DOCSEARCHbyAlgolia
Submit Docs

Forensics Wiki

repository·main·Indexed 43 days ago

https://github.com/forensicswiki/wiki

An open-source repository and website providing comprehensive information on digital forensics, including tools, research papers, and industry figures. The wiki covers technical topics such as NTFS $MFT analysis, macOS Target Disk Mode acquisition, AAC file metadata extraction, and guidance on using ADF Solutions products like Triage-G2, Triage-Examiner, and Triage-Responder.

Tokens
289.4K
Snippets
464
Records
1.5K
Agent score
50%

What's inside Forensics Wiki

  1. Overview of DeepSound steganography tool

    main
    DeepSound is a Windows-specific steganography tool used to hide data within audio files and extract it later. It supports encoding files into audio formats and can utilize AES 256-bit encryption to secure the concealed data. Because the data is embedded in audio, it can be stored on media like CDs, making the presence of hidden data non-obvious to anyone unaware of its existence.

  2. Overview of HD HPE PRO for Hard Drive Repair

    main
    HD HPE PRO is a specialized toolset produced by SalvationDATA designed for hard drive platter replacement and disk head exchange. It is specifically engineered to address head stack and Data Storage Module (DSM) issues. The tool is intended for data recovery professionals to handle physical failures such as clicking drives or stuck/burnt spin motors in a controlled, stable environment to prevent data corruption or further physical damage caused by manual misalignment.

  3. Overview of the Forensic Toolkit for SQLite

    main
    The Forensic Toolkit for SQLite is a suite of three commercial applications designed to simplify the recovery of SQLite records from disks, images, and databases. The toolkit is intended for forensic investigators to recover live and deleted data and to analyze the low-level structure of SQLite files.

  4. Overview of Belkasoft Live RAM Capturer

    main

    Belkasoft Live RAM Capturer is a free tool used for volatile memory acquisition. It is designed to extract the entire contents of a computer's RAM, even when the system is protected by aggressive anti-debugging or anti-dumping mechanisms (such as nProtect GameGuard).

    Key features:

    • Kernel-mode operation: By operating in kernel mode, it can bypass protections that typically block user-mode acquisition tools.
    • Low footprint: Separate 32-bit and 64-bit builds are provided to minimize the tool's impact on the target system.
    • Portability: The tool is non-installable and can be run directly from a USB thumb drive.
    • Analysis compatibility: Captured memory dumps can be analyzed using Belkasoft Evidence Center (Live RAM Analysis) or other standard memory forensics products.

  5. Overview of Oxygen Forensic Suite

    main
    Oxygen Forensic Suite is a mobile forensic software package developed by Oxygen Software designed for the logical analysis of cell phones, smartphones, and PDAs. It is used to extract device information, contacts, calendar events, SMS messages, event logs, and files, including associated metadata.

  6. Introduction to Steganography Training Course

    main

    The 'Introduction to Steganography: Steganography and Data Exfiltration' is a virtual one-day training class designed to teach the methods, techniques, and threats associated with steganography.

    Key Learning Objectives:

    • Understand the evolution and future of steganography.
    • Learn how criminals and terrorist organizations use steganography for command and control communication and intelligence.
    • Master techniques to detect, shunt, disrupt, and destroy steganographic communications.
    • Identify unauthorized use of steganography to prevent data exfiltration within an organization.

    Target Audience:

    • Forensic Investigators
    • Law Enforcement (Local, State, and Federal)
    • Private Investigators
    • IT Security Professionals
    • Security Auditors

    Upon completion, participants are expected to be able to execute full investigations in their respective disciplines, with proficiency tested via certification exams.

  7. Overview of Net/FSE: Network Forensic Search Engine

    main

    Net/FSE is a server application designed for network operations, specifically optimized for processing high-volume IP-based network log data (e.g., from firewalls, IDS, and routers).

    Key components include:

    • Data Capture Service: Streams log data in near real-time.
    • Indexing Service: Processes and indexes log records for fast retrieval.
    • Search Service: Enables fast drill-down and analysis of billions of records.
    • Web Interface: A Tomcat and GWT-based UI designed for security, compliance, troubleshooting, and management workflows.

    Integration can be achieved via Socket-based APIs or HTTP-based XML APIs.

  8. Overview of fiwalk

    main

    fiwalk is a batch forensics analysis program written in C that utilizes the Sleuth Kit library to process disk images. It is designed to extract metadata and file information from disk images and can output results in several formats, including:

    • XML: Digital Forensics XML (DFXML).
    • ARFF: Attribute Relationship File Format, used by the Weka Datamining Toolkit.
    • Textual: An easy-to-read text format.

    It is primarily used for disk analysis and data carving tasks across Linux, FreeBSD, MacOS, and Windows environments.

  9. Overview of Security Onion for Forensics

    main
    Security Onion is a Linux distribution pre-configured with a suite of forensic, Intrusion Detection System (IDS), and Network Security Monitoring (NSM) tools. While its primary design focus is IDS and NSM, it serves as a comprehensive platform for digital forensics due to the wide array of pre-installed investigative tools.

  10. Overview of SIMCon (Paraben's SIM Card Seizure)

    main
    SIMCon (now known as Paraben's SIM Card Seizure) is a forensic tool used to securely image all files on a GSM SIM Card using a standard PC-SC smart card reader (serial or USB). It allows investigators to acquire, analyze, and interpret data stored on the card, including stored numbers, call history, and text messages. The tool supports both SIM and USIM cards and provides secure file archiving using hashing.

  11. Overview of Belkasoft Evidence Center X

    main
    Belkasoft Evidence Center X is a commercial digital forensics solution designed for the acquisition, location, extraction, and analysis of digital evidence from computers and mobile devices. It supports a wide range of sources including hard drives, drive images, memory dumps, mobile devices, and chip-off dumps. The tool is capable of discovering over 1500 types of artifacts, including 300+ mobile applications, various document formats, browsers, email clients, social networks, and system/registry files.

  12. What is MattockFS?

    main

    MattockFS is a computer forensics actor-framework component, data repository, and message bus implemented as a Fuse based user-space filesystem. It is designed to serve as a foundational component for actor-model based computer forensic frameworks.

    Key characteristics include:

    • Immutability: Uses CarvPath annotations to designate frozen repository data, providing a lab-side privilege-separation equivalent of Sealed Digital Evidence Bags.
    • Provenance: Maintains trusted provenance logs that record actor/worker roles in processing digital evidence chunks, preventing untrusted modules from falsifying logs.
    • Message Bus: Provides a domain-specific, localhost message bus oriented towards actors and toolchains, utilizing sparse-capability based access to an Anycast message bus.
    • Hashing: Performs opportunistic BLAKE2 hashing on active CarvPaths during low-level reads and writes.
    • Performance Optimization: Features page-cache friendly archive interaction, job picking policies (optimized for hashing or page-cache load), and load balancing support via a 'load-balancer' actor that can steal jobs from overloaded actors.
    • Extensibility: Provides hooks for distributed FIVES router functionality and provides metadata (throttle information) regarding page-cache load and actor queue sizes to help frameworks manage data output.