Exterro Legal Hold

My main use case for Exterro  is to parse data whenever there is an incident in a company, so I often use Exterro  to process the data and parse the artifact to find the relevant data according to the incident that has occurred.

A specific example of how I have used Exterro in a real incident involved an insider threat where an employee copied important data to a pen drive. With the help of Exterro, I parsed the image of that particular machine, and by correlating the USB artifact being used at that time and the activity of the logins that accessed that system, I correlated the USB timelines and other artifacts, such as MPAS and SIMCAS, as well as the use of the USB drive at that time, and accordingly set up the correlation of the timeline, proving that the employee copied the important file from the computer itself.

I often use Exterro to process data, regardless of whether there is an incident involving a threat actor, C2 connections, a compromised system by malware, insider threats, or HR compliance investigations where individuals extract data for personal use or might oversell it. In those cases, Exterro helps in finding malicious files, correlating data, and processing it so an investigator can use it in real scenarios to find artifacts and proofs of concepts that can be attached to reports, which are very useful for presenting to stakeholders, allowing both technical and non-technical individuals to easily understand the screenshots and artifacts collected during the data processing and analysis.

The best features Exterro offers include FTK Central, which has capabilities such as a GUI version of the investigation process for filtering and searching data plus tagging data for usefulness. Another feature is Cerberus, which provides sandboxing for particular files that help identify malicious data, which are often used for further investigations, significantly assisting in quickly finding malicious files in a system.

These features help make my investigations easier and more efficient as finding malicious files in a system is very hard without tools such as Exterro. Specifically, the Cerberus model gives a fast way to identify malicious files and flag them efficiently.

Exterro has positively impacted my organization by providing many features that aid in fast investigations of images, machines, systems, or files. It helps in structuring presentations and artifact processing so that our analysts can easily overview artifacts and present them effectively in reports that are useful for non-technical stakeholders.

I would like to add that Exterro should incorporate data processing improvements, such as for OVA files exported with cloud features such as AWS , which provide OBF files. The OBF feature should be included, and timeline sections should present artifacts in a way that allows for a tree view of multiple pieces of evidence processed simultaneously, which would help analysts handle investigations more efficiently.

Exterro can be improved by adding more sandboxing plugins or features since investigations increasingly require finding malicious files, processes, or any kind of DLLs or EXEs. If Exterro can integrate high-quality sandbox features such as Thread Gate or Fire Ice, it would greatly enhance the speed of investigations into malicious files.

I want to focus more on threat investigations, and I believe adding a timeline explorer would be beneficial. If Exterro FTK could ingest firewall logs or web access logs, it would assist in investigating cases related to defacement or beaconing activities present in particular files.

I have been using Exterro for around six years.

My advice to others looking into using Exterro is to go ahead with the product, as it is very useful. I have been using it for over five to six years, and it is particularly helpful for investigating any kind of incident and obtaining useful data pieces required for accurate findings. I would rate this product a seven out of ten.

My primary use case for Exterro  includes data collection, chain of custody, and investigation of traces and evidence.

In my opinion, the best features that Exterro  offers are that it is a very powerful tool for analysis and also for collecting information in digital investigations. I really use it a lot for performing the chain of custody and collecting and generating the image for conducting the investigation. My experience using FTK Imager shows that the product's speed and ease of use are particularly beneficial.

Exterro has had a positive impact on my organization by bringing many conveniences and delivering quick answers so that the board can make the best decision between terminating someone or even finding out if the person under investigation is or is not guilty in that incident. It is very important to carry out internal investigations with tools that guarantee the integrity of the data collected. Through this, it is possible to reach the truth of the facts and the reality of the facts. With that, it is possible to distinguish who really carried out the incident, who was involved in the incident, or who is being the victim of some kind of plot or collusion to harm that person. This way the company does not commit injustices.

In my opinion, Exterro can be improved with more accessible prices. By making the software more humanized at the financial level, it could be sold and have a culture of use across a much larger range of users and companies that today have this need but do not use FTK Suite because it is a very expensive tool.

I have had some difficulty with Exterro's stability during use. There was a crash, but I was not able to identify whether the crash was caused by the hardware or the software.

I rate customer support a nine. The company that provides us technical assistance is TechBiz here in Brazil. They are good at technical support for the products.

At the beginning of my career, I used many open-source solutions before switching to Exterro. The company I worked for already had FTK Suite as a tool, and I started practicing with it more. In my post-graduate training in computer forensics, Exterro, in this case FTK Suite, was used in the classroom. My learning culture for data, disk, and digital data investigation comes from college, in this case from my post-graduate course, which was based on this FTK platform.

I have obtained a return on investment using Exterro through a reduction in legal costs. Costs were reduced by being able to identify the fraud that occurred and thus take the decision to dismiss the person and provide the legal department with the necessary evidence for a dispute or litigation between the company and the former employee. The savings were very good because instead of paying all the costs of a dismissal, the severance payments, and all the compensations involved in an employee dismissal, the company was able to fire them for just cause without having to be obliged to pay any kind of benefit.

My experience with Exterro's pricing, setup costs, and licensing was not very good for personal use. For the company, since it is a renewal, they have a budget for it and then it took place routinely and easily. Every year the budget already included that amount to make a new update or a subscription renewal. There was no impact for the company at all. In my case, however, I was never able to have it because it is very expensive.

I researched other options on the market such as EnCase, Kali Linux , among other open-source solutions, including IPED, before deciding on Exterro.

I would advise other people who are thinking about using Exterro to do it in a very well-thought-out manner with tests and all the necessary evaluations and approvals because the investment is high. I gave this review an overall rating of nine.

My main use case for Exterro  was MDM  control. I used Exterro  for MDM  control by controlling my company's mobile devices.

In my opinion, the best features Exterro offers are complete, cheap, and free solutions. I appreciate the range of features, which seems to be the full package, and we are currently taking the free version, so it seems to be enough for us.

Exterro has positively impacted my organization with better control over devices. Since it has only been about 30 or 40 days, I cannot say much more about my experience because we are just starting.

Exterro could be improved because the documentation seems to be very short, and sometimes the kickoff setup is very tricky and confusing.

I have been working in my current field for about 20 years.

Exterro seems to be stable.

Exterro's scalability is as good as it gets.

I have not had any need for contacting support regarding customer service.

I did not previously use a different solution.

I tested Exterro for about two months. It is too early to tell if I noticed any time savings or improvements in efficiency with better control over my devices, but I think we are going to have better control over where my employees are and what activities they are developing.

I would not like to add more about the needed improvements.

It is still too early to see a return on investment. I have not saved any money yet.

My experience with pricing, setup cost, and licensing is zero cost and no licensing, which seems to be enough.

I did not evaluate other options before choosing Exterro.

My advice to others looking into using Exterro is to take a shot; I am very sure it will be good enough. I rated this review 9 out of 10.

As a forensic science student, I can realistically use Exterro for all of my academic work. It is very easy to understand and manage digital evidence. I use it for storage, tagging, and organized investigations, primarily to study digital evidence management and workflow using Exterro.

I try to incorporate what I have learned in my regular classes and apply it using Exterro, which helps me manage and understand the concepts better. I use Exterro for e-discovery, forensic and legal forensics, mobile evidence handling, and cyber crime investigation workflows. Comparing Exterro with Autopsy and FTK Imager, the UI, workflow, and reporting usability are much easier, which is why I use it.

Exterro has made me more efficient and productive. It is easier for me to manage evidence and get clearer results. It has been a much easier workplace for me compared to any other imaging or working environment.

I saved considerable time on projects that required extensive work. Exterro made it easier for me to manage everything quickly and find information more easily. It was very effective for me to understand the processes and everything involved. It was productive and saved me a significant amount of time.

The reporting and usability of Exterro are valuable to me. The investigation support is very good, and I can work with my evidence handling much better. The UI is also very good and easy to understand.

The reporting makes it easier for me to find information, and the filter system is much easier to incorporate what I have prepared. Compared to FTK Imager, it is much harder to find and manage information in other tools. Exterro makes it easier to know what I used last and allows me to restart from that particular point where I ended, then use it for my investigation and management.

I would like Exterro to be a complete forensics workflow. Currently it is effective for handling digital evidence, but it only compares with EnCase, FTK Imager, or Autopsy. I want this to expand beyond just digital evidence to include chain of custody and everything related to it across multiple categories of forensics, not just physical evidence, but every subdivision of forensics.

I want the mentioned categories to be involved more in Exterro with the existing features it already has regarding digital evidence. This would make it much easier for any officer, magistrate, or forensic expert to get into Exterro and begin their work. That would be much easier.

I have used Exterro  for about two years and applied it to my forensics work as a forensic science student. I have made several projects using Exterro  and found it very helpful.

Exterro can handle larger projects. My project was not that big, but I believe it can handle more.

I did not reach out for help, but the customer experience was good. I have seen positive feedback, and the customer service experience during this feedback process has been nice.

I was comparing Exterro with FTK Imager and other tools. They did not have AI features to make my work easier. Exterro was much easier, which is why I switched.

I did not formally evaluate other solutions, but I experimented with FTK Imager and Autopsy. Other than that, I have done all of my work on Exterro.

The initial setup was good. As a student, it was nice.

I do not remember the cost, but I did save time because I had a last-minute assignment. It was very easy and I could complete it on time. It was a good investment.

For anyone using FTK Imager or Autopsy, I would recommend that Exterro is much easier. The AI feature makes it much easier to handle and manage evidence collection. I have recommended Exterro to all my friends, colleagues, seniors, juniors, and teachers. Those who were working on projects have also felt very positive about Exterro's work.

I am having an excellent experience using Exterro. It has been a very fun and positive experience. Exterro is performing well, and my suggestion to expand into other forensic categories would enhance it further. Otherwise, they are doing great.

As a student working on Exterro, I sometimes need Exterro's help, so I mostly work on a private cloud only. I have completed a few projects on Exterro, and it has been very good and fine. My overall review rating for Exterro is nine out of ten.