SPEKTOR Drive is a Forensic Triage solution designed for people with little or no technical skills.  It can transform a normal laptop or MacBook into a fully functiona SPEKTOR Forensic Intelligence Unit.  This allows the quick and easy review of the contents of all PCs, MACs, Servers, and any mobile media such as USB thumb drives, memory cards, mobile phones and satellite navigation systems etc, (we call these the target devices) in a way that is acceptable both as evidence or intelligence.

No, SPEKTOR has been specifically designed to provide non-forensic operators the ability to triage digital devices, whilst in a forensically sound manner. This is achieved by utilising a combination of integrated hardware, process driven configuration and deployment protocols in conjunction with comprehensive event auditing within a secure Linux Operating System.

SPEKTOR Forensic Intelligence is the base product which operates in a Linux environment, providing the ability to triage and forensically image a wide range of digital media, such as computers, USB external storage devices and card based media, e.g. SD, Compact Flash etc.

Yes, SPEKTOR is configured with designated read only protected USB and Firewire ports, allowing media to be individually ‘triaged’ or forensically imaged via the SPEKTOR Control Pod to a triage collector disc or store disc for imaging. A multimedia card reader is supplied as standard, which supports a variety of proprietary media formats.

The creation of search profiles is wizard-driven, using clear, concise terms and intuitive onscreen graphics. The operator is able to create new, edit, clone and save as many profiles as required to suit individual operational needs.

Whether performing standard triage or creating forensic images of target systems (SPEKTOR produces images in Encase, FTK, SMART and DD formats) the target systems/devices are always accessed 100% read-only. This has been validated in our own forensic laboratories and by CAST during their recent evaluation of triage tools. Standard triage mode and Forensic imaging uses exactly the same techniques that forensic analysts use when processing a target with a Linux boot CD. Target computers can be booted either from a Linux partition on the SPEKTOR collector or from the SPEKTOR Linux boot CD. We use a specially crafted OpenSuse Linux in both cases and all target access is 100% read only, resulting in absolutely no changes being made to the target media. Live mode is used to acquire data from running windows computers and, like every other live response tool, the process does make some small changes to the target. Such changes are impossible for any tool to avoid. However, we do not make any changes to file system dates and times and restrict the changes we do make to a couple of entries in the Windows Registry that relate to the attachment of the SPEKTOR Collector, a similar entry in the Setupapi.log file and a further entry in the Pre-fetch data showing the collection code being run. Any attempt to remove these entries after collection would not reflect good forensic practice so we don’t do it.

Yes, SPEKTOR Drive is able to undertake triage collections on Intel based MacBooks and forensic imaging on all models by using the MacBook expansion card variant.

Following a triage based collection, data can be reviewed and marked as an item of interest and subsequently selected to be exported to either a USB storage device or optical media. Exported content includes logical files, hash values, a full file listing, html report and full details of the collection configuration.

No, SPEKTOR utilises a special boot disc which allows the target computer to be booted in a forensically sound manner and preventing the often onerous task of disassembling modern notebooks and prevents any change ‘writes’ being made to the target disc being accessed. An ISO image of the boot disc is stored on SPEKTOR, allowing you to burn as many bootable CD’s as required, in order to undertake multiple, consecutive triage collections or full disc imaging.

To maintain the maximum effectiveness of SPEKTOR, new updates are released on a regular basis, which can be downloaded directly onto SPEKTOR via our secure support portal. We are always looking to improve functionality and welcome feedback from users, which directly contributes to ongoing product development.

Recoverable deleted data is collected as part of standard triage collections, which is designed to collect and present potentially valuable evidence and actionable intelligence within the shortest possible time frame. SPEKTOR can be deployed to undertake full forensic imaging in a variety of proprietary formats, e.g. EnCase, FTK, SMART and DD, in order to support further extensive traditional forensic analysis.

To maintain the maximum effectiveness of SPEKTOR, new updates are released on a regular basis, which can be downloaded directly onto SPEKTOR via our secure support portal. We are always looking to improve functionality and welcome feedback from users, which directly contributes to ongoing product development.

Audit and logging is at the heart of SPEKTOR. MD5 and SHA1 hash values are calculated for every file SPEKTOR collects together with comprehensive logs covering the entire triage or imaging process, from the initial registering of the collector to the control pod, through the cleaning of the collector prior to deployment, the deployment process, the automatic data analysis process and even the users navigation of the results and which files they have viewed. The level of log detail exceeds that produced by Accessdata’s FTK forensic tool. It also logs when and how a user exports data from SPEKTOR.

No, we recommend that forensic analysis be undertaken on systems identified by SPEKTOR as containing potential evidence. SPEKTOR is designed to allow intelligent decisions to be made by the user at the point of contact with suspect device. The use of SPEKTOR does not affect any subsequent forensic analysis.