hemu1438/forensicsgpt-training-data huggingface dataset:
Simson l garfinkel -
Simson L. Garfinkel joined the National Institute of Standards and Technology in Gaithersberg, Maryland, in January 2015 as Senior Advisor, Information Access Division. His current research includes privacy and data de-identification.Garfinkel was formerly an Associate Professor at the Naval Postgraduate School in Monterey, California from 2006 to January 2015. He lives in Arlington, VA
Dr. Garfinkel has research interests in computer forensics, the emerging field of usability and security, and in personal information management. He is also interested in information policy and terrorism, and has published in these areas since the late 1980s.
In addition to his work as an academic, Garfinkel is a contributing editor at Technology Review Magazine, where he writes a weekly blog on emerging technology, and an editor-at-large at CSO Magazine, where he writes the award-winning monthly column "Machine Shop." In the past Garfinkel was a weekly contributor to The Boston Globe, The San Jose Mercury News and The Christian Science Monitor He was a founding contributor of Wired Magazine. Overall, Garfinkel's popular articles have appeared in more than 70 publications around the world.
Garfinkel is the author or co-author of fourteen books on computing. He is perhaps best known for his book Database Nation: The Death of Privacy in the 21st Century. Garfinkel's most successful book, Practical UNIX and Internet Security (co-authored with Gene Spafford), has sold more than 250,000 copies in more than a dozen languages since the first edition was published in 1991.
Garfinkel received three Bachelor of Science degrees from MIT in 1987, a Master's of Science in Journalism from Columbia University in 1988, and a Ph.D. in Computer Science from MIT in 2005.
Garfinkel's home page is https://simson.net/page/Main_Page.
Forensics
Simson L. Garfinkel is the author of the following forensic tools:
AFFLIB
Bulk Extractor
fiwalk
frag_find
On the MediaWiki version of Forensics Wiki, Garfinkel was known as simsong.
See Also
Simson Garfinkel's home page
Simson Garfinkel on Wikipedia
Steve gibson -
Overview
Steve Gibson is the President and Founder of Gibson Research Corporation, CA, USA. From 1986 to 1993 he was a columnist and editor for InfoWorld Magazine. In the past he has also held positions with Hovik Corporation and as an Independent Consultant. Gibson Research's most well known product is the disk recovery tool known as SpinRite. However the last major release of SpinRite was V6.0, released in 2004, and development then appears to have stalled as Steve has been working on other projects.
Steve has also developed a number of free utilities, such as Shield's Up and produced a series of well researched pod-casts on personal computer security.
External Links
Gibson Research Corporation
The grugq -
The Grugq has spent several years researching anti-forensic techniques and is the author of Hash (hacker shell)
Forensic Presentations
2004
HiTB: The Art of Defiling: Defeating Forensic Analysis on Unix File Systems (pdf)
2005
Blackhat: The Art of Defiling: Defeating Forensic Analysis on Unix File Systems (synopsis) (pdf)
External Links
Where Is Hacking Now? A Chat with Grugq, March 12, 2007
Golden g richard iii -
Golden G. Richard III is Professor of Computer Science, University Research Professor, and Director of the Greater New Orleans Center for Information Assurance (GNOCIA) at the University of New Orleans, where he has taught and done research in cybersecurity, operating systems internals, reverse engineering, and malware analysis since 1994. Golden earned a Ph.D. in Computer Science from The Ohio State University in 1995. He is also the Founder and Owner of Arcane Alloy, LLC, a private digital forensics and cybersecurity firm, the original author of the Scalpel file carving tool, a pioneer in applying high performance computing principles to digital forensics, and a professional music photographer.
He maintains a blog called "Outlook Purple" and can be found on Twitter at @nolaforensix.
See Also
Forensics on GPUs
External Links
Arcane Alloy, LLC
Outlook Purple
Harlan carvey -
Harlan Carvey is a computer forensics author, researcher and practitioner. He has written several books and tools focusing on Windows systems and incident response. His Windows Incident Response Blog Harlan Carvey's interest in computer and information security began while he was an officer in the U.S. military, and a student at the Naval Postgraduate School, earning his MSEE. After leaving military service, he began working in the field of commercial and government information security consulting, performing vulnerability assessments and penetration tests. While employed at one company, he was the sole developer of a program for collecting security-specific information (i.e., Registry entries, file information, configuration settings, etc.) from Windows NT systems during vulnerability assessments. The purpose of the product was to overcome shortfalls in commercial scanning products and provide more valuable information to the customer. Harlan has also done considerable work in the area of incident response and forensics, performing internal and external investigations. He has also written a number of proof-of-concept tools for educating users in such topics as Windows null sessions, file signature analysis, and the retrieval of metadata from a variety of file formats. Harlan's experience with computers began in the early '80s, with a Timex-Sinclair 1000. Around that time, he was learning to program BASIC on an Apple IIe. From there, he moved on to computers such as the Epson QX-10 and the TRS-80, on which he programmed BASIC and learned some rudimentary PASCAL, using the TurboPASCAL compiler. Since then, he's worked with SunOS and Solaris systems, as well as various versions of DOS and Windows, OS/2, and Linux. Harlan has presented at a variety of computer security conferences, including Usenix, DefCon9, Black Hat, GMU2003/HTCIA/RCFG, WACCI, and PFIC2010. He has discussed various topics specific to issues on Windows platforms, such as data hiding, incident response, and forensic analysis. He has had articles published in the Information Security Bulletin, on the SecurityFocus website, and in the Hakin9 magazine. Finally, Harlan has written a number of open source programs (including RegRipper), which have been made available online and via CDs/DVDs in his books. His Windows Incident Response blog is updated on a regular basis.
Website
Harlan's Windows Incident Response Blog
Tools
WinForensicAnalysis Tools - Hosted on Google Code, includes files for the Windows Registry Forensics book.
Books
Windows Registry Forensics
Windows Forensic Analysis
Windows Forensics and Incident Recovery
Perl Scripting for Windows Security
A Study of Video Teleconferencing Traffic on a TCP/IP Network
Jesse kornblum -
Jesse Kornblum is a computer forensics author, researcher and engineer.
Tools
md5deep and hashdeep - Cross platform recursive hashing and auditing programs, respectively. Computes MD5, SHA-1, SHA-256, Tiger and Whirlpool hashes. Can also match against sets of known hashes. The latter program uses multihashing to conduct a computer forensics audit.
foremost - File carving program
ssdeep - Usually called Fuzzy Hashing, this program implements Context Triggered Piecewise Hashing.
FRED - The First Responder's Evidence Disk
dc3dd - A patch to add forensics features to GNU dd
Miss Identify - Program to identify Win32 executables that don't have an executable extension. Can also identify all executables.
Jessica fridrich -
Jessica Fridrich is an Associate Professor at SUNY Binghamton. She works in information hiding in digital imagery, watermarking, steganography, and forensic analysis of digital images. She holds a patent on Lossless embedding of data in digital objects and has applied for others on Secure image authentication with discrete level tamper localization. She is also a Master of speedcubing.
External Links
Home page
Search for all Fridrich's patent applications at USPTO
Opensavemru -
The OpenSaveMRU key exists in the Windows Registry and tracks files that have been opened or saved within a Windows shell dialog box. It is part of a set of keys recording information from the Windows Common Dialog. The Common Dialog libraries can be used by any Windows application and Microsoft highly recommends that developers use them instead of creating novel user interface elements.
Data is commonly found in this key from web browsers, document viewers, archiving utilities, and image viewers.
Registry Key Location
The key is present in each user's NTUSER.DAT hive in the \Software\Microsoft\Windows\CurrentVersion\Explorer\ComDIg32\OpenSaveMRU location. The values stored in the key itself are items that do not have file extensions associated with them.
Since most files in Windows have extensions, what often ends up here is auto-complete information. Consider an OpenSave dialog box that allows you to choose a file type from a list (e.g. .jpg, .png, .bmp). User input into this dialog will typically be the name of the file without the extension, since the dropdown filetype menu takes care of filling in the extension. Thus what will be stored in the OpenSaveMRU value is auto-complete information for that transaction, and the full filename is not stored.
Sub-Keys
The possibility for a large number of subkeys exist within the OpenSaveMRU key. All but one of the sub-keys correspond to file extensions and store full path information for files of that extension that have been opened or saved. Each subkey keeps its own Most Recently Used (MRU) list and last write time.
One outlier is the * subkey. This key tracks the last ten files of any extension (including no extension) that have been input into the OpenSave dialog.
OpenSaveMRU in Windows 7
Starting with Windows Vista, the key has been renamed to OpenSavePidlMRU
External Links
Harlan Carvey, Windows Forensic Analysis DVD Toolkit, 2009
Advanced steganography demystifying steganography investigation -
Advanced Steganography Demystifying Steganography Investigation
During this 2 day advanced class, students will participate in hands on experiments with stego’d images, multimedia files, advanced network protocols and Steganographic file systems. Detailed analytical and jamming methods will be utilized to both discover and disrupt Steganographic operations. Analysis of Steganographic file systems, streaming steganography and Voice Over Internet Protocol (VOIP) based steganography will be covered. A host of both open source and proprietary technologies will be utilized during this class.
Steganography is Evolving!
The art of analyzing steganography within images, multimedia and in network protocols is considered a black art. As criminals communicate and conceal vital information in new Steganographic file systems, voice over internet protocol (VOIP) streams and in a host of multimedia carriers, it is vital and urgent that a cadre of trained experts exist to counter this threat. A deep understanding and analysis of images, multimedia files and network protocols along with clear understanding of the known methods of data hiding are essential in order to participate in this analysis.
Who Should Attend?
Forensic Investigators
Local, state and federal law enforcement
Private investigators
IT security professionals
Our trainers take you inside the minds of today’s criminals and students completeing the class will be able to execute a full investigation in the respective discipline. Participants proficiency in the above skills will be tested with certification exams.
Contact Information:
1-877-WETSTONE ext 2
www.wetstonetech.com
Cell phone forensics research -
Academic Publications
Mobile Forensics - Advanced Investigative Strategies by Oleg Afonin and Vladimir Katalov, Elcomsoft, September 30, 2016. A straightforward guide to address the roadblocks face when doing mobile forensics with the right mix of methods, techniques, and tools.
The Future of Mobile Forensics, Oleg Afonin, Danil Nikolaev, Yuri Gubanov by Belkasoft Research, June 2015
Data Acquisition from Cell Phone using Logical Approach, Keonwoo Kim, Dowon Hong, Kyoil Chung, and Jae-Cheol Ryou, PROCEEDINGS OF WORLD ACADEMY OF SCIENCE, ENGINEERING AND TECHNOLOGY VOLUME 26 DECEMBER 2007 ISSN 1307-6884 This article discusses three approaches for acquiring data from cell phones: physically removing the flash RAM chips and reading them directly; reading the data out using the JTAG interface, and running software on the cell phone to extract the files at a logical level. The authors have built a logical extraction system and are working on a system based on JTAG.
Forensics for Korean cell phone, Keonwoo Kim, Dowon Hong and Kyoil Chung, Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop, Adelaide, Australia, 2008.
An Integrated Approach to Recovering Deleted Files from NAND Flash Data, by James Luck & Mark Stokes, SMALL SCALE DIGITAL DEVICE FORENSICS JOURNAL, VOL. 2, NO. 1, JUNE 2008 ISSN# 1941-6164
US Government Publications
Guidelines on Cell Phone Forensics (NIST SP 800-101), May 2007
Cell Phone Forensic Tools: An Overview and Analysis (NISTIR 7250)
PDA Forensic Tools: An Overview and Analysis (NISTIR 7100)
Disk reliability -
Research on disk reliability and disk failure rates is relevant to computer forensics for several reasons:
Disk failures frequently make it difficult to recover data from a subject computer.
Because forensic practitioners use very large datasets, issues of disk drive reliability can have direct bearing on forensic readyness.
Bibliography
An analysis of latent sector errors in disk drives, Lakshmi N. Bairavasundaram, Garth R. Goodson, Shankar Pasupathy, Jiri Schindler, SIGMETRICS '07. (ACM DL)
Failure Trends in a Large Disk Drive Population, by Eduardo Pinheiro, Wolf-Dietrich Weber and Luiz Andre Barroso, Proceedings of the 5th USENIX Conference on File and Storage Technologies (FAST’07), February 2007
Imager ng ideas -
This page is for discussing ideas regarding next-generation (NG) imaging tools.
Note that some of the ideas mentioned can be already used by imaging tools, but the idea of this page is to determine how useful these features could be for next-generation of imaging tools. The scope is mainly a software-based imaging tools, but not limited to. Some features might not be doable, because of limitations of certain image file formats.
Please, do not delete text (ideas) here, use the discussion page if you want to discuss the usefulness of a feature.
License
Features
Compression
Integrity checks
Encryption
Error correction (parity)
Pre-processing during imaging
User suspend/resume, resume after failure
Remote imaging
Error resistance in reading storage media, e.d. disks
maybe have different techniques, e.g. to use for heavily damaged storage media
Support different types of storage media
disk
volume
optical discs
memory
files and directories
Store relevant data about the storage media and the imaging process
read errors
Support multiple image format
not all image formats have support for all the features
Built-in write blocking (software write blocker)
Compression
Reduces the amount of data that needs to be written; improved the overall imaging speed.
hash-based imaging
detection of easy (emtpy-block) and hard (encrypted block) to compress data
multi-threaded compression
sparse ranges
de-duplication
de-duplication
hash-based imaging
sparse or repeated ranges
pattern-fill
Integrity checks
Integrity hash (MD5, SHA1, SHA256)
piecewise hashing
Supportive tooling
Image conversion
Image verification
modes:
full verification and print a report at the end
stop on error (useful for automation?)
Image format
Implied features for an image format
High-speed imaging
Compact storage
Error-resistant storage (over a longer time)
Minimal overhead on read
Evidence bag
multiple images in one image format
support for additional information e.g. case data
See Also
Disk Imaging
Memory Imaging
Piecewise hashing
Leet '08 -
As the Internet has become a universal mechanism for commerce and communication, it has also become an attractive medium for online criminal enterprise. Today, widespread vulnerabilities in both software and user behavior allow miscreants to compromise millions of hosts, conceal their activities with sophisticated system software, and manage these resources via a distributed command and control framework. This platform in turn provides economics of scale for a wide range of criminal activities including spam, phishing, DDoS, click fraud, and so on.
LEET has evolved from the combination of two other successful workshops, the ACM Workshop on Recurring Malcode (WORM) and the USENIX Workshop on Hot Topics in Understanding Botnets (HotBots), which have each dealt with aspects of this problem. However, while papers relating to both worms and botnets are explicitly solicited, LEET has a broader charter than its predecessors. We encourage submissions of papers that focus on any aspect of the underlying mechanisms used to compromise and control hosts, the large-scale "applications" being perpetrated upon this framework, or the social and economic networks driving these threats.
Topics of interest include, but are not limited to:
- Infection vectors for malware (worms, viruses, etc.) - Botnets, command, and control channels - Spyware - Operational experience - Forensics - Click fraud - Measurement studies - New threats and related challenges - Boutique and targeted malware - Phishing - Spam - Underground markets - Carding and identity theft - Miscreant counterintelligence - Denial-of-service attacks - Hardware vulnerabilities - Legal issues - The arms race (rootkits, anti-anti-virus, etc.) - New platforms (cellular networks, wireless networks, mobile devices) - Camouflage and detection - Reverse engineering - Vulnerability markets and zero-day economics - Online money laundering - Understanding the enemy - Data collection challenges 
LEET '08 will be a one-day event, Tuesday, April 15, 2008, co-located with the 5th USENIX Symposium on Networked Systems Design and Implementation (NSDI '08), which will take place April 16-18, 2008.
The submissions deadline is 11:59 p.m. EST on Monday, February 11, 2008. Submissions guidelines can be found at https://www.usenix.org/legacy/leet08/cfpb/
We look forward to your submissions.
Fabian Monrose, Johns Hopkins University LEET '08 Program Chair leet08chair@usenix.org
Zombies and botnets setup investigate shutdown -
Zombies and Botnets: Setup-Investigate-Shutdown
WetStone has created this one-day advanced module to their Hacking Bootcamp focusing exclusively on Zombies and Botnets. Students will have unique access to our “hands-on” interactive learning environment. Students will work together to establish a complex Botnet environment and practice investigative methods/techniques to collect criminal information. Each student will learn how to shutdown and isolate Botnet operators and individual Zombies in order to limit or preempt the damage they can cause.
Sinister Cyber Weapons
One of the most sinister cyber weapons to arrive on the scene in recent years are Zombies and their associated Botnets.
Today's cyber investigators must possess in depth working knowledge of their internals. To accomplish this you must know how to setup, investigate, and shutdown these weapons.
Botnets are continuing to be a global issue. These types of malicious software are penetrating our personal, corporate and government systems. Statistics are showing that up to one quarter of all computers that are connected to the internet have become a part of a Botnet.
Skills Learned
Upon completion of the course, students will have gained advanced knowledge in the fundamentals of Zombies and Botnets
* Offensive planning of Zombies and Botnets * Investigative considerations when faced with these weapons * Learn the art of isolation and termination of Botnets.
Our trainers take you inside the minds of today’s criminals and students completeing the class will be able to execute a full investigation in the respective discipline. Participants proficiency in the above skills will be tested with certification exams.
Contact Information:
1-877-WETSTONE ext 2
www.wetstonetech.com
Ivpn -
iVPN.net is a commercial VPN service focused on multihop VPN connections. Traffic is routed via multiple OpenVPN and IPSec network links in multiple jurisditions to ensure anonymity. iVPN also implements interface crowding to direct an optimal number of client connections to a single interface to increase crowding factors and make real time correlation of network streams significantly more difficult. The iVPN privacy policy explicitly claims that they do not log any data relating to their customers activities.
External Links
Official website
Arsenal recon -
About Arsenal Recon
Arsenal Recon grew out of a need to dig deeper into electronic evidence than current solutions permitted. Led by the computer forensic experts at Arsenal Consulting and world-class developers, Arsenal Recon develops ground-breaking software tools which enable investigators to extract information from their evidence that other tools simply cannot.
Software Products
Arsenal Image Mounter
Arsenal Image Mounter mounts the contents of disk images as complete disks in Microsoft Windows®. Arsenal Image Mounter includes a virtual SCSI adapter (via a unique Storport miniport driver) which allows users to benefit from disk-specific features in Windows like integration with Disk Manager, access to Volume Shadow Copies, and more.
Registry Recon
Registry Recon provides access to an enormous volume of Windows Registry data which has been effectively deleted, whether that deletion occurred due to benign system activity, malfeasance by a user, or even re-imaging by IT personnel.
Hibernation Recon
Hibernation Recon has been developed to not only support memory reconstruction from Windows XP, Vista, 7, 8/8.1, and 10 hibernation files, but to properly identify and extract massive volumes of information from the multiple types (and levels) of slack space that often exist within them.
External Links
Arsenal Recon Official Website