Forensic Imaging

Forensic Imaging Tools Used By Computer Forensic Experts

Leading computer cyber forensics Expert Lee Neubeckers discusses FTK Imager (forensics imaging tool) and Write Block Technology with Alex Gessen renowned forensics expert.

The transcript of the video follows

Lee Neubecker: So, I hear you recently uncovered a problem with forensic write block technology can you tell me about that?

Alex Gessen: Oh, yes. Not only with write block technology, but even more importantly with… Forensic imaging tool, which is used by basically everybody in the industry, called FTK Imager. And what I discovered, I also used that tool for years, and didn’t realize the fault, but what I discovered. Basically, two weeks ago, and I did some tests and analysis and I asked Kevin to help me, that FTK Imager produces a wrong serial number when USB storage devices are imaged and that serial number basically is useless for the purpose of verification if specific device was plugged into a specific computer, which, with USB devices, is almost always. When you analyze these devices, 90% of times, it’s of critical importance, and–

Lee Neubecker: So, how is that information used when you are doing a trade secret misappropriation investigation to assist you?

Alex Gessen: I… Quite often, I have to image a computer. Usually work computer, where the person works, or worked, and then, first of all, I find out, analyzing the computer, that certain devices were plugged in, in this specific instance. There are other ways to steal intellectual property or trade secrets. You can upload them to the Cloud, you can email important attachments to yourself. But, quite often, because it’s the most time effective, is to copy data to external devices. So, first, you find out which devices were plugged into the computer, and then you have to get these devices and analyze them. And when you have these devices, you have to be sure that this is device which was plugged into the computer in question and for that you need serial number, and FTK Imager didn’t provide serial number. And people, whole industry, was using that for years and years.

Read Below to Learn More About Computer Forensics

Computer Forensic Expert Witness Reports & Testimony