Scans a whole directory tree and give a quick overlook over the directories that have special permissions set. The AccessScanner application was designed to be a small tool that can scan a whole directory tree and give a quick overlook over the directories that have special permissions set.

It's especially useful to find corrupted folders after a crash, clean up a file structure before a migration or just plain do some housekeeping on organically grown servers.

Download page

The Windows Forensic Toolchest is designed to provide a structured and repeatable automated Live Forensic Response, Incident Response, or Audit on a Windows system while collecting security-relevant information from the system. WFT is essentially a forensically enhanced batch processing shell capable of running other security tools and producing HTML based reports in a forensically sound manner.

Computer forensics is the systematic step-by-step examination and analysis of data that is stored, retrieved, or processed on computer systems in a legal, approved way so that the evidence can be used in court if needed. Forensic specialists must know how to record evidence at the scene by taking photographs, documenting their activities in an investigator’s notebook, interviewing suspects and witnesses, and knowing the proper procedures for collecting or seizing suspected systems or media. Doing all of this correctly protects the chain of custody and legality of the evidence.

Although law enforcement has been practicing forensics for a long time, the computer forensics field is relatively new to the corporate sector. This means that many IS auditors might not be highly skilled in auditing this important field. An IS auditor must look carefully at the policies and procedures that detail forensic activities during an audit.