Michele Zambelli

Both the free version and the commercial version of the PTK project, equipped with an appliance, are constantly developing. PTK is now able to thoroughly and accurately manage the hash libraries thus rendering investigation processes faster and easier. At the moment, PTK is working with hash...

A forensics analysis tool has to be able to execute thorough keyword search operations. PTK's search tool is be able to isolate the keywords searched even in the most complex and unusual situations. It is possible to verify if a keyword is in portions of the file system that are hard to analyze...

At the moment the output formats used in computer forensics for the support of media duplication are mainly three: ? dd (RAW image) — the best and most utilized format? Encase format (EWF) — closed format now widely supported by the CF products? AFF Lib Format— very complete but still expanding PTK...

In this article, we will describe the installation of PTK, a very simple and automated process notwithstanding the use it makes of various components. This process is entirely web based. First of all we remind you that the PTK 1.0 was made available for download on October 28. (PTK 1.0...

PTK Indexing The Sleuth Kit (TSK) and PTK are both Open Source and run on UNIX platforms. As shown in the figure, there is an interaction between the advanced interface PTK and TSK core. In particular, TSK, shown in green, is responsible for acquiring, extracting and managing the low layer of data...

PTK was developed from scratch and besides providing functions already present in Autopsy Forensic Browser, it implements numerous new features essential during forensics work. PTK is not just a new graphic and highly professional interface based on Ajax technology. It offers many features such as...