{"id":36,"date":"2018-09-17T16:11:26","date_gmt":"2018-09-17T16:11:26","guid":{"rendered":"https:\/\/josephnaghdi.com\/?page_id=36"},"modified":"2018-09-17T17:04:05","modified_gmt":"2018-09-17T17:04:05","slug":"computer-forensics-tools-part-two","status":"publish","type":"page","link":"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/","title":{"rendered":"Computer Forensics Tools -Part II"},"content":{"rendered":"<h1>Computer Forensics Tools -Part II<\/h1>\n<h2><b>Disk tools and data capture<\/b><\/h2>\n<ul>\n<li><a href=\"https:\/\/www.arsenalrecon.com\/apps\/image-mounter\/\">Arsenal Image Mounter<\/a><\/li>\n<li><em>Arsenal Consulting,<\/em> <em>Mounts disk images as complete disks in Windows, giving access to Volume Shadow Copies, etc.<\/em><\/li>\n<li><a href=\"http:\/\/www.moonsols.com\/2011\/07\/18\/moonsols-dumpit-goes-mainstream\/\">DumpIt<\/a><\/li>\n<li><i>MoonSols,\u00a0<\/i>Generates physical memory dump of Windows machines, 32 bits 64 bit. Can run from a USB flash drive.<\/li>\n<li><a href=\"http:\/\/www1.guidancesoftware.com\/Order-Forensic-Imager.aspx\">EnCase Forensic Imager<\/a><\/li>\n<li><i>Guidance Software,\u00a0<\/i>Create EnCase evidence files and EnCase logical evidence files [direct download link]<\/li>\n<li><a href=\"http:\/\/info.magnetforensics.com\/encrypted-disk-detector\">Encrypted Disk Detector<\/a><\/li>\n<li><i>Magnet Forensics,\u00a0<\/i>Checks local physical drives on a system for\u00a0TrueCrypt, PGP, or\u00a0Bitlocker\u00a0encrypted volumes.<\/li>\n<li><a href=\"http:\/\/www.4discovery.com\/our-tools\/\">EWF MetaEditor<\/a><\/li>\n<li><i>4Discovery,\u00a0<\/i>Edit EWF (E01) meta data, remove passwords (Encase v6 and earlier).<\/li>\n<li><a href=\"http:\/\/www.ridgecrop.demon.co.uk\/index.htm?fat32format.htm\">FAT32 Format<\/a><\/li>\n<li><i>Ridgecrop,\u00a0<\/i>Enables large capacity disks to be formatted as FAT32.<\/li>\n<li><a href=\"http:\/\/www.fawproject.com\/en\/default.aspx\">Forensics Acquisition of Websites<\/a><\/li>\n<li><i>Web Content Protection Association,\u00a0<\/i>Browser designed to forensically capture web pages.<\/li>\n<li><a href=\"http:\/\/www.accessdata.com\/support\/product-downloads\">FTK Imager<\/a><\/li>\n<li><i>AccessData,\u00a0<\/i>Imaging tool, disk viewer and image mounter.<\/li>\n<li><a href=\"http:\/\/guymager.sourceforge.net\/\">Guymager<\/a><\/li>\n<li><i>vogu00,\u00a0<\/i>Multi-threaded GUI imager under running under Linux.<\/li>\n<li><a href=\"http:\/\/forensic.belkasoft.com\/en\/ram-capturer\">Live RAM Capturer<\/a><\/li>\n<li><i>Belkasoft,\u00a0<\/i>Extracts RAM dump including that protected by an anti-debugging or anti-dumping system. 32 and 64 bit builds<\/li>\n<li><a href=\"http:\/\/sourceforge.net\/projects\/networkminer\/\">NetworkMiner<\/a><\/li>\n<li><i>Hjelmvik,\u00a0<\/i>Network analysis tool. Detects OS, hostname and open ports of network hosts through packet sniffing\/PCAP parsing.<\/li>\n<li><a href=\"http:\/\/nmap.org\/\">Nmap<\/a><\/li>\n<li><i>Nmap,\u00a0<\/i>Utility for network discovery and security auditing.<\/li>\n<li><a href=\"http:\/\/www.magnetforensics.com\/ram-capture\/\">Magnet RAM Capture<\/a><\/li>\n<li><i>Magnet Forensics,\u00a0<\/i>Captures physical memory of a suspect\u2019s computer. Windows XP to Windows 10, and 2003, 2008, 2012. 32 &amp; 64 bit.<\/li>\n<li><a href=\"http:\/\/www.osforensics.com\/tools\/create-disk-images.html\">OSFClone<\/a><\/li>\n<li><i>Passmark\u00a0Software,\u00a0<\/i>Mount utility for CD\/DVD or USB flash drives to create dd or AFF images\/clones.<\/li>\n<li><a href=\"http:\/\/www.osforensics.com\/tools\/mount-disk-images.html\">OSFMount<\/a><\/li>\n<li><i>Passmark\u00a0Software,\u00a0<\/i>Mounts a wide range of disk images. Also allows creation of RAM disks.<\/li>\n<li><b>Email analysis<\/b><\/li>\n<li><a href=\"http:\/\/www.nucleustechnologies.com\/exchange-edb-viewer.html\">EDB Viewer<\/a><\/li>\n<li><i>Lepide\u00a0Software,\u00a0<\/i>Open and view (not export) Outlook EDB files without an Exchange server.<\/li>\n<li><a href=\"http:\/\/www.mitec.cz\/mailview.html\">Mail Viewer<\/a><\/li>\n<li><i>MiTeC,\u00a0<\/i>Viewer for Outlook Express, Windows Mail\/Windows Live Mail, Mozilla Thunderbird message databases and single EML files.<\/li>\n<li><a href=\"http:\/\/www.systoolsgroup.com\/mbox-viewer.html\">MBOX Viewer<\/a><\/li>\n<li><i>SysTools,\u00a0<\/i>View MBOX emails and attachments.<\/li>\n<li><a href=\"http:\/\/www.nucleustechnologies.com\/ost-viewer.html\">OST Viewer<\/a><\/li>\n<li><i>Lepide\u00a0Software,\u00a0<\/i>Open and view (not export) Outlook OST files without connecting to an Exchange server.<\/li>\n<li><a href=\"http:\/\/www.nucleustechnologies.com\/pst-viewer.html\">PST Viewer<\/a><\/li>\n<li><i>Lepide\u00a0Software,\u00a0<\/i>Open and view (not export) Outlook PST files without needing Outlook.<\/li>\n<li><b>General<\/b><\/li>\n<li><a href=\"https:\/\/github.com\/log2timeline\/plaso\/wiki\">LOG2TIMELINE<\/a>:\u00a0Computer Artefact Time Creator<\/li>\n<li><em><strong>log2timeline<\/strong><\/em> is designed as a framework for artefact timeline creation and analysis. The main purpose is to provide a single tool to parse various log files and artefacts found on suspect systems (and supporting systems, such as network equipment) and produce a body file that can be used to create a timeline, using tools such as\u00a0mactime\u00a0from TSK, for forensic investigators.<\/li>\n<li><a href=\"http:\/\/www.mythicsoft.com\/page.aspx?type=agentransack&amp;page=home\">Agent Ransack<\/a><\/li>\n<li><i>Mythicsoft,\u00a0<\/i>Search multiple files using Boolean operators and Perl Regex.<\/li>\n<li><a href=\"http:\/\/www.cfreds.nist.gov\/\">Computer Forensic Reference Data Sets<\/a><\/li>\n<li><i>NIST,\u00a0<\/i>Collated forensic images for training, practice and validation.<\/li>\n<li><a href=\"http:\/\/www.nuix.com\/Nuix-evidence-mover\">EvidenceMover<\/a><\/li>\n<li><i>Nuix,\u00a0<\/i>Copies data between locations, with file comparison, verification, logging.<\/li>\n<li><a href=\"http:\/\/ipmsg.org\/tools\/fastcopy.html.en\">FastCopy<\/a><\/li>\n<li><i>Shirouzu Hiroaki,\u00a0<\/i>Self labelled \u2018fastest\u2019 copy\/delete Windows software. Can verify with SHA-1, etc.<\/li>\n<li><a href=\"http:\/\/www.garykessler.net\/library\/file_sigs.html\">File Signatures<\/a><\/li>\n<li><i>Gary Kessler,\u00a0<\/i>Table of file signatures.<\/li>\n<li><a href=\"http:\/\/www.hexbrowser.com\/\">HexBrowser<\/a><\/li>\n<li><i>Peter\u00a0Fiskerstrand,\u00a0<\/i>Identifies over 1000 file types by examining their signatures.<\/li>\n<li><a href=\"http:\/\/www.nirsoft.net\/utils\/hash_my_files.html\">HashMyFiles<\/a><\/li>\n<li><i>Nirsoft,\u00a0<\/i>Calculate MD5 and SHA1 hashes.<\/li>\n<li><a href=\"http:\/\/mobalivecd-en.mobatek.net\/\">MobaLiveCD<\/a><\/li>\n<li><i>Mobatek,\u00a0<\/i>Run Linux live CDs from their ISO image without having to boot to them.<\/li>\n<li><a href=\"http:\/\/www.nsrl.nist.gov\/Downloads.htm\">NSRL<\/a><\/li>\n<li><i>NIST,\u00a0<\/i>Hash sets of \u2018known\u2019 (ignorable) files.<\/li>\n<li><a href=\"http:\/\/sourceforge.net\/projects\/quickhash\/\">Quick Hash<\/a><\/li>\n<li><i>Ted Technology,\u00a0<\/i>A Linux &amp; Windows GUI for individual and recursive SHA1 hashing of files.<\/li>\n<li><a href=\"http:\/\/dsicovery.com\/dsicovery-software\/usb-write-blocker\/\">USB Write Blocker<\/a><\/li>\n<li><i>DSi,\u00a0<\/i>Enables software write-blocking of USB ports.<\/li>\n<li><a href=\"http:\/\/www.it-forensik.fh-aachen.de\/projekte\/volix\/13\">Volix<\/a><\/li>\n<li><i>FH Aachen,\u00a0<\/i>Application that simplifies the use of the Volatility Framework.<\/li>\n<li><a href=\"http:\/\/winfe.wordpress.com\/\">Windows Forensic Environment<\/a><\/li>\n<li><i>Troy Larson,\u00a0<\/i>Guide by Brett Shavers to creating and working with a Windows boot CD.<\/li>\n<li><b>File and data analysis<\/b><\/li>\n<li><a href=\"http:\/\/www.ash368.com\/\">Advanced Prefetch Analyser<\/a><\/li>\n<li><i>Allan Hay,\u00a0<\/i>Reads Windows\u00a0XP,Vista\u00a0and Windows 7 prefetch files.<\/li>\n<li><a href=\"https:\/\/github.com\/dkovar\/analyzeMFT\">analyzeMFT<\/a><\/li>\n<li><i>David Kovar,\u00a0<\/i>Parses the MFT from an NTFS file system allowing results to be analysed with other tools.<\/li>\n<li><a href=\"https:\/\/binaryforay.blogspot.co.uk\/2015\/07\/introducing-bstrings-better-strings.html\">bstrings<\/a><\/li>\n<li><i>Eric Zimmerman,\u00a0<\/i>Find strings in binary data, including regular expression searching.<\/li>\n<li><a href=\"http:\/\/www.capanalysis.net\/site\/\">CapAnalysis<\/a><\/li>\n<li><i>Evolka,\u00a0<\/i>PCAP viewer.<\/li>\n<li><a href=\"http:\/\/www.crowdstrike.com\/community-tools\/\">Crowd Reponse<\/a><\/li>\n<li><i>CrowdStike,\u00a0<\/i>Windows console application to aid gathering of system information for incident response and security engagements.<\/li>\n<li><a href=\"http:\/\/www.crowdstrike.com\/community-tools\/\">Crowd Inspect<\/a><\/li>\n<li><i>CrowdStrike,\u00a0<\/i>Details network processes, listing binaries associated with each process. Queries\u00a0VirusTotal, other malware repositories &amp; reputation services to produce \u201cat-a-glance\u201d state of the system.<\/li>\n<li><a href=\"http:\/\/www.digital-detective.net\/digital-forensic-software\/free-tools\/\">DCode<\/a><\/li>\n<li><i>Digital Detective,\u00a0<\/i>Converts various data types to date\/time values.<\/li>\n<li><a href=\"http:\/\/sourceforge.net\/projects\/defraser\/\">Defraser<\/a><\/li>\n<li><i>Various,\u00a0<\/i>Detects full and partial multimedia files in unallocated space.<\/li>\n<li><a href=\"http:\/\/sourceforge.net\/projects\/ecryptfs-p\/\">eCryptfs Parser<\/a><\/li>\n<li><i>Ted Technology,\u00a0<\/i>Recursively parses headers of every\u00a0eCryptfs\u00a0file in selected directory. Outputs encryption algorithm used, original file size, signature used, etc.<\/li>\n<li><a href=\"http:\/\/www.lostpassword.com\/encryption-analyzer.htm\">Encryption Analyzer<\/a><\/li>\n<li><i>Passware,\u00a0<\/i>Scans a computer for password-protected &amp; encrypted files, reports encryption complexity and decryption options for each file.<\/li>\n<li><a href=\"http:\/\/www.sno.phy.queensu.ca\/~phil\/exiftool\/\">ExifTool<\/a><\/li>\n<li><i>Phil Harvey,\u00a0<\/i>Read, write and edit\u00a0Exif\u00a0data in a large number of file types.<\/li>\n<li><a href=\"http:\/\/www.toolsley.com\/\">File Identifier<\/a><\/li>\n<li><i>Toolsley.com,\u00a0<\/i>Drag and drop web-browser JavaScript tool for identification of over 2000 file types.<\/li>\n<li><a href=\"http:\/\/www.sandersonforensics.com\/forum\/list.php?category\/46-Free-Software\">Forensic Image Viewer<\/a><\/li>\n<li><i>Sanderson Forensics,\u00a0<\/i>View various picture formats, image enhancer, extraction of embedded\u00a0Exif, GPS data.<\/li>\n<li><a href=\"http:\/\/www.getghiro.org\/\">Ghiro<\/a><\/li>\n<li><i>Alessandro\u00a0Tanasi,\u00a0<\/i>In-depth analysis of image (picture) files.<\/li>\n<li><a href=\"http:\/\/www.mandiant.com\/products\/free_software\/highlighter\/\">Highlighter<\/a><\/li>\n<li><i>Mandiant,\u00a0<\/i>Examine log files using text, graphic or histogram views.<\/li>\n<li><a href=\"http:\/\/www.4discovery.com\/our-tools\/\">Link Parser<\/a><\/li>\n<li><i>4Discovery,\u00a0<\/i>Recursively parses folders extracting 30+ attributes from Windows .lnk\u00a0(shortcut) files.<\/li>\n<li><a href=\"http:\/\/www.nirsoft.net\/utils\/live_messenger_contacts.html\">LiveContactsView<\/a><\/li>\n<li><i>Nirsoft,\u00a0<\/i>View and export Windows Live Messenger contact details.<\/li>\n<li><a href=\"https:\/\/binaryforay.blogspot.co.uk\/2016\/01\/pecmd-v0600-released.html\">PECmd<\/a><\/li>\n<li><i>Eric Zimmerman,\u00a0<\/i>Prefetch Explorer.<\/li>\n<li><a href=\"https:\/\/appliedalgo.com\/\">PlatformAuditProbe<\/a><\/li>\n<li><i>AppliedAlgo,\u00a0<\/i>Command Line Windows forensic\/ incident response tool that collects many artefacts.\u00a0<a href=\"https:\/\/appliedalgo.com\/doc\/AppliedAlgo%20PlatformAuditProbe%20Guide.pdf\">Manual<\/a><\/li>\n<li><a href=\"http:\/\/www.emc.com\/security\/rsa-netwitness.htm#%21freeware\">RSA Netwitness Investigator<\/a><\/li>\n<li><i>EMC,\u00a0<\/i>Network packet capture and analysis.<\/li>\n<li><a href=\"http:\/\/www.mandiant.com\/products\/free_software\/memoryze\/\">Memoryze<\/a><\/li>\n<li><i>Mandiant,\u00a0<\/i>Acquire and\/or analyse RAM images, including the page file on live systems.<\/li>\n<li><a href=\"http:\/\/www.4discovery.com\/our-tools\/\">MetaExtractor<\/a><\/li>\n<li><i>4Discovery,\u00a0<\/i>Recursively parses folders to extract meta data from MS Office, OpenOffice and PDF files.<\/li>\n<li><a href=\"http:\/\/www.sandersonforensics.com\/forum\/list.php?category\/46-Free-Software\">MFTview<\/a><\/li>\n<li><i>Sanderson Forensics,\u00a0<\/i>Displays and decodes contents of an extracted MFT file.<\/li>\n<li><a href=\"http:\/\/www.mikesforensictools.co.uk\/MFTPB.html\">PictureBox<\/a><\/li>\n<li><i>Mike\u2019s Forensic Tools,\u00a0<\/i>Lists EXIF, and where available, GPS data for all photographs present in a directory. Export data to .xls\u00a0or Google Earth KML format.<\/li>\n<li><a href=\"http:\/\/technet.microsoft.com\/en-us\/sysinternals\/bb896649.aspx\">PsTools<\/a><\/li>\n<li><i>Microsoft,\u00a0<\/i>Suite of command-line Windows utilities.<\/li>\n<li><a href=\"http:\/\/www.shadowexplorer.com\/\">Shadow Explorer<\/a><\/li>\n<li><i>Shadow Explorer,\u00a0<\/i>Browse and extract files from shadow copies.<\/li>\n<li><a href=\"https:\/\/addons.mozilla.org\/en-US\/firefox\/addon\/sqlite-manager\/\">SQLite Manager<\/a><\/li>\n<li><i>Mrinal Kant,\u00a0Tarakant\u00a0Tripathy,\u00a0<\/i>Firefox add-on enabling viewing of any SQLite database.<\/li>\n<li><a href=\"http:\/\/technet.microsoft.com\/en-gb\/sysinternals\/bb897439.aspx\">Strings<\/a><\/li>\n<li><i>Microsoft,\u00a0<\/i>Command-line tool for text searches.<\/li>\n<li><a href=\"http:\/\/www.mitec.cz\/ssv.html\">Structured Storage Viewer<\/a><\/li>\n<li><i>MiTec,\u00a0<\/i>View and manage MS OLE Structured Storage based files.<\/li>\n<li><a href=\"http:\/\/www.mikesforensictools.co.uk\/MFTSAR.html\">Switch-a-Roo<\/a><\/li>\n<li><i>Mike\u2019s Forensic Tools,\u00a0<\/i>Text replacement\/converter\/decoder for when dealing with URL encoding, etc.<\/li>\n<li><a href=\"http:\/\/www.mitec.cz\/wfa.html\">Windows File Analyzer<\/a><\/li>\n<li><i>MiTeC,\u00a0<\/i>Analyse\u00a0thumbs.db, Prefetch, INFO2 and .lnk\u00a0files.<\/li>\n<li><a href=\"http:\/\/www.xplico.org\/\">Xplico<\/a><\/li>\n<li><i>Gianluca Costa &amp; Andrea De\u00a0Franceschi,\u00a0<\/i>Network forensics analysis tool.<\/li>\n<li><b>Mac OS tools<\/b><\/li>\n<li><a href=\"https:\/\/github.com\/twocanoes\/audit\">Audit<\/a><\/li>\n<li><i>Twocanoes\u00a0Software,\u00a0<\/i>Audit Preference Pane and Log Reader for OS X.<\/li>\n<li><a href=\"http:\/\/forensic.n0fate.com\/?page_id=412\">ChainBreaker<\/a><\/li>\n<li><i>Kyeongsik\u00a0Lee,\u00a0<\/i>Parses keychain structure, extracting user\u2019s confidential information such as application account\/password, encrypted volume password (e.g.\u00a0filevault), etc.<\/li>\n<li><a href=\"https:\/\/github.com\/aburgh\/Disk-Arbitrator\">Disk Arbitrator<\/a><\/li>\n<li><i>Aaron Burghardt,\u00a0<\/i>Blocks the mounting of file systems, complimenting a write blocker in disabling disk arbitration.<\/li>\n<li><a href=\"https:\/\/www.blackbagtech.com\/resources\/freetools\/epochconverter.html\">Epoch Converter<\/a><\/li>\n<li><i>Blackbag\u00a0Technologies,\u00a0<\/i>Converts epoch times to local time and UTC.<\/li>\n<li><a href=\"http:\/\/accessdata.com\/product-download\/digital-forensics\/mac-os-10.5-and-10.6x-version-3.1.1\">FTK Imager CLI for Mac OS<\/a><\/li>\n<li><i>AccessData,\u00a0<\/i>Command line Mac OS version of\u00a0AccessData\u2019s\u00a0FTK Imager.<\/li>\n<li><a href=\"https:\/\/www.blackbagtech.com\/resources\/freetools\/ioreg-info.html\">IORegInfo<\/a><\/li>\n<li><i>Blackbag\u00a0Technologies,\u00a0<\/i>Lists items connected to the computer (e.g., SATA, USB and FireWire Drives, software RAID sets). Can locate partition information, including sizes, types, and the bus to which the device is connected.<\/li>\n<li><a href=\"https:\/\/www.blackbagtech.com\/resources\/freetools\/pmap-info.html\">PMAP Info<\/a><\/li>\n<li><i>Blackbag\u00a0Technologies,\u00a0<\/i>Displays the physical partitioning of the specified device. Can be used to map out all the drive information, accounting for all used sectors.<\/li>\n<li><a href=\"http:\/\/forensic.n0fate.com\/?page_id=412\">Volafox<\/a><\/li>\n<li><i>Kyeongsik\u00a0Lee,\u00a0<\/i>Memory forensic toolkit for Mac OS X.<\/li>\n<\/ul>\n<h2><a href=\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-three\/\"><em><strong>COMPUTER FORENSICS TOOLS PART III<\/strong><\/em> &#8211;<span style=\"color: #ff0000;\"><strong>CONTINUED<\/strong><\/span><\/a><\/h2>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>Computer Forensics Tools -Part II Disk tools and data capture Arsenal Image Mounter Arsenal Consulting, Mounts disk images as complete disks in Windows, giving access <a class=\"mh-excerpt-more\" href=\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/\" title=\"Computer Forensics Tools -Part II\"><span>Read More<\/span><\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-36","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Computer Forensics Tools -Part II - Computer Forensics Expert<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Computer Forensics Tools -Part II - Computer Forensics Expert\" \/>\n<meta property=\"og:description\" content=\"Computer Forensics Tools -Part II Disk tools and data capture Arsenal Image Mounter Arsenal Consulting, Mounts disk images as complete disks in Windows, giving access Read More\" \/>\n<meta property=\"og:url\" content=\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/\" \/>\n<meta property=\"og:site_name\" content=\"Computer Forensics Expert\" \/>\n<meta property=\"article:modified_time\" content=\"2018-09-17T17:04:05+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/\",\"url\":\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/\",\"name\":\"Computer Forensics Tools -Part II - Computer Forensics Expert\",\"isPartOf\":{\"@id\":\"https:\/\/josephnaghdi.com\/#website\"},\"datePublished\":\"2018-09-17T16:11:26+00:00\",\"dateModified\":\"2018-09-17T17:04:05+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/josephnaghdi.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Computer Forensics Tools -Part II\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/josephnaghdi.com\/#website\",\"url\":\"https:\/\/josephnaghdi.com\/\",\"name\":\"Computer Forensics Expert\",\"description\":\"Digital Forensics Investigatory Tools\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/josephnaghdi.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Computer Forensics Tools -Part II - Computer Forensics Expert","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/","og_locale":"en_US","og_type":"article","og_title":"Computer Forensics Tools -Part II - Computer Forensics Expert","og_description":"Computer Forensics Tools -Part II Disk tools and data capture Arsenal Image Mounter Arsenal Consulting, Mounts disk images as complete disks in Windows, giving access Read More","og_url":"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/","og_site_name":"Computer Forensics Expert","article_modified_time":"2018-09-17T17:04:05+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/","url":"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/","name":"Computer Forensics Tools -Part II - Computer Forensics Expert","isPartOf":{"@id":"https:\/\/josephnaghdi.com\/#website"},"datePublished":"2018-09-17T16:11:26+00:00","dateModified":"2018-09-17T17:04:05+00:00","breadcrumb":{"@id":"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/josephnaghdi.com\/index.php\/computer-forensics-tools-part-two\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/josephnaghdi.com\/"},{"@type":"ListItem","position":2,"name":"Computer Forensics Tools -Part II"}]},{"@type":"WebSite","@id":"https:\/\/josephnaghdi.com\/#website","url":"https:\/\/josephnaghdi.com\/","name":"Computer Forensics Expert","description":"Digital Forensics Investigatory Tools","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/josephnaghdi.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/josephnaghdi.com\/index.php\/wp-json\/wp\/v2\/pages\/36","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/josephnaghdi.com\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/josephnaghdi.com\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/josephnaghdi.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/josephnaghdi.com\/index.php\/wp-json\/wp\/v2\/comments?post=36"}],"version-history":[{"count":7,"href":"https:\/\/josephnaghdi.com\/index.php\/wp-json\/wp\/v2\/pages\/36\/revisions"}],"predecessor-version":[{"id":58,"href":"https:\/\/josephnaghdi.com\/index.php\/wp-json\/wp\/v2\/pages\/36\/revisions\/58"}],"wp:attachment":[{"href":"https:\/\/josephnaghdi.com\/index.php\/wp-json\/wp\/v2\/media?parent=36"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}