There are two primary categories of digital forensics tools, those that acquire evidence (data), and those that analyze the evidence. Typically, "presentation" functionality is rolled into analysis tools.

Acquisition tools, well... acquire data. This is actually the easier of the two tools to write, and there are a number of acquisition tools in existence. There are two ways of storing the acquired data, on a physical disk (disk to disk imaging) and in a file (disk to file imaging).

At Forensic Computing.

[ Read more ]