PTK
PTK is an alternative advanced interface for the suite TSK (The Sleuth Kit). PTK was developed from scratch and besides providing the functions already present in Autopsy Forensic Browser it implements numerous new features essential during forensic activity. PTK is not just a new graphic and highly professional interface based on Ajax technology but offers a great deal of features like analysis, search and management of complex cases of digital investigation. The core component of the software is made up of an efficient Indexing Engine performing different preliminary analysis operations during importing of every evidence. PTK allows the management of different cases and different levels of multi-users. It is possible to allow two investigators to work at the same case at the same time. All the reports generated by an investigator are saved in a reserved section of the Database. PTK is a Web Based application and builds its indexing archive inside a Database MySQL, using thus the construction LAMP(Linux-Apache-MySql-PHP).
PTK Structure
PTK needs three requisites for its standard functioning:
- Lynux System
- Apache Server with PHP5
- MySQL server
There are several advantages gained with this configuration. PTK should be implemented on a system having fairly good hardware resources. The suggested requisites are:
- P4 2.33 ghz
- 512 MB of RAM
- 10 GB of Disk (depending on the number of cases managed)
In order to use the abilities of Multi Investigator System (PTK–MIS) and therefore allow different investigators to access a case at the same time it's necessary to have at least 2 GB of RAM.
The implementation of PTK is done through a web console dealing with the creation of the pattern in the database and of the administrative user.
PTK Features
PTK inherits all analysis features already present in TSK, among the most important being:
- Analyzes raw (i.e. dd), Expert Witness (i.e. EnCase) and AFF file system and disk images. (Sleuth Kit Informer #11)
- Supports the NTFS, FAT, UFS 1, UFS 2, EXT2FS, EXT3FS, and ISO 9660 file systems (even when the host operating system does not or has a different endian ordering).
- List allocated and deleted ASCII and Unicode file names. (Sleuth Kit Informer #14 (FAT Recovery), #16 (NTFS Orphan Files))
- Display the details and contents of all NTFS attributes (including all Alternate Data Streams).
- Display file system and meta-data structure details.
The principal new features added to PTK are:
Indexing Engine (PTK-IE)
- String Extracion
- Allocated, Unallocated, Slack Space
- Live Search
- File Categorization
- File signature analysis
- File extension mismatch
- Hash Set Manager
- Timeline generation
Advanced Timeline
- Search specified time windows
Gallery View
Advance Keyword Search
Auto Data Carving
Bookmarking Section
Multi Investigator System (PTK-MIS)
Incident Response Mode (PTK-IRM)
