pbobby wrote:
Can't be paralyzed by the potential for errors, gaps in data and the like.
Who says you have to be paralyzed?
pbobby wrote:
If your case hinges on one or two critical pieces of information - spend the effort to validate manually or with multiple tools.
Interesting point; so how would you go about this? Look on the internet for articles, read a book? Do you cross validate the findings in the article or book. I recently ran into serious error in a book that even states to be a forensic book. The fact that have done a lot of validation directly made it clear to me that this book was full of errors. I reported the errors to the authors, but is very disappointing that the authors have not address various errors they made in computer science fundamentals. It is even more disappointing to see various, to use your terminology, "big names" claiming the book is good while it is full of errors.
So it would be interesting to hear how you validate your tool?
I largely do it by writing my own, and documenting my findings in the process.
pbobby wrote:
when is your testing ever enough to start trusting the tool?
There never will be too many edge cases, so how can we, as a non-exact science address that?
* By applying scientific methods
* By making sure to validate your findings when it matters; when does it matter that will depend
* By having open format specifications
* By having tooling that is transparent in what it finds (not necessarily open source)
* By having proven and validated methodologies (which is ironic if you consider Zdziarski a couple of years ago)
pbobby wrote:
These sorts of FUD come out every year - I guarantee everyone here, including the 'big names' in this thread, all use tools
FUD or not will largely depend on how you approach the discussion.
↧