Virus File Scanner

Have you ever had an anti-virus or firewall tell you a file was malware, but you didn’t really think so?  It is a situation I encounter from time to time.  Sometimes, one security program will say one by another company is bad.

Well, there is a free site that helps you get a definitive 2nd, 3rd, 4th… 30th opinion.  It is VirusTotal.com .   A quick upload of the suspicous file to their site then it is scanned by numerous security programs.  This gives you a breadth of opinions on which to base your decision.

Another good way to get additional info, is to search for the file name in Google.  This will usually give some definitive write-ups on the file for anything that has been around for awhile.

Of course if you are in the Gainesville, Florida area… you can always contact me for a second opinion on your trojan, virus, or other malware. :)

Gainesville Data Recovery Services

I just wanted to give a little update on my local Gainesville business.  I have been super busy lately! It seems like with every computer repair or data recovery job I do for a University of Florida student or professor I get 3 more jobs.  I am not complaining mind you :)   It just show how valuable word of mouth is among the UF community.

I have been doing more referral work, also.  Other computer shops recommending me, usually after they have given it a shot :)   It is all good.

I just want to thank everyone  who has been recommending me and helping my business take off.  THANKS!!

CNW Recovery

I first downloaded CNW Recovery this software when I was working on my forensics certification. It was in Beta at the time. It was already then a nice piece of software, but needed some polishing at the time. Even then though there documentation was VERY impressive.

I recently downloaded the demo to take another look at it. I was very impressed. The software is geared towards data recovery, not forensics. The software is extremely versatile. It does a lot more than the traditional, “I can get your photos back” programs. It does have uses for forensics uses also.

I actually had a case where the suspect had deleted the boot sector in an effort to make the drive unreadable. I was able to use CNW recovery to get evidence off the drive. The software was stable and easy to use. It made quick work of the recovery job.

I will be buying the software for my data recovery business.

By the way, I am serious about their manual (and website). You can learn some lessons on data recovery just reviewing all that they have available for reading.

I am predicting that CNW Recovery will be a major player in the future of the data recovery world! Remember where you heard it!

When I have more experience with the software under my belt, I will report back with a more detailed review.

X-Ways Forensics my First Week

Earlier this week my X-Ways Forensics dongle arrived. (For anyone who is not familiar with that, it is basically a small USB key that is your license for the software.) I spent most of the rest of the week working on a criminal case that will probably go Federal. I mostly used X-Ways as my forensic tool.

The tool has performed as promised so far. All the features have either been intuitive to use or concisely explained in the manual. Some computer software manuals make you feel like the author tried to figure out how to make it as difficult to follow as possible. For instance, I have never found the Encase manual to be an easy read.

With X-ways, I had found files and evidence, within an hour, that I had failed to locate with Encase. I am not claiming that Encase is incapable of finding the same files…. I was just know that I didn’t find them with Encase. I have not attended the Encase training due to their high cost. A trained user may know some way to get the software to find the same evidence. Under X-Ways though, with only a few hours under my belt with the software I was able to find the files.

Speed is one thing that just kept amazing me with the software. This investigation was very image intensive. I was able to just fly through sorting, filtering, marking for report inclusion, viewing, and commenting on files. Even though I was intentionally trying to push the software, I never got a single crash. It was always very quick moving from Hex View, Calender View, Preview…whatever I needed to do. The skin color percentage sort feature for images in AWESOME!

I spent the last few hours of today starting work with the report module. The report module was performing well. I just say well, because I was having to include a lot of images and movies that had been encrypted by the file system of the suspect machine. This required me to recover the files outside of X-Ways then import them into the “case.” The good news is that this is possible and reasonably quick with X-Ways. To start setting up the whole report package for export to external devices was taking some tweaking of the report HTML code. Nothing major, just changing file source addresses. This was because the files were being referenced to their absolute location on the drive and not relative to the report. (In X-Ways defense though, I have to say this was my first time using their report module and I was in a hurry at the end of the day. So, it is possible there is a way to do it that would have saved the HTML coding issue.)

Another important point, I had a question about the software the other day. I sent a support email. I got a response within about 10 minutes from the lead software designer himself. That was impressive service. Can’t say I have ever gotten that good of service on any other software.

I still hope to get back with an even more detailed review when I have more experience under my belt. I wanted to let everyone know how it was going though.

Recover Deleted Files on You Own

I frequently get approached with the following scenario in Gainesville. I lost some files on my computer, but can’t afford to have professional data recovery done. What can I do?

Well, there are two quick free things that you can do.

1. There is a free piece of software called Recuva by Piriform. They are the same folks that provide ccleaner for free. They of course ask for donations to support them if the software works for you. I have used the software, testing it, with success. It is not by any means a top of the line piece of forensic software, but, for a free easy to use product, it seems to be pretty nice.

2. Many times the problem with recovering files lies with your Windows installation more than with the file. Files can often be viewed and recovered in Linux when they are unreachable under Windows. There are many distributions of Linux that run on a bootable CD-ROM. They are mostly free. I really like Puppy and DSL Linux myself. There are many others though. The Linux approach will involve a learning curve if you don’t know Linux. But, it is free!