Skip to content

Understanding Analyst Utilities

Analyst utilities support common tasks such as hashing, extracting archives, viewing structured data, editing notes, and managing working files.

What you will learn

By the end, you should be able to choose utilities by purpose, distinguish original from derived material, and document supporting actions reproducibly.

What are analyst utilities?

Core concept

General-purpose applications become part of the forensic workflow when they open, transform, extract, hash, or display case material. Their outputs and side effects should be documented according to the importance of the task.

HashesArchivesTextTablesWorking copies

Keep in mind: Convenience does not remove the need for provenance. Keep original evidence, working copies, and derived output clearly separated.

01OriginalThe preserved source evidence or acquired representation02Working copyA verified copy used for examination03Derived outputMaterial created by extraction, conversion, filtering, or analysis

Utility roles

IntegrityCalculate and compare cryptographic hashes
ExtractionInspect and unpack archives to a controlled location
ViewingOpen text, tabular, document, and web content
WorkflowManage notes, scripts, repositories, and repeatable tasks

Why it matters

Verify files

Hashes identify exact file content and support integrity comparison.

Handle containers

Archive tools expose contained files while retaining the original package.

Review output

Text and spreadsheet tools help filter and understand structured results.

Preserve decisions

Clear notes connect supporting actions with investigation findings.

How to use utilities defensibly

  1. DefineState the task and identify whether the input is original, working, or derived.
  2. VerifyUse a trusted utility version and record its source where material.
  3. ProtectUse working copies and a controlled output directory.
  4. PerformRecord commands, settings, transformations, and errors proportionately.
  5. ReviewCheck results, hash important outputs, and retain context in the case notes.

Choose the next step

ScenarioYou need to inspect files inside an evidence archive. What is the best workflow?

Keep provenance visible

  1. 1ClassifyIdentify original, working, and derived material.
  2. 2ProtectUse controlled locations and access.
  3. 3RecordDocument transformations and relevant settings.
  4. 4VerifyCheck and hash important results.

General utilities in SUSA

Integrity

Hasher

Calculate and compare cryptographic file hashes.

Archives

7-Zip

Inspect and extract common archive formats.

Text review

Notepad++

Search and inspect text, logs, scripts, and structured output.

Continue learning