IT forensics trainers

Existing forensic tools tend to favour user-friendly interfaces to facilitate an investigator’s daily tasks and these are often used when training IT forensics topics; particularly file system properties and artefacts. This can distract learners from the fundamental principles of IT forensics and key points are often overlooked by the automated processes behind these user interfaces.

Tyrhex provides a simple and clear sector based view with instant decoding of values on demand. Offset values are displayed in hexadecimal and decimal, and are are highlighted along with current row and colomn. Information about value size, endianness relevance, artefacts and available slack data are possible and can be used to promote to an intuitive knowledge of the concepts behind the data.

Bookmarks can be used to confirm student hypotheses and can be prepared before training. Colour-coding of bookmarks can also be used to support explanations too.

When discussing byte level concepts, Tyrhex is an essential training aid for digital forensics trainers.

tyrhex © Yves Vandermeer  2015-2017   #tyrhex