Digital Forensic Tools: Comparison of Autopsy TSK and Forensic Explorer

This research aims to compare the effectiveness of two prominent digital forensics tools, Autopsy TSK and Forensic Explorer, in analysing a well-known forensic image, specifically the Lone Wolf image from Digital Corpora. The aim is to assess their capabilities in detecting and handling forensic artefacts and their responses to selected anti-forensic techniques. Autopsy TSK and Forensic Explorer exhibited robust performance in identifying and analysing forensic artefacts within the Lone Wolf image. They successfully retrieved most of the available digital evidence. Data was concealed using encryption techniques, both tools failed to detect the hidden information, highlighting a limitation in their ability to uncover encrypted steganographic content. In cases of altered Exif and metadata, both tools could retrieve the original information from the hex data of the files. However, it is noteworthy that neither tool provided an alert or warning to guide the investigator regarding potential data manipulation. Based on the findings of this research, it is advisable for digital forensic investigators to exercise caution and employ additional techniques or tools when handling cases which may involve encrypted steganography.