I hate to say this as it costs money, but if you already have encase...wny not take a look at encase portable as well for portable acquisition? My second question is why ftk imager in the first place, encase got a free imager? Its not as complete as ftk's free imager, but if all you need is imaging and not parsing or searching it may be something worth checking out.
Link to guidance's imager:
https://www.guidancesoftware.com/products/Pages/Product-Forms/Forensic-Imager-download.aspx
You are right that proprietary forensics softwares tend to be the standard, but from what I know the court decides if you an "expert witness" and if your evidence is "forensically sound." For example, if your software has a bug for the particular evidence that you acquired, the evidence is still discarded. Manually parsed evidence is something the only evidence you can acquire in some cases (just a nature of an industry that is always changing), software just makes these automated processes faster and possible more free of human errors (debatable topic).
Yeah you definitely need to educate them, a good starting point may be that these forensic softwares just do automatically what can be done manually and that they are still subject to bugs and other limitations.
Hope that helps
↧