Autopsy Digital Forensics vs. Colasoft Capsa

Autopsy Digital Forensics is great for image investigation, just do a copy of the image, load it up and do the investigation. In the hands of DFIR specialist this software can do wonders in revealing various of pieces of information from an image. Software is easy to use and even a novice could use it without much trouble (assuming he has the knowledge of what to search for).

Capsa is highly recommended to be used in small dense areas of a network where it makes sense to be able to run analytics off of a mirror port to gain insight into traffic trends. It is a costly product to install in branch locations, and requires a decent spec hardware to run appropriately

Incentivized

• Easy to use UI
• Fast compared to competitors
• Ability to use modules and plugins
• Portable
• Just does the job

• Robust Application. Able to handle traffic that most businesses will throw at it.
• Easy to use. Easy to setup captures and filter down to specific traffic types.
• Relatively cheap for what it's able to accomplish.

Incentivized

• None - this software is amazing.

• Needs options to scale to 10Gb/s networks. The cutoff for performance looks to be around 3Gb/sl
• Needs API access to trigger capturesl
• Needs Agents for remote capturesl

Incentivized

Autopsy was easier to use, I liked the UI more and it just felt better.

Colasoft performs more like the traditional wireshark as opposed to other solutions that tend to focus on graphs instead of giving you the raw data. I personally prefer the raw data, and then the ability to build graphs upon this (which Capsa can do). This allows for quicker analysis and makes it easier to relate to.

Incentivized

• Easies forensic investigations
• Has great training platform
• Has a free version

• While the product doesn't detect malware, it has helped track down malware infected machines by using data from other applications to run filters to look for known traffic destinations for that malware. For me this is a huge ROI since malware can be the great unknown.
• Relatively cheap compared to the feature set.

Incentivized