hemu1438/forensicsgpt-training-data huggingface dataset:
Executable -
An executable file is used to perform tasks according to encoded instructions. Executable files are sometimes also referred to as binaries which technically can be considered a sub class of executable files.
There are multiple families of executable files:
Scripts; e.g. shell scripts, batch scripts (.bat)
DOS, Windows executable files (.exe) which can be of various formats like: MZ, PE/COFF, NE
EFI fat binary; roughly a 48-byte header and 2x MZ-PE/COFF
ELF
Mach-O
External Links
Wikipedia: Executable
Anatomy of a Program in Memory, by Gustavo Duarte, January 27, 2009
Extracting Compiler Provenance from Program Binaries, by Nathan E. Rosenblum, Barton P. Miller, Xiaojin Zhu, June 2010
Journey to the Stack, Part I, by Gustavo Duarte, March 10, 2014
MZ, PE/COFF
Wikipedia: Portable Executable
Microsoft PE and COFF Specification
Peering Inside the PE: A Tour of the Win32 Portable Executable File Format, by Matt Pietrek, March 1994
An In-Depth Look into the Win32 Portable Executable File Format, by Matt Pietrek, February 2002
MZ, PE-COFF executable file format (EXE), by the libexe project, October 2011
The Internal of Reloc .text, Full Disclosure Mailing list, October 21, 2013
DBG, PDB
Wikipedia: Program database
Matching Debug Information, by debuginfo.com
Public and Private Symbols, by Microsoft
DbgHelp Structures, by Microsoft
Internet Archive: Microsoft Symbol and Type Information, by Microsoft
Stream Descriptions, pdbparse project
libmsdebug, by the MinGW project
The Types Stream, by Brendan Dolan-Gavitt, October 4, 2007
Minidump
MSDN: MINIDUMP_HEADER structure
minidump_format.h, by Google, 2006
Parsing Windows Minidumps, by Brendan Dolan-Gavitt, May 7, 2008
Format of a minidump (mdmp) file, Internet Archive: StackHash blog, May 16, 2011
Mach-O
Wikipedia: Mach-O
Tools
MZ, PE/COFF
pefile, multi-platform Python module to read and work with Portable Executable (aka PE) files
PDB
pdbparse, Open-source parser for Microsoft debug symbols (PDB files)
Minidump
Dumpchk.exe, by Microsoft
minidump, Python library to parse and read Microsoft minidump file format
Recovering overwritten data -
Can data be recovered from a hard drive after that data has been written by 35 passes of random information? How about a single pass of zeros?
Whether or not such data can be recovered has been a question of debate for decades. Unfortunately, there have been few hard facts published.
Prior Work
The Gutmann Paper 1996
The most widely known paper in this area is Peter Gutmann's 1996 classic, Secure Deletion of Data from Magnetic and Solid-State Memory, Proceedings of the Sixth Usenix Security Symposium 1. An extended version of the paper appears on Peter Gutmann's website 2.
In this paper, Gutmann discusses techniques using an electron microscope that might work for recovering overwritten data. He then proposes a series of erasure patterns that can be used to overwrite data from hard drives that use different kinds of encoding schemes. A total of 35 patterns are proposed, although, as Gutmann notes, there is no reason to ever use all 35 patterns (because the patterns are designed for use on different kinds of magnetic recording technology).
It's important to realize that this paper, written in 1996, discusses a magnetic recording technology that is no longer widely available. In 1998 Gutmann added the Epilogue to Gutmann's 1996 paper. The gist of that epilogue is that two passes of random data should be enough for today's disk drives.
ActionFront's Drive Independent Data Recovery 2005
In August 2005 ActionFront Data Recovery Labs presented a detailed paper at the IEEE 16th Annual Magnetic Recording Conference in which they discussed the current state-of-the-art of recovering information from hard drives without using the drive's own read/write heads 3.
One of the key points that the paper makes is that there is a high degree of variability between individual modern hard drives. Manufacturers exploit this variability to increase drive densities. Unfortunately, this variability makes it dramatically harder to perform drive independent data recovery — that is, a single recovery approach that will work on multiple drives.
Current Work
Paper: Overwriting Hard Drive Data: The Great Wiping Controversy
In December 2008 Craig Wright, Dave Kleiman, and Shyaam Sundhar R.S. presented a paper at ICISS2008, which purpose was "a categorical settlement to the controversy surrounding the misconceptions involving the belief that data can be recovered following a wipe procedure" 4.
See also
Remnant Data
Recovering deleted data
Recovering bad data
Unicdma -
Features
Modes
Hyndai HWT /HWP-110/120/220
Hyndai HGC-310e, HGC-600e
LG
Qualcomm
Samsung SPH-A460
Samsung (general)
Samsung SCH-X127/X250/X350/…
Sky IM-1200/1400/2000/etc.
Withus
Read
Hardware date
Software date
Software version
CAI rev
SCM
ESN
Analog MIN
Digital MIN
Security Code
Lock Code
EEPROM
Size
custom or 16384, 32768, 65536
Memory
Starting Address
Length (bytes)
custom or 524288, 786432, 1310720, 1703936
Write
ESN
SCM
A-KEY
Scan
Memory
Range
Step (bytes)
custom or 256, 512, 1024, 2048, 4096, 8192, 16384, 32768, 65536, 131072, 262144, 524288, 1048576
Settings
COM Port
1 to 4
Baud rate
19200, 38400, 57600, 115200
Forensics
UniCDMA can be used in cell phone forensics to access or modify the phone's ESN, security code, lock code, firmware, or filesystem.
Troubleshooting
LG
If UniCDMA cannot be used to place an LG cell phone in DM Mode, the following procedures may be followed:
Close UniCDMA
Connect LG cell phone to computer using USB data cable
Open Hyperterminal
Connect to LG cellphone on correct COM port at 115200 bits per second
Place LG cellphone into DM mode by typing "AT\$QCDMG"
Close Hyperterminal
Azimuth radioproof enclosures -
Azimuth’s RadioProof Enclosures provide an RF-interference free environment in which to test wireless devices. RadioProof enclosures provide up to 90 dB of radiated RF isolation for a broad range of technologies that operate in frequency bands between 1 - 6GHz.
Features
-RF ports for controlled test traffic path connection (six to ten ports depending on model) -Dual 10/100/1000 Ethernet ports that support Power over Ethernet(PoE) -An 8 pin COMM port for serial or other custom communication links to the device under test -Power connections to provide up to 50V power to the device under test
References
Official website
Data copy king -
Data Copy King is one disk image hardware, DoD data wipe hardware and also used as one professional forensic disk image tool.
Data Copy King has build-in IDE and SATA ports and supports USB data copy with adapters, it is one 1:1 hard drive duplicator. The top features of DCK is its claimed disk image speed at 7GB/min and data wipe speed at 8GB/min and its ability to copy bad sectors/unstable drives.
Background of Universal Hard drive duplicator
In the past, traditional hard drive duplicators and imaging tools can only copy good hard drives or drives with few bad sectors, most of them were designed without considering the data copy from unstable drives after head or platter swap or drives with a lot of bad sectors. If you use the traditional image tools to copy such unstable drives, the imaging process usually get stuck, the source drive stops working when only part of data is copied and other kind of imaging obstacles. At this time, you need to re-copy the data and reset the starting LBA value. The operators can not guarantee at all what and how much data has been copied, what has been omitted. The direct loss is your efficiency loss, data copy failure and even further damage to your data storage medias to cause permanent data loss.
Add-on of Universal Hard drive duplicator
Disk wipe tools are flooded in the data wiping market. As we all know, when we are using our hard disk drives, we always meet bad sectors, both logically and physically, sometimes, if your computers have a fall, there might be some slight scratches even if it's still detected in the bios, as time passes by, the bad sectors and scratches become more severe and your drives become undetected at that time. Before that deadly failure, we should perform effective data backup and wipe the disk for data security. But traditional disk image tools or hd duplicators can not copy and wipe the unstable drives with bad sectors or scratches at all, therefore, we need not only some new and powerful data copy solution but also strong disk wipe solution to wipe data on the unstbale sectors and slightly scratched drives. That's why Universal hard drive duplicators need also an add-on for disk wipe solutions.
Universal hard drive duplicator
'Universal' indicates the storage medias from hard drives to flash drives, from good storage medias to storage medias with defects such as a lot of bad sectors, unstable heads or motor after head or platter swap, clicking drives but still detected in the bios or other kind of logical failure with detected status;
'Universal' suggests a combination of multiple Data Copy related solutions such as drive health checking, data clean or data destruction;
'Universal' means the wide use among different fields like data recovery field, IT after sale field, Education and training field, Government and miliary field, computer forensics field, Financial department field etc;
One important thing to mention about the 'Universal' here is the green concept used, no backdoor design, physical read only, 0 training required, friendly and nice interface, Energy-saving, cost effective, etc.
Esda -
From 'forensic science' Andrew R.W. Jackson and Julie M. Jackson. Publisher: Pearson prentice hall.
ESDA which stands for Electrostatic detection apparatus, is a machine used within forensics for document examination. The machine allows the visulisation of indented writing wihout damaging the document.
The questioned document (usually a piece of paper) is put onto the bronze plate, then a thin film is placed over it. A corona (a highly charged wire) then passes over the film, giving it an electrostatic charge. The areas in which the paper is indented will have the greatest charge. Once the corona has passed over the film, the bronze plate is titled and photocopy toner powder (with small glass beads) is added. The toner then adds to the areas of greatest charge, and thus allows the indentation to now be seen.
External Links
ESDA®2 product site
Paraben stronghold bag -
Paraben's Wireless StrongHold Bag is an "evidence bag" for wireless radio frequency devices, for PDAs, Cell Phones, and SmartPhones.
In order to prevent a wireless device from connecting to the network, the device (e.g. a Cell Phone) can be placed inside of a RF Isolation bag or Faraday bag to blocks radio transmissions.
First responders can help to maintain the integrity of evidence contained in wireless devices through the use of this equipment. It should be noted that power should be supplied to the device if the data is volatile in nature, but the cable may introduce a pathway for electromagnetic signals to penetrate the controlled environment.
One example of such a kit is Paraben's Wireless StrongHold Bag. This bag is weaved from three layers of nickel, copper, and nylon silver. The company also produces a StrongHold Tent, which allows the investigator to enter the radio signal dampened environment and also to bring in other equipment, such as laptops, in order to facilitate the investigation. As with any type of tool, RF isolation must be thoroughly tested before introduction to actual digital evidence.
External Links
Product website
Accessdata -
AccessData offers computer forensics software and training. Their flagship product is Forensic Toolkit, but they offer several others including:
FTK Imager - a free imager available as a program that is installed, and a "lite" version that can run without installation.
Password Recovery Toolkit, a workstation-level password cracking application.
Distributed Network Attack, their distributed cryptographic brute force cracking network.
FTK Mobile Phone Examiner, a cellular phone evidence collection tool.
Trivia
In 2006, a team from AccessData won the DC3 Digital Forensics Challenge.
External Links
Official Website
Recon imager -
RECON IMAGER is a forensic imaging software, developed by SUMURI for macOS, and is based on OS X.
Product Overview
RECON IMAGER can image all Intel® based Apple computers, including the newest generation of MacBook Pro with Touch Bar. It has a simplified GUI to ensure that the digital footprint of the program is small to maintain maximum integrity of data stored in RAM.
Product Features
Interprets Apple FileVault, Fusion and Core Storage volumes and disks to make decrypted forensic images by entering the user's password or Recovery Key.
Image RAM without an admin password
Rolling update structure to stay current with newest MacOS releases
Quintuple boot system.
Native MacOS boot environment
RAM imager - admin password not required.
Controls write protection.
Fusion drive support.
Apple core storage support.
Includes all versions of PALADIN Forensic Suite
External Links
Official Website
Antivirus software -
Antivirus software is a program or suite of programs working in collaboration with each other in order to protect a device from malware such as viruses, worms, Trojan horses, and spyware.
Protection Methods
Signature Based Detection
Antivirus programs that use signature based detection contain a constantly updated dictionary of virus signatures. Whenever a file is opened or is scanned during a system scan, the antivirus software checks the contents of the file against the signatures in the virus dictionary. This method is efficient at detecting presently existing malware, but is less effective at detecting newer, innovative viruses.
Heuristic Based Detection
Because there is such a large number of viruses in existence, viruses are often classified into families. These families consist of the main virus and any variants it may have. This method of protection allows for new viruses to be caught faster than signature based detection because of shared areas of unique code that are identical within that family of viruses.
File Emulation Based Detection
File emulation based virus detection is performed by opening files in a virtual environment and retaining a log of what actions the program performs. The antivirus software can then review the actions contained in the log and determine whether or not the file is malicious.
Mobile Antivirus Solutions
Unlike desktop PCs, applications on smartphones run each application independent of each other. This ensures that each application on the device cannot access the data of other applications. Because of this, any antivirus software installed on the device is not able to access all of the data contained within the other applications unless the device is jailbroken or rooted.
External Links and Resources
How effective is antivirus software on smartphones? - TechRepublic
Wikipedia entry regarding antivirus software
Aryson outlook pst repair -
Aryson Outlook PST Repair is a renowned software which helps users in repairing, recovering and restoring corrupt Outlook PST files. MS Outlook stores all your email data, attachments and other files in PST format. And these PST files are quite prone to corruption. In case of corruption, users might not be able to view, open or edit their files and emails. But with the help of Aryson Outlook PST Repair, a user can easily repair and recover corrupt data files and can also restore deleted emails from Outlook. This application supports all versions of MS outlook and also let users to save the recovered files different formats.
Features
Repair and recover inaccessible emails
Restore accidentally deleted emails and their attachments
Support recovery of Outlook mailbox items like Calendar, Contacts, etc.
Let users to save files different formats like: Outlook PST, EML, Outlook Express DBX, MBOX and even in MSG format
Support recovery of Non-English characters
No data loss during recovery
Maintains folder hierarchy and the integrity of your data
Advanced search and preview feature, to search and preview files
Simple and easy GUI
Support all MS Outlook formats and their PST files
Compatible with all versions of MS Windows
External Links
Official Website
Apple safari -
Apple Safari is the default web browser included with Mac OS X.
Locations
The Safari browser uses different locations to store different kind of information.
The user directory:
On MacOS-X
/Users/$USER/Library/Safari/ 
On Windows XP
C:\Documents and Settings\%USERNAME%\Application Data\Apple Computer\Safari\ 
On Windows 7
C:\Users\{user}\AppData\Roaming\Apple Computer\Safari\ 
The cache directory:
On MacOS-X
/Users/$USER/Library/Caches/com.apple.Safari/ 
On Windows XP
C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Apple Computer\Safari\ 
On Windows 7
C:\Users\{user}\AppData\Local\Apple Computer\Safari\ 
History
The browser history is stored in a binary plist file named History.plist in the user directory.
For each website, the program records the URL visited, the date and time of the last visit, and the number of times the site has been visited.
The date and time values are stored as a floating point value containing the number of seconds since Jan 1, 2001 00:00:00 UTC.
Downloads
The downloads history is stored in a plist file named Downloads.plist in the user directory.
Last Session
The browser last session information is stored in a plist file named LastSession.plist in the user directory.
Cache
The Safari cache is stored in Cache.db in the cache directory.
This file uses the SQLite database format.
External Links
iOS / macOS - Tracking Downloads from Safari Without Downloads by Scott Vance, Friday, 28 May 2021
Tools
J.A.F.A.T. Archive of Forensics Analysis Tools home of Safari Forensic Tools (SFT)
Adroit photo forensics -
Adroit Photo Forensics (APF) is a commercial forensic software package distributed by Digital Assembly. It specializes in the recovery and analysis of digital photographs.
Features
Adroit Photo Forensics can parse a number of filesystems, including FAT 12/16/32, NTFS, (Classic) HFS, and HFS+. It can read from EnCase as well as raw/dd images.
It is best known for implementing the SmartCarving and GuidedCarving algorithms to recover fragmented photos.
Exif
Adroit Photo Forensics also parses exif data and can be used to view and group files based on exif date stamps instead of file system date stamps. APF also includes a full zoomable time-line viewer based on exif and file system date stamps.
Other Features
Adroit Photo Forensics interface is optimized for the display of photos. APF also include grouping and sorting options that are photo relevant.
Aryson pdf merge -
Aryson PDF Merge'' is one of the best applications to combine or merge multiple PDF files into one. Managing multiple PDF files can be hard sometimes and users may face issues regarding management of these files. But with the help of Aryson Technologies, a user can easily combine PDF files is no time. With a simple and easy to understand user interface, even a novice user can use it without any technical help.
Features
Combine PDF files without altering its data
Can select multiple number of files
Support adding folder containing all PDF files
Let users to add passwords in the generated PDF file
Let users organize the PDF files as per their order
Simple and easy to understand user interface
Support all versions of Adobe Acrobat DC
Compatible with all versions of Microsoft Windows
External Links
Official Website
Safe boot disk -
The System Acquisition Forensic Environment (SAFE) Boot Disk is the first and only commercially available forensically sound Windows Boot disk by ForensicSoft. SAFE is a fully licensed version of Windows PE protected that is protected by the proven SAFE Block XP software write blocking technology.
SAFE Boot Disk now allows you to boot any x86-based computer without the need to remove the drives or worry about the need for special adapters or controller cards. Because SAFE Boot Disk is based on Windows PE it includes built in driver support as well as the ability to easily install any drivers that may be missing. This also means the Safe Boot Disk includes built in support for the NTFS file system without the need for third party tools and has the ability to write to NTFS and NTFS compressed file systems, taking advantage of larger partition sizes, larger file size limits and the advantage of native NTFS compression.
In order to ensure the SAFE Boot Disk is a forensically sound Live CD it has the proven write blocking technology used by SAFE Block XP built in to ensure that upon booting every attached disk and flash device are automatically blocked without any required user interaction. Unlike some of the Linux Live CD's this is true write blocking and not just mounting read-only or not auto-mounting.
Finally SAFE Boot Disk provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, has built in Case Logging and built in tools for exploration, viewing, and simple forensics functions.
External Links
Download site
Belkasoft acquisition tool -
The Belkasoft Acquisition Tool (BelkaImager) is a free forensic imaging utility developed by Belkasoft. Four types of data sources are currently supported:
Hard and removable drives
Mobile devices
Windows RAM memory
Cloud data
The acquired image can be then analyzed with Belkasoft Evidence Center or any similar third-party tool.
Hard and removable drive imaging
BelkaImager can acquire hard drives, SSD drives and removable drives connected to a computer, laptop or tablet. The drive can be acquired as DD or E01 image. Physical or logical acquisition can is performed.
Mobile device acquisition
The product acquires data from Android and iOS devices (iPhones, iPads).
RAM capturing
RAM memory of a running Windows computer, laptop or tablet can be dumped in a raw format.
Cloud data downloading
BelkaImager can download data from a number of cloud services such as iCloud and Google Drive.
Belkasoft live ram capturer -
The Belkasoft Live RAM Capturer is a free volatile memory acquisition tool developed by Belkasoft. It allows to reliably extract the entire contents of computer’s volatile memory – even if protected by an active anti-debugging or anti-dumping system. Separate 32-bit and 64-bit builds are available in order to minimize the tool’s footprint as much as possible. Memory dumps captured with Belkasoft Live RAM Capturer can be analyzed with Live RAM Analysis in Belkasoft Evidence Center or any other similar product.
Bypassing Anti-Debugging and Anti-Dumping Protection
Acquiring volatile memory from a computer running a debugging protection or anti-dumping system is tricky. Most memory acquisition tools run in the system’s user mode, and are unable to bypass the defense of such protection system (which run in the systems’ most privileged kernel mode).
Belkasoft Live RAM Capturer is designed to work correctly even if an aggressive anti-debugging or anti-memory dumping system is running. By operating in kernel mode, Belkasoft Live RAM Capturer plays on the same level with these protection systems, being able to correctly acquire address space of applications protected with the most sophisticated systems such as nProtect GameGuard.
Compatibility and System Requirements
Belkasoft Live RAM Capturer is compatible with 32-bit and 64-bit editions of Windows including XP, Vista, Windows 7/8/10, 2003 and 2008 Server. The tool does not require installation, and can be launched from a USB thumb drive.
Sql log analyzer -
SQL Log Analyzer is an Forensic Analysis tool for SQL transaction log details and associated database recovery.
Features
SQL Log Analyzer is a commercial tool to analyze the Log file transaction belonging to an SQL Server database, for eDiscovery purposes. The analyzed SQL Log transactions can further be used for recovering the corresponding database file (MDF) from corrupt state. Additionally, support to all SQL Server versions, unlimited database or log file size, and different options to export data; are featured in the tool.
Note: SQL Server environment is not a requirement to run the software unless the data is being exported directly to an SQL Server database.
External Links
Official Website