Forensic approach

One of the key concept of the forensic approach is that the evidence do not have to be modified.

Tyrhex respect this concept and still allows the user to edit some volume properties using a virtual layer for each volume, saved as other information in the case file but without any effect on the evidence file.

Findings have to be documented and, when vital for investigation, cross-checked by use of alternative forensic tool. Some forensic tools use the same libraries, especially to decode file systems properties and artefacts. The unique file systems libraries included in Tyrhex provides a robust alternative tool.

tyrhex © Yves Vandermeer  2015-2017   #tyrhex