hemu1438/forensicsgpt-training-data huggingface dataset:
Dcfldd -
dcfldd is an enhanced version of dd developed by the U.S. Department of Defense Computer Forensics Lab. It has some useful features for forensic investigators such as:
On-the-fly hashing of the transmitted data.
Progress bar of how much data has already been sent.
Wiping of disks with known patterns.
Verification that the image is identical to the original drive, bit-for-bit.
Simultaneous output to more than one file/disk is possible.
The output can be split into multiple files.
Logs and data can be piped into external applications.
The program only produces raw image files.
Example
Unix/Linux
dcfldd if=/dev/sourcedrive hash=md5,sha256 hashwindow=10G md5log=md5.txt sha256log=sha256.txt \ hashconv=after bs=512 conv=noerror,sync split=10G splitformat=aa of=driveimage.dd
This command will read ten Gigabytes from the source drive and write that to a file called driveimage.dd.aa. It will also calculate the MD5 hash and the sha256 hash of the ten Gigabyte chunk. It will then read the next ten gigs and name that driveimage.dd.ab. The md5 hashes will be stored in a file called md5.txt and the sha256 hashes will be stored in a file called sha256.txt. The block size for transferring has been set to 512 bytes, and in the event of read errors, dcfldd will write zeros.
Windows
While there is a Windows executable of DCFLDD out there, it can be difficult to use. There is currently a PowerShell Script that can be used to help newcomers out, located here
Precautions
This tool is not suitable for imaging faulty drives:
dcfldd is based on an extremely old version of dd: it's known that dcfldd will misalign the data in the image after a faulty sector is encountered on the source drive (see the NIST report), and this kind of bug (wrong offset calculation when seeking over a bad block) was fixed for dd in 2003 (see the fix in the mailing list);
similarly, dcfldd can enter an infinite loop when a faulty sector is encountered on the source drive, thus writing to the image over and over again until there is no free space left.
See Also
dc3dd
Kaspersky anti virus -
Quarantine directory
The location of the quarentine directory is dependent on the version of Kaspersky Anti-Virus. Some examples of different locations used by different version of Kaspersky Anti-Virus:
On Windows 7:
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP12\QB 
On Windows 7:
C:\ProgramData\Kaspersky Lab\AVP60MP4\QB 
The quarantine files are stored in the Kaspersky Anti-Virus Quarantine File format
Report files
Depending on the version Kaspersky Anti-Virus use Report files to log information about scans and on-access detected malware. The report files are stored in the Kaspersky Anti-Virus Report File format format and typically use the .rpt extension. The report files can be found in the following locations:
On Windows 7:
C:\ProgramData\Kaspersky Lab\AVP60MP4\Report 
See Also
Kaspersky Quarantine File
Kaspersky Report File
External Links
Kaspersky
Sophos antivirus -
Quarantine directory
The Quarentine directory can be found in the following locations:
On Windows XP:
c:\documents and settings\All Users\Application Data\Sophos\Sophos Anti-Virus\INFECTED 
On Windows 7:
C:\ProgramData\Sophos\Sophos Anti-Virus\INFECTED 
On Mac OS X:
/Users/Shared/Infected 
Log files
The log files can be found in the following locations:
On XP:
c:\documents and settings\All Users\Application Data\Sophos\Sophos Anti-Virus 
On Windows 7:
C:\ProgramData\Sophos\Sophos Anti-Virus 
On MacOS-X:
/Library/Logs/Sophos Anti-Virus.log 
Log entries
The Sophos logs sometimes contain the following notation:
...\file.exe\FILE:0000 
These are not an NTFS ADS, but seems to be related to "running" files
These entries also surface when scanning a packed executable. So they might refer to unpacked versions of the executable.
External Links
Sophos
Microsoft security essentials -
Quarantine directory
On Windows XP:
C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Quarantine 
On Windows 7:
C:\ProgramData\Microsoft\Microsoft Antimalware\Quarantine 
Scan cache
C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\CacheManager\MpScanCache-0.bin 
File system cache (Windows Defender)
C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin 
To build run:
"%programfiles%\Windows Defender\MpCmdRun.exe" –BuildSFC 
External Links
Microsoft Security Essentials, by Microsoft
Endpoint Protection, by Microsoft
Quarantined files
hardcoded key obtained from mpengine.dll
Air -
The Automated Image and Restore or AIR is a GUI front-end to dd and dc3dd designed for easily creating forensic bit images.
Features:
auto-detection of IDE and SCSI drives, CD-ROMs, and tape drives
choice of using either dd or dcfldd
image verification between source and copy via MD5 or SHA1/256/384/512
image compression/decompression via gzip/bzip2
image over a TCP/IP network via netcat/cryptcat
supports SCSI tape drives
wiping (zeroing) drives or partitions
splitting images into multiple segments
detailed logging with date/times and complete command-line used
External Links
Official website
Darik's boot and nuke -
Darik's Boot and Nuke is a disk image that can create a bootable CD/DVD/Floppy/USB Device that can securely wipe the hard disks of most computers. 
DBan is bundled with Eraser
Wipe Methods
Quick Erase
Canadian RCMP TSSIT OPS-II Standard Wipe
American DoD 5220-22.M Standard Wipe
Gutmann Wipe
PRNG Stream Wipe
External Links
Official website
Support Forum
Kernel for ie password -
This utility restores and displays the user logins and passwords from the cache of Internet Explorer and auto complete the data strings that assist user in dealing with such mishaps.
Features
Kernel IE Password Recovery tool performs restoration of user logins and password with help of sophisticated algorithms that are designed to tackle such issues easily. With this enhanced tool, user can open protected sites and recover data strings stored by the Auto complete option. The tool exemplifies the strategy of time management by a remembering user’s login.
External Links
Official Website
Kernel for mbox viewer -
Kernel MBOX Viewer is the standalone utility designed to view entire MBOX file contents in hierarchical manner. This MBOX Viewer tool perfectly maintains folder structure and format. Thus, with an immediate quick installation of this tool, you must not wait for queued installation and getting the tool ready for uploading concerned files.
Overview
Kernel MBOX Viewer is a free tool developed to provide complete visuals and details of the contents in hierarchal manner present in MBOX files. This application is automated to reflect the items like mails, contacts, folders, drafts, appointments, etc. Being a standalone platform, no supporting application (active or passive form) is required. Kernel MBOX Viewer can tackle even complicated MBOX files irrespective of their complication level.
Features
Kernel MBOX Viewer is a versatile tool that provides preview of the MBOX files with an efficacy of supporting 20 MBOX clients. It would be wise to use a reliable tool like Kernel for MBOX Viewer, than other tool with a subscription of only 1-year.
Standalone Utility
Kernel MBOX Viewer is an independent tool that does not require any assistance from other tool. Being a self-sufficient utility, Kernel MBOX Viewer is widely used by most system professionals. Soon after its installation, you can carry out previewing of MBOX items without any delay.
Previewing Data
Preview option often benefits user by providing a chance to view data items like mails, contacts, folders, drafts, appointments, etc. By doing so, user remains assured that MBOX files are intact and no data was lost in thin air.
Processing of Multiple MBOX files
Kernel MBOX Viewer remains entirely accountable for processing of single/multiple files in a single cycle. The selection of MBOX files entirely depends upon user’s requirement. However, user must remain assure that no data mingling will take place during entire process.
Equipped with email filtering options
The email filtering option makes Kernel MBOX Viewer more adorable among its users as it presents retrieval of MBOX emails on the basis of different criteria like To, From, Subject, Date/Time, and Folder. This all is done with the help of powerful filters that are deemed to do so without any error. Thus, Kernel MBOX Viewer works well!
Saves retrieved email lists in HTML
Kernel MBOX Viewer has inbuilt capability to save the retrieved MBOX files in HTML format. This makes accessibility to MBOX files flexible from other web browsers like Internet Explorer, Google Chrome, Firefox, etc. This feature of Kernel MBOX Viewer is best for those users who don’t have direct access to MBOX files.
Licensing
For details regarding licensing of Kernel for MBOX Viewer, visit to official website is requested.
Support
Kernel Data Recovery provides quick and satisfactory technical support throughout the year. Moreover, response to any technical query is dealt through email or call as per choice of the user.
External Links
Official Website
Kernel for olm viewer -
Kernel for OLM Viewer is a advance tool that reveals its true value when user system is completely devoid of Outlook for Mac. In absence of Mac Outlook, this tool provides direct and easy access to Outlook files without any technical mishaps.
Overview
Most users face awkward situation when they have to access the OLM files which remain inaccessible due to either compatibility issues or non-availability through proper means. Kernel for OLM Viewer is the perfect solution to act in such situation. This outstanding tool not only facilitates display of OLM data items but also provides File Analysis Report that entails information about OLM file data.
Features
Kernel for OLM Viewer is efficient in accessing healthy and corrupted OLM files in complete absence of Outlook for Mac. The sophisticated algorithm, with reserved developing rights, accomplishes this task efficiently without losing data items and maintaining the hierarchy of data.
Independent Existence
Kernel for OLM Viewer has an independent existence. This clearly carves out the clear picture that Kernel for OLM Viewer can handle OLM files in complete absence of Mac Outlook.
Determining about OLM files
Generation of File Analysis Report purely determines the entire information regarding concerned OLM files. It gives the detailed information regarding Total item types, Mail flow density by date, Mail flow density by senders, and Interaction between users. Apart from this feature, the message list folder of an OLM folder can be saved in HTML format.
Access of OLM files in Windows OS
Compatibility issues with OLM files are quite common issues that user face. The tool has been designed in such a manner that the OLM files can be perfectly opened even in other platforms like Windows OS. This feature puts down the compatibility issue and permits user to access OLM files from any system without taking assistance.
Looks for specific OLM emails
Kernel for OLM Viewer is customized with an ancillary feature for locating specific emails that are important to the user. The specific email is looked on the basis of certain criteria like From, To, Subject, Received before, Received after, and Message has attachments.
View items of healthy and damaged files
Kernel for OLM Viewer provides access to damaged and healthy OLM files without any irregularities in data integrity. This clearly depicts that irrespective of OLM file condition, the tool is capable to retrieve data items without any issue. Thus, by accessing such filers, this tool fulfills need of every user.
Licensing
For details regarding licensing of Kernel for OLM Viewer, visit to official website is requested.
Support
Kernel Data Recovery provides quick and satisfactory technical support throughout the year. Moreover, response to any technical query is dealt through email or call as per choice of the user.
External Links
Official Website
Kernel for outlook express password recovery -
Kernel for Outlook Express Password Recovery is a professional software developed by Kernel Data Recovery. It's specifically programmed to recover all types of passwords of Outlook Express email accounts.
Overview
Kernel for Outlook Express Password Recovery tool was officially introduced by Kernel Data Recovery in May, 2006. The tool joined the Kernel's vast range of free software. The advanced tool, specially programmed for recovering passwords of Outlook Express email accounts, is available online for free download. The tool used to be a paid one at the time of launch but now it’s available free of cost.
Interface
The Graphical User Interface (GUI) of the software is quite easy-to-understand. It displays all functions on its welcome screen. Simply download the software and launch it. On the welcome screen, click on the 'Recover' button and the tool displays all email accounts alongwith their username and passwords.
Any kind of technical or non-technical assistance is not required to operate Kernel for Outlook Express Password Recovery tool. Even if any support is required, Kernel Data Recovery's tech support team is available 24*7.
Features
Multi-lingual Passwords
Outlook Express Password Recovery tool can recover extremely complex and multi-lingual passwords easily. The advanced tool takes hardly any time for recovering any kind of password. It displays all email accounts alongwith their username & passwords and provides option to save them.
Ensures Quick Recovery
Outlook Express Password Recovery tool is programmed to provide quick results. It can recover any kind of password (lost, forgotten, passwords with characters of different languages, etc.) within a very short span of time.
Easy to Operate
Kernel for Outlook Express Password Recovery tool carries a user-friendly and interactive interface. All its features are very much self-explained. Welcome screen of the tool explains all features. Just a single click recovers all email account passwords.
Compatibility
Kernel for Outlook Express Password Recovery tool offers high software compatibility. It can recover passwords of all Outlook Express versions including 6.0, 5.5, 5.0, and 4.0. And, it can be used with all versions of Windows operating system including Windows 8.1, 8, 7, Vista, XP, 2000, 98, NT and 95.
Software License
Kernel for Outlook Express Password Recovery is a free tool. There are no downloading charges. The tool can be downloaded from the official website of Kernel Data Recovery.
Customer Support
Kernel Data Recovery provides 24*7 technical support to all its customers. The tech support team at Kernel is always ready to assist its customers through emails, Live chat or call to resolve any query related to any Kernel software.
External Links
Official Website
Kernel for outlook password recovery -
Restoration of lost PST password is the remarkable notion behind this significant tool.
Features
This tool impeccably recovers the lost password of any PST file by using strong encryption algorithms. Providing password instantly is not only its characteristic feature, moreover, the tool perfectly supports multilingual password recovery from Microsoft Outlook 2010/2007/2003/XP/2000/97 PST files.
External Links
Official Website
Internet explorer -
Microsoft Internet Explorer (MSIE) is the default Web Browser included with Microsoft Windows.
MSIE 4 to 9
MSIE 4 to 9 uses the Internet Explorer History File Format (or MSIE 4-9 Cache File format). The Cache Files commonly named index.dat are used to store both cache and historical information.
MSIE 10
C:\Users\%USER%\AppData\Local\Microsoft\Windows\WebCache\ 
The WebCacheV01.dat and WebCacheV24.dat files are in the Extensible Storage Engine (ESE) Database File (EDB) format
Configuration
Internet Explorer will apply its setting in the following order, where the lower the order overrides settings in the higer order.
Settings in Machine policy key
Settings in User policy key
Settings in User preference key
Settings in Machine preference key
Machine policy key
HKET_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings 
Machine preference key
HKET_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 
User policy key
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings 
User preference key
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 
Security Zones
0 - My Computer
1 - Local Intranet Zone
2 - Trusted Sites Zone
3 - Internet Zone
4 - Restricted Sites Zone
5 - Custom
WPAD
TODO add some text
Command line options
MSIE supports various command line options, see: IE Command-Line Options
Artifacts
Recovery store
TODO add some text
On Windows Vista and later:
C:\Users\%USER%\AppData\Local\Microsoft\Internet Explorer\Recovery 
Typed URLs
Internet Explorer stores the cached History (or Address box) entries in the following Windows Registry key:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs 
See Also
Extensible Storage Engine (ESE) Database File (EDB) format
Internet Explorer 4-9 Cache File Format
External Links
Internet Explorer Cache
Internet Explorer security zones registry entries for advanced users, by Microsoft
Troubleshooting Automatic Detection, by Microsoft
IE Command-Line Options, by Microsoft, January, 2011
Little-known browser commands and functions, by Fred Langa, June 21, 2012
Java Web Vulnerability Mitigation on Windows, by Tim Johnson, May 23, 2013
Internet Explorer EPM Sandbox Escape CVE-2014-6350, by James Forshaw, December 1, 2014
Recovery store
Internet Explorer RecoveryStore (aka Travelog) as evidence of Internet Browsing activity, by Yogesh Khatri, September 29, 2011
Typed URLS
TypedURLs Registry Key, Sketchymoose's Blog, February 18, 2014
Internet Explorer 10
Windows 8 Forensics: Internet History Cache, by Ethan Fleisher, August 21, 2012
Forensic Analysis of ESE databases in Internet Explorer 10, by Bonnie Malmström & Philip Teveldal, June 2013
Libscca -
The libscca package contains a library and applications to read the Windows Prefetch File Format (scca).
Tools
The libscca package contains the following tools:
sccainfo, which shows information about Prefetch (SCCA) files.
History
Libscca was created by Joachim Metz in 2011 and was originally named libpf, but renamed due to naming conflicts.
External Links
Project site
Kernel for outlook pst reporter -
To get a detailed report on Outlook PST files, you need to have an analytical tool that can devise a strategy for you to make your work easier. Kernel Data Recovery has designed Kernel Outlook PST Reporter that can provide you analytical approach on Outlook profiles email structure. It gives detailed description about concerned PST files.
Overview
Kernel Outlook PST Reporter is a free tool with an outstanding capability to provide detailed statistical and analytical data on user’s PST files. Being a free tool, Kernel Outlook PST Reporter comes without any limitations on providing comprehensive reports for concerned folder of PST files. The tool manages its report on the basis of data items such as Sender's Name, Sender's Email ID, Emails Read/Unread, and Total Email Item Size, Total Attachments, Attachment Type, and so on.
Features
The most important feature of Kernel Outlook PST Reporter is to provide statistical and analytical report on user’s selected folders of PST files. The other features are ancillary to it.
Detailed Report of PST files
Kernel Outlook PST Reporter provides detailed report on folders of PST files. It gives an idea on intensity of email traffic on the basis of data such as Sender's Name, Sender's Email ID, Emails Read/Unread, and Total Email Item Size, Total Attachments, Attachment Type, and so on.
Provision of Deleting the Selected Date Range
Kernel Outlook PST Reporter provides a functionality to delete the date if it does not contain the folder of our interest. This feature provides clean inspection of data items available in the selected data range. It helps in creating detailed report.
Provides Different Format for Report Generation
MS Excel and HTML are the two formats provided by Kernel Outlook PST Reporter to generate file analysis report. The selection of either format maintains the availability of report at anytime and anywhere. Being easy to export, you can attach them to your e-mail according to you convince.
Supports MS Outlook and Windows OS
Due to large number of versions of MS Outlook and Windows OS, it is necessary for the software to recognize the PST file in which it is made. Kernel Outlook PST Reporter perfectly recognizes PST file versions as it supports nearly all versions of MS Outlook and Windows OS.
Support
Due to user-friendly GUI no technical support is needed; however, if user faces any technical glitches while installation and uninstallation of Kernel Outlook PST Reporter, then user can contact through phone or email without any hesitation.
External Links
Official Website
Microsoft defender advanced hunting -
Microsoft Defender Advanced Hunting
Microsoft Defender advanced hunting is a query-based threat hunting tool which supports threat hunting (exploration) of raw data, from various Microsoft products, up to a period of 30 days. 
External links
Proactively hunt for threats with advanced hunting in Microsoft Defender XDR
Understand the advanced hunting schema
Drilling down on phishing campaigns with UrlClickEvents, by Sandra Hathaway, March 4, 2022
Libuna -
The libuna package contains a library and application to read and write the Text File (txt) format in different characters encodings.
Libuna currently supports:
7-bit ASCII
ISO 8859-1, 8859-2, 8859-3, 8859-4, 8859-5, 8859-6, 8859-7, 8859-8, 8859-9, 8859-10, 8859-11, 8859-13, 8859-14, 8859-15
Windows 874, 932, 936, 949, 950, 1250, 1251, 1252, 1253, 1254, 1255, 1256, 1257, 1258
Kod Obmena Informatsiey 8-bit; KOI8-R, KOI8-U
UTF-7, UTF-8, UTF-16, UTF-32
History
Libuna was created by Joachim Metz in 2008, while working for Hoffmann Investigations.
The codepages are based on libiconv and documentation available by Microsoft.
Currently libuna mainly supports the Windows codepages to be able to convert these when encountered in file formats that use them.
Libuna is intended as a character encoding support library and is used in:
libewf
libnk2
libpff
Tools
The libuna package contains the following tools:
unaexport, which exports the plain text files in different encodings. It also allows end of line conversion and control over the byte order mark (BOM).
External Links
project site
Libvshadow -
The libvshadow package contains a library and applications to read the Volume Shadow Snapshot (vss) volumes.
Tools
The libvshadow package contains the following tools:
vshadowinfo, which shows information about VSS Volumes.
vshadowmount, which FUSE mounts VSS Volumes.
History
Libvshadow was created by Joachim Metz in 2011.
See Also
Windows Shadow Volumes
External Links
Project site
Opera -
Data directory
Opera stores the user data in the following locations:
On Linux:
/home/$USER/.opera/ 
On MacOS-X
/Users/$USER/Library/Opera/ 
On Windows XP
C:\Documents and Settings\%USERNAME%\Application Data\Opera\Opera\ 
On Windows Vista, 7
C:\Users\%USERNAME%\AppData\Roaming\Opera\Opera\ 
Global history
The file global_history.dat is a text file.
Welcome to Opera https://www.opera.com:443/portal/upgrade/ 1319089117 -1 
Where the fields are:
Title
URL
date and time (32-bit POSIX or Unix epoch timestamp)
Search field history
The file search_field_history.dat is an XML file that contains the history of queries typed in the search bar by the user.
Typed history
The file typed_history.xml contains the history of the URLs typed in the address bar by the user.
Cache
On Linux
/home/$USER/.opera/cache/ 
On MacOS-X
/Users/$USER/Library/Caches/Opera/cache/ 
On Windows XP
C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Opera\Opera\cache\ 
On Windows Vista, 7
C:\Users\%USERNAME%\AppData\Local\Opera\Opera\cache\ 
External Links
Official website
Opera: Files used by Opera
Opera MBS Viewer
Opera Forensics