Monday, May 7, 2012

Digital Forensics:Forensic Tools

Computer Forensic Tools
      

Disk tools and data capture

Name
From
Description
MoonSols
Generates physical memory dump of Windows machines, 32 bits 64 bit. Can run from a USB flash drive.
Guidance Software
Create EnCase evidence files and EnCase logical evidence files [direct download link]
Magnet Forensics
Checks local physical drives on a system for TrueCrypt, PGP, or Bitlocker encrypted volumes
4Discovery
Edit EWF (E01) meta data, remove passwords (Encase v6 and earlier)
Ridgecrop
Enables large capacity disks to be formatted as FAT32
Web Content Protection Association
Browser designed to forensically capture web pages
AccessData
Imaging tool, disk viewer and image mounter
vogu00
Multi-threaded GUI imager under running under Linux
Kazuyuki Nakayama
Safely remove SATA disks similar to the “Safely Remove Hardware” icon in the notification area
CERT
Allows examiner to boot dd images in VMware.
Paraben
Mount forensic images as read-only local logical and physical disks
Belkasoft
Extracts RAM dump including that protected by an anti-debugging or anti-dumping system. 32 and 64 bit builds
Passmark Software
Boot utility for CD/DVD or USB flash drives to create dd or AFF images/clones.
Passmark Software
Mounts a wide range of disk images. Also allows creation of RAM disks
Tableau
Imaging tool for use with Tableau imaging products
Microsoft
Converts raw disk images to VHD format which are mountable in Windows Disk Management

Email analysis

Name
From
Description
Lepide Software
Open and view (not export) Outlook EDB files without an Exchange server
MiTeC
Viewer for Outlook Express, Windows Mail/Windows Live Mail, Mozilla Thunderbird message databases and single EML files
Lepide Software
Open and view (not export) Outlook OST files without connecting to an Exchange server
Lepide Software
Open and view (not export) Outlook PST files without needing Outlook




General

Name
From
Description
Mythicsoft
Search multiple files using Boolean operators and Perl Regex
Blackthorn
Contemporaneous notes recorder
NIST
Collated forensic images for training, practice and validation
Nuix
Copies data between locations, with file comparison, verification, logging
Shirouzu Hiroaki
Self labelled ‘fastest’ copy/delete Windows software. Can verify with SHA-1, etc.
Gary Kessler
Table of file signatures
Nirsoft
Calculate MD5 and SHA1 hashes
Mobatek
Run Linux live CDs from their ISO image without having to boot to them
Arkane Systems
Automatically moves mouse pointer stopping screen saver, hibernation etc.
Notepad ++
Advanced Notepad replacement
NIST
Hash sets of ‘known’ (ignorable) files
Ted Technology
A Linux & Windows GUI for individual and recursive SHA1 hashing of files
DSi
Enables software write-blocking of USB ports
Sécurité Multi-Secteurs
Software write blocker for Windows XP through to Windows 8
Troy Larson
Guide by Brett Shavers to creating and working with a Windows boot CD

File and data analysis

Name
From
Description
Allan Hay
Reads Windows XP,Vista and Windows 7 prefetch files
David Kovar
Parses the MFT from an NTFS file system allowing results to be analysed with other tools
Various
Detects full and partial multimedia files in unallocated space
Ted Technology
Recursively parses headers of every eCryptfs file in selected directory. Outputs encryption algorithm used, original file size, signature used, etc.
Passware
Scans a computer for password-protected & encrypted files, reports encryption complexity and decryption options for each file
Phil Harvey
Read, write and edit Exif data in a large number of file types
Sanderson Forensics
View various picture formats, image enhancer, extraction of embedded Exif, GPS data
Mandiant
Examine log files using text, graphic or histogram views
4Discovery
Recursively parses folders extracting 30+ attributes from Windows .lnk (shortcut) files
Nirsoft
View and export Windows Live Messenger contact details
EMC
Network packet capture and analysis
Mandiant
Acquire and/or analyse RAM images, including the page file on live systems
4Discovery
Recursively parses folders to extract meta data from MS Office, OpenOffice and PDF files
Sanderson Forensics
Displays and decodes contents of an extracted MFT file
NetGrab
Network monitoring tool, with covert “silent port scanning”
Mike’s Forensic Tools
Lists EXIF, and where available, GPS data for all photographs present in a directory. Export data to .xls or Google Earth KML format
Microsoft
Suite of command-line Windows utilities
Shadow Explorer
Browse and extract files from shadow copies
Chris Mayhew
GUI tool for parsing .lnk files, prefetch and jump list artefacts
Mrinal Kant, Tarakant Tripathy
Firefox add-on enabling viewing of any SQLite database
Microsoft
Command-line tool for text searches
MiTec
View and manage MS OLE Structured Storage based files
Mike’s Forensic Tools
Text replacement/converter/decoder for when dealing with URL encoding, etc
MiTeC
Analyse thumbs.db, Prefetch, INFO2 and .lnk files

Mac OS tools

Name
From
Description
Twocanoes Software
Audit Preference Pane and Log Reader for OS X
Aaron Burghardt
Blocks the mounting of file systems, complimenting a write blocker in disabling disk arbitration
Blackbag Technologies
Converts epoch times to local time and UTC
AccessData
Command line Mac OS version of AccessData’s FTK Imager
Blackbag Technologies
Lists items connected to the computer (e.g., SATA, USB and FireWire Drives, software RAID sets). Can locate partition information, including sizes, types, and the bus to which the device is connected
Cyber Marshal
Command-line utility to capture physical RAM from Mac OS systems
Blackbag Technologies
Displays the physical partitioning of the specified device. Can be used to map out all the drive information, accounting for all used sectors

Mobile devices

Name
From
Description
Leo Crawford, Mat Proud
Explore the internal file structure of Pad, iPod and iPhones
Robin Wood
Extracts phone model and software version and created date and GPS data from iPhone videos.
CCL Forensics
Deconstructs Blackberry .ipd backup files
SignalSEC Corp
Obtain SMS Messages, call logs and contacts from Android devices
Zena Forensics
Extract WhatApp messages from iOS and Android backups

Data analysis suites

Name
From
Description
Brian Carrier
Graphical interface to the command line digital investigation analysis tools in The Sleuth Kit (see below)
Backtrack
Penetration testing and security audit with forensic boot capability
Nanni Bassetti
Linux based live CD, featuring a number of analysis tools
Dr. Stefano Fratepietro and others
Linux based live CD, featuring a number of analysis tools
ArxSys
Analyses volumes, file systems, user and applications data, extracting metadata, deleted and hidden items
Harlan Carvey
Automates ‘repetitive tasks of data collection’. Fuller description here
Sumuri
Ubuntu based live boot CD for imaging and analysis
SANS
VMware Appliance pre-configured with multiple tools allowing digital forensic examinations
Brian Carrier
Collection of UNIX-based command line file and volume system forensic analysis tools
How-To Geek
Guide to using an Unbuntu live disk to recover partitions, carve files, etc.
Volatile Systems
Collection of tools for the extraction of artefacts from RAM

File viewers

Name
From
Description
Microsoft
View PowerPoint presentations
Microsoft
View Visio diagrams
VideoLAN
View most multimedia files and DVD, Audio CD, VCD, etc.


Internet analysis

Name
From
Description
CCL Forensics
Python module for performing off-line parsing of Chrome session files (“Current Session”, “Last Session”, “Current Tabs”, “Last Tabs”)
Nirsoft
Reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
Mike’s Forensic Tools
Extracts embedded data held within Google Analytics cookies. Shows search terms used as well as dates of and the number of visits.
Busindre
Runs in Python 3.x, extracting forensic information from Firefox, Iceweasel and Seamonkey browsers. See manual for more information.
Belkasoft
Captures information publicly available in Facebook profiles.
Nirsoft
Extracts various details of Internet Explorer cookies
Nirsoft
Extract stored passwords from Internet Explorer versions 4 to 8
Nirsoft
Reads the cache folder of Firefox/Mozilla/Netscape Web browsers
Nirsoft
Parses the cookie folder of Firefox/Mozilla/Netscape Web browsers
Nirsoft
Reads the history.dat of Firefox/Mozilla/Netscape Web browsers, and displays the list of all visited Web page
Nirsoft
Extracts search queries made with popular search engines (Google, Yahoo and MSN) and social networking sites (Twitter, Facebook, MySpace)
Nirsoft
Extracts the user names and passwords stored by Mozilla Firefox Web browser
Nirsoft
Reads the cache folder of Opera Web browser, and displays the list of all files currently stored in the cache
Nirsoft
Decrypts the content of the Opera Web browser password file, wand.dat
Mandiant
Reviews list of URLs stored in the history files of the most commonly used browsers
Magnet Forensics
Takes list of URLs saving scrolling captures of each page. Produces HTML report file containing the saved pages

Registry analysis

Name
From
Description
Woanware
Extracts user information from the SAM, SOFTWARE and SYSTEM hives files and decrypts the LM/NT hashes from the SAM file
Microsoft
Examine Windows processes and registry threads in real time
US National Institute of Justice, Digital Forensics Solutions
For the acquisition, analysis, and reporting of registry contents
Harlan Carvey
Registry data extraction and correlation tool
Regshot
Takes snapshots of the registry allowing comparisons e.g., show registry changes after installing software
TZWorks
Extracts data from Shellbag entries
Woanware
Details previously attached USB devices on exported registry hives
4Discovery
Displays 20+ attributes relating to USB device use on Windows systems
Nirsoft
Details previously attached USB devices
4Discovery
Extracts SID, User Names, Indexes, Application Names, Run Counts, Session, and Last Run Time Attributes from UserAssist keys
Didier Stevens
Displays list of programs run, with run count and last run date and time
MiTec
Extracts configuration settings and other information from the Registry

Application analysis

Name
From
Description
Magnet Forensics
Decrypts the Dropbox filecache.dbx file which stores information about files that have been synced to the cloud using Dropbox
Magnet Forensics
Takes x,y,z coordinates found in a tile filename and downloads surrounding tiles providing more context
Sanderson Forensics
Extracts various data from the KaZaA application
Nirsoft
View and export Windows Live Messenger contact details
Nirsoft
View Skype calls and chats

Abandonware

Name
From
Description
Digital Detective
Converts various data types to date/time values
Rene Devichi
View unencrypted backups of iPad, iPod and iPhones
Foxton Software
Analysis of internet history data generated using Google Chrome
Nirsoft
Extracts recently visited Internet Explorer URLs




Domain and IP address query tools

DomainTools  https://www.domaintools.com
Domain Dossier  http://centralops.net/co/DomainDossier.aspx
IP to ASN Mapping http://www.team-cymru.org/IP-ASN-mapping.html
GeoLite2  http://dev.maxmind.com/geoip/geoip2/geolite2/
RIPEstat  https://stat.ripe.net
E-mail header analysis tools
Google Apps
Messageheader
https://toolbox.googleapps.com/apps/messageheader/
MXToolbox http://mxtoolbox.com/EmailHeaders.asp
Network monitoring tools
nfdump http://nfdump.sourceforge.net/
nfsen http://nfsen.sourceforge.net/
Network auditing tools
nmap https://nmap.org/>
AutoScan-Network http://autoscan-network.com/
Wireshark https://www.wireshark.org/
AbuseHelper https://github.com/abusesa/abusehelper>
Vulnerability assessment tools
Nessus http://www.tenable.com/products/nessusvulnerability-scanner
Metasploit https://www.metasploit.com
Vega https://subgraph.com/vega/index.en.html
OWASP ZAP https://www.owasp.org/index.php/OWASP_Zed_
Attack_Proxy_Project
SQLcheck http://www.softpedia.com/get/Internet/Servers/
Database-Utils/SQL-Check.shtml
Burp Suite https://portswigger.net/burp/
Kali https://www.kali.org/
Intrusion detection tools
Snort https://www.snort.org/
Tripwire https://sourceforge.net/projects/tripwire/
Forensic tools
Sleuth Kit http://www.sleuthkit.org/
Autopsy http://www.sleuthkit.org/autopsy/
Tcpxtract http://tcpxtract.sourceforge.net/
EnCase https://www.guidancesoftware.com/encaseforensic
FTK, Forensic
Toolkit
http://accessdata.com/solutions/digital-forensics/
forensic-toolkit-ftk
Malware analysis tools
VirusTotal  https://www.virustotal.com/
Malware Domain List   http://www.malwaredomainlist.com
Malware Hash Registry  http://www.team-cymru.org/MHR.html
MISP, Malware Information Sharing Platform   https://misppriv.circl.lu
AlienVault Open Threat Exchange   https://otx.alienvault.com
Malwr   https://malwr.com/
Honeypots
honeyd  http://www.honeyd.org/index.php
WiFi tools
inSSIDer  http://www.metageek.com/products/inssider/
Acrylic WiFi Scanner https://www.acrylicwifi.com/en/wlan-software/wlan-scanner-acrylic-wifi-free/
SIEM tools
Splunk   http://www.splunk.com
Encryption tools
GnuPG  https://www.gnupg.org/
VeraCrypt  https://veracrypt.codeplex.com/
Incident-tracking tools
RTIR  https://bestpractical.com
OTRS  https://www.otrs.com/
Databases
SQLite  https://www.sqlite.org/
MySQL  https://www.mysql.com/
PostgreSQL  https://www.postgresql.org/

  ที่มา:
thaicert  
kitploit

#WindowsForensic #computerforensic #ComputerForensics #dfir #forensics#digitalforensics #investigation #cybercrime 

#fraud #Cyber Forensic เครื่องมือ


No comments:

Post a Comment

เจาะลึก 14 Certifications ด้าน Cybersecurity

เจาะลึก 14 Certifications ด้าน Cybersecurity เจาะลึก 14 Certifications ด้าน Cybersecurity ที่น่าสนใจ! แชร์มุมมองส่วนตัวเกี่ยวกับ certificati...