hemu1438/forensicsgpt-training-data huggingface dataset:
Forensic accounting -
Certified Forensic Accounting Professional (CFAP) is a person who has undergone training to become an expert in the field of forensic accounting, forensic auditing, litigation support and investigative accounting. Certified Forensic Accounting Professional (CFAP)is a designation awarded by Indiaforensic Center of Studies and moderated by the Forensic Accounting Research Foundation. The Forensic Accounting Research Foundation is a member-based Indian organisation dedicated to providing forensic accounting and forensic auditing education and training with presence in more than 7 countries including Nigeria, Oman, Qatar, UAE, Uganda and others
Indiaforensic Center of Studies offers three certifications viz.
Certified Forensic Accounting Professional
Certified Anti-Moneylaundering Expert
Certified Bank Forensic Accounting
In order to be Certified as a Forensic Accountant one must meet the following requirements:
Be at least a graduate from the Recognised University
Have professional experience of at least three years
Pass the CFAP examination conducted by Indiaforensic with at least 75% marks
Be of high moral character
Academic requirements
Generally, applicants for CFAP certification have a minimum of a bachelor's degree and should possess at least three years of professional experience. The graduates not having three years of experience may apply for the Forensic Accounting Entrance exam conducted by the Indiaforensic Center of Studies.
Information Technology Specialisation
Indiaforensic Center of Studies have launched the certifications focusing the needs of various industrial sectors including Information technology and Banking. CFAP [IT] is one of the foremost efforts to address the industry specific frauds. Separate curriculum is designed for the program based on the frauds in Satyam and other IT companies. The subject on Satyam case study is contributed by some of the investigators who were involved in the Investigation and not in re-statement.
Examination
Examinations offered by Indiaforensic and Moderated under the bylaws of Forensic Accounting Research Foundation consists of 200 multiple option questions and single paper on forensic accounting. The exams are computer based and the self assessment test needs to be completed before the final examination needs to be completed.
External links
CFAP Information Powerpoint
Certification programs offered by Indiaforensic
International Organizations -
INTERPOL IT Crime Unit
US Government
National Computer Forensic Institute
Computer Crime and Intellectual Property Section of the Department of Justice
Computer Technology Investigators Network
National Institute of Justice
National Center for Forensic Science
National Institute of Standards and Technology, Computer Forensic Tool Testing
Department of Defense Cyber Crime Center
FBI Regional Computer Forensic Laboratory Program
Air Force Office of Special Investigations
Trade Organizations
National Association for Information Destruction
Professional Organizations
The SANS Institute
High Technology Crime Investigation Association
International Association of Computer Investigative Specialists
Regional Computer Forensic Group
High Tech Crime Network
American Academy of Forensic Science The AAFS Board of Directors has approved the creation of the Digital and Multi-media section, which will be voted upon during the AAFS business meeting (during the annual meeting) in Feb 2008.
Non-profit
Digital Forensics Association (DFA)
Micro systemation -
Micro Systemation (MSAB) is a public company based in Stockholm, Sweden who specialize in producing a mobile forensics product called XRY.
The company which was founded in 1984 has a long history of involvement in mobile communications and their first product SoftGSM was designed to help early mobile phones uers connect to their computers to back up important information.
In 2002 work with the Swedish Police led to the identification of a need for forensic software which could assist law enforcement to recover data from mobile phones and in 2003 XRY was created. Originally called .XRY after the unique file extension the reports create, the product is now generally referred to and branded as XRY.
The companies early success was in promoting the product to law enforcement agencies in Western Europe who were early adopters of the product. The company now has offices in Europe and the USA, as well as a network of distributors globally.
XRY is used by Police, Law Enforcement, Military, Government Intelligence Agencies and Forensic Laboratories in over 60 countries. In May 2011 they supplied over 95% of Police Forces in the United Kingdom with XRY.
The company is listed on the Swedish Stock Exchange.
External Links
Micro Systemation (MSAB)
Napatech -
Napatech is a leading OEM supplier of multi-port 10 GbE and 1 GbE intelligent adapters for real-time network analysis with over 40,000 Ethernet ports deployed. Napatech network adapters provide real-time packet capture and transmission with full line-rate throughput and zero packet loss no matter the packet size. Intelligent features enable off-load of data traffic processing and packet analysis normally performed in the CPU. This results in more processing power for the network monitoring, analysis, management, test, measurement, security or optimization application being supported. Napatech has sales, marketing and R&D offices in Mountain View, California, Andover, Massachusetts, and Copenhagen, Denmark.
Napatech network adapters can be synchronized with a variety of time sources, such as Global Positioning System (GPS), IEEE 1588v2, CDMA and Pulse Per Second (PPS) sources. This allows packets to be time-stamped with an accuracy of 50 nanoseconds. The time synchronization solution also allows Napatech adapters to be daisy-chained allowing a single time synchronization source for multiple adapters.
Napatech intelligent adapters can be used for performance monitoring, test & measurement, security and optimization markets. The boards provide interception from 1 Gbps to 10 Gbps. Software is available for Linux, FreeBSD and Windows.
See Also
www.napatech.com
Nokia -
Nokia Corporation is a Finnish multinational communications corporation, headquartered in Keilaniemi, Espoo, a city neighbouring Finland's capital Helsinki. Nokia is focused on wireless and wired telecommunications, with 112,262 employees in 120 countries, sales in more than 150 countries and global annual revenue of 51.1 billion euros and operating profit of 8.0 billion as of 2007. It is the world's largest manufacturer of mobile telephones: its global device market share was about 40% in Q2 of 2008, up from 38% in Q2 2007 and up from 39% sequentially. Nokia produces mobile phones for every major market segment and protocol, including GSM, CDMA, and W-CDMA (UMTS). Nokia's subsidiary Nokia Siemens Networks produces telecommunications network equipments, solutions and services.
External links
Official website
Universally unique identifier -
A Universally Unique Identifier, sometimes also called a Globally Unique IDentifier, is a number generated such that it is guaranteed to be unique in space and time. They are normally 128 bit numbers, although some of those bits are used to define a version of the UUID. The UUID specification is given in RFC 4122.
Usage
UUIDs are in many modern applications. For example, they are used as identifiers in the Windows Registry and as part of the Message ID field for Apple Mail emails.
External Links
RFC 4122 - A Universally Unique IDentifier (UUID) URN Namespace
Wikipedia entry on UUIDs
What is an UUID / GUID?
Oxygen software -
About
Founded in 2000, Oxygen Software is the worldwide leading maker of the advanced forensic data examination tools for smartphones and other mobile devices. The company is dedicated to delivering the most universal forensic solution covering the widest range of mobile devices running Android, iOS, Blackberry, Windows Phone, Symbian and other operating systems. Law enforcement and government agencies, institutions, corporations and private investigators, help desk personnel and thousands of private consumers rely on Oxygen Software products to ensure evidence availability in the event of mobile device data analysis and recovery. Oxygen Software customers include various US and European federal and state agencies such as the IRS, US Army, US Department of Defense (DOD), US Department of Justice, US Department of Homeland Security, US Department of Transportation, US Postal Service, US Supreme Court, European Commission, London Metropolitan Police, French National Police and Gendarmerie, PricewaterhouseCoopers, Ernst & Young, and many others. As a result, Oxygen Forensic Suite receives great response at forensic conferences, exhibitions and trainings, and occupies a spot on the top of the list in relevant tests for extracting more data than competitors.
See Also
Oxygen Forensic Suite
Links
Official Site
Windows boot configuration data -
The Windows Boot Configuration Data (BCD) is stored in the BCD Windows NT Registry file on the active (boot) partitions in '\Boot' or '\EFI\Microsoft\Boot'.
On a running Windows system the contents of this Registry file can be accessed via keys and values under 'HKEY_LOCAL_MACHINE\BCD00000000'.
'bcdedit.exe' can be used to modify the Windows Boot Configuration Settings on a running Windows system.
The mappings of Registrys key to associated bcdedit commands are as follows:
'HKEY_LOCAL_MACHINE\BCD00000000\Objects\*\Elements\%MAPPING%', where '%MAPPING%' consists of
16000009: 'bcdedit.exe /set {default} recoveryenabled \<yes|no>', where '00' gets stored for 'no', '01' gets stored for 'yes'
250000e0: 'bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures', where '01 00 00 00 00 00 00 00' gets stored. Otherwise, the key is not present
The wildcard component of the Windows Registry key is the identifier associated with the Windows Boot Loader instance on a given machine. This identifier can be determined by running 'bcdedit.exe /v' and looking at the 'identifier' under the Windows Boot Loader section.
Misuse
Malware, like Cerber (ransomware), is known to change the Windows Boot Configuration Settings and disable recovery options like the ability to boot into safe mode.
External Links
Modifications to Microsoft Boot Components: Update, by Microsoft
BCD System Store Settings for UEFI, by Microsoft, October 8, 2021
Malware analysis
Sodinokibi ransomware exploits WebLogic Server vulnerability, by Talos Intelligence, April 30, 2019
Yaffs2 -
YAFFS2 (Yet Another Flash File System) is a file system which is used in many modern smartphones and which is build for NAND and NOR flash. Although YAFFS2 is an open standard and there exists an open source implementation, the behavior of YAFFS2 is not very well understood. Ad- ditionally, several aspects like wear-leveling and garbage- collection are not well-specified in the standard.
More Information
The official YAFFS2 website: 2
Research in motion limited -
Research In Motion Limited (RIM) is a Canadian wireless device company. It is best known as the developer of the BlackBerry handheld communication device.
RIM is headquartered in Waterloo, Ontario, and is a sponsor of RIM Park in the northeast of the city. It was founded by Mike Lazaridis, who currently serves as its co-CEO along with Jim Balsillie.
RIM develops its own software for its devices, using C++, C and Java technology. RIM also develops and sells embedded wireless data components.
External links
Research In Motion, the manufacturer of the BlackBerry OS.
BlackBerry.com, the BlackBerry OS main site.
BlackBerry Frequently Asked Questions, Largest collaboration of Answers to Questions for BlackBerry
Null Byte Hashes -
Forensics Wiki has captured MD5 and SHA1 hashes for various sizes of null bytes.
MD5 Sums
Block Size Hash 
512 bytes	bf619eac0cdf3f68d496ea9344137e8b	
4096 bytes	5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5	
SHA1
Block Size Hash 
512 bytes	5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5	
4096 bytes	1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
Dropbox -
Overview
Dropbox is a service with dedicated applications allowing people to share their files between multiple computers (including smartphones) and each other. It is thus similar in purpose to Wuala, SpiderOak and Box.com.
Security
Dropbox has been shown to have major design flaws, making it very insecure. A key problem is that the files are encrypted by Dropbox's servers, which allows Dropbox (and legal authorities) to get access to the files. In June 2011 Dropbox accidentally broke their authentication control system and allowed access to any account without a password, and thus potentially every user's files to be exposed to the world.
Client Application
The Dropbox client running on windows was analyzed and shown to leave a significant amount of data debris behind when deleted.
Even after deletion of the application, this would allow a forensic analyst to detect that Dropbox has been in use, potentially identify other computers linked to the same account, and potentially recover files that were shared using the service.
Server-side file encryption has some benefits to both user and provider, in that if someone uploads a file already stored by Dropbox, then the client makes a fingerprint (hash) of the file and Dropbox's servers will flag that the file doesn't need to be uploaded, so the client "upload" process completes much faster. However, this also means that it is possible to detect if a file has already been stored by Dropbox, and therefore a legal authority can take action against Dropbox to identify other "owners".
Configuration
Windows XP
C:\Documents and Settings\%USERNAME%\Application Data\Dropbox\ C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Dropbox\ 
Windows Vista and later
C:\Users\%USERNAME%\AppData\Local\Dropbox\ C:\Users\%USERNAME%\AppData\Roaming\Dropbox\ 
Mac OS X
/Users/$USER/.dropbox/ 
Linux
/home/$USER/.dropbox/ 
config.db and config.dbx
The "config.db" SQLite database contains the configuration for the account. It contains:
the email address associated with the account;
the "host_id";
local path information.
"config.dbx" is an encrypted variant of "config.db"
filecache.db and filecache.dbx
host.db and host.dbx
Server Side
Per Where is my data stored?
All files stored online by Dropbox are encrypted and kept in secure storage servers. Storage servers are located in data centers across the United States. Additionally, storage servers are available in Australia, the European Union, Japan, and the United Kingdom for eligible Dropbox business users 
External Links
Product site
Dropbox Forensics by Frank McClain, July 24, 2011
Decrypting More Dropbox Files: config.dbx, by Magnet Forensics, November 20, 2013
Sans -
The SANS Institute was established in 1989 as a cooperative research and education organization. Its programs now reach more than 165,000 security professionals around the world. A range of individuals from auditors and network administrators, to chief information security officers are sharing the lessons they learn and are jointly finding solutions to the challenges they face. At the heart of SANS are the many security practitioners in varied global organizations from corporations to universities working together to help the entire information security community.
SANS is the most trusted and by far the largest source for information security training and security certification in the world. It also develops, maintains, and makes available at no cost, the largest collection of research documents about various aspects of information security, and it operates the Internet's early warning system - the Internet Storm Center.
Computer Security Training & Certification
SANS provides intensive, immersion training designed to help you and your staff master the practical steps necessary for defending systems and networks against the most dangerous threats - the ones being actively exploited. The courses are full of important and immediately useful techniques that you can put to work as soon as you return to your offices. They were developed through a consensus process involving hundreds of administrators, security managers, and information security professionals, and address both security fundamentals and awareness, and the in-depth technical aspects of the most crucial areas of IT security.
SANS training can be taken in a classroom setting from SANS-certified instructors, self-paced over the Internet, or in mentored settings in cities around the world. Each year, SANS programs educate more than 12,000 people in the US and internationally. To find the best teachers in each topic in the world, SANS runs a continuous competition for instructors. Last year more than 90 people tried out for the SANS faculty, but only five new people were selected.
SANS also offers a Work Study Program through which, in return for acting as an important extension of SANS' conference staff, facilitators may attend classes at a greatly reduced rate. Facilitators are most definitely expected to pull their weight and the educational rewards for their doing so are substantial.
Software Vendors -
AccessData - Forensic Toolkit (FTK)
ADF Solutions
ASR Data - SMART
Belkasoft
Computer Forensic Analysis
Computer Cop Forensic Examiner
CPR Tools
Data Recovery, Data Security and Development Tools
Elcomsoft
Tools for desktop, mobile and cloud forensics
ForensicSoft
SAFE Block XP - Software write blocker
SAFE Boot Disk - Forensically sound Windows boot disk
Guidance Software - EnCase
LTU Technologies - LTU-Finder
MaresWare Software
Nuix Pty Ltd - Nuix Desktop
Oxygen Software
Paraben Forensics
ProDiscover
WetStone Technologies, Inc.
X-Ways Software
Google drive -
Google Drive is a cloud storage service by Google Inc.
Client software
Google provides a Mac OS X and Windows and desktop client.
snapshot.db
C:\Users\%USERNAME%\AppData\Local\Google\Drive\snapshot.db C:\Users\%USERNAME%\AppData\Local\Google\Drive\user_default\snapshot.db 
sync_config.db
C:\Users\%USERNAME%\AppData\Local\Google\Drive\sync_config.db C:\Users\%USERNAME%\AppData\Local\Google\Drive\user_default\sync_config.db 
sync_config.log
C:\Users\%USERNAME%\AppData\Local\Google\Drive\sync_config.log C:\Users\%USERNAME%\AppData\Local\Google\Drive\sync_config.log.1 C:\Users\%USERNAME%\AppData\Local\Google\Drive\sync_config.log.2 C:\Users\%USERNAME%\AppData\Local\Google\Drive\user_default\sync_config.log C:\Users\%USERNAME%\AppData\Local\Google\Drive\user_default\sync_config.log.1 C:\Users\%USERNAME%\AppData\Local\Google\Drive\user_default\sync_config.log.2 
External Links
Product site
Google Drive artifacts - explained, by bitforensics, December 2012
Tools
Plaso
One drive -
One Drive, previously known as Sky Drive, is a cloud storage service by Microsoft.
SkyDrive Client Logs
C:\Users\%USERNAME%\AppData\Local\Microsoft\SkyDrive\logs\ 
BIFROST.dev=0.YYYY-MM-DD.####.####-#.log
SkyDrive.exe.err.YYYY-MM-DD-hhmmss.###.log
SkyDrive.exe.reg.YYYY-MM-DD-hhmmss.###.log
SyncDiagnostics.log
External Links
Product site
Sumuri llc -
SUMURI, LLC is a company that develops advanced forensic investigation software and hardware. Stylized as "SUMURI", the company is based in Camden, Delaware, USA.
Products
Free Tools
PALADIN - completely free forensics toolkit. Includes over 100 forensic tools, and also includes Autopsy by Basis Technology.
Software
RECON IMAGER - macOS imager capable of forensic imaging of all Intel Based Macs. Based on OS X.
RECON for Mac OS X - automated forensics toolkit for Mac OS X.
CARBON - complete virtual forensics suite.
Hardware
TALINO Forensic Workstations - high-end computer systems developed to run specialized forensic discovery processes.
External Links
Official Website
Swgde -
The Scientific Working Group on Digital Evidence (SWGDE) brings together organizations actively engaged in the field of digital and multimedia evidence to foster communication and cooperation as well as to ensure quality and consistency within the forensic community. 1
SWGDE is made up of federal, state and local law enforcement as well as private and public sector organizations. As of 2012 any one can become a full voting member of SWGDE.
External Links
SWGDE
SWGDE: Documents
File -
File is a command-line tool that attempts to identify the type of data and format within the file. It has three tests: filesystem, magic number, and language, which are performed in that order. The result of first test that finds a match is returned. These heuristics are fairly simplistic and can easily be fooled.
The filesystem test examines the filetype and name of the file under examination, looking for execution flags and common filenames like core. The magic number test examines the first few bytes of a file in order to identify its type. The language test checks to see if the file is a text file and attempts to recover which encoding is being used for the text.
Other things I'd like to see on this page are: command-line usage, examples, and uses for forensic investigation.
Identifying Partitions with File
File can identify disk partitions too!
# file -s /dev/rdisk1s2 /dev/rdisk1s2: Macintosh HFS Extended version 4 data (mounted) last mounted by: 'HFSJ', created: Thu Jan 24 22:05:19 2008, last modified: Fri Apr 25 20:58:56 2008, last checked: Thu Jan 24 22:05:19 2008, block size: 4096, number of blocks: 183059668, free blocks: 56950487 #
Miss identify -
Miss Identify is a program to find Win32 applications. In its default mode it displays the filename of any executable that does not have an executable extension (i.e. exe, dll, com, sys, cpl, hxs, hxi, olb, rll, or tlb). The program can also be run to display all executables encountered, regardless of the extension. This is handy when looking for all of the executables on a drive. Other options allow the user to record the strings found in an executable and to work recursively.
Usage
The program can be used to search for mislabeled executables:
C:\> missidentify * C:\missidentify-1.0\sample.jpg
To enumerate all executables:
C:\> missidentify -a * C:\missidentify-1.0\sample.jpg C:\missidentify-1.0\missidentify.exe
To search for all executables in an unusual place:
C:\> missidentify -ar c:\windows\system32 ... C:\WINDOWS\System32\ntdll.dll C:\WINDOWS\System32\ntoskrnl.exe C:\WINDOWS\System32\NEVER-GONNA-CATCH-ME.EXE C:\WINDOWS\System32\ntver.dll ...
External Links
Official website
Regripper -
RegRipper is an open source forensic software application developed by Harlan Carvey. RegRipper, written in Perl, is a Windows Registry data extraction tool.
RegRipper can be customized to the examiner's needs through the use of available plugins or by users writing plugins to suit specific needs.
Technical Background and Forensic Soundness
RegRipper uses James McFarlane’s Parse::Win32Registry module 1 to access a Windows Registry hive file in an object-oriented manner, bypassing the Win32API. This module is used to locate and access Registry key nodes within the hive file, as well as value nodes and their data. When accessing a key node, the LastWrite time is retrieved, parsed and translated into something the examiner can understand. Data is retrieved in much the same manner…if necessary, the plugin that retrieves the data will also perform translation of that data into something readable.
Also see
Windows Registry
External Links
Using RegRipper
RegRipper GitHub Repo
RegRipper Blog
Windows Forensics Analysis
RegRipper Supplemental Plugins
Developers blog (Windows Incident Response)
RegRipper Google Code
Strings -
Strings is a program that prints out any ASCII or Unicode strings in the input file. Forensic examiners can use strings to get a sense of the functionality of an unknown program. User prompts, error messages, and status messages can give hints, but should not be used as proof or lack or any functionality.
Most Linux distributions and other UNIX-like operating systems have a strings program included.
There is a Windows version of strings by Mark Russinovich. Note that the Windows version prints an output header and searches for both ASCII and Unicode strings by default.