Categories of software
Describe the five categories of software that can be used in computer investigation.
Sample Solution
1. Operating System Analysis Software: This type of software is used to investigate the operating system of a computer, including its file systems and registry entries. It can be used to identify any malicious activity, as well as look for signs of tampering or other suspicious behavior. Additionally,
it can also help investigators gain an understanding of how the operating system works in order to better understand how a machine stores and processes data.
2. Network Analysis Software: This type of software is used to analyze network traffic and identify potential security vulnerabilities or threats. It allows investigators to search through large amounts of packet data quickly, so that they can detect anomalies or unusual patterns within the communication between computers on a network. This type of software is often used during incident response investigations in order to determine if an attack has occurred or if there are any malicious actors present on the system.
3. Data Recovery Software: Data recovery software helps investigators locate and recover deleted files, emails, photos, documents, code fragments etc., which may be helpful during digital forensic investigations into criminal activities such as identity theft and financial frauds where evidence must be produced from existing hard drives or memory devices like USB sticks/flash drives etc.. The recovered data could reveal information about activities committed by perpetrators which may otherwise not have been uncovered during traditional physical investigation techniques alone
4. Protocol Analyzer Software: A protocol analyzer (also called packet sniffer) is a tool that captures packets that traverse across networks and displays details about each packet’s content such as source IP address, destination IP address, port number etc., allowing for further analysis into suspicious network activity such as malware infections over timeframes shorter than those examined with log-based intrusion detection systems (IDS). Protocol analyzers enable administrators and security professionals alike to perform deep analysis into traffic flows across their networks looking for anomalies that may indicate attacks in progress or post-incident forensics examinations for evidence gathering purposes
5 Mobile Forensic Tools: Similar to PC based forensic tools but specifically designed for mobile device investigations where physical/logical access has been obtained by law enforcement personnel onto cell phones & tablets; these tools allow users extract all available user data stored on “locked” devices such as call logs & SMS messages while other more advanced solutions provide access deeper dive capabilities such as password cracking & unlocking hidden features allowing users retrieve encrypted files off devices too