A Comparative Analysis of OS Forensics Tools

Abstract

The internet is expanding at a carelessly fast pace, as the number of crimes perpetrated using or against computers. The area of computer forensics has arisen in reaction to the rise of computer crime. Computer forensics is the meticulous collection and examination of electronic evidence that not only analyses the damage to a computer because of an electronic attack but also recovers lost data from such a system to convict a criminal. As a result, the standard forensic process that is required after an electronic attack involves collecting evidence from a computer system, analyzing, and presentation of the collected evidence in court. Forensics deals primarily with the recovery and analysis of latent evidence. The growth of digital forensics has substantially increased the requirement for practical tools. There are several tools available today that are used to investigate the OS of a given computer. The purpose of this paper is to compare OS forensics tools by evaluating their ease of use, functionality, performance, and product support and documentation. This research will provide a brief comparative analysis of two widely used OS forensic tools-OSForensics and autopsy, based on various contradictory factors.

Keywords: Forensic, Database, Disk, Cloud, Mobile, Autopsy, Data wiping, Framework, and Trucrypt.

JEL Classification: O3