hemu1438/forensicsgpt-training-data huggingface dataset:
Academic forensics programs graduate level -
US Programs
American InterContinental University
Arizona State University
Boston University
California Sciences Institute
Carnegie Mellon University
Champlain College
Dartmouth College
George Mason University
George Washington University
John Jay College
Michigan State University
Maryville University
Naval Postgraduate School
Polytechnic Institute of New York University
Purdue University
Sam Houston State University
Stevenson University
Texas State University
University of Alabama-Birmingham
University of Albany-SUNY
University of Central Florida
University of Massachusetts, Amherst
University of New Haven
University of New Orleans
University of Rhode Island
University of Texas at San Antonio
Utica College
Center for Information Security University of Tulsa
West Virginia University
Europe
Cranfield University, UK
Limerick Institute of Technology
University of Amsterdam
University of Bradford
University of East London
University College Dublin
University of Technology, Mauritius
University of Strathclyde
University of Glamorgan, Wales, UK
University of Applied Sciences Albstadt-Sigmaringen, Germany Master of Science, Digital Forensics, in cooperation with University of Mannheim and University of Tübingen, Germany
Asia
Zayed University UAE
Australasia
Edith Cowan University, Perth, Western Australia
Africa
University of Cape Town
See Also
American Academy of Forensic Sciences (AAFS)
Digital Forensics Association List
Msg viewer -
MSG Viewer MSG Viewer is a freeware application to open and view single email file of Microsoft Outlook without platform availability.
Features
The email data in an MSG file can be viewed in modes including; normal, hex, MIME, HTML, etc., for respective purposes. Further, this application can be upgraded to a licensed version adding facilities to export into PDF. The upgradation to licensed version has to be executed through purchase.
External Links
Official Website
FREE MSG Viewer
Nsf merge tool -
NSF Merge Tool is an innovative application For IBM Notes users. NSF Merge tool helps IBM users to merge two or more NSF files into one. This is one of the most easy to use software to merge multiple NSF files. Not only this, it allow users to join files too plus have the ability to consolidate unlimited Lotus Notes archive database files.
Features
NSF Merge Tool let users to consolidate unlimited archive database files
Allow users to merge as well as join Lotus Notes files
Support merging of emails, archives, events and contacts
Option to filter duplicate entries
Compatible with all versions of IBM Lotus Notes
Easy and simple user interface
External Links
Official Website
The onion router -
Tor (The Onion Router) is an implementation of second-generation onion routing.
Overview
Tor is a distributed censorship-resistant network designed to anonymize TCP-based applications.
Attacks
Timing attacks
Tor fails when the attacker can correlate timing patterns on both ends of the communications channel.
Misconfigured software
DNS leaks
Some applications do name resolution directly (bypassing Tor proxy). In this case lookup requests leak significant information (e.g. website being visited).
Web browsers
Enabled scripts: Java and Flash applets may leak real IP address (see Metasploit Decloaking Engine);
Enabled cookies: web server can identify clients using unique cookies.
Direct connections in Instant Messaging also leak real IP address
TLS attacks
Various deviations of system time can be detected in TLS traffic (e.g. HTTPS traffic). Attacker can modify system time of the target computer (or group of them) via NTP and easily trace TLS connections from anonymous network.
Eavesdropping by exit nodes
Tor doesn't encrypt traffic between an exit node and the target server, so exit nodes are able to capture all unencrypted traffic. Malicious exit nodes can perform man-in-the-middle attacks on encrypted protocols.
Location hidden services are also vulnerable to timing correlation attack.
External Links
Official website
Wikipedia: Tor (network)
Low-Cost Traffic Analysis of Tor (University of Cambridge)
Libfvde -
The libfvde package contains a library and applications to read the FileVault Disk Encryption (fvde) volumes.
Tools
The libfvde package contains the following tools:
fvdeinfo, which shows information about FVDE Volumes.
fvdemount, which FUSE mounts FVDE Volumes.
History
Libfvde was created by Omar Choudary and Joachim Metz in 2011.
External Links
Project site
Building (libfvde and tools) from source
Mounting a FileVault encrypted volume
Timestomp -
Timestomp is a utility co-authored by developers James C. Foster and Vincent Liu. The software's goal is to allow for the deletion or modification of timestamp-related information on files.
Take for example the "Timestomp MACE Values" screenshot displaying a command prompt window displaying the MACE values for a document file titled "text.txt". There are (4) four date time and date stamps displayed that are useful to Forensic Examiners in reconstructing when data was last modified, accessed, created, or entered into the NTFS Master File Table by the operating system or manually by the user.
Using the Timestomp application, the modified date and timestamp can be completely changed (i.e., evidenced by the "Timestomp MACE Change" screenshot). If I were to change it, along with the other entries to more believable dates and times, then the validity of the document falls into question as does its ability to completely slip by an examiner's watchful eye if looking for modified files in an entirely different year or date span.
The "Timestomp MACE Change Proof" screenshot is a final shot of the Operating System's interpretation of the Modified timestamp. It reflects the aforementioned change exactly.
Note: Although this program is designed to frustrate forensic analysis, it should be noted that its use can be easily detected. Because the program can delete all timestamp information, the lack of timestamp values would lead an examiner to the conclusion that something is amiss on the system. Microsoft-based Windows operating system record at least some timestamp information. The total absence of such is a dead giveaway that a user has tried to hide something. On the flipside, if the values are simply changed to believable values, then there is little chance of the change(s) being noticed at a casual glance.
A Practical Example
Timestomp cannot be used directly to modify all (on average) 8 timestamp values in the MFT entry; 4 in \$STANDARD_INFORMATION attribute and 4 in \$FILE_NAME attribute. The \$FILE_NAME attribute MACE values are intended to be modified by Windows, but still there is an indirect workaround to update those values in order to further frustrate forensics.
1) Create file (c:\test.txt)
2) Change timestamps using Timestomp
timestomp.exe c:\test.txt -z "Saturday 10/08/2005 2:02:02 PM" timestomp.exe c:\test.txt -a "Saturday 10/08/2005 2:02:02 PM" 
3) Move that file to another folder (c:\argument\test.txt)
$STANDARD_INFORMATION values are copied to $FN MACE values
4) Update accessed and modified timestamps in \$STANDARD_INFORMATION
timestomp.exe c:\argument\test.txt -m "Saturday 10/08/2005 2:02:02 PM" timestomp.exe c:\argument\test.txt -a "Saturday 10/08/2005 2:02:02 PM" 
External Links
Presentation at Blackhat 2005
Liblnk -
The liblnk package contains a library and applications to read the Windows Explorer Shortcut (lnk) format.
Tools
The liblnk package contains the following tools:
lnkinfo, which shows information about LNK files.
Examples
Requesting the information in a LNK file:
lnkinfo Calculator.lnk lnkinfo 20150617 Windows Shortcut information: Contains a link target identifier Contains a description string Contains a working directory string Contains an environment variables block Link information: Creation time : Aug 10, 2004 16:54:24.000000000 UTC Modification time : Aug 04, 2004 14:00:00.000000000 UTC Access time : Jun 26, 2006 10:36:41.703125000 UTC File size : 114688 bytes File attribute flags : 0x00000020 Should be archived (FILE_ATTRIBUTE_ARCHIVE) Drive type : Fixed (3) Drive serial number : 0xc868f004 Volume label : System Local path : C:\WINDOWS\system32\calc.exe Description : @%SystemRoot%\system32\shell32.dll,-22531 Working directory : C:\WINDOWS\system32 Environment variables location : %SystemRoot%\system32\calc.exe Link target identifier: Shell item list Number of items : 5 Shell item: 1 Item type : Root folder Class type indicator : 0x1f (Root folder) Shell folder identifier : 20d04fe0-3aea-1069-a2d8-08002b30309d Shell folder name : My Computer Shell item: 2 Item type : Volume Class type indicator : 0x2f (Volume) Volume name : C:\ Shell item: 3 Item type : File entry Class type indicator : 0x31 (File entry: Directory) Name : WINDOWS Modification time : Dec 17, 2006 20:55:44 File attribute flags : 0x00000010 Is directory (FILE_ATTRIBUTE_DIRECTORY) Extension block: 1 Signature : 0xbeef0004 (File entry extension) Long name : WINDOWS Creation time : Feb 01, 2006 21:49:46 Access time : Dec 17, 2006 20:55:48 Shell item: 4 Item type : File entry Class type indicator : 0x31 (File entry: Directory) Name : system32 Modification time : Nov 26, 2006 19:56:54 File attribute flags : 0x00000030 Is directory (FILE_ATTRIBUTE_DIRECTORY) Should be archived (FILE_ATTRIBUTE_ARCHIVE) Extension block: 1 Signature : 0xbeef0004 (File entry extension) Long name : system32 Creation time : Feb 01, 2006 21:49:46 Access time : Dec 17, 2006 20:49:46 Shell item: 5 Item type : File entry Class type indicator : 0x32 (File entry: File) Name : calc.exe Modification time : Aug 04, 2004 14:00:00 File attribute flags : 0x00000020 Should be archived (FILE_ATTRIBUTE_ARCHIVE) Extension block: 1 Signature : 0xbeef0004 (File entry extension) Long name : calc.exe Creation time : Aug 10, 2004 16:54:24 Access time : Jun 26, 2006 10:36:42 Distributed link tracking data: Machine identifier : hostname Droid volume identifier : aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee Droid file identifier : 00000000-1111-2222-3333-444444444444 Birth droid volume identifier : aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee Birth droid file identifier : 00000000-1111-2222-3333-444444444444 
History
Liblnk was created by Joachim Metz in 2009, while working for Hoffmann Investigations.
See Also
Windows Shortcut File (LNK) format
External Links
Project site
Ntfs log analyzer -
NTFS Log Analyzer is a freeware application for scanning and analyzing the log details for activities carried out on a NTFS based computer
Features
The application is built with the programming to scan and examine activities performed on an NTFS machine via its activity log. In addition, a search facility is added to the tool for looking up a particular activity from the entire log details along with proper details. Moreover, the details are further exportable from the software in a CSV (Comma Separated Values) Format.
Note: Make it a point to run the software only on a Windows based Operating System to avoid failure.
External Links
Official Website
Ost file viewer -
Free OST Viewer is a freeware application For Microsoft Outlook users. This freeware tool helps to open, view and read OST files even if they are corrupted and that too without the help of Microsoft Outlook. This freeware tool is one of the tools made by SysInfoTools Software to help open corrupt and inaccessible MS Outlook OST files without any problems. Anyone can download this freeware tool to view, open and read Outlook emails and other items like contacts, task, calendars and can even save them in HTML format.
Features
Open and view OST files even without the help of Microsoft Outlook
Open and view OST files without requiring Exchange Server
Read, open and view files even when they are inaccessible or corrupted
Can read and view emails, tasks, calendars, notes, journal entries and so on
Three scanning modes to detect and view corrupt and inaccessible OST files
Exporting users data in HTML format
Supports creation of Log file with flexible saving option
Simple and highly interactive user interface
Compatible with all versions of Microsoft Windows
External Links
Official Website
Truecrypt -
TrueCrypt is an open source program to create and mount virtual encrypted disks in Windows Vista/XP/2000 and Linux and OS X as well as Full Disk Encryption on Windows. It provides two levels of plausible deniability (hidden values / no signatures to make a distinction from random data), on the fly encryption and supports AES, Serpent and Twofish. As of version 6.0 TrueCrypt now supports hidden Operating Systems under Windows only.
As of May 28, 2014 development to the software has been discontinued. the two major alternatives are VeraCrypt and CipherShed.
Detection
TrueCrypt volumes can be detected by
size of file or collection of clusters object modulo 512 is zero, that is size divided by zero has no remainder,
minimum size of object is 19KB, although by default is minimum 5MB,
contains no specific file signature throughout the entire object, and
has a high Shannon entropy or passes Chi-squared distribution test.
Forensic Acquisition
If you encounter a system that has a mounted TrueCrypt drive, it is imperative that you capture the contents of the encrypted drive before shutting down the system. Once the system is shutdown, the contents will be inaccessible unless you have the proper encryption key generated by a user's password. You may also need an additional datafile.
Attacks
The only option for acquiring the content of a dismounted TrueCrypt drive is to do a brute-force password guessing attack. AccessData's Password Recovery Toolkit and Distributed Network Attack (dna) can both perform such an attack, but DNA is faster.
TrueCrypt also supports keyfiles (it uses the first 1024 kilobytes of any file, but can also use it's PRNG to generate such keys). It is important to look for anything that might be used as a keyfile (such as a 1024k file on a USB stick).
Hidden volume is a volume hidden within the free space of another TrueCrypt volume. Even when the outer volume is mounted, it is hard to prove whether there is a hidden volume or not.
When a hidden volume is mounted, the operating system and third-party applications may write to non-hidden volumes information about the data stored in the hidden volume (e.g. filenames). It is important to look for such kind of information.
Previous versions of encrypted containers may be found in the journaling filesystems. It is important to track any changes within the free space of the outer container to detect presence of a hidden container.
Hidden operating system is a system that is installed in a hidden TrueCrypt volume.
It is possible to detect network-enabled hidden operating systems by matching downloaded content (from a network dump) with data on a possible decoy system.
Investigator can also detect boot times by searching network dumps for IP packets with low IDs (only if Windows system is permanently connected to a LAN) and TCP timestamps.
External Links
Official website
Version history
Identifying TrueCrypt Volumes For Fun (and Profit?), by Brian Moran, January 20, 2014
Ost recovery tool -
OST Recovery Tool is one of the smartest recovery software to repair and restore corrupt Exchange OST files. In addition, it also lets users to save the repaired files in multiple formats like EML, PST, MBOX, MSG and in Outlook Express DBX format.
Features
Effectively repair and restore corrupt Outlook OST files
Three different recovery modes: Standard, Advanced and Deep
Lets users to save recovered files in different formats like PST, DBX, MSG, MBOX and EML
Support data encryption and data compression
Can recover Emails, Contacts, Tasks, Calendars and Distribution groups
Support both English and non-English characters
Can recover all your data without any data loss
Compatible with all versions of MS Outlook
Support all versions of MS Windows Operating system
External Links
Official Website
Libnk2 -
The libnk2 package contains a library and applications to read the Nickfile (nk2) format.
Tools
The libnk2 package contains the following tools:
nk2export, which exports the items stored in NK2 files.
nk2info, which shows information about NK2 files.
History
Libnk2 was created by Joachim Metz in 2009, while working for Hoffmann Investigations.
See Also
Nickfile (nk2)
External Links
Project site
Aid4mail -
Aid4Mail is a commercial email forensics product by Fookes Software. It's used to collect, convert and cull email data. It supports many different email format conversions and can also de-duplicate, filter and search email.
History
Aid4Mail V1 was first released in 2005 by Fookes Software founder and CEO, Eric Fookes. Prior to that, Aid4Mail technology was used to process email as the back-end of Paraben's Email Examiner.
Supported File Formats
See Supported Email Formats
External Links
Aid4Mail
Window washer -
Features & Benefits:
Windows Vista™ Compatible
Extensive Wash Areas
Browser Activity Eraser
Permanent Bleaching
Free Space Cleaner
One-click Shredder
Critical File ProtectionSmart Cookie Saver
Flexible Washes
Automatic Wash Cycles
Total System Erase
Expert Customer Support
Satisfaction Guarantee
External Links
https://www.webroot.com/us/en/home/products-spysweeper
Libmsiecf -
The libmsiecf package contains a library and applications to read the MSIE Cache File format.
Tools
The libmsiecf package contains the following tools:
msiecfexport, which exports the items stored in MSIECF files.
msiecfinfo, which shows the information about MSIECF files.
Examples
Exporting items from an index.dat:
msiecfexport -m items index.dat 
Exporting recovered items from an index.dat:
msiecfexport -m recovered index.dat 
Exporting an index.dat from a Chinese Windows installation:
msiecfexport -c windows-936 index.dat 
History
Libmsiecf was created by Joachim Metz in 2009, while working for Hoffmann Investigations.
Libmsiecf is a rewrite of pasco with support for more recent versions of MSIE Cache Files
See Also
MSIE Cache Files
External Links
Project site
Vpn -
VPN (Virtual Private Network) is a class of technology that allows remote machines to interconnect by creating a virtual network layer, on top of the physical network connection, that in practice is used to maintain the privacy of data shared over this virtual network connection (essentially all VPN toolsets use some form of packet-level encryption. There are many different modern implementations of the VPN concept itself, to the point where categorizing them together becomes somewhat questionable.
Overview
Virtual Private Networks are deployed by organizations and individuals for different purposes:
Protecting confidential information in organizations (for example, when connecting geographically distant office networks);
Providing "work from home" or traveling employees with secure remote access to office network resources;
Securing general Internet traffic in particularly insecure network usage settings (e.g. open wireless networks);
Encrypting all internet traffic to and from a home connection, to prevent ISP packet shaping and/or surveillance.
When used for Internet connectivity, VPN service also acts as a form of proxy and protects the user's real IP address from public display. As a result, they are an increasingly popular form of anonymity protection for ordinary internet users and criminals.
VPNs and anonymity
Log files: VPN services may maintain usage logs which could then be used to track the activities of the user of those services, after the fact. However some commercial consumer-oriented VPN services specifically configure their servers not to retain any logfile information of this type. Example are Cryptocloud VPN or iVPN.
Protocol stack: TCP timestamps and IP ID values may be used in correlating incoming (encrypted) and outgoing (unencrypted) network streams. This type of "traffic analysis" can, in theory, be used to gather information about a fully-encrypted VPN connection - in practice, there are no known public examples of traffic analysis being used against commercial VPN service providers.
See Also
iVPN
Proxy server
Libpff -
The libpff package contains a library and tools to read the Personal Folder File (PAB, PST, OST) format.
Features
Libpff is a cross-platform shared library that support PST, OST and PAB files. Currently the data in PAB files is only partially supported. Support was added to deal with corrupted files and to recover data.
Tools
The libpff package contains the following tools:
pffexport, which exports the items stored in PAB, PST and OST (PFF) files
pffinfo, which shows information about PFF files.
pffrecover, has been replaced by pffexport -m recovered
History
Libpff was created by Joachim Metz in 2008, while working for Hoffmann Investigations.
Libpff is a rewrite of earlier work on the PST file format by the libpst project.
See Also
Personal Folder File (PAB, PST, OST)
libpst
External Links
Project site
Building libpff and tools from source
Registryasxml -
Registryasxml is a GUI tool by Stephane Rodriguez that exports and imports Microsoft Registry files with a simple key/value syntax that looks like this:
<?xml version="1.0" encoding="UTF-8"?> <registry> <k name="HKEY_LOCAL_MACHINE"> <k name="SYSTEM"> <k name="Setup"> <v name="CmdLine" value="setup -newsetup"/> <v name="OsLoaderPath" value="\"/> <v name="SetupType" value="0x00000000 (0)" type="REG_DWORD"/> <v name="SystemPartition" value="\Device\HarddiskVolume1"/> <v name="SystemPrefix" value="cf 03 00 00 00 a0 3d e0" type="REG_BINARY"/> <v name="SystemSetupInProgress" value="0x00000000 (0)" type="REG_DWORD"/> <k name="AllowStart"> <k name="AFD"/> <k name="EventLog"/> <k name="PlugPlay"/> <k name="ProtectedStorage"/> <k name="Rpcss"/> <k name="SamSs"/> <k name="Seclogon"/> <k name="WS2IFSL"/> </k> </k> </k> </k> </registry> 
See Also
Windows Registry
External Links
https://www.codeproject.com/Articles/3105/Import-Export-Registry-Sections-as-XML
Sql database recovery tool -
SQL Database Recovery Tool is one of the best tools to repair & Recover Corrupt MS SQL database easily. A reliable Windows based recovery tool to perform MS SQL recovery and help users in restoring their recovered SQL data files in no time. This software, not only help users to recover SQL files but it also supports recovery of MDF as well as NDF files of SQL database. The smart algorithm loaded with simple GUI makes it easier for novice users to recover all their corrupt SQL database files in no time.
Features
Accurate and reliable recovery tool to recover corrupt SQL database
Let users to recover file objects like views, tables, triggers, defaults and so on
Two recovery modes to handle different types of corruption: Standard and Advanced
Let users to save their recovered data either in SQL Server compatible Script format or in SQL Server database format
Can repair corrupt MDF and NDF files seamlessly
SQL Server PAGE-compression and ROW-compression
Allow users to preview recovered files even before recovery
Support recovery of XML files, image files, BLOB and even large page data
Support more than 50+ types of data which let users restore any types of file objects
Highly compatible with all version of Microsoft Windows
External Links
Official Website
Amcache -
The AMCache stores metadata about program installation and execution on Windows.
It can be found on Windows 7 and Server 2008 R2 and later.
The AMCache is stored in the Windows NT Registry File (regf) format in a file named AMCache.hve.
See Also
Windows Application Compatibility
Amcache.hve in Windows 8 - Goldmine for malware hunters, by Yogesh Khatri, December 2013
Amcache on Windows 7, by Yogesh Khatri, May 2016
Examples of amcache.py, by Willi Ballenthin
Analysis of the AMCache, by Blanche Lagny, July 2019