My previous post on this topic addressed an apparent dichotomy (admittedly, based on a limited aperture) of thought between vendors and users when it comes to features being added to commercial forensic suites. This was the result of a road I’d started down a while back, trying to see if there was any value proposition to RegRipper at all (turns out, no, there isn’t), and was simply the most recent pit stop along that road.
From my previous post, there seem to be two thoughts on the matter, or maybe it’s more correct to say that only two basic positions or perspectives were shared. One is from vendors, some who rely on users to express the need for features; as such, vendors are relying on users to drive their own investigations, requesting or expressing the need for features as they arise. I’m sure vendors have ways of prioritizing those requests/needs, based on limited/available resources.
The other perspective is from users of those forensic tools; the views expressed are that if a vendor finds or ‘sees’ a cool feature, it should simply be added to the tool or framework, regardless of whether anyone actually wants it or not. To me, this seems to be users relying on vendors to drive investigations.
While I tend to agree more with the vendor perspective, as a user of forensic tools (albeit not commercial products), it seems that I have a different perspective from most users. There have been a few times in my career where I’ve had to deal with the issue of tool features; some examples follow:
CCN Searches
Circa 2009-ish (give or take), Chris Pogue and I were working a PCI forensic investigation, and found that while Discover and JCB cards had reportedly been processed by the merchant, none were appearing in our searches. As our team had recently grown, we had settled on EnCase (then owned by Guidance Software) as the tool used for all of the PCI-specific searches (CCNs, hashes, file names, etc.); this tool was commonly understood, and we wanted accuracy and consistency above all else.
We began digging into the issue, even going to the brands and getting test data. We kept reducing the scope of our testing, even to the point of, “here’s a file with 3 Discove
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: