Digital forensic examiners are investigators who are experts in gathering, recovering, analyzing, and presenting data evidence from computers and other digital media related to computer-based .They might work on cases concerning identity theft, electronic fraud,investigation of material found in digital devices ,electronic evidence, often in relation to cyber crimes.
Thursday, March 11, 2021
Cloud Forensics:How To Extract Credential Data Using KeyScout
Cloud Forensics:How To Extract Credential Data Using KeyScout
Credit Photo by: blog.oxygen-forensic
KeyScout is a utility built into Oxygen Forensic® Detective which uncovers and extracts user data, tokens and passwords from apps and web browsers as well as Wi-Fi hotspot passwords, iTunes backups, and operating system data on PCs running Windows.
OxyKeyScout.Windows.exe
1. Run KeyScout on the target computer
The KeyScout application is one of the tools available in the tool suite
concept of the Forensic Detective product. KeyScout is a standalone
application that can be run locally.
2. Start search
3. Save collected data to an inserted removable drive (this collection will contain both an ocpk file and odb file).
Save resulted
Export Finished
2 passwords and 3 tokens. That’s bad all by itself. Out of 8 different applications, 5.67GB. of data – we’ll have a look.
Or, as you’ll see inside Detective when you finally pull extracted data
into a case, the accounts and passwords section is the same information
that would be contained in an OCPK file. You’ll see a button in the tool
called ‘Export to OCPK.’ We’ll talk about the way you’d do that and
what that means. But this is the literal ability to grab the account
data to feed the Cloud Extractor.
Well, let’s look here: Passwords and tokens.
Who knows what you’re doing? Select it all.
4. Investigators can import the ocpk file to Oxygen Forensic® Cloud Extractor and the odb file to JetEngine.
“Import credentials file generated by Oxygen Forensic Detective, which
we just saw, or KeyScout, which we just saw. If you click that, it’s
looking for that OCPK file.
สรุป
Oxygen Forensics เป็นผู้พัฒนาเครื่องมือประเภท digital forensics เพื่อช่วยในการสืบสวน ตัวเครื่องมือมีความสามารถในการวิเคราะห์ข้อมูลทั้งจากคอมพิวเตอร์ ,โทรศัทพ์มือถือและเก็บข้อมูลบนคลาวด์ หนึ่งในความสามารถที่ถูกเพิ่มเข้ามาในเวอร์ชันหลังๆ คือการดึงข้อมูลของ Credential Data จาก application มาวิเคราะห์ได้
No comments:
Post a Comment