The Future

NTI has been a vendor of forensic software tools for many years, but the purpose of this chapter is not to simply tout the virtues of our software, training, or techniques. Although forensic tools are discussed at length, it is crucial to realize that the examiner's knowledge and the methodologies used are of higher importance than the prowess of a given tool.

Five years from now, the tools we use will certainly have changed to some degree. For example, IBM recently announced that they would be quadrupling storage capacities of hard drives between 2001 and 2005. If 60 and 70 gigabytes are common today, a fourfold increase in hard drive capacity will push many tools and techniques (and the consultants who use them) to be more efficient and effective. Many tools will need complete redesign to handle the larger file systems. NTI has already had to modify some of our techniques to handle cases that involved processing two terabyte chunks of data. With databases and file servers growing in size, such large quantities of data are becoming less of a rarity and forensic examiners need to be able to deal with vast amounts of data.

Furthermore, computers may be running completely different operating systems and file systems in the future. Therefore, examiners should not become overly reliant on tools and must develop a solid understanding of the underlying technology and related forensic examination techniques. With this in mind, tools are mentioned frequently in...