I am studying digital forensics and have been working with both AccessData\'s FT

Question

I am studying digital forensics and have been working with both AccessData's FTK and Autopsy to analyze disks for different assignments. I keep hearing that Autopsy findings should not be admitted in a court of law due to a lack of proof of reliablity, integrity, etc.

This is bothersome, as I find Autopsy to be the better option of the two digital forensics tools that I have used. I know their are other options out there like EnCase, but I really find Autopsy to be a nice system to work with. Has anyone here presented digital forensics findings that were derived from Autopsy or Sleuth Kit in a court of law, or found literature/precedence regarding this question.

I see that Autopsy received early funding from the U.S. Army and currently receives funding from the DHS, so I have to think it is at least somewhat regarded as a professional grade tool.

Explanation / Answer

The reliability & expertise in court is the responsibility of the examiner, not the tool. Voir dire will audit your training, experience, past testimony, etc. You can't audit or voir dire a tool, only a person (examiner). Use whatever tool you like, validate it with other tools as needed, update your tools regularly and don't be afraid to make a change if one tool isn't working for you. I used EnCase for years. I switched to Xways for a number of reasons. I also will use Autopsy to validate & for supplemental reasons. I may almost use Autopsy exclusively, but it doesn't create the forensic image, so that's a challenge. Anyway, that's my 2 cents. Good luck!

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.