hemu1438/forensicsgpt-training-data huggingface dataset:
Horde imp header format -
Horde Internet Messaging Program (IMP)
Message-ID: <1186073825.46b20ce1ad3cd@sendinghost.com> Date: Thu, 2 Aug 2007 20:57:05 +0400 From: username@sendinghost.com To: username@receivinghost.com Subject: Header test MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-5 Content-Transfer-Encoding: 8bit User-Agent: Internet Messaging Program (IMP) 3.2.2 X-Originating-IP: 255.255.255.255 
Message-ID format:
horde/lib/Horde/MIME.php ... function generateMessageID() { return '<' . date('YmdHis') . '.' . substr(base_convert(microtime() . mt_rand(), 10, 36), -16) . '@' . $_SERVER['SERVER_NAME'] . '>'; }
Hotmail header format -
Message-ID: <BAJ334-H2TF2ACACF5F966510E7ADA6GC0@phx.gbl> Content-Type: multipart/alternative; boundary="_123eccb8-5ca2-67e8-a450-1234c16e36a3_" X-Originating-IP: [255.255.255.255] From: Username <username@sendinghost.com> To: Username <username@receivinghost.com> Subject: header test Date: Sat, 28 Jul 2007 10:35:46 +0100 Importance: Normal MIME-Version: 1.0 X-OriginalArrivalTime: 28 Jul 2007 09:35:47.0016 (UTC) FILETIME=[AD3C4C80:01C7D0FA] 
Message ID Field
The example shown above is a real message id field with some of the digits randomly replaced.
First responder's evidence disk -
The First Responder's Evidence Disk, or FRED, is a script based incident response tool. It was designed to capture volatile information from a computer system for later analysis without modifying anything on the victim. It consists of a batch file used to execute a set of known good tools that gather the state of a victim computer system. It was similar to the IRCR program and has been widely imitated by other tools. Many other incident response tools used names similar to FRED.
Usage
The program was distributed as a compressed 1.44 MB floppy image. The examiner runs this image on a safe system and writes the FRED program out to a piece of removable media such as a floppy disk or USB device. The examiner then connects this device to the victim machine. When run, the FRED program writes information out to an audit file on the removable device. The examiner takes this audit file back to the safe system for later analysis. The audit file can also be sent to other investigators if desired.
History
FRED was developed by Jesse Kornblum for the Air Force Office of Special Investigations starting in the fall of 2000 and was first released in 2001. The tool was publicly unveiled the following year at the DFRWS Conference. Although the component parts of FRED were not released, mostly due to licensing restrictions, Kornblum did present a paper, Preservation of Fragile Digital Evidence by First Responders, that included the FRED script.
A version of the FRED script was later incorporated into the Helix disk.
There was a proposal for a program to process the audit files into HTML, but this never came to fruition.
Since 2004 FRED has been maintained by the Air Force Computer Emergency Response Team. The current version of FRED (version 4) has been redesigned as a single executable, with remote collection capabilities, and uses Native API functions. The audit file uses PKI for encryption to protect the contents from tampering and disclosure. The publicly available version has the remote functionality as well as the PKI encryption capabilities turned off.
Trivia
The desire for a recursive MD5 program for FRED inspired the development of md5deep.
See Also
COFEE
Id3 -
ID3 is a standard for encoding metadata into MP3 files.
Version 1
ID3 version provides minimal information. The first 128 bytes of the file contain title, artist, album, year, genre and comment information. The header begins with the string "TAG".
Version 2.xx
ID3 Version 2+ is much more complicated than v1, and may contain a wide variety of information, including attached pictures, lyrics, encoding software, file owner and payment data. In practice, the most commonly used fields however tend only to list such information as album, artist and track details.
The header may be placed anywhere in the file, being preceded by the string "ID3".
External Links
id3lib, a widely-used open source C/C++ ID3 implementation.
MP3::Info (Perl)
MPEG::ID3v2Tag (Perl)
getID3() - The PHP media file parser
Imaging disks with bad sectors -
How do tools handle imaging tools with bad sectors?
To find this out, you need (for starters) disks that can reliably generate faculty sectors. The NIST computer forensic tool testing program has some of them.
They found that IXimager did a pretty good job.
But sometimes, when it encountered a disk with a single faculty sector, it would miss the next 7.
Encase 5 & 6 let you set an error granularity. But if they find an error in their window, they won't get any of the blocks.
What's the right thing to do? For starters, the programs should document how they handle bad blocks.
Forensic 408 windows in depth -
FOR408: COMPUTER FORENSIC INVESTIGATIONS - WINDOWS IN-DEPTH focuses on the critical knowledge of the Windows Operating System that every digital forensic analyst needs to investigate computer incidents successfully. You will learn how computer forensic analysts focus on collecting and analyzing data from computer systems to track user-based activity that can be used in internal investigations or civil/criminal litigation.
This course covers the methodology of in-depth computer forensic examinations, digital investigative analysis, and media exploitation so each student will have complete qualifications to work as a computer forensic investigator helping to solve and fight crime. In addition to in-depth technical knowledge of Windows Digital Forensics (Windows XP through Windows 8 and Server 2012), you will learn about well-known computer forensic tools such as Access Datas Forensic Toolkit (FTK), Guidance Softwares EnCase, Registry Analyzer, FTK Imager, Prefetch Analyzer, and much more. Many of the tools covered in the course are freeware, comprising a full-featured forensic laboratory that students can take with them.
COMPUTER FORENSIC INVESTIGATIONS - WINDOWS IN-DEPTH COURSE TOPICS
Windows File System Foundations
Evidence Acquisition Tools and Techniques
Law Enforcement Bag and Tag
Evidence Integrity
Registry Forensics
Windows Artifact Analysis
Facebook, Gmail, Hotmail, Yahoo Chat and Webmail Analysis
E-Mail Forensics (Host, Server, Web)
Microsoft Office Document Analysis
Windows Link File Investigation
Windows Recycle Bin Analysis
File and Picture Metadata Tracking and Examination
Prefetch Analysis
Event Log File Analysis
Firefox, Chrome, and Internet Explorer Browser Forensics
Deleted File Recovery
String Searching and Data Carving
Examination of Cases involving Windows XP, VISTA, and Windows 7, and Windows 8
Media Analysis And Exploitation involving:
Tracking user communications using a Windows PC (e-mail, chat, IM, webmail)
Identifying if and how the suspect downloaded a specific file to the PC
Determining the exact time and number of times a suspect executed a program
Showing when any file was first and last opened by a suspect
Determining if a suspect had knowledge of a specific file
Showing the exact physical location of the system
Tracking and analysis of USB devices
Showing how the suspect logged on to the machine via the console, RDP, or network
Recovering and examining browser artifacts, even those used in private browsing mode
Forensic Analysis Report Writing
Fully Updated to include Windows 8 and Server 2012 Examinations
In system programming (isp) forensics -
Definition
In-System Programming (ISP) is the ability of to program devices while installed in a complete system, rather than requiring the chip to be programmed prior to installing it into the system. In-system programming (ISP) can also be called In-Circuit Serial Programming (ICSP).
Forensic Application
ISP, in a forensic application, is an acquisition procedure which involves connecting to specific points on the device to directly read a component. This process bypasses the devices CPU as it reads the component directly. The specific points used are essentially the visible points on the PCB which connect to the hidden points underneath the chip. For this reason, these points are direct electrical connections to the chip you are trying to read.
ISP can therefore be used to directly read the device storage such as the eMMC which will provide you with a raw binary image of the chip. Performing an ISP procedure on supported phones can be an extremely effective technique to extract a full physical image from devices without having to resort to a chip-off procedure which is destructive. Once completed, the phone or device can be re-assembled and should function normally.
Tools and Equipment
JTAG and Chip-Off Tools and Equipment
Procedures
ISP Lumia 635/RM-975
Incredimail imm and iml -
IMM
The Incredimail email file (IMM) is used by the Incredimail email client to store all the email data. The .imm files are basically meant for storing the emails. They do not have the caliber to keep hold of attachments. The Incredimail email client is an advanced application that has a benchmarked level of graphically enabled features and attributes. It was developed by Perion Network Ltd.
Location of IMM
On Windows XP, the default location where the IMM is stored by Incredimail can be obtained by clicking on “Tools” and selecting “Options” from the dropdown menu. Now move to “General” tab, followed by “Data Folder Settings”. Now in the Data Folder Settings pop – up window, copy the displayed path and paste it in the address bar of windows explorer. Move to “Identities” > “String of Numbers” > “Message Store Folder”. You can now view the available IMM files (inbox.imm. deleted items.imm, outbox.imm, etc.).
On Windows 7, to view the stored IMM files, move to the following location: - “C:\Users\%username%\Appdata\Local\IM\Identities”
Under the “Identities” folder, locate the "Message Store"; in which under the “Messages” folder, you can locate the “msg.iml” file. The users of Incredimail 2.0 and previous versions can find the file as “msg.imm”, where as the latter one’s can now recognize it as “msg.iml”.
The header meta data of the IMM files gets stored in a peculiar format that is recognized as an IMH file extension.
Structure of IMM
The structure of IMM file is very much similar to that of MBOX files that keeps hold of multiple emails. The file, when viewed with a text editor like notepad; shows that it starts with the simple structure of Delivered-To and Received meta data fields. Each and every information related to all the emails such as Return-Path, DKIM-Signature and many more can be viewed easily.
External Links
Tools
Incredimail Converter
Insider threat research -
Bibliography
US Government Reports
Insider Risk Evaluation and Audit, PERSEREC TR 09-02, August 2009
Ten Tales of Betrayal: The Threat to Corporate Infrastructures by Information Technology Insiders Analysis and Observations, PERSEREC TR 05-15 September 2005
Technological, Social, and Economic Trends That are Increasing U.S. Vulnerability to Insider Espionage, PERSEREC TR 05-10 May 2005
Changes in Espionage by Americans: 1947-2007, by Katherine L. Herbig, PERSEREC TR 08-05, March 2008.
External Links
Software Engineering Institute (CMU) Insider Threat Center
Defense Personnel and Security Research Center (PERSEREC)
Insider Threat Page
Forensics on gpus -
Using a Graphical Processing Unit (GPU) for forensics analysis attempts to make use of the significant, parallel processing power available on these high cards for a different purpose than their original intent. The idea of forensic analysis on a GPU was first proposed by Marziale, Richard and Roussev in 2007 with a version of Scalpel that utilized a GPU.
Password Cracking
Password cracking process accelerated by using GPU is several times faster than in CPU-only mode.
For example, password recovering speed for MD5 hash using Core2 Duo is about 4,7 millions passwords per second. By using 8800GTX it is possible to reach 265 millions passwords per second.
ElcomSoft Distributed Password Recovery
ElcomSoft Password Recovery Bundle
Passware Kit Forensic
Passcovery Suite
Bibliography
@inproceedings{p73-marziale,
author="Lodovico Marziale and Golden G. Richard III and Vassil Roussev", title="Massive Threading: Using GPUs to Increase the Performance of Digital Forensics Tools", booktitle="DFRWS: Proceedings of the 7th Annual Digital Forensics Research Workshop", year=2007, url="http://old.dfrws.org/2007/proceedings/p73-marziale_pres.pdf"
} 
@inproceedings{1191892,
author = {Nigel Jacob and Carla Brodley}, title = {Offloading IDS Computation to the GPU}, booktitle = {ACSAC '06: Proceedings of the 22nd Annual Computer Security Applications Conference on Annual Computer Security Applications Conference}, year = {2006}, isbn = {0-7695-2716-7}, pages = {371--380}, doi = {https://ieeexplore.ieee.org/document/4041182/}, publisher = {IEEE Computer Society}, address = {Washington, DC, USA}, url="https://www.acsac.org/2006/papers/74.pdf" }
Frag find -
frag_find is a program for finding blocks of one or more MASTER files in a disk IMAGE file. This is useful in cases where a MASTER file has been stolen and you wish to establish that the file has been present on a subject's drive. If most of the MASTER file's sectors are found on the IMAGE drive---and if the sectors are in consecutive sector runs---then the chances are excellent that the file was once there.
The idea of using individual sector hashes in this manner has been discussed in the forensic community for several years. Frag_find is an efficient and easy-to-use tool that perform this process.
frag_find relies on two observations about files and file systems:
Most file systems tend to block-align files stored within the file system. So if you break up an 8K file into 16 different 512-byte blocks, then store that file in a file system, it's likely that those 16 different "file blocks" will be stored each in its own individual disk sector.
Most 512-byte blocks within most files are "unique" --- that is, they do not appear by chance in other files. This is especially true for files that are compressed (like zip and docx files) and files that are encrypted. It is less true of files such as Microsoft Word doc files that are likely to have one or more blocks filled with NULLs or some other constant.
frag_find deals with the problem of non-unique blocks by looking for runs of matching blocks, rather than individual blocks.
frag_find is fast because:
Initial filtering of presence/absence is done using the NPS Bloom filter implementation, an efficient memory-mapped Bloom implementation designed to be used with hash functions.
Hashes are stored in efficient C++ structures.
All computations are done in binary, rather than hex.
OPTIONS
The following options are available:
-b blocksize - sets the blocksize (default is 512 bytes). -s- start the image scan at(default is start of image) -e- stop the image scan at(default is end of image) -r - prints the raw association map, in addition to the cleaned one
MEMORY USAGE
frag_find uses 512MB of RAM for the Bloom filter, approximately 1MB of RAM for bookkeeping, and roughly 64 bytes for every block of the target file.
AVAILABILITY
Download: https://downloads.digitalcorpora.org/downloads/frag_find
github: https://github.com/simsong/frag_find
Investigator -
A computer forensics investigator is the individual responsible for the practice of identifying, extracting and considering evidence from digital media, such as computer hard drives. Digital evidence is both fragile and volatile and requires the attention of the investigator, which should be a qualified specialist, to ensure that materials of evidentiary value can be effectively isolated and extracted in a scientific manner that will bear the scrutiny of a court of law.
The vernacular of digital or computer forensics investigator is forensicator.
Firmware -
A hard drive can be compared to a small computer. It uses microprocessors to control both the physical behavior of the various electro-mechanical components. The logical operations that store and retrieve data as an arrangement of the magnetic particles on the disk surface. This operation is completely independent of the operation of the host PC. Like any computer, the hard drive needs its own software to control the operation of the microprocessors, but unlike a PC this software is limited to the drive’s operational functionality, and is not (and under normal circumstances cannot be) changed by the user. This hard drive ‘software’ is, as a result, more usually referred to as Firmware. The firmware carries out a range of functions, from what might be termed ‘Analogue’ functions such as controlling the spinning of the disc and positioning of the read/write heads, as well as the ‘Digital’ functions used to pass data files to and from the PC, keeping track of the location and parameters of the data files stored, and many, many more.
Corrupted Firmware
Without firmware, or the firmware is corrupted the drive is simply a collection of electronic components.
External Links
Tools
Chipsec
UEFITool
Jtag forensics -
Definition
From Wikipedia (https://en.wikipedia.org/wiki/Joint_Test_Action_Group):
Joint Test Action Group (JTAG) is the common name for what was later standardized as the IEEE 1149.1 Standard Test Access Port and Boundary-Scan Architecture. It was initially devised for testing printed circuit boards using boundary scan and is still widely used for this application. Today JTAG is also widely used for IC debug ports. In the embedded processor market, essentially all modern processors support JTAG when they have enough pins. Embedded systems development relies on debuggers talking to chips with JTAG to perform operations like single stepping and breakpointing. Digital electronics products such as cell phones or a wireless access point generally have no other debug or test interfaces.
Forensic Application
JTAG forensics is an acquisition procedure which involves connecting to the Standard Test Access Port (TAPs) on a device and instructing the processor to transfer the raw data stored on connected memory chips. Jtagging supported phones can be an extremely effective technique to extract a full physical image from devices that cannot be acquired by other means.
Tools and Equipment
JTAG and Chip-Off Tools and Equipment
Procedures
JTAG HTC Wildfire S
JTAG Huawei TracFone M865C
JTAG Huawei TracFone H866C
JTAG Huawei U8655
JTAG Huawei Y301-A1 Valiant
JTAG LG L45C TracFone
JTAG LG P930 (nitro.md)
JTAG LG E960 (nexus.md)
JTAG Nokia Lumia 620
JTAG Samsung Galaxy Centura (sch-s738c)
JTAG Samsung Galaxy S3 (sgh-i747m)
JTAG Samsung Galaxy S4 (sgh-i337)
JTAG Samsung Galaxy Ace Q (sgh-i827d)
References
Analyzing Windows Phone 8.1 JTAG and UFED Dumps, article by Belkasoft
Lastvisitedmru -
The LastVisitedMRU Windows Registry key records recently used applications and the last path those applications used to open a file 1. It is used by the Windows operating system to store common paths used to open or save files and provide auto-complete services to the user within the Windows Common Dialog. The Common Dialog libraries can be used by any Windows application and Microsoft highly recommends that developers use them instead of creating novel user interface elements 2. A wide variety of applications use the Common Dialog, including encryption products like TrueCrypt, media players, and document viewers.
Registry Key Location
The key is present in each user's NTUSER.DAT at \Software\Microsoft\Windows\CurrentVersion\Explorer\ComDIg32\LastVisitedMRU. It contains data stored as registry values and a MRUList. Value data is stored in binary (REG_BINARY) format.
LastVisitedMRU in Windows 7
Starting with Windows Vista, the key was renamed to LastVisitedPidlMRU.
Nuix desktop -
Nuix Desktop is the main product provided by Nuix capable of processing many different formats including:
EnCase, AccessData and raw dd images.
HFS+, HFSX, ext2/3/4, NTFS, FAT16/32
Cellebrite and XRY images
Features
NTFS deleted file recovery and file carving support for all supported file systems.
Processing the data produces a full text index that can be quickly searched.
The ability to extract out several types of "named entities" including email addresses, IP addresses, references to companies and currencies.
It also provides a network graph to see the communications detected inside the data.
External Links
Official website
M3 bitlocker loader for mac -
M3 Bitlocker Loader for Mac is a forensic tool to unlock Bitlocker encrypted volume on Mac computer.
Features
M3 Bitlocker Loader for Mac is a forensic tool to load Windows Bitlocker encrypted hard drive and flash drive on Mac computer, unlock Bitlocker encrypted volume with the original Bitlocker recovery key or encryption password and then read Bitlocker encrypted volume on Mac computer.
Supported File System
M3 Bitlocker Loader for Mac supports NTFS and FAT32 file systems.
Supported Operating System
M3 Bitlocker Loader for Mac supports Mac OS X 10.10 (Yosemite), 10.9 (Mavericks), 10.8 (Mountain Lion), 10.7 (Lion).
See Also
M3 Data Recovery for Mac
M3 Bitlocker Recovery
M3 RAW Drive Recovery
External Links
Download Link
M3 Bitlocker Loader for Mac
Ocfa treegraph api -
The OCFA treegraph API is a more advanced API for the Open Computer Forensics Architecture. The basic OcfaLib API allows for the fast and simple creation of simple dissector and extractor modules for OCFA, but has some limitations. To overcome these limitations, the 2.2 version of OCFA re-vectored and promoted an API that was previously used internally by th OCFA library to an API available to module builders. The OCFA treegraph API defines an interface that a loadable library must implement in order to be usable as an advanced dissector module bu the Open Computer Forensics Architecture. Basically it defines an interface 'TreeGraphNode' that a treegraph module will need to derive one or many classes from. A TreeGraphNode can contain data, meta-data and sub node's that are also TreeGraphNode implementations. The data interface of the TreeGraphNode also allows treegraph modules that are CarvFs aware, to return a carvpath as so called soft linkable path'. Doing so allows OCFA to use substantially less storage resources.
An example of a treegraph module for OCFA is included in the 2.2 release of OCFA. This example is the OCFA mmls module. The ocfa mmls module reproduces the functionality of the The Sleuth Kit mmls tool. It does this using the OCFA treegraph library, the LibCarvPath library, and the The Sleuth Kit library.