Difference between revisions of "PTK"

Revision as of 08:10, 18 March 2008

PTK is an alternative advanced interface for the suite TSK (The Sleuth Kit). PTK was developed from scratch and besides providing the functions already present in Autopsy Forensic Browser it implements numerous new features essential during forensic activity. PTK is not just a new graphic and highly professional interface based on Ajax technology but offers a great deal of features like analysis, search and management of complex cases of digital investigation. The core component of the software is made up of an efficient Indexing Engine performing different preliminary analysis operations during importing of every evidence. PTK allows the management of different cases and different levels of multi-users. It is possible to allow two investigators to work at the same case at the same time. All the reports generated by an investigator are saved in a reserved section of the Database. PTK is a Web Based application and builds its indexing archive inside a Database MySQL, using thus the construction LAMP(Linux-Apache-MySql-PHP).

PTK Structure

PTK needs three requisites for its standard functioning:

• Lynux System
• Apache Server with PHP5
• MySQL server

There are several advantages gained with this configuration. PTK should be implemented on a system having fairly good hardware resources. The suggested requisites are:

• P4 2.33 ghz
• 512 MB of RAM
• 10 GB of Disk (depending on the number of cases managed)

In order to use the abilities of Multi Investigator System (PTK–MIS) and therefore allow different investigators to access a case at the same time it's necessary to have at least 2 GB of RAM. The implementation of PTK is done through a web console dealing with the creation of the pattern in the database and of the administrative user.

PTK Features

PTK inherits all analysis features already present in TSK, among the most important being:

• Analyzes raw (i.e. dd), Expert Witness (i.e. EnCase) and AFF file system and disk images. (Sleuth Kit Informer #11)
• Supports the NTFS, FAT, UFS 1, UFS 2, EXT2FS, EXT3FS, and ISO 9660 file systems (even when the host operating system does not or has a different endian ordering).
• List allocated and deleted ASCII and Unicode file names. (Sleuth Kit Informer #14 (FAT Recovery), #16 (NTFS Orphan Files))
• Display the details and contents of all NTFS attributes (including all Alternate Data Streams).
• Display file system and meta-data structure details.

The principal new features added to PTK are:

Indexing Engine (PTK-IE)

• String Extracion
  • Allocated, Unallocated, Slack Space
  • Live Search
• File Categorization
  • File signature analysis
  • File extension mismatch
• Auto Data Carving
  • Customizable file signature
• Hash Set Manager

Advanced Timeline (PTK-AT)

Gallery View (PTK-GV)

Advance Keyword Search (PTK-AKS)

Bookmarking Section (PTK-BS)

Multi Investigator System (PTK-MIS)

Incident Response Mode (PTK-IRM)

References

PTK Official Site