Forensic Toolkit (FTK) 4 - Expansion Modules (Cerberus Malware Analysis, Visualization)
AccessData announced the release of Forensic Toolkit (FTK) 4. This major release is designed to give FTK users enterprise-class capabilities at a stand-alone price. A new feature called ‘Single-Node Enterprise’ gives FTK users the full analysis functionality of AD Enterprise, AccessData’s enterprise-class investigation and incident response solution. This gives organizations affordable access to more advanced incident response and remote investigative capabilities. Using FTK, computer forensics examiners are able to securely and remotely investigate a running computer to analyze and collect data from disk, volatile and RAM, eliminating travel and reducing response time. “FTK 4 gives our users access to functionality not found in any other product in this class of forensic software,” commented Brian Karney, President and COO of AccessData.
Corporations and investigators in many disciplines increasingly require the ability to investigate internal matters, such as HR policy violations, regulatory compliance and employee separation. Whether motivated by regulations or internal policy, the ability to conduct remote investigations is a requirement to address the risks of a digital workplace. FTK 4 now offers the critical components necessary to manage those risks to organizations that cannot spend tens of thousands of dollars on large-scale enterprise investigations platforms. These capabilities have never been offered in such an integrated and affordable solution.
FTK 4 also introduces two expansion modules for computer forensics examiners and malware analysts. These add-on offerings increase the breadth and depth of the FTK user experience and introduce a new paradigm for first and second responders.
Cerberus Malware Analysis
Cerberus is a malware analysis and triage technology that reduces the level of expertise required to triage suspected malware, allowing first and second responders to gain actionable intelligence on malware threats without waiting for a malware team to analyze binaries in a sandbox. The first step towards automated reverse engineering, Cerberus provides threat scores and disassembly analysis to determine the behavior and intent of suspect binaries, prior to sending them on for deeper analysis.
Visualization
Visualization allows FTK users to view data in multiple display formats, including timelines, social analyzer, pie charts and more. By combining the state-of-the-art backend processing of FTK with this graphical analytic interface, FTK users will dramatically enhance the accuracy and speed with which they can analyze case data.
Previous releases of FTK placed AccessData's flagship product in a category of its own, by delivering a different architecture, more advanced capabilities and a different approach to processing and analysis. The database-driven solution introduced distributed processing, integrated volatile data and memory analysis, the most comprehensive Apple OS analysis of any other Windows-based forensics product and integrated decryption capabilities. FTK 4 builds on this functionality to provide more flexibility for the analysis of remote machines and new options to integrate state-of-the-art data analytics and malware handling. "We at AccessData are committed to providing the most advanced computer forensics technology to aid law enforcement, government and corporate investigators, as well as consultants, with complex investigations and burgeoning workloads. We pride ourselves on having the most advanced product in the industry," stated Karney.
