AccessData Forensic Toolkit User Guide

Below you will find brief information for Forensic Toolkit. The Forensic Toolkit offers a comprehensive set of tools for investigating digital evidence, including the ability to acquire and analyze data from both static and live sources. The user interface is intuitive and easy to navigate, making it suitable for both novice and experienced investigators. It also includes advanced features such as data carving, decryption, and known file filtering, providing users with a powerful set of tools for uncovering valuable insights from digital evidence.

PDF
Document
Forensic Toolkit User Guide | Manualzz

Advertisement

Advertisement

/

Advertisement

Key features

  • Acquiring and examining digital evidence

  • Data carving and decryption

  • Known file filtering

  • Case management and evidence organization

  • Reporting and presentation of findings

  • Integration with other AccessData products

Frequently asked questions

To create a new case, click the New Case button in the Case Manager. You can then configure the case with specific options, such as processing profiles, evidence refinement, and indexing preferences. You can then add evidence to the case.

Forensic Toolkit supports a wide range of evidence types, including static evidence (such as hard drives and memory dumps), live evidence (such as active computers and mobile devices), and remote evidence (such as network shares and email accounts).

The Known File Filter (KFF) allows you to identify and filter known files based on their hash values. You can add hashes to the KFF server manually or import KFF data from existing databases. You can enable a case to use KFF and configure its specific settings.

Forensic Toolkit includes a built-in decryption tool that can decrypt files that have been protected with a variety of encryption methods, such as NTFS EFS, Microsoft Office DRM, Lotus Notes, S/MIME, Bitlocker, and Safeguard Utimaco. This decryption tool can be used to decrypt individual files or entire data sets.

Preparing document for printing…
0%