Cyber Security Technologies

Cyber Security Technologies Corporation (CST) is the innovation leader in affordable software products for computer investigations. CST was formed by industry veterans who see the need for new investigative tools designed for the changing investigative environment. We are dedicated to delivering technically advanced but easy-to-use software products for corporations, government agencies, service providers and law enforcement, as well as related training and certification. CST is an affiliate of Architecture Technology Corporation, a technology company specializing in software-intensive solutions for complex problems in IT security and high-security network computing applications. Learn more...

Mac Marshal™ automates the analysis of Mac OS X file system images. It scans a Macintosh disk image, automatically detects and displays Macintosh and Windows operating systems and virtual machine images, and provides the investigator with analysis tools to automate the extraction of Mac OS X-specific forensic evidence.

Highlights of the features available in Release 1.0 of Mac Marshal are:

Analyzes Mac OS X and dual-boot disk and partition images in multiple formats
Analyzes configuration and log files from OS X applications, such as Apple Mail, Safari, iChat, Quick Time Player, and Address Book
Automatically gathers comprehensive machine usage information
Automatically detects and provides analysis of FileVault-encrypted user directories
Automatically detects VMware, VirtualBox and Parallels virtual machines
Lists detailed information about every iPod and iPhone that has been connected to the machine
Provides rapid searching of Spotlight file metadata
Supports dd, EnCase, FTK, AFF, and Apple disk images
Maintains a detailed audit trail and generates detailed reports in HTML, PDF, RTF and tab-separated value formats

Learn more

The OnLine Digital Forensic Suite™ (OnLineDFS for short) is a software product for performing forensic-quality investigations of live computers in networked environments. We built OnLineDFS for IT security professionals, service providers and law enforcement professionals who need to conduct investigations of live computers for:

incident response;
compliance monitoring;
e-discovery;
criminal investigations.

The OnLineDFS architecture does not use pre-installed agents on target systems. Thus, OnLineDFS is very simple and inexpensive to deploy, maintain and use, offering the best price/value in the industry.

OnLineDFS is a feature-rich tool which enables an investigator to capture and analyze volatile data (including the memory, running processes, open ports, process/port associations, and much more), as well as the full array of persistent data required for a forensic analysis. Because OnLineDFS was designed for conducting investigations over a network, it enables the investigation of target systems which are geographically remote as well as close-at-hand.

Learn more | Training

P2P Marshal™ is a computer forensic tool which automatically detects, extracts and analyzes P2P evidence on hard drive images. P2P Marshal provides forensic investigators with a powerful investigative product that automates the tedious, time consuming process of identifying P2P usage on computers under investigation.

P2P Marshal automatically detects a roster of the most commonly-used P2P client programs and presents per-user information on those clients, including shared files, downloaded files, peer servers, and configuration and log information. P2P Marshal performs these tasks in a forensically valid way and presents the results in an easily readable form on-screen and in a format that can easily be incorporated into a report.

P2P Marshal is available in a software-only version called Forensic Edition, and in a USB 2.0 flash drive version called Field Edition.

Forensic Edition

Forensic Edition is a software product which is installed and runs on an investigator's workstation to analyze a disk image. Forensic Edition requires a unique serial number to be installed on a specific workstation; a different serial number is required to install Forensic Edition on a different workstation.

Field Edition

Field Edition is available on a USB 2.0 flash drive only and requires no installation to run. The Field Edition is different from Forensic Edition in two respects:

Field Edition may be plugged into a USB port of a live target computer and used to conduct an investigation of that target computer’s hard drive (i.e. an image is not necessary);
Field Edition may be moved from computer to computer – no installation is required, and thus it is portable.

Other than the ability to examine a live target and portability, Field Edition is identical to Forensic Edition.

Field Edition requires no serial number for operation and is ideal for use in the field where investigators may have access to a live target system. Analysis of a target system may be performed without the requirement of performing a disk image.

Field Edition is also ideal for use in a forensic lab to examine disk images. It may be used on any available forensic workstation since it executes from the USB flash drive.

P2P Marshal follows forensic best practices and maintains a detailed log file of all activities it performs. It has extensive search capabilities, produces reports in CSV, RTF, PDF and HTML formats, and runs on common Windows platforms.

Learn more | Training

Press Releases

Frost & Sullivan Recognizes Cyber Security Technologies with Product Innovation of the Year Award
- Press Release 12/2/09