hemu1438/forensicsgpt-training-data huggingface dataset:
Stego suite -
Stego Suite™
Stego Suite is comprised of four specialized products: Stego Hunter™, Stego Watch™, Stego Analyst™, and Stego Break™. This comprehensive suite of applications is designed to quickly identify, examine and analyze digital images and/or audio files for the presence of hidden information or covert communication channels. Detecting the presence of steganography is a tedious process; without advanced tools it is close to impossible to detect. Using Stego Suite investigators are able to utilize the latest algorithms for flagging suspicious files through a blind anomaly-based approach, examine files with image filters, analyze DCT coefficient histograms, and track palette manipulation with close color pairs, shortening investigation time drastically and allowing investigators to work specifically within the four tools provided in the suite.
Key Features:
Rapid identification of known steganography programs, Flag suspicious files through blind anomaly-based approach, State-of-the-art image and audio analyzer, Crack and extract payloads from carrier, Court ready investigator reports, Scan audio files, JPG, BMP, GIF, PNG and more
filesSystem Recommendations:
Microsoft Windows® 98 or higher, 100 MB free disk space, 512 MB RAM, Pentium® III 1GHz processor
License:
Single user license allows for installation of entire suite, Site licenses are available upon request
Contact Information:
1-877-WETSTONE ext 2
www.wetstonetech.com
Sqlite recovery -
Modern operating systems typically contain many SQLite databases (often in excess of 100), SQLite Recovery can be used to display all of them alongside each other allowing the investigator to gain an overview of the type and content of all of the databases on the suspects computer. These databases can contain anything from SMS messages to lists of passwords and are an invaluable source of evidence.
SQLite Recovery is a forensic tool to aid in the recovery of SQLite databases, tables and records. SQLite Recovery can search a disk, volume, image or file for deleted SQLite databases.
The output of SQLite Recovery is individual SQLite databases that can be investigated with other forensic software such as SkypeAlyzer.
Features
Simple to use Template based Carves deleted journal and WAL files Carves unknown databases (including those in unallocated space) Search all tables for multiple keywords at one Template constraints can override column affinity Extracts to SQLite databases to investigate with 'other' forensic software Export a recovered table to XLS Parse time filtering to improve quality of recovered data Optionally display numeric columns as formatted date Advanced filters to clean up data post parse Automatically identify and delete duplicate rows Supports parsing from individual files (DD/Unallocated), logical and physical devices, EWF images.
External Links
SQLite Recovery
Ata interface -
ATA is the AT Attachment interface, one of two major standards for connecting storage media devices like hard drives to personal computers (PCs). The opposing standard is SCSI.
PATA is the Parallel ATA specification. Mostly incorrectly referred to as IDE (Integrated Device Electronics) by a lot of vendors. SATA is the Serial ATA specification.
ATAPI is an extension on the ATA standard for optical media, like CD, DVD, Blu-Ray.
References
Wikipedia: Parallel ATA
ATA/ATAPI-5 T13 Technical Specification
Windows media player database extractor -
The Windows Media Player Database Extractor (.wmdb) is a commercial analysis tool, part of the Simple Carver Suite of tools.
Windows Media Player Database Extractor (.wmdb) is a tool designed to view and extract information contained within the Microsoft Windows Media player data file typically titled as CurrentDatabase_360.wmdb. The CurrentDatabase_360.wmdb file can contain file name, file properties, music, video, photo and playlist information.
Useful for use in forensic examinations as forensic software or by data recovery technicians. All extracted information from the Windows Media Player CurrentDatabase_360.wmdb file is saved and presented as csv, text or html report formats.
Bkf recovery tool -
BKF Recovery Tool is one of the most user-friendly tools to recover corrupt backup files from your system. With an advanced recovery algorithm, this MS BKF Recovery tool can recover maximum possible data from your corrupt BKF files.
Features
Can recover backup files created by NT-Backup utility tool
Can repair and recover MS BKF files of more than 1TB
Advanced search option, which let users to search specific BKF files in their system as well as in the recovered database
Let users to scan as per their needs with the help of Range Scan
Can resolve all corruption error messages
Allow users to preview the status of their recovered files and folders with the help of tree-structure preview
BKF Recovery Tool allows its users to preview more than 200 file formats
Simple & easy to use GUI
Snapshot feature for saving and uploading them
Compatible with all version of MS Windows
External Links
Official Website
Carbon -
CARBON is a virtualized forensic analysis tool for the Windows operating system, developed by SUMURI.
Product Overview
CARBON automatically virtualizes and bypasses Windows logons to give you instant access to the user's desktop. All virtualization is done in a manner which protects the data from changes or alterations.
Product Features
Write block internal and attached devices
Includes PALADIN toolbox
Seven forensic image formats
Device cloning
Data carving
Custom search conditions
External Links
Official Website
Sqlite forensic reporter -
SQLite Forensic Reporter is a commercial analysis tool. A universal SQLite database examination tool capable of analysing, extracting and reporting on information from any SQLite database (not corrupted or encrypted). Useful for Computer & Phone Forensic Analysts and Data Recovery Technicians. Processes all SQLite database files in a case, uses advanced file recognition and decoding not available in any other tool.
This tool differs by firstly allowing the user to determine how a database is identified and then secondly how data is decoded through user created templates. Includes all the currently known date and time formats and some custom formatting options making it one of the most useful tools for examining SQLite databases to date.
Usb -
USB is an acronym for the Universal Serial Bus, a method for attaching a wide variety of devices to a host system. USB provides for hot-swap of devices, and network-like communications that allow for additional ports to be added to a system by way of internal or external hubs, often mitigating the need to physically open a host system in order to add more device capacity. There also exist some ways to redirect USB, which was already plugged to PC. Software solutions and additional steps may help to make USB device accessible over IP.
History of Past Devices
Microsoft Windows operating systems are known to record information about each USB device when it is connected. Such information can be used by an examiner to show that a person had possession of a USB device, a device was used on a machine, or that data exfiltration was conducted, for example.
USB Monitoring Tools
Windows:
usbsnoop
Linux
enable CONFIG_USB_STORAGE_DEBUG and monitor syslog
usbmon
Turn on usbfs_snoop and monitor syslog and the kernel buffer ring.
Data compass -
Data Compass is a hardware and software data recovery tool produced by SalvationDATA. The product uses a "3+1 Data Recovery" to restore damaged media. The product is intended to recover data from hard drives with multiple bad sectors, platter surface problems, head instabilities, or are making clicking sounds. The vendor claims to spin up hard drives using an emulated firmware rather than the drive's own firmware. This could enable recovery from damaged hardware, but this claim has not been independently verified. A software component is available for filesystem repair.
External Links
Official website
File carving guidedcarving -
GuidedCarving is a File Carving technique to recover fragmented files introduced in Adroit Photo Forensics. GuidedCarving allows a user to attempt to recover a fragmented file that failed to fully recover using SmartCarving.
Process
The user opens a photo that has failed to recover properly.
The user identifies the first error on a photo by clicking on it.
Adroit Photo Forensics then presents the user with the best possible block matches.
The user cycles through the presented blocks to find the correct continuation block.
User can then choose to either manually build the rest of the file or allow SmartCarving to take over again.
Edbmails exchange recovery tool -
EdbMails is an Exchange server recovery tool that helps to recover corrupted database that has data such as mails, calendar, contacts, journals, notes, attachments etc. It has options to preview content before exporting from an edb file to pst file, Office 365, Live Exchange Server.
Overview
EdbMails application is the unique solution to view, read and export email items of the offline EDB files. It support all major Exchange server versions. Also, using EdbMails you can migrate mailboxes to Office365 user accounts and Live exchange server directly.
Features
Extract Mailboxes from Corrupted EDB files: EdbMails Application is engineered with best programming methodologies that enables the complete extraction of email items from the corrupted or damaged EDB files. All the mail items like calendar appointment, contacts, mail, mail attachments, Task, Notes, folder structure will be exported to PST file.
Ability to Export individual item: It enables the users to recover single email to MSG, EML etc formats. It can filter recovery operation for items based on subject and date.
Exchange server granular recovery: Granular Recovery is used by many backup solutions to allow recovery of the smallest data set within a larger backup set.
Recovery of Deleted Mailboxes/folders: Recover all the accidentally deleted mailboxes and folder from the EDB file using EdbMails Application.
Migration of EDB to Office365: It has options to choose multiple mailboxes for Office365 according to requirements and route recovered mailboxes data to appropriate Office365 user mailbox.
Migrate EDB to Live Exchange server: Migrate your mailboxes from EDB to live Exchange server using EdbMails application.
License Information
For software’s license related information, visit our website Licence agreement
Technical Support
24/7 technical support services is offered through modes, i.e. live chat, voice messaging, telephone, email support to assist with any software related issue.
External links
Official Website
Video tutorials for EdbMails
Blog
Cofee -
Computer Online Forensic Evidence Extractor (COFEE)
COFEE is a collection of Microsoft software designed to all the easy capture of important "live" computer evidence at the scene in cybercrime investigations, without special forensics expertise.
The fully customizable tool allows your on-the-scene agents to run more than 150 commands on a live computer system. It also provides reports in a simple format for later interpretation by experts or as supportive evidence for subsequent investigation and prosecution. And the COFEE framework can be tailored to effectively meet the needs of your particular investigation. To help combat the growing number of ways that criminals use computers and the Internet to commit crimes, Microsoft is working with INTERPOL and the National White Collar Crime Center (NW3C) to provide COFEE at no cost to law enforcement agencies in 187 countries worldwide. INTERPOL and NW3C are also working with Florida State University and University College Dublin to continue the research and development that will help ensure that COFEE serves the needs of law enforcement, even as technology evolves.
Law enforcement can get COFEE from NW3C at https://www.nw3c.org/ or by contacting INTERPOL at COFEE@interpol.int.
File carving smartcarving -
SmartCarving is a file carving technique to recover fragmented files first proposed by A. Pal, T. Sencar and N. Memon in DFRWS 2008.
The term smart carving was already proposed in 2006 in Analysis of 2006 DFRWS forensic carving challenge - A smart carving approach.
SmartCarving utilizes a combination of structure based validation along with validation of each file's unique content. Results for the SmartCarving technique were demonstrated on fragmented JPEGs in the DFRWS 2006 and DFRWS 2007 challenges. From these two challenges SmartCarving was able to recover all but one fragmented JPEG file.
History
Memon et al. presented an efficient algorithm based on a greedy heuristic and alpha-beta pruning for reassembling fragmented images. Building on this work, Memon et al. researched and introduced sequential hypothesis testing as an effective mechanism for detecting fragmentation points of file. This paper won the best paper award for DFRWS 2008. The techniques presented in the paper were the foundation for the overall SmartCarving design.
Details
After identifying a header block of a specific file type, for example, JPEG, a SmartCarver will analyze each subsequent block to determine if it belongs or does not belong to the starting block. If a block is determined not to belong, then the file is assumed to be fragmented and the SmartCarving algorithm looks for the next fragment by matching the data of other available blocks with the first fragment. This process can be done in parallel for many files.
Applications
There are currently two commercial applications available that utilize SmartCarving, both produced by Digital Assembly:
Adroit Photo Forensics
Adroit Photo Recovery
Further there is one open-source solution under development:
Multimedia File Carver - Implementation that focuses on the recovery of fragmented movies and images (JPEG)
References
Automated reassembly of file fragmented images using greedy algorithms, by A. Pal and N. Memon, in IEEE Transactions on Image processing, February 2006, pp 385­393
Detecting File Fragmentation Point Using Sequential Hypothesis Testing, by A. Pal, T. Sencar and N. Memon, Digital Investigations, Fall 2008
Foremost -
Foremost is a Linux based program data for recovering deleted files and served as the basis for the more modern Scalpel. The program uses a configuration file to specify headers and footers to search for. Intended to be run on disk images, foremost can search through most any kind of data without worrying about the format.
History
Foremost was developed by Jesse Kornblum and Kris Kendall when they served in the Air Force Office of Special Investigations. Originally designed to imitate the Defense Computer Forensics Lab's
carvthis program, it gained popularity among Air Force investigators and was eventually distributed to the general public.
First published in 2000, a major update was released in 2005 when Nick Mikus joined the project.
Spinoffs
Foremost served as the basis for Golden G. Richard III's Scalpel, a significantly faster program to also recover deleted files. It has also inspired tcpxtract, a program for extracting file from network traffic.
Foremost's authors have recommended that practitioners use Scalpel instead of Foremost.
Limitations
Due to programming difficulties, foremost is limited to processing files smaller than 2GB.
Forensic email collector -
Overview
Forensic Email Collector (FEC) is a digital forensics software developed by Metaspike. FEC connects to cloud email providers and on-premises email servers and forensically preserves email evidence.
Features
Connects to Microsoft Exchange servers via Exchange Web Services (EWS)
Supports Exchange In-place Archive, Recoverable Items Folder, and Public Folders
Connects to Gmail / Google Workspace via REST API
Connects to Microsoft Graph API
Connects to virtually any email provider that supports the IMAP4 or POP3 protocol
Acquires Google Drive attachments of emails during Gmail / Google Workspace acquisitions
Supports instant In-place Searches and comprehensive Inline Searches
Supports enterprise authentication scenarios via delegate access and impersonation
Automatically re-tries email preservation to acquire failed email messages
Ability to resume past projects
Supports OAuth authentication
Provides detailed acquisition and exception reports
Flexible output options including MIME, MSG and PST format
Hashes output using MD5, SHA1, SHA256 or SHA512
Uses Exchange Autodiscover to automatically detect Exchange Web Services (EWS) endpoint URL
Performs MX lookups to identify mail provider for target domain
Includes numerous built-in connection profiles for popular email service providers
External Links
Official Website
Tsk cp -
Tsk-cp is a set of LibCarvPath aware versions of The Sleuth Kit tools, that are for use together with the normal versions of the other sleuthkit tools in the process of doing zero storage carving.
The tools are:
mmls-cp : A CarvPath based version of mmls for listing a partitioned carvpath disk images as a list of partition carvpaths.
dls-cp : A CarvPath based version of dls for listing all continuous unallocated fragments of a carvpath partition holding a filesystem as a list of unallocated block carvpaths.
icat-cp : A CarvPath based version of icat that instead of copying out the data of an inode within a carvpath partition holding a filesystem as the carvpath of the file and the carvpath of the file slack.
The carvpaths output by dls-cp can be used as the input of a CarvPath aware carving tool.
See Also
Open Computer Forensics Architecture
Forensic toolkit -
The Forensic Toolkit (FTK) is a commercial forensic software package distributed by AccessData.
Features
The Forensic toolkit can parse a number of filesystems, including FAT 12/16/32, NTFS, NTFS Compressed, ext2 and ext3. It can use image files created by AFF, EnCase, SMART, Snapback, some versions of Safeback and dd.
The program allows users to search with keywords or take advantage of drive indexing using the dtSearch algorithm.
Data Reduction
The Known File Filter, or KFF, can be used to eliminate or highlight known files using MD5 hashes generated by user or from NIST or Hashkeeper.
External Links
Forensic Toolkit information from AccessData
Forensic toolkit for sqlite -
The Forensic Toolkit for SQLite includes three comprehensive software applications, The Forensic Browser for SQLite, Forensic Recovery for SQLite and SQLite Forensic Explorer, which make recovering SQLite records from disk, image and database simpler and more intuitive. These tools are an invaluable addition to any investigators tool box.
Forensic Toolkit for SQLite
The Forensic Browser for SQLite
A comprehensive database browser that recovers live and deleted records from SQLite databases as well as rollback journals and write ahead logging journals. The browser provides numerous data conversion facilities and allsow you to display numbers in many datae formats and apply timezone conversions, display blobs as pictures, integrate maps into report, export tables in many formats and provides a comprehensive visual query building interface.
The Browser also supports extensions that can be written by Sanderson Forensic or by our users. Extensions can be used to decode data encoded or encrypted in tables (usually in blobs - such as in Facebook orca2.db blobs) or can be used to decode files to 'import' the data in the the Browser (the latest extension decodes and imports tables from Microsoft ESE/EDB/JetBlue databases)
SQLite Forensic Explorer
SQLite Forensic Explorer is an investigative tool designed to show every single byte of an SQLite database or WAL file along with its decoded data. This means you can look at any field in the DB/WAL file header and see what it means, or you can look at an index B-Tree page and see each structure within the page decoded.
SQLite Forensic Explorer provides an unparalleled view into the structure and workings of SQLite at a file level and is invaluable to forensic investigators looking for deleted data (or a corrupt database) or to those who simply want to know more about the structure of a database
SQLite Forensic Recovery
SQLite Recovery is a forensic tool to aid in the recovery of SQLite databases, tables and records. SQLite Recovery can search a disk, volume, image or file for deleted SQLite databases. You can search for specific databases and tables 'described' by a signature or you can let SQLFR search for all databases (known and unknown) on a volume.
Gargoyle investigator -
Gargoyle Investigator™ Forensic Pro Edition
Gargoyle Investigator Forensic Pro Edition is our most advanced malware detection software package for rapid in depth forensic investigations. It is designed for forensic laboratories, law enforcement, field investigators and advanced private investigators. Gargoyle performs a quick search for malicious software programs and provides significant clues regarding activities, motives and the intent of the suspect or potential suspects. Gargoyle goes beyond the standard virus protection software with our extensive collection of “hostile” programs that typical virus protection software cannot detect. This tool was developed to shorten investigation time and provide accurate and detailed forensic evidence reports to assist investigators in the malware investigation process.
Key Features:
Ability to conduct scans on a stand-alone system or network resource,20 datasets containing thousands of types of malicious software, Dataset Creator™ - ability to create or extend datasets, Interoperable with popular forensic tools such as EnCase™ and FTK™, 32-Bit and 64-Bit drive mounting and management integration, Detailed forensic evidence reports with secure source timestamping
System Recommendations:
Microsoft Windows® 2000, XP, Vista, 130 MB free disk space, 256 MB RAM, Pentium® III 1GHz processor
License:
Single user license, To Simultaneously scan suspects up to 100 systems please view Gargoyle Investigator™ Enterprise Module.
Contact Information:
1-877-WETSTONE ext. 2
www.wetstonetech.com
Minitool data recovery -
MiniTool Power Data Recovery (Free) is a Free Partition Recovery & Data Recovery Software that helps recover deleted, lost or damaged logical drives and partitions on Windows, then recover data from them.
It bundles several tools that together can recover lost and deleted data from hard drives, USB drives, and nearly every kind of disk or directory that can hold (and lose) data.
Undelete Recovery
"Undelete Recovery": is used to recover mistakenly deleted files and folders.
Damaged Partition Recovery
"Damaged Partition Recovery": is used to recover data from damaged partition. For instance, if a drive is displayed as RAW and Windows asks "Do you need to format this drive?"
Lost Partition Recovery
"Lost Partition Recovery": fully supports lost or deleted partition data recovery.
"Digital Media Recovery": can help users recover digital media files such as photos, music files and video from storage devices such as memory card, memory stick and USB flash disk.
CD/DVD Recovery
"CD/DVD Recovery": is available for users to recover deleted or lost data from formatted or scratched CD/DVD.
External Links
MiniTool: Data Recovery Software
Blockhashloc -
BlockHashLoc (BHL) enable the recovery of files via previously made small files with a list of blocks hashes.
With adequately sized blocks (512 bytes, 4KB, etc. depending on the media and File System), this let one recover a file regardless of the FS used, or the FS integrity, or the fragmentation level.
Tech spec
Byte order: Big Endian Hash: SHA-256
BHL file structure
section desc note 
Header	Signature & version		
Metadata	Misc info		
Hash	Blocks hash list & final hash		
Last block	zlib compressed last block remainder	if needed	
pos to pos size desc 
0	12	13	Signature = ‘BlockHashLoc’ + 0x1a	
13	13	1	Version byte	
14	16	4	Block size	
18	24	8	File size	
Metadata
pos to pos size desc 
26	28	4	Metadata section size	
30	var	var	Encoded metadata list	
Hash
pos to pos size desc 
var	var	32	1st block hash	
…	…	32	…	
var	var	32	Last block hash	
var	var	32	Hash of all previous block hashes	
Versions
Currently the only version is 1.
Metadata encoding
Bytes Field 
3	ID	
1	Len	
n	Data	
IDs
ID Desc 
FNM	filename (utf-8)	
FDT	date & time (8 bytes, seconds since epoch)	
External Links
BlockHashLoc GitHub