Digital Forensics Framework - A Perspective Forensics Tool
After Helix Forensic went commercial, the open source Computer Forensics is missing a tool that integrates required forensic techniques as well as Helix did.
The tool
A group which calls themselves ArxSys have developed a Python based Forensic Analysis Tool, which they call Digital Forensics Framework (DFF).
DFF can be installed on Linux and Windows, and is functional even under Windows 7. The general architecture of the tool is to create a central contained program in which different forensic functions can be added as building blocks to create a fully integrated forensic environment.
In comparison, most current open source tools are merely wrappers for a whole myriad of standalone tools.
While this architecture is a visionary one, it's strength is also it' weakness: all functions need to be written for this framework, which will slow down development of the DFF as a full solution. At it's current state of development, DFF can handle disk dumps in FAT, but not NTFS nor memory dumps.
Another very important drawback is that DFF has no functionality for Forensic Acquisition, so the forensic investigator still needs additional tools.
Conclusion
Digital Forensics Framework is still a very 'young' product. It is focusing only on forensic analysis, with no initiative on forensic acquisition and documentation. The strong sides of the product are the flexibility and ease with which new python scripts can be added.
At this moment, it's not the first choice for a Forensic Investigators tool-chest, but we will follow on the development of the product.
Talback and comments are most welcome
Related posts
Tutorial - Computer Forensics Process for Beginners
Tutorial - Computer Forensics Evidence Collection
Competition - Computer Forensic Investigation














0 comments:
Post a Comment