Virtualized environments can make forensics investigation more difficult. Technological advances in virtualization tools essentially make removable media a PC that can be carried around in a pocket or around a neck. Running operating systems and applications this way leaves very little trace on the host system.

In this book, Tony Sammes and Brian Jenkinson show how information held in computer systems can be recovered and how it may be deliberately hidden or subverted for criminal purposes. Forensic Computing: A Practitioner s Guide is illustrated by plenty of case studies and worked examples, and will help practitioners and students gain a clear understanding of:
* how to recover information from computer systems in such a way as to ensure that its integrity cannot be challenged and that it will be accepted as admissible evidence in court
* the principles involved in password protection and data encryption
* the evaluation procedures used in circumventing these safeguards
* the particular legal issues associated with computer-generated evidence and how to ensure admissibility of such evidence.

Passware Kit Enterprise ($ 495) a set of tools for the selection or definition of passwords to files (more than 100 species), created the most famous in the world of software: Office, Excel, Word, Windows XP/2000/NT/Vista/7, Access, Outlook, Outlook Express, Exchange, WinZip PKZip ZIP, WinRAR RAR, VBA Visual Basic modules, Internet Explorer / EFS - Encrypted File System, FileMaker / Acrobat, Quicken, QuickBooks, Lotus 1-2-3, Lotus Notes, Lotus, Organizer, Lotus WordPro, Quattro Pro , Backup, Project, MYOB, Peachtree, Paradox, ACT!, Mail, Schedule +, Money, WordPerfect and MS Office 2007, as well as identify key Windows XP/2000/NT.

Passware Kit Enterprise ($ 495) a set of tools for the selection or definition of passwords to files (more than 100 species), created the most famous in the world of software: Office, Excel, Word, Windows XP/2000/NT/Vista/7, Access, Outlook, Outlook Express, Exchange, WinZip PKZip ZIP, WinRAR RAR, VBA Visual Basic modules, Internet Explorer / EFS - Encrypted File System, FileMaker / Acrobat, Quicken, QuickBooks, Lotus 1-2-3, Lotus Notes, Lotus, Organizer, Lotus WordPro, Quattro Pro , Backup, Project, MYOB, Peachtree, Paradox, ACT!, Mail, Schedule +, Money, WordPerfect and MS Office 2007, as well as identify key Windows XP/2000/NT. This complete password recovery solution provides corporate security administrators with the full control over employees' computers and files. System administrators, IT professionals and help desk personnel can now get access to any business file whenever required. Many types of passwords are recovered or reset instantly, while advanced acceleration methods are used to recover difficult passwords.

Passware Password Recovery Kit Forensic - a set of tools for the selection or definition of passwords to files (more than 180 species), created the most famous in the world of software: Office, Excel, Word, Windows XP/2000/NT, Access, Outlook, Outlook Express, Exchange, WinZip PKZip ZIP, WinRAR RAR, VBA Visual Basic modules, Internet Explorer / EFS - Encrypted File System, FileMaker / Acrobat, Quicken, QuickBooks, Lotus 1-2-3, Lotus Notes, Lotus, Organizer, Lotus WordPro, Quattro Pro, Backup , Project, MYOB, Peachtree, Paradox, ACT!, Mail, Schedule +, Money, WordPerfect and MS Office 2007, as well as identify key Windows XP/2000/NT/7. In the 10-th version of the transcript added hard drives, zakriptovannyh BitLocker and TrueCrypt.

Mobile phones contain some of the most important evidence in criminal investigations. Law enforcement agencies around the world need every possible advantage to help solve crimes. In many instances, mobile phones contain the important incriminating evidence that legal investigators require to solve a case. MOBILedit! Forensic has changed the way this evidence is obtained and presented. It provides reports with tamper-proof and indisputable evidence in a court of law. This report details out every piece of information in the phone such as call history, list of contacts, messages, photos, voice recordings, video, files, calendar, tasks, notes etc. MOBILedit! Forensic is a must-have for any forensic agent looking for that extra edge. With just a single click, MOBILedit! Forensic collects all possible data from the mobile phone and generates an extensive report onto a PC that can be stored or printed. MOBILedit! Forensic is the most universal cellular phone solution with architecture able to support virtually all phones. MOBILedit! Forensic allows you to customize the output making it completely adaptable to the needs of your judicial system. MOBILedit! Forensic also has frequent updates and upgrades so that you can be sure you are using the absolute latest in technology.

Faculty Fellow Rob Lee created the SANS Investigative Forensic Toolkit(SIFT) Workstation featured in the Computer Forensic Investigations and Incident Response course (FOR 508) in order to show that advanced investigations and investigating hackers can be accomplished using freely available open-source tools. The SANS SIFT Workstation is a VMware Appliance that is pre-configured with all the necessary tools to perform a detailed digital forensic examination. It is compatible with Expert Witness Format (E01), Advanced Forensic Format (AFF), and raw (dd) evidence formats. The brand new version has been completely rebuilt on an Ubuntu base with many additional tools and capabilities that can match any modern forensic tool suite.