I attended presentations from Mr. Tim Miller, at business development from Paraben Corp. and Eric Thompson, founder and CTO at AcessData Corp.

Enterprise forensic systems acquire, consolidate, preserve and analyze corporate wide information to be used in possible litigation.

Both companies had previous standalone products and have evolved them to the enterprise arena.

Mr. Miller made a product oriented presentation, but raised good points on what the problems and best practices in the activity are.

He explained what his company calls “360º forensics”: the gathering of information in a pristine fashion from all kind of devices and focusing on what the persons do, not what devices involved in actions are.

In the core of their enterprise solution there’s a 3 tiers architecture:

– A hidden Monitoring Software that gathers all kind of information regarding users’ activity.
– A Central Authentication.
– A Captain Module.

I asked him if (how and why) evidence presented using their tools gets questioned in court. Mr. Miller answered yes, of course there’s some opposition to evidence against one. He pointed as factors that minimize the success of an opposition: the presentation of multidimensional, coherent information, less technical and more appealing to persons; and training (“good training creates good case law”).

Mr. Thompson on his side made a very close, honest presentation, adapting it to what we the audience asked and giving us a good share of details about the best practices on the setup and fine tuning of their product for the performance conscious user. He presented the new features added to version 3.2 of their product FTK.

They include:

–          Rewritten Processing Engine,
–          The ability to «merge case index» to speedup searches,
–          The ability to set up global filters, labels or columns,
–          The possibility to define custom carvings,
–          New improved email analysis and results presentation,
–          The ability to show the relevance of documents calculated by occurrence per size unit,
–          A web server based front end and
–          New logging of all the actions performed during the session.