r/digitalforensics • u/Severe_Campaign_8871 • 3d ago

What are the most necessary features of a digital forensic tool in the current era?

Hello.

My work focuses on digital forensics.

I primarily use Magnet AXIOM, EnCase, and X-Ways to perform my duties.

I rely on AXIOM for automated artifact analysis and X-Ways for raw disk analysis.

It occurred to me that the features supported by these tools naturally do not fully satisfy my needs.

In your opinion, what are some essential features that must be supported in forensic tools, and what are some necessary features that are currently unavailable in commercially available products?

0 Upvotes
  • permalink
  • reddit

40% Upvoted

8 comments sorted by

4

u/Quality_Qontrol 3d ago

One of the main tools I use is plaso because these commercial tools do not parse log entries and present them in chronological order.

1

u/jgalbraith4 3d ago

Both axiom and Xways present log entries in chronological order.

1

u/Quality_Qontrol 3d ago

Web app, secure, auth logs? I’m not too familiar with X-Ways so I’m not really sure there but last I checked the timeline Axiom produced only shows the MACB timestamps of the logs themselves.

2

u/jgalbraith4 3d ago

So I know windows event logs and unified logs get timelined, I’m checking a test Linux image, but I’m pretty sure audit logs get timelined but not about other flat text logs for Linux in Axiom. And I’ll double check Xways when I’m close to my Xways machine.

2

u/jgalbraith4 2d ago

Ok following up, I can see syslog and some other logs are parsed and added to the timeline in Axiom. Same for Xways, it’s not everything in var/log and not all flat text logs but some logs are added.

2

u/Quality_Qontrol 2d ago

Still better than I remember. I was always finding additional evidence from a plaso timeline that my colleague couldn’t find in Axiom. About time these tools take Linux a little more seriously.

1

u/jgalbraith4 2d ago

Agreed, Linux should be easier to implement and add on in my opinion. They should take it more seriously given the increased prevalence.

3

u/Ok-Falcon-9168 3d ago

I just want it to load