Digital Forensic Scientist

1 minute read

Throughout the time I have been developing REAPER, many people in more developed countries have expressed a need for a type of forensic preview ability. Maybe they do not need to take an image of every machine. Fair enough, says I.

Because of this, I have been developing REAPER Preview. It is a live CD based off of Debian Live that automatically generates a preview of the data on the system. Currently I have gallery view of various photo, movie, document, and music formats. The preview is fairly superficial with speed in mind.

Also since REAPER is focused on acquisition the ability to automatically image the local suspect drives is still there.

For this version OCFA has been replaced by the PTK front-end to TSK. It is meant to be a very light collect-and-go with some analysis capability.

As always the goal of REAPER is to be as quick and easy as possible. While Preview is not 100% automatic yet, it is by far the easiest way to preview and image a suspect's machine to an external hard drive.

I will be singleing everything I have for this version to the svn either tomorrow or this weekend. Feel free to email me if you would like more information.

You may also enjoy

iLEAPP and RLEAPP updates and dev thoughts

1 minutes to read

Alex (@kviddy) has been pushing some extremely useful updates to the open-source Android forensic tool - [ALEAPP](https://github.com/abrignoni/ALEAPP]. Speci...

What data can you find in RAM?

1 minutes to read

To determine if you need to collect Random Access Memory on-scene, it is useful to know what kinda of investigation-relevant data is often available in RAM.

Modular artifact scripts coming to iLEAPP

1 minutes to read

kviddy has been pushing some great core updates to ALEAPP. Specifically, artifact scripts are now self-contained. This means that script authors no longer ne...