While some companies have habitually tried to destroy e-mail records, others keep them in abundance, and that can be every bit as much of a problem as trying to track down deleted files. A company that has backed up on tape every e-mail sent in the last five years might initially appear to be evidentiary heaven. But, a single backup tape can contain 300 million e-mails — the equivalent of 360,000 banker's boxes of paper documents. While the evidence being sought may be there, it is almost impossible for individuals to wade through that volume of data to find the proverbial needle in a haystack. This is where forensics software comes into its own. Not only does it discover deleted files and expose metadata, but it can also help analyze, categorize, and manage all the different types of files on a disk. Here are some examples of forensics programs and other tools:

• Forensics Toolkit (Accessdata, Inc.)

• The Coroner's Toolkit (Computer Forensics Analysis)

• Computer forensics software, hardware, and services (DIBS Computer Forensics)

• DriveSpy and other hardware and software solutions (Digital Intelligence)

• Portable Linux Auditing CD (Fred Cohen and Associates)

• EnCase Software (Guidance Software)

• ILook Investigator Page (IRS Criminal Investigation Electronic Crimes Program)

• Broad forensics software site (Mares and Company, LLC)

• Forensics software and services (New Technologies, Inc.)

• Forensics tools and technology (Paraben Forensics Tools)

• Forensics software utilities (Tools That Work)

• The Ultimate Collection of Forensics Software (TUCOFS) (Cyber Enforcement Resources)

Guidance Software's EnCase, for example, simultaneously searches across multiple imaged hard drives, and it has built-in viewers for different file types so the user can go from looking at a fax to an e-mail to a photograph to a letter without having to switch between programs.

Another key element of forensics software is its ability to sort through all the documents and recognize duplicates. That way, when an e-mail with its attachment gets forwarded to everyone in the company, it is not necessary to look at the same document a thousand times, as it shows up only once in the index.

---