hemu1438/forensicsgpt-training-data huggingface dataset:
Xplico -
The Xplico is a Network Forensic Analysis Tool (NFAT). The main scope of Xplico is to extract all application data content from a network capture (pcap file or real-time acquisition). For example, Xplico is able to extract all e-mails carried by the POP and SMTP protocols, and all content carried by HTTP protocol from a pcap file.
Features
Protocols supported: [HTTP, SIP, FTP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...;
VoIP audio codecs supported: G711ulaw, G711alaw, G722, G729, G723, G726 and MSRTA (x-msrta:Real Time Audio)
Port Independent Protocol Identification (PIPI) for each application protocol;
Multithreading;
Output data and information in SQLite database or MySQL database and/or files;
At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled;
Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer ---RAM, CPU, HD access time, ...--- );
TCP reassembly with ACK verification for any packet or soft ACK verification;
Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;
No size limit on data entry or the number of files entrance (the only limit is HD size).
Demo and Cloud computing
Demo with full features: Demo
VoIP decoding, from pcap to wav file: pcap2wav
External links
Official website
Analyzing program execution -
This article is intended to give a high-level overview of analyzing program execution on the various operating systems. A typical operating system has direct and indirect program executions indicators.
direct indicators; these are artifacts of sub systems related to "executing" a program on the operating system, e.g. a Prefetch file.
indirect indicators; these are artifacts that the program itself has left while running, e.g. a MRU Registry key.
This article focuses on the direct program execution indicators.
Linux
Mac OS X
Windows
See Also
Executable
Memory analysis
Linux
Linux Memory Analysis
Mac OS X
Launch Agents
Launch Daemons
Windows
Program crashes
Windows Error Reporting (WER)
Minidumps
Services and drivers
UserAssist Registry key
Windows Application Compatibility
RecentFileCache.bcf
Amcache.hve
AppCompatCache Registry key
Windows Memory Analysis
Hibernation file
Page file
Windows Event Log
Windows PC Accelerators
Prefetch
ReadyBoot
ReadyBoost
ReadyDrive
SuperFetch
Run/RunOnce Registry keys (and equivalents)
Windows Task Scheduler
Job files
TaskCache Registry key
XML task/job files (C:\Windows\System32\Tasks, C:\Windows\SysWOW64\Tasks)
Other
Note that third party tooling like "Anti-Virus" or Host-based Intrusions Detection Systems (HIDS) can be used to track program executions. This will vary per product.
External Links
Windows
HowTo: Determine Program Execution, by Harlan Carvey, July 06, 2013
It Is All About Program Execution, by Corey Harrell, January 14, 2014
Libregf -
The libregf package contains a library and applications to read the Windows NT Registry File (regf) format.
Tools
The libregf package contains the following tools:
regfinfo, which shows information about REGF files.
regfmount, which mounts the keys and values in a REGF file as directories and files.
History
Libregf was created by Joachim Metz in 2009, while working for Hoffmann Investigations.
Also See
Windows NT Registry File (regf)
Windows Registry
External Links
Project site
Anycast relay -
The AnyCast-relay is a core component of the Open Computer Forensics Architecture for communicating tasks or jobs between processes. Build upon the concept of an on-disk persistent priority queue, the AnyCast-relay implements a a collection of named multi-producer multi-consumer work queues for modules in the Open Computer Forensics Architecture. In OCFA, a process identifies itself to the AnyCast-relay as being an instance of a named type of module and in doing so registers itself with the AnyCast as worker for that module. The name of the AnyCast relay stems from the fact that the produces creates and forwards a job that is than delivered to any worker registered as instance of the named module. The AnyCast-relay uses a limited set of static message priorities to sort the jobs that age given to the workers.
In modern terminology the AnyCast-relay should probably be clasified as a message bus.
Fast thunder -
Fast Thunder (aka Xunlei) is a download manager developed by Thunder Networking Technologies.
SuperDownload database
The SuperDownload database can be found at:
On Windows
C:\Program Files\Thunder Network\Thunder\data\SdInfoDb.dat 
This file uses the SQLite database format.
The timestamp:
SuperDownloadInfo.ContentDownloadTime is stored as BIGINT and contains a POSIX timestamp
SuperDownloadResource.DownloadTime is stored as BIGINT and contains presumably a POSIX timestamp
Task database
The Task database can be found at:
On Windows
C:\Program Files\Thunder Network\Thunder\Profiles\TaskDb.dat 
The timestamp:
TaskBase.CreationTime and TaskBase.CompletionTime are stored as BIGINT and contains a POSIX timestamp shifted 24-bits to the left, e.g.
printf "0x%x\n" 22090158425767936 0x4e7ae1ce000000 date -d @$(( 22029112998625280 >> 24 )) Thu Aug 11 06:37:35 CEST 2011 
Example queries
Some example queries:
To get an overview of the tasks:
SELECT datetime((TaskBase.CreationTime >> 24), "unixepoch"), datetime((TaskBase.CompletionTime >> 24) , "unixepoch"), TotalReceiveSize, TotalSendSize, Url, ReferenceUrl, Name, Description, SavePath FROM TaskBase; 
See Also
SQLite database format
External Links
Wikipedia article on Fast Thunder (Xunlei)
Analyzemft -
analyzeMFT is designed to fully parse the \$MFT file system metadata file from an NTFS file system and present the results in multiple formats.
It was written in Python 2 and is no to longer maintained 1
There is a Python 3 fork of analyzeMFT 2, it is also no longer maintained 3.
External Links
Python 2 version of analyzeMFT
analyzeMFT3 - Python 3 fork of analyzeMFT
Network Forensic Search Engine -
Net/FSE is a server application for network operations. The system consists of a data capture, indexing and search services optimized for processing high-volume IP-based network log data. Log data from firewalls, intrusion detection systems, routers and other network devices is streamed to Net/FSE in near real time, providing network professionals on enterprise networks with fast drill down and analysis of billions of log records.
A web interface built on top of Tomcat and GWT is integrated into the codebase. The UI is designed to be an easy to use workflow tool for network operations including security, compliance, troubleshooting and management. Socket-based APIs and HTTP-based XML APIs make integrating search of network log data fast and easy.
The system is also moving towards a plugin architecture which will allow users to build custom data processing engines to meet individual needs. The core system handles capture and storage, as well as search/query functionality, allowing plugins to easily leverage the system's capabilities with minimal coding.
Project Status
In June 2009 version 0.2 of the open source Net/FSE was initially published on NetFSE.org. The 0.3 release was targeted for August 2010. The project appears to have been abandoned.
External Links
Project site
Safeback -
Safeback is a forensic tool suite distributed by Armor Forensics.
File Search Facilities
Lists allocated and unallocated files.
Sorts files by type.
Searches for keywords.
Historical Reconstruction
Can it build timelines and search by creation date?
Searching Abilities
Can use basic keyword searching.
Offers full-text indexing.
If you're interested in the Internet history, one tool, GetHTML, assembles HTML from data. Also NTAStealth is a program that peruses this history.
Hash Databases
Evidence Collection Features
A tool called NTI Secure Toolkit will encrypt files and build self-extracting packages that just require the right password.
License Notes
"This suite of computer forensic software tools is made available, free of charge, to law enforcement computer specialists". Other parts of the website hint at large discounts or site licenses. No prices are quoted publicly.
Libolecf -
The libolecf package contains a library and applications to read the Object Linking and Embedding (OLE) Compound File (cf) format.
History
Libolecf was created by Joachim Metz in 2008, while working for Hoffmann Investigations.
Tools
The libolecf package contains the following tools:
olecfexport, which exports the streams stored in OLECF files.
olecfinfo, which shows information about OLECF files.
External Links
libolecf project site
Belkasoft evidence center -
The Belkasoft Evidence Center X is a commercial forensic solution for acquiring, locating, extracting, and analyzing digital evidence stored inside computers and mobile devices.
The toolkit acquires and analyzes digital evidence from multiple sources including hard drives, drive images, memory dumps, mobile devices and chip-off dumps. Discovers 1500+ types of artifacts, including 300+ mobile applications, as well as major document formats, browsers, email clients, dozens of picture and video formats, instant messengers, social networks, system and registry files, P2P and file transfer tools, etc.
Features
Built-in acquisition of multiple types of digital devices and clouds
Automated extraction and analysis of 1500+ types of evidence for both mobile and computer devices
Destroyed and hidden evidence recovery via data carving, Volume Shadow Copy recovery and other means
In-depth SQLite forensics including freelist, WAL and journal file analysis as well as SQLite Unallocated
Live RAM analysis
Connection graph with communities detection
Investigation of corporate incidents
Cross-case search
Adjustable reports
Dbx recovery tool -
DBX Recovery Tool is a diverse tool to recover Outlook Express DBX files and help users to restore them to DBX, PST, EML and RTF formats. With its smart recovery algorithm, this recovery tool takes the user experience to a different level. DBX Recovery Tool, is one of the finest recovery software to recover and restore impaired, corrupt and inaccessible Outlook Express files in its original format. Not only this, it also let users in restoring these impaired files in EML, PST RTF and MSG formats. So this DBX Recovery Tool, is a one stop solution for any types of corruption issues and errors.
Features
Fastest scanning and recovery procedure
Flexible saving options, which let users to save the recovered files in different formats like PST, RTF, MSG And EML
Advanced recovery algorithm, which help users in scanning and recovering maximum files in no time
Three recovery modes to restore files from different types of corruption: Standard, Advanced and RAW recovery
Fast & accurate recovery
Supports recovery of corrupted as well as deleted emails
Supports recovery of corrupted as well as deleted emails
Let users to preview recovered files even before the recovery process
Simple and easy interface
Highly compatible with all versions of Microsoft Windows
External Links
Official Website
Dbx to pst converter -
DBX To PST Converter is a tool known to import Outlook Express DBX files to Outlook PST format. It is one of the fastest, reliable and accurate conversion tool to convert all your Outlook Express email messages. However, with its high end algorithm, this software let users to import all their mailbox items including their meta properties, attachments, internet headers and allow to save them in a new PST file.
Features
Let users to convert all of their Outlook Express emails to MS Outlook PST format
Allow users to do batch conversions
Support encryption of new PST files with the help of its password protection feature
Let users to search a specific DBX file in their system with its Search feature
Preview Option to preview converted files
Flexible saving option
Option to create a single PST file by merging all your DBX files
High compatibility with all former versions of MS Outlook Express and MS Outlook
This DBX to PST converter tool is also compatible with all major versions or Microsoft Windows
Simple and easy user interface
External Links
Official Website
Oxygen pm ii -
Oxygen Phone Manager II was superseded by Oxygen Forensic Suite.
Oxygen Phone Manager II for Symbian OS Smartphones
Oxygen Phone Manager II for Symbian OS smartphones v2.7.6 is an extended forensic mode of data access which is compatible with Windows and supports a wide range of phone-connectivity options, including Bluetooth. While users gain total access to the content of Symbian-powered phones, they leave data untouched with no noticeable changes.
The program reads the content of a phone and stores it as an image on the hard drive. This relieves users from running synchronization and ensures faster data access with more efficient processing. Oxygen Phone Manager II consists of options to access and edit contacts, calendar items, to-do tasks, messages and multimedia content. The data can also be exported to other standard applications, such as MS Outlook and Address Book etc. The image saved to the hard drive also serves as a backup copy. It protects you against accidental loss of valuable forensic evidence. It ensures fast migration between phones of different models and producers. At the same time, Oxygen Phone Manager II allows a full-scale interactive access to phone content. You can use PC to edit and send out messages, create or import contacts, access and modify multimedia content. The program is a go-between that immediately translates content changes between two operating systems. They can access contacts, calendar, to-dos and the gallery from a tree of expandable folders. There is a details panel in the phone browser that shows the file size and other attributes. It also shows the overall size and number of images, melodies and video clips, and their drive in which they are present (local, flash card or ROM).
Separate windows show contacts, calendar items and to-dos. The fields accessible from menus and submenus in Symbian media appear in one grid and are easy to revise. It has an Outlook-style interface provides access to Unicode SMS, MMS, e-mail and other messages. It offers many options that you have in an email service such as file attachment support, a reply with the original message included, a one-click attachment playback, and others.
Oxygen Phone Manager II Forensic Edition Features at a Glance:
No data can be loaded into the program
No changes can be written to the phone
Support for Symbian-powered smartphones (Nokia, Sony Ericsson, Motorola, BenQ, Panasonic, Vodafone, etc.)
Support for cable and wireless connectivity (IrDA, Bluetooth)
Interactive access to contacts, calendar items, to-dos, messages, and multimedia content
Ability to save phone contents to a hard drive and flash drives
Support for Unicode SMS, MMS, e-mail, BIO and other message formats
Ad-hoc data editing in separate edit windows
Data export and import capabilities to PST, WAB, CSV, XML and other formats
Support for RNG, MID, WAV, AMR, AWB, MP3, AU, and XMF multimedia formats
Contact editing from both phonebook and vCard window
Easy management of meetings, reminders, anniversary, and other calendar items
Add-ons for Arabic, Croatian, Dutch, French, German, Hungarian, Italian, Polish, Russian, Slovak, Spanish, Turkish languages
Apparmor -
AppArmor, found in Suse and Ubuntu Linux, is a system for letting applications run according to the principle of least privilege. This can be a useful for running forensic or other tools of questionable stability (what according to many means almost all tools) on data that may constructed with malicious intent against the specific tool, and mitigating the potential damage to the forensic process. While AppArmor works with static profiles, it does not intervene in communication of open files over unix sockets, that thus can be used to dynamically communicate authority to an (untrusted) AppArmor confined tool.
E01 viewer -
E01 Viewer is a freeware tool developed to view forensic disk image file contents.
Features
The software is particularly meant for viewing forensic disk image files of E01 formatting regardless of corruption. Email files within the disk image can be viewed along with text & image file types. Both, multiple as well as an individual E01 file processing is carried out by the tool.
Note: There is no requirement of a supported application for operating the tool. Make sure that the tool is being operated on a Microsoft Windows Operating System.
External Links
Official Website
Apple iphone -
The iPhone is a smartphone made by Apple Inc. and sold with service through AT&T. It can be used to send/receive email (see IPhone Mail Header Format, keep schedules, surf the web, and view videos from YouTube. A large number of forensic products can process iPhones, see Tools section.
In December 2009, Nicolas Seriot presented a paper 1 in combination with a harvesting application named SpyPhone. This application grabs data as sensitive as location data and a cache of keyboard words. It neither requires jailbreaking nor makes Private API calls (which Apple's App Store does not allow in any application it distributes).
Tools
Belkasoft Evidence Center by Belkasoft can make iPhone logical acquisition and analyze iOS backups and dumps.
Cellebrite BlackBag Technology Mobilyze
Cellebrite UFED
Elcomsoft Mobile Forensic Bundle performs physical, logical and over-the-air acquisition.
EnCase Neutrino
Internet Evidence Finder by Magnet Forensics
iPhone Analyzer
iphone-dataprotection; a set of tools that can image and decrypt an iPhone. The tools can even brute-force the iPhone's 4-digit numerical password.
libimobiledevice is a library with utilities for backing up iPhones. The output format is an iTunes-style backup that can be examined with traditional tools. They are available in the Debian-testing packages libimobiledevice and libimobiledevice-utils.
Logicube CellDEK
MacLock Pick
Micro Systemation .XRY
Mobile Sync Browser
Nuix Desktop can detect and analyse many databases from iOS and iPhones and can directly ingest HFSX dd images.
Oxygen Forensic Suite
Paraben Device Seizure
SpyPhone
Publications
Gómez-Miralles, Arnedo-Moreno. Versatile iPad forensic acquisition using the Apple Camera Connection Kit, Computers And Mathematics With Applications, Volume 63, Issue 2, 2012, pp.544-553.
External Links
Official website
Wikipedia: iPhone
Wikipedia: IOS jailbraking
The iPhone Wiki
Slashdot: Malware Could Grab Data From Stock iPhones
Apple iOS Privacy, slides hash days presentation, by Nicolas Seriot, in November 2010.
Evolution of iOS Data Protection and iPhone Forensics: from iPhone OS to iOS 5, by Andrey Belenko and Dmitry Sklyarov, 2011
Forensic analysis of iPhone backups, by Satish B, 2012
Forensic Analysis on iOS Devices, by Tim Proffitt, November 5, 2012
Exchange edb viewer -
Exchange EDB Viewer is a freeware standalone tool which can scan and offer preview of database file without Server environment needed.
Features
Exchange Server database of any size can be scanned and viewed with this upgradable freeware tool. Further, in case of a severely damaged Exchange database, advanced mode of scanning can be opted. A number of features will be added to the tool on upgrading it to a licensed version, however, it will still remain a standalone.
External Links
Exchange Database Viewer
Official Website
Apple mail header format -
Apple Mail version 2.1 generates email headers in the following format:
Mime-Version: 1.0 (Apple Message framework v752.2) Content-Transfer-Encoding: 7bit Message-Id: <38D1C1FD-3C35-4568-925C-FC46CAC0DE8A@sendinghost.com> Content-Type: text/plain; charset=US-ASCII; format=flowed To: Other User <otheruser@receivinghost.com> From: User Name <username@sendinghost.com> Subject: Subject Line Date: Mon, 26 Feb 2007 20:21:57 -0500 
The message-id appears to be a random, or version 4, Universally Unique Identifier. By default Mac OS X includes a command line program uuidgen that can be used to generate such values.
Application footprint xml -
The Application Footprint XML provides a means for distributing information about an application's distribution format, it's installation footprint, and the residual information left on a hard drive after it has been installed.
<?xml version='1.0' encoding='ISO-8859-1'?> <application_footprint> <metadata ns='https://forensics.wiki/app_print/' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xmlns:dc='http://purl.org/dc/elements/1.1/'> <dc:creator>Your Organization Here</dc:creator> <dc:title>iTunes 9.0.2</dc:title> <dc:description>Application Print of Apple MacOS iTunes 9.0.2</dc:description> <dc:date>2009-11-23</dc:date> <dc:type>Application Print</dc:type> </metdata> <distribution> <!-- In this section goes information consistent with the distribution files --> </distribution> <install> <!-- In this section goes information consistent with the installed files --> <fileobject> <!-- this is a standard fiwalk fileobject --> </fileobject> </install> <residual> <!-- In this section goes information consistent with information left after an uninstall --> </residual> <documentfiles> <!-- Descriptions of the document files that the application makes --> </documentfiles> <network> <!-- Information that is sent over the network that is characteristic for the application --> </network> <memory> <!-- Characteristic information in memory --> </memory> </application_footprint> 
For each of the blocks above, we would like to indicate:
Files (hashes & fuzzy hashes)
Registry entries
Magic Numbers (perhaps there is an 8-byte code left in memory or in an executable that's descriptive)
Tool artifacts
Kernel bulk image resizer -
This picture perfect free software proves effective when one require to resize the bulk of images in single tone, quality and size.
Features
Kernel Bulk Image Resizer is well embedded with certain characteristics that are mandatory to excel in work of imagination. This Resizer tool is inbuilt with high quality distortion-less resizing algorithm that stretches percentage as per requirement and applies bulk image effects. Apart from resizing large number of images in single go and ability to rotate and flip image, this tool supports all popular formats including JPEG, JPG, PNG, BMP, TIF, TIFF, GIF and allows renaming of files. The tool indicates specific output format for all included images and allows user to resize imagination with bounty of colors.
External Links
Official Website