Forensic Tools

For Unix like

• AIR(Automatic Image and Restore)
  AIR is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
  
  Features:
  # 自動偵測 IDE and SCSI drives, CD-ROMs, and tape 等媒體。
  # 可選取使用 dd or dcfldd等dump出來的檔案。
  # 由MD5 or SHA1/256/384/512驗證image是否與source相同。
  # 使用gzip/bzip2執行image壓縮與解壓縮
  # image over a TCP/IP network via netcat/cryptcat
  # 支援 SCSI tape drives
  # wiping (zeroing) drives or partitions
  # splitting images into multiple segments
  # detailed logging with date/times and complete command-line used
  

AIR screen shot

AIR log

官網：http://air-imager.sourceforge.net/

• AUTOPSY
  
  官網：http://www.sleuthkit.org/autopsy/
  
  

For Windows

• Encase
  
  
• ProDiscover
  
  
• FTK(Forensic Tool Kit)