On-scene triage open source forensic tool chests: are they effective?

Stavros Shiaeles, Anargyros Chryssanthou, Vasilios Katos*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

Abstract

Considering that a triage related task may essentially make-or-break a digital investigation and the fact that a number of triage tools are freely available online but there is currently no mature framework for practically testing and evaluating them, in this paper we put three open source triage tools to the test. In an attempt to identify common issues, strengths and limitations we evaluate them both in terms of efficiency and compliance to published forensic principles. Our results show that due to the increased complexity and wide variety of system configurations, the triage tools should be made more adaptable, either dynamically or manually (depending on the case and context) instead of maintaining a monolithic functionality.

Original languageEnglish
Pages (from-to)99-115
Number of pages17
JournalDigital Investigation
Volume10
Issue number2
DOIs
Publication statusPublished - 1 Sep 2013

Keywords

  • ACPO principles
  • Incident response
  • Kludge
  • Open source
  • TR3Secure
  • Triage
  • TriageIR

Fingerprint

Dive into the research topics of 'On-scene triage open source forensic tool chests: are they effective?'. Together they form a unique fingerprint.

Cite this