hemu1438/forensicsgpt-training-data huggingface dataset:
Atola insight forensic -
Atola Insight Forensic is a fast forensic imaging system produced by Atola Technology capable of diagnosing and imaging damaged and unstable drives. It offers sophisticated data retrieval functions along with utilities for manually accessing hard drives at the lowest level, wrapped in a simple and efficient user interface. The tool is developed by a team of data recovery engineers in collaboration with law enforcement agencies and forensic experts.
The system has several key features for data capture in forensic and e-discovery cases:
Fastest in industry imaging speed up to 550 MB/s
High-performance multi-pass imaging for damaged drives
In-depth Automatic HDD diagnostics
Extraction of unknown ATA Passwords
Case management system prepares acquisition reports automatically
Hash calculation: MD5, SHA1, SHA224, SHA256, SHA384, SHA512
Unclip DCO (device configuration overlay) and HPA (host protected area)
Forensic data erasure methods including DoD 5220.22-M, Security Erase, NIST 800-88, Pattern Erase
File recovery for NTFS (all versions), Ext 2/3/4, HFS, HFS+, HFSX, ExFAT, FAT16, FAT32, APFS
Support for SATA, IDE, SAS, USB media
Support for Apple PCIe (2013 - recent models), NVMe and M.2 PCIe SSDs via Atola extension modules
Built-in write blocker
Optional 10Gb Ethernet via extension modules
Search of forensic artifacts: GPS coordinates, phone numbers, emails, URLs, IP and MAC addresses, credit card numbers, custom keywords and regular expressions
Major Imaging Parameters:
Multi-pass imaging system with adjustable settings for damaged media
Linear and segmented hash calculation (pre-hash, during imaging, post-hash)
Selective head imaging
Handling of freezing drives (automatic reset and power cycle commands)
HEX pattern to fill skipped sectors with (00 by default)
Automatic split file creation mode: .001, .002, .003, etc.
Image file on a source device
Create encrypted password-protected VeraCrypt volume on a target drive to store images
Creation of E01 segmented files (E01, E02, etc) supported
Compare media after imaging and hash verification
Atola Insight Forensic system includes:
Atola Insight Forensic software (runs on any Windows PC or laptop)
DiskSense hardware unit
Hardware extensions (optional)
Battery (optional)
Libvhdi -
The libvhdi package contains a library and applications to read the Virtual Hard Disk (VHD) image format.
Tools
The libvhdi package contains the following tools:
vhdiinfo, which shows the information about VHD files.
vhdimount, which FUSE mounts VHD image files.
Examples
FUSE mounting a VHD image
vhdimount image.vhd mount_point 
History
Libvhdi was created by Joachim Metz in 2012.
Also See
Virtual Hard Disk (VHD) image format
External Links
Project site
Building libvhdi and tools from source
Mounting a VHD image
Libsmraw -
The libsmraw package contains a library and applications to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
History
Libsmraw was created by Joachim Metz in 2010, while working for Hoffmann Investigations. Libsmraw is a rewrite of earlier work for the proof-of-concept multi-threaded imager: GNOME Forensic Imager.
Tools
The libsmraw package contains the following tools:
smrawmount, which FUSE mounts (split) RAW image files.
The libsmraw package also contains the following bindings:
pysmraw, bindings for Python (libsmraw 20140621 or later).
Examples
FUSE mounting a split RAW image (libsmraw 20110916 or later)
smrawmount image.raw.000 mount_point 
Or:
smrawmount image.raw.??? mount_point 
Also See
RAW Image format
External Links
Project site
Libvmdk -
The libvmdk package contains a library and applications to read the VMWare Virtual Disk Format (vmdk) format.
Tools
The libvmdk package contains the following tools:
vmdkinfo, which shows the information about VMDK files.
vmdkmount, which FUSE mounts VMDK image files.
Examples
FUSE mounting a VMDK image
vmdkmount image.vmdk mount_point 
History
Libvmdk was created by Joachim Metz in 2009.
Also See
VMWare Virtual Disk Format (vmdk)
External Links
Project site
Building libvmdk and tools from source
Mounting a VMDK image
Write blockers -
Write blockers are devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents. They do this by allowing read commands to pass but by blocking write commands, hence their name.
There are two ways to build a write-blocker: the blocker can allow all commands to pass from the computer to the drive except for those that are on a particular list. Alternatively, the blocker can specifically block the write commands and let everything else through.
Write blockers may also include drive protection which will limit the speed of a drive attached to the blocker. Drives that run at higher speed work harder (the head moves back and forth more often due to read errors). This added protection could allow drives that can not be read at high speed (UDMA modes) to be read at the slower modes (PIO).
There are two types of write blockers, Native and Tailgate. A Native device uses the same interface on for both in and out, for example a IDE to IDE write block. A Tailgate device uses one interface for one side and a different one for the other, for example a Firewire to SATA write block.
Steve Bress and Mark Menz invented hard drive write blocking (US Patent 6,813,682).
There are both hardware and software write blockers. Some software write blockers are designed for a specific operating system. One designed for Windows will not work on Linux. Most hardware write blockers are software independent.
Hardware Write Blockers
Hardware write blockers can be either IDE-to-IDE or Firewire/USB-to-IDE. Simson prefers the IDE-to-IDE because they deal better with errors on the drive and make it easier to access special information that is only accessible over the IDE interface. You may feel differently.
NIST test results are here: https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt/cftt-technical/hardware
Commercial
MyKey Technology, Inc. NoWrite FPU and FlashBlock II 1.8"/2.5"/3.5"/ IDE to IDE, FireWire/USB to IDE & SATA, all media types - NIST Ver. 2 accepted
Tableau write blockers for IDE, SATA, SCSI, USB NIST Ver. 1 accepted https://www.opentext.com/products/tableau-forensic-bridges
WiebeTech write-blockers for almost any disk drive: 2.5"/3.5" IDE, SCSI, SATA, ... https://wiebetech.com/products/ NIST Ver. 1 accepted
EPOS WriteProtector
Software Write Blockers
Software write blockers can be either tailored to an individual operating system or can be an independent boot disk. Their main upsides are with ease of use, since they are on a CD and do not require you to open up the case, and speed since they do not become a bottle neck.
Open Source
Linux software write blocker
Commercial
SAFE Block XP SAFE Block XP is a software-based write blocker designed for the Windows XP Operating System. It comes in both 32 and 64 bit options. NIST Ver. 1.2 accepted.
Linen -
LinEn is a Linux version of the normally DOS based EnCase acquisition tool. It has roughly the same functionality as the DOS version.
Features
File Systems Understood
File Search Facilities
Historical Reconstruction
Can it build timelines and search by creation date?
Searching Abilities
Can it search? Does it build an index? Can it focus on file types or particular kinds of metadata?
Hash Databases
Can it create hashes of files and/or blocks? Can it compare these hash values to any databases? What sort of hash functions does it use?
It can calculate an MD5 hash.
Evidence Collection Features
Can it sign files? Does it keep an audit log?
History
License Notes
Linen is released under a proprietary license. It is included as part of the freely downloadable Helix live CD.
External Links
Official website
Deepspar disk imager -
The DeepSpar Disk Imager is a hardware, drive to drive, data recovery imaging device. It makes use of a fairly standard PC system but connects directly to the source drive (the drive being imaged.) Through this hardware connection, it is able to command the source drive on a low ATA register level. It thus bypasses normal BIOS calls to the hard drive. Standard BIOS / hard drive operations will not allow the retrieval of damaged or corrupted sectors as it would invariably cause a system (OS) failure. For data recovery purposes however, it is important to be able to access any available data.
Additionally, the DeepSpar Disk Imager controls the power input of the source drive so that it can, if required, re-power the source without rebooting the system. (This is significant with highly unstable drives that will continually “hang.”)
To control and pre-configure the source drive, the DeepSpar Disk Imager makes use of specific ATA commands 1 as well as some vendor specific commands. This includes the ability to read sectors while ignoring ECC errors as well as the ability to send software and hardware reset commands to the drive which creates the ability to control “read timeout.” (Read timeout is a user defined amount of time in milliseconds that the hard drive will be given to read any particular sector. If the read timeout is reached before the sector is correctly read, it will be skipped. The imager then marks in its “map” that the sector was skipped so that it can be reprocessed on later passes.)
Through the tool’s software interface, the end user is able to configure all parameters and commands that they wish the imager to use over multiple imaging passes. As previously mentioned, the DeepSpar Disk Imager stores a “map” of all the sectors from the source drive. This map allows the imager to always remember which sectors have been imaged, which were skipped, and which had errors etc. This in turn allows the imager to run multiple passes without reprocessing sectors that had been previous read correctly. It also allows the imager run imaging passes to target specific sector errors.
Unlike forensics tools, the DeepSpar Disk Imager does not create an image file. Instead, it uses commands and techniques to image all sectors on the source drive directly to the destination drive. The image drive can then be used by any data retrieval or forensics software for file recovery or forensics investigation.
External Links
Official website
Product data sheet
Review of the DeepSpar Disk Imager by Mike Montgomery of MJM Data Recovery in the UK.
Disk Imaging: A Vital Step in Data Recovery, a whitepaper on the product
Interview on the imager on the Cyberspeak podcast
Helix3 -
Helix3 is a Live CD built on top of Ubuntu. It focuses on incident response and computer forensics.
According to Helix3 Support Forum, e-fense is no longer planning on updating the free version of Helix.
Tools Included
Helix focuses on Incident Response and forensics tools. It is meant to be used by individuals who have a sound understanding of Incident Response and forensic techniques.
Bootable Side
aimage
dc3dd
dcfldd
LinEn
The Sleuth Kit
and others.
Windows Side
FTK Imager
IRCR
mdd
WFT
win32dd
winen
and others.
Windows side can be used to scan for pictures on a live system.
Forensic Issues
Helix3 will automount ext3 and ext4 file systems during the boot process and recover them if required (bug in initrd scripts);
Helix3 can automount some storage devices like firewire devices and MMC in read/write mode;
Helix3 relies on file system drivers to provide write protection, mounting some file system types (e.g. XFS will result in several data writes to the original media.
See Also
Helix3 Pro
Helix3 pro -
Helix3 Pro is a Live CD built on top of Ubuntu. It focuses on incident response and computer forensics.
Tools Included
Live side for Mac OS X, Windows and Linux
A bootable forensically sound environment based on Ubuntu
Open source forensic tools include:
dc3dd
aimage
The Sleuth Kit (3.0.1, with "light" version of Autopsy, with libewf
foremost
Volatility
Several tools for mobile phone forensics
Other tools include:
LinEn
Forensic Issues
Helix3 Pro can automount some storage devices like firewire devices and MMC in read/write mode;
Helix3 Pro relies on file system drivers to provide write protection, mounting some file system types (e.g. XFS will result in several data writes to the original media.
See Also
Free version: Helix3
Eudora header format -
Message-Id: <6.0.0.22.0.20070728180447.02342558@sendinghost.com> X-Sender: username@pop.sendinghost.com X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.22 Date: Sat, 28 Jul 2007 18:05:07 +0200 To: Username <username@receivinghost.com> From: Username <username@sendinghost.com> Subject: header test Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed
Evolution header format -
Subject: header test From: Username <username@sendinghost.com> To: Username <username@receivinghost.com> Content-Type: text/plain Date: Sat, 28 Jul 2007 11:52:35 +0200 Message-Id: <1185616355.19231.0.camel@localhost> Mime-Version: 1.0 X-Mailer: Evolution 2.10.1 Content-Transfer-Encoding: 7bit 
The Message id consists of five parts:
The current time as returned by the time function followed by a period. The value is dislayed in decimal and is the number of seconds since midnight on 1 Jan 1970. In the example above, 1185616355 refers to Sat, 28 Jul 2007 09:52:35 GMT.
The process id number in decimal followed by a period
The third value starts at zero but may increase as more messages are sent. It is also followed by a period
The word camel followed by an '@'
If the canonical hostname can found, it is used. Otherwise the hostname
The Message id format comes from the function camel_header_msgid_generate in evolution-data-server/camel/camel-mime-utils.c.
Ost reporter -
OST Reporter is a forensic purpose profile detail generation tool for Exchange Offline Outlook OST file. This application is a freeware reporter.
Features
Outlook OST Reporter is a freeware application built to generate the complete report of an Offline Storage Table File (OST File). The report is generated with overall statistics, usage overview, and other details of the file displayed in graphical representation. The generated report is exportable to a Comma Separated Values (CSV) file.
External Links
Official Website
Pst reporter -
PST Reporter is a forensic purpose profile detail generation tool for Microsoft Outlook data file. This application is a freeware reporter.
Features
Outlook Data File Reporter tool can be operated on any available version of Windows OS. For the different versions of MS Outlook; PST Reporter offers ANSI and Unicode PST support.
Outlook PST Reporter can process any size of PST file complying with the ANSI & Unicode formatted PST file support.
External Links
Official Website
Yahoo! mail header format -
The Yahoo! Web Mail header format has changed over time, but currently includes the sender's IP address, a domain key signature, and some other helpful information.
DomainKey-Signature
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=ql3kRKrhner1LTFFVBgCYI1uqK4+8hrb6d/Fefr/HkLuObQwIrIpEXA1OiagbuFZU+H+ue1anFvm1cHQ4hjpdUcjpIIPL7ldNL9YnOxauugdVW+ OpbTvAu0XaGf2t7eBqOWJF0Y5gM7TE27WdElgVRikunfCQca1VFV6KSuQP0o=; 
Here is a sample mail header. Note that the 'date' field will change from (PDT) to (PST) depending on the status of daylight savings time in California, USA. The sender's IP address is represented as a.b.c.d in the example below.
Mail Header
Received: from [a.b.c.d] by web53409.mail.re2.yahoo.com via HTTP; Sat, 14 Feb 2009 05:42:03 PST X-Mailer: YahooMailWebService/0.7.260.1 Date: Sat, 14 Feb 2009 05:42:03 -0800 (PST) From: Sender Name <sender@yahoo.com> Reply-To: sender@yahoo.com Subject: Test Message To: recipient@domain.com MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Message-ID: <695976.86300.qm@web53409.mail.re2.yahoo.com> 
Message IDs
The Message-ID header in yahoo emails is a good identifier for the device that sent the message. Below are some samples:
Sent via Yahoo!® Mail for Android application on Android (Jelly Bean):
Message-ID: <1332714176.54741.androidMobile@web141101.mail.bf1.yahoo.com> 
Sent via Yahoo Webmail from Chrome:
Message-ID: <1332793663.59921.YahooMailNeo@web121601.mail.bf1.yahoo.com> 
Sent via Android browser on via mobile webmail interface:
Message-ID: <1332792527.64712.BPMail_high_noncarrier@web121601.mail.bf1.yahoo.com> 
Sent via Android email application configured for SMTP (jelly bean):
Message-ID: <gf4yxl2u7us2lp89xkgbty9u.1342797846221@email.android.com> 
Sent via iPod (IOS 5.0.1)
Message-ID: <1341798412.80181.YahooMailMobile@web124306.mail.ne1.yahoo.com> 
Also See
Yahoo Forensics
Yahoo Backup
3des -
3DES or Triple DES is a block cipher formed by using the Data Encryption Standard (des cipher three times).
3DES is typically implemented as ENCRYPT(block,K1), DECRYPT(block,K2), ENCRYPT(block,K3). This way, if you set K1==K2 it's backwards compatible with single-key DES with K3. It's pretty cool, but perhaps less useful today than it was when 3DES was first brought out.
External Links
Wikipedia: 3DES
File vault -
FileVault (or File Vault) is the cryptographic file system developed by Apple and introduced with MacOS 10.3.
FileVault works by storing each user's home directory in an encrypted ".sparseimage" file. The file is automatically mounted when the user logs in and unmounted when the user logs out. All of the user's files and preferences are stored in this file. The file's encryption key is stored in the .sparseimage file, but that encryption key is itself encrypted with the user's login password.
There are no known attacks against File Vault other than a brute force attack on the user's password.
As part of the security enhancements in OS X 10.5 (Leopard) Apple have moved from AES-128 to AES-256 for the encryption used in the disk image.
In Mac OS X 10.7 (Lion) a full volume encryption variant was introduced.
See Also
FileVault Disk Encryption
External Links
Design Principles and Patterns for Computer Systems That Are Simultaneously Secure and Usable, by Simson Garfinkel, May 2005. PhD thesis that discusses of File Vault's usability shortcomings.
Unlocking FileVault talk at 23rd Chaos Communication Congress (23c3), by Jacob Appelbaum and Ralf-Philipp Weinmann, December 2006
slides
Tools
VileFault
Freeotfe -
FreeOTFE is an open source program to create and mount virtual encrypted disks in Windows Vista/XP/2000 and Linux. It provides two levels of plausible deniability (hidden containers and no signatures to make differentiate containers from random data), on the fly encryption and supports numerous encryption algorithms (including AES, Blowfish, Serpent and Twofish.
A hidden volume is a volume concealed within the free space of another FreeOTFE volume. Even when the outer volume is mounted, it is hard to prove whether there is a hidden volume or not.
When a hidden volume is mounted, the operating system and third-party applications may write to non-hidden volumes information about the data stored in the hidden volume (e.g. most recently used mru).
External Links
Project mirror
Atola taskforce -
Atola TaskForce is a forensics imager by Atola Technology, designed for working with both good and damaged media with a focus on high-performance (up to 18 parallel imaging sessions at 15 TB/hour).
General Information
Supports SAS, SATA, USB and IDE drives via 18 ports
Multitasking at 15 TB/hour (imaging, hashing, wiping in parallel on all ports)
Diagnostics for drive condition assessment, imaging time estimate, detection of file systems and restricted areas (encrypted, password-protected, HPA/DCO)
Evidence drives can be imaged to up to 5 targets each. The targets may include other drives, image files (E01, RAW, img or dd) on a target drive or on a server, or a combination of all of the above
Multi-user access allows a group of operators to work simultaneously on different tasks, tracking the progress remotely and using multitasking capabilities to the full.
Standalone mode for in-the-field imaging
Imaging
12+ simultaneous imaging sessions
RAID support
Express mode
Web API for imager integration into workflow automation tools
Imaging to E01 and RAW files
Imaging to encrypted target drives (VeraCrypt)
Selective partition acquisition
Hardware unit
Ports: 6x SATA, 6x SAS/SATA, 4x USB, IDE + extensions for NVMe, PCIe, Apple SSD, MacBooks, etc.
Source switches on all ports for hardware write protection
Server-grade motherboard, 8-thread Xeon CPU 3.7 GHz and ECC RAM
2x 10Gb Ethernet ports
Touch screen
Other features
Standalone mode
Multi-user access when connected to a network (web-based interface)
Unknown ATA password recovery
HPA & DCO recovery
Hash calculation (MD5, SHA1, SHA256, SHA512)
Wiping with various methods: custom pattern, NIST 800-88, DoD 5220.22-M, random, LBA number
Case management and automatic report generation
Damaged drive support
Imaging of drives with surface scratches, logical errors, broken heads, worn-out magnetic layer and firmware issues:
In-depth drive diagnostics
Selective head imaging
Automated multi-pass system for gentle yet thorough imaging of damaged media
Imaging of freezing drives
Segmented hashing to verify images from media with bad sectors
Automatic overcurrent and short-circuit protection
Libqcow -
The libqcow package contains a library and applications to read the QEMU Copy-On-Write (QCOW) image format.
Tools
The libqcow package contains the following tools:
qcowinfo, which shows the information about QCOW files.
qcowmount, which FUSE mounts QCOW image files.
Examples
FUSE mounting a QCOW image (libqcow 20111009 or later)
qcowmount image.qcow mount_point 
History
Libqcow was created by Joachim Metz in 2010.
Also See
QEMU Copy-On-Write (QCOW) image format
External Links
Project site
Building libqcow and tools from source
Mounting a QCOW image
Rainbow tables -
Overview
Rainbow tables are large pre-computed tables that make it fast to determine what word produced a particular hash. Rainbow tables only work if the following conditions are true:
The hash algorithm was known when the rainbow table was created;
No salt was used in the individual password.
These rainbow tables are free for download.
Windows XP & Vista passwords (LM & NT hashes)
https://ophcrack.sourceforge.io/tables.php
WPA/WPA2-PSK passwords
https://www.renderlab.net/projects/WPA-tables/ (only for top 1000 SSID list)
DOC, PDF, etc
See Also
Hashing#MD5_Reverse_Hash_Services
References
Wikipedia's Rainbow table entry
Twofish -
Twofish is an encryption algorithm designed designed by Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson, Eli Biham and Lars Knudsen as a candidate for the Advanced Encryption Standard AES competition, where it got third place with 31 votes (Rijndael got 86 votes, and was selected by NIST as the AES, and Serpent.
Twofish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. It is related to the earlier Blowfish block cipher, also designed by Bruce Schneier.
External Links
Twofish Homepage
Wikipedia: Twofish
Serpent -
Serpent is an encryption algorithm designed by Ross Anderson, Eli Biham and Lars Knudsen as a candidate for the Advanced Encryption Standard AES competition, where it got second place with 59 votes Rijndael got 86 votes, and was selected by NIST as the AES).
Serpent uses a block size of 128 bits and supports a key size of 128, 192 or 256 bits.
Serpent and Rijndael are somewhat similar. The main difference is that Rijndael has fewer rounds (10, 12 or 14 (depending on key size) compared to 32 for Serpent), hence it is faster. Arguably, Serpent is more secure.
Serpent is available as public domain, and can be freely used by anyone.
External Links
Serpent Cipher Homepage
Wikipedia: Serpent (cipher)