hemu1438/forensicsgpt-training-data huggingface dataset:
Kernel for eml viewer -
Kernel EML Viewer is a freeware program to provide a preview of restored e-mail messages that were created using Outlook Express and other supported e-mail clients like Thunderbird, Windows Live Mail. An EML file is a file extension used as a mode of backup or for sharing purposes, for an array of email clients.
The EML Viewer is specifically developed to provide free and unrestricted view of the restored EML information (like e-mail messages and attachments), without having the native application installed on the host machine.
Overview
Kernel EML Viewer is a free EML file reading software developed by Kernel Data Recovery. The freeware is built to open the contained information of EML files while maintaining the exact properties and hierarchical order of the original file. The EML Viewer performs examination on the user-provided EML file to make the content viewable for the end-users in the absence of Outlook Express environment.
Kernel EML Viewer is a standalone program embedded with advanced-algorithms to conduct customized previewing of EML file in the same cycle. The viewer can be installed on all versions of Windows-supported operating system including Windows 8.1.
Features
Independent EML Viewer
The software requires no installation of Microsoft Outlook Express program in order to open and access the contained information in EML file. However, the software is proven to open only healthy EML file.
Advanced Scanning
The freeware is embedded with ‘Advanced Settings’ option allowing to recuse all the sub-folders present on the host machine. The feature quickly scans all the EML files available in the user-selected folder and enlists them in an organized hierarchy for complex-free user-preview.
Advanced View Settings
Kernel EML Viewer is integrated with various fields (like From, Subject, Date/Time, to and Folder) to help users to quickly customize the view settings as per the user necessity and priority.
Simplified Interface
The application is built using intuitive Graphical User Interface design to extend user simplicity in understanding and operating. The total restored folders of the machine’s hard drive are presented in a tree-like structure guiding users to quickly select EML files.
Detailed Preview
The utility automatically aligns and displays the e-mail messages of EML files in the dedicated preview pane of the interface. It allows to view and open file items and the intrinsic details of the attached email-messages within the tool.
Saving Option
There is only a single saving option, i.e. HTML format. Select the desired email items and save the desired list in HTML file to view them outside the software.
Modern Version Support
The freeware is widely compatible with all new and older versions of Outlook Express, which allows users to read any version of Outlook EML file using a single utility.
Licensing
Kernel EML Viewer is available for free download and use. To learn more information related to licensing, visit the official website of Kernel Data Recovery.
External Links
Official Website
Disk explorer -
DiskExplorer is a forensic tool that can be used by investigators to analyze file systems. The file systems supported by DiskExplorer are:
FAT12
FAT16
FAT32
NTFS
DiskExplorer for FAT file systems can accomplish the following tasks1:
Navigate through your drive by using browser-style back and forth arrows, by going directly to the partition table, boot record, FAT or root directory, by jumping to a certain sector etc.
Switch between several views, such as hex, text, directory, FAT, partition table and boot record view
Search your drive for text, boot records, partition tables and sub directories
Investigate the volume' s boot record by looking at the volume information
Edit your drive by using the direct read/write mode (not recommended) or the virtual write mode
View and recover even deleted files
Create a virtual volume when your boot record is lost or corrupted
Conduct your own data recovery by taking advantage of all these features
DiskExplorer for NTFS file systems can accomplish the following tasks2:
Navigate through your NTFS drive by jumping to the partition table, boot record, Master file table or the root directory
Choose between views such as hex, text, index allocation, MFT, boot record, partition table
Inspect the file entry details, NT attributes etc.
Search your drive for text, partition tables, boot records, MFT entries, index buffers
View files
Save files or whole directories from anywhere on the drive
Identify the file a certain cluster belongs to
Create a virtual volume when the boot record is lost or corrupt
Edit your drive by using the direct read/write mode (not recommended) or the virtual write mode
Conduct your own data recovery by taking advantage of all these features
External Links
Official website
Aol pfc -
PFC files are files associated with America Online (AOL). PFC (Personal Filing Cabinet) is a database file that enables the users to save AOL emails locally on the computer’s hard drive. It also stores all the received and sent emails of America Online email client. The PFC file enables the user to manage and access the AOL mails when the user needs to work without the presence of internet connectivity. PFC file enables to create custom folders in it for making it easier for the user to identify the mails. Each username in AOL has only one PFC file associated with it, which can be viewed only via AOL. In addition to this, the PFC file cannot be accessed from any other computer or even if the user signs as a guest in his own computer.
File Signature
Hexadecimal: 41 4F 4C 56 4D 31 30 30
ASCII : AOLVM100
Contents
It contains attributes like emails, URLs, bookmarks, preferences, configuration data, etc. When it comes to the attachments associated with the AOL emails, the attachments are not stored in the PFC file. Thus, the attachments embedded in the AOL emails cannot be opened manually. These inline body attachments of AOL emails are stored in encoded 64 bit structure.
Location
The location of the AOL PFC mail store is:
In Windows XP(AOL 9.0) - C:\Documents and Settings\All Users\Application Data\AOL\C_AOL9.0\Organize
In Windows 7(AOL 9.7) - C:\ProgramData\AOL\C_AOL Desktop 9.7\backup
In Windows 10(AOL 9.7) - C:\ProgramData\AOL\C_AOL Desktop 9.7\backup
Tools
AOL PFC Viewer
SysTools AOL PFC Viewer
SysTools AOL PFC Converter
Kernel for hotmail msn password -
Kernel Hotmail MSN Password Recovery tool is developed by Kernel Data Recovery to recover lost or forgotten password of Hotmail MSN. This tool is beneficial for those users who have multiple MSN accounts.
Overview
Kernel Hotmail MSN Password Recovery tool is a freeware specifically designed to deal with lost or forgotten password of MSN account. It precisely traces the lost password characters by employing inbuilt powerful algorithm. The tool is compatible with all Windows OS, so user can perfectly download it on any version of Windows.
Features
Kernel Hotmail MSN Password Recovery tool has user-focused features that assist in recovery of lost password without need of any technical expert.
Supports decryption of complex passwords
Kernel Hotmail MSN Password Recovery tool is inbuilt with powerful algorithm that without any delay decrypts the most complicated passwords. It works swiftly on tracking of lost characters of the password.
Swift response for password recovery
Once you have installed Kernel Hotmail MSN Password Recovery tool, you can perform password recovery within seconds or even fraction of it. Thus, you must not remain hang on for hours to rescue password.
Significant tool for cyber forensics
Kernel Hotmail MSN Password Recovery tool works as most genuine tool for cyber forensic experts who just want to sneak into convicts email account to get last minute email details, if it supports the committed crime.
Licensing
Kernel Hotmail MSN Password Recovery is a freely available tool and therefore, no licensing is required.
Support
Kernel Data Recovery provides complete support to its client over email and chat, which ever client demands.
External Links
Official Website
Ascii -
The American Standard Code for Information Interchange (ASCII) is an encoding scheme for character or text representation in computerized systems.
The ASCII presentation uses 7-bit for a total of 128 non-printing, printing and control characters. The expanded version of ASCII to 8-bits became ISO/IEC 8859, and Windows-1252.
In some forensics tools 7-bit ASCII is referred to as low ASCII, while 8-bit ISO/IEC 8859 as high ASCII.
Autopsy forensic browser -
Autopsy® is an easy to use, GUI-based program that allows you to efficiently analyze hard drives and smart phones. It has a plug-in architecture that allows you to find add-on modules or develop custom modules in Java or Python.
Autopsy uses The Sleuth Kit for file system analysis. It can analyze Windows, MacOS, and UNIX disks, as well as cell phone dumps and collections of individual files. There are many third-party plug-in modules.
See also
Autopsy Forensic Browser, version 2
Search Autopsy Addon Modules
Carlos Lannister's catalog of Autopsy Modules
Autopsy forensic browser, version 2 -
The Autopsy Forensic Browser (Autopsy) is a graphical interface to the command line digital investigation analysis tools in The Sleuth Kit. Together, they can analyze Windows and UNIX disks and file systems such as:
NTFS
FAT
UFS1/UFS2
Ext2/Ext3
The The Sleuth Kit and Autopsy are both Open Source and run on UNIX platforms. As Autopsy is HTML-based, you can connect to the Autopsy server from any platform using a web browser. Autopsy provides a "File Manager"-like interface and shows details about deleted data and file system structures.
Current state
As of 2014, Autopsy 2.24 is the last version of Autopsy that supports non-Windows platforms. Since Autopsy 2.24 was released in 2010, it cannot support all features introduced in latest The Sleuth Kit versions. Various modifications introduced in Sleuthkit since 2010 break Autopsy 2.24.
There are several known conflicts between Autopsy 2.24 and Sleuthkit 4.1.3:
Autopsy cannot normally jump through directories on HFS.
Autopsy cannot handle Sun VTOC.
Autopsy cannot view timelines in most cases.
Also, Ext4 file creation timestamps cannot be viewed in the Autopsy "File Manager"-like interface. Unofficial patch exists to fix or "hack around" these issues.
See also
Autopsy Forensic Browser, version 3
Basic security module (bsm) file format -
The Basic Security Module (BSM) file format originates from the Sun Solaris operating system and has been adopted in various forms by BSD Unix, Mac OS X included.
External Links
Wikipedia: OpenBSM
audit_bsm_token.c, Apple Open Source
Solaris Basic Security Mode (BSM) Auditing, by Hal Pomeranz
Tools
praudit
OpenBSM, Open Source Basic Security Module (BSM) Audit Implementation
linuxbsm, The Linux Basic Security Module; The Linux BSM is an auditing tool that aims to bring the capabilities of Sun's Solaris Basic Security Module to Linux.
linuxbsm2, LinuxBSM-2; LinuxBSM-2 introduces auditing features in Linux kernel to achieve better security and keep an eye on system activities.
linuxopenbsm, Linux Basic Security Module
Domainkeys identified mail -
DomainKeys Identified Mail (DKIM) is a method for signing email messages to help eliminate spam.
The signature in each message should give the domain (d=) and selector (s=). The appropriate key can be retrived as a TXT DNS record from the host selector._domainkey.domain 1. A sample message from Gmail had the following DKIM header:
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; 
We can thus retrieve the Gmail key with:
$ host -t txt beta._domainkey.gmail.com beta._domainkey.gmail.com descriptive text "t=y\; k=rsa\; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC69TURXN3oNfz+G/m3g5rt4P6nsKmVgU1D6cw2X6BnxKJNlQKm10f8tMx6P6bN7juTR1BeD8ubaGqtzm2rWK4LiMJqhoQcwQziGbK1zp/MkdXZEWMCflLY6oUITrivK7JNOLXtZbdxJG2y/RAHGswKKyVhSP9niRsZF/IBr5p8uQIDAQAB" 
External Links
Official website
Wikipedia entry on DKIM
Dan Kegel's mini-howto on checking a DKIM signature
Domex -
DOMEX is Document and Media Exploitation
Articles and Press Releases
National Drug Intelligence Center - Document and Media Exploitation
June 28, 2007 - National Drug Intelligence Center and Utah National Guard Open a Joint Language Training Center Housing a Foreign Language Document Exploitation Team
See Also
MEDEX - Media Exploitation
DOCEX - Document Exploitation
Intelligence Community Directive Number 302: Document and Media Exploitation, July 6, 2007
Blackbag -
With regards to computer forensics, "black bag" operations usually consist of the acquisition of digital evidence without the target's knowledge.
This type of operation is especially useful during internal affairs or ongoing criminal investigations. Depending on the sensitivity of the investigation, access to the target's computer is sometimes facilitated by the target's superiors by giving the evidence collection specialist intelligence to bypass physical security devices during the operation. It should also be noted that during this type of operation, it is also possible to install applications and configure a computer system to further the investigation from a remote location.
According to the FBI's web page, the term "black bag" is coined from a practice used by that agency between 1942 and 1967. During that time, the FBI illegally obtained evidence against several individuals/organizations by entering their offices and obtaining photographs of information found in their records. The practice was ordered to be discontinued by then FBI Director Hoover.
Educational resources for teaching computer forensics -
Realistic Cases
One of the most difficult things for new investigators is finding sample cases to work on.
The https://digitalcorpora.org/ website has more than 5 terabytes of realistic computer forensics data, including disk images, memory dumps, and packet captures. Also available are instructor's packets and answer keys.
The HoneyNet Project has several challenges online. These include the "Scan of Month", "The Reverse Challenge," and "The Forensic Challenge." The last one asked entrants to examine a complete RedHat Linux system for information. All of these challenges include complete solutions.
See Also
NSF DUE-0919593
Bulk extractor viewer -
Bulk Extractor Viewer (BEViewer) is a User Interface for browsing features that have been extracted via the Bulk Extractor feature extraction tool. BEViewer supports browsing multiple images and bookmarking and exporting features. BEViewer also provides a UI for launching Bulk Extractor scans.
See Also
Bulk Extractor, the feature extraction tool that provides feature data for BEViewer.
External Links
Official website
Encapsulated postscript (eps) -
Encapsulated PostScript (EPS) is a PostScript document with additional restrictions to be usable as a graphics file format.
External Links
Wikipedia: Encapsulated PostScript
Malware
The EPS Awakens, by Genwei Jiang, Dan Caselden, Ryann Winters, December 16, 2015
The EPS Awakens - Part 2, by Ryann Winters , FireEye Threat Intelligence, December 20, 2015
Encase -
EnCase is a family of all-in-one computer forensics suites sold by Guidance Software. These products include EnCase Enterprise, EnCase Forensic Edition, EnCase eDiscovery, and EnCase Lab Edition. These programs use a proprietary image file format that has been reverse engineered. Users can create scripts, called EnScripts, to automate tasks.
History
Expert Witness (for Windows) was the original name for EnCase (dating back to 1998). More info about this can be found on the Internet Archive 1 including a demo of the original software 2.
File Format
See Encase image file format
Hash Databases
EnCase uses MD5 hashes and stores them in its proprietary Encase hash file format; either individually or in a "hash map". EnCase supports importing hashes from the NSRL, Hashkeeper, and plain MD5 files.
See Also
Encase image file format
EnScripts
LinEn
WinEn
External Links
Guidance Software
Encase hash map -
The EnCase suite of tools can generate 'hash maps', or 'EnMap' files, which allow users to identify chunks of files when the whole file is not available. This data is stored in a file with a .EnMap extension and contains piecewise MD5 hashes of the file. Each EnMap file has the following format:
The file has an ASCII header, ENMAP V4, or in hex 45 4e 4d 41 50 20 56 34 0b 00 00 00.
This is followed by a Unicode representation of the original filename.
There is then an MD5 hash of the entire file. This hash is followed by three bytes of zeros, and then a hexadecimal representation of each piecewise hash.
Cell phones -
Cell phones or mobile phones are an important target for forensic investigators.
Technologies
CDMA
TDMA
GSM
iDEN
EDGE
GPRS
UMTS
Hardware
RIM BlackBerry
T-Mobile Sidekick
SIM Cards
Operating Systems
Microsoft PocketPC
Microsoft Windows Mobile
Palm
RIM BlackBerry
Symbian
Linux
Forensics
Procedures
Cell Phone Forensics
SIM Card Forensics
Blackberry Forensics
JTAG Forensics
Chip-Off Forensics
In-System Programming (ISP) Forensics
Tools
Flashers
UFS Tornado
Hardware
Azimuth RadioProof™ Enclosures
Cellebrite UFED
LogiCube CellDEK and * LogiCube CellDEK TEK
| Micro Systemation Field Version
Network Security Solutions Secure Tents and Seizure Bags for Cell Phones/PDAs/Laptops
Paraben CSI Stick
Paraben Device Seizure Toolbox
Paraben Handheld First Responder Kit
Paraben StrongHold Bag
Radio Frequency (RF) Jammers
Radio Tactics Acesso, Apollo and Athena
Software
Belkasoft Evidence Center
BitPIM
BK Forensics Cell Phone Analyzer
FloAt's Mobile Agent
ForensicMobile
ForensicSIM
Guidance Software Neutrino
iDEN Phonebook Manager
MicroSystemation .XRY
MOBILedit!
Oxygen Forensic Suite
Paraben Device Seizure
Paraben SIM Seizure
Pandora's Box
Quantaq USIMdetective, USIMcommander, USIMexplorer, USIMprofiler and USIMregistrar
Susteen Secure View
TULP2G
WOLF
Encyclopedia forensica -
Encyclopedia is defined as - An encyclopedia is a type of reference work – a compendium holding a summary of information from either all branches of knowledge or a particular branch of knowledge (Wikipedia). This page and its linked contents will attempt to divide into sections the known corpus of computer forensic knowledge in regards to operating system artifacts. Once competed, and likely during, the goal of this project is to define what is known and what is still unknown so that we can begin to map out those unknown areas for future research.
Current planned operating systems, please add more if you plan to document them
(Currently Windows 7 is the active working project to determine template and content, Please start there if you are looking to contribute)
Operating Systems:
Windows Vista
Windows 7
Windows 8
Mac OS X
File Systems
ext2, ext3, ext4
FAT
HFS+
NTFS
Cell site analysis -
Cell Site Analysis (CSA) is the technical discipline of using mobile telephony signals and network data to triangulate and identify the relative geographic position of a device.
Cell site analysis is considered a highly intrusive surveillance technique and as such normally deployed only in sensitive or serious criminal investigations.
The technique can assist in demonstrating the co-location (meeting) of individuals, their movements over time, proximity to a scene of crime, and to verify the any defence alibi evidence.
External Links
Introduction to Cell Site Analysis
Cell Site Analysis Hardware & Survey Toolkit
Endianness -
Endianness refers to the way that a computer processor or file format stores numbers.
Big endian numbers are stored in such a way that the most significant digit appears first in the number as it is read from left to right. This is familiar to most people as it is the way that nubers are represented in most languages. For example, in the number 1337 the first digit is the most significant digit because it represents 1000 units. The last digit is the least significant because it only represents 7 units.
Little endian numbers are stored in such a way that the most significant digit appears last in the number as it is read from left to right. When the number 1337 is stored in a little endian system, the seven is the most significant digit and represents 7000 units. The one is now the least significant digit representing only one unit.
When examining numbers in hexadecimal form on a little-endian system, the byte order must be reversed before converting to decimal. Note that the individual characters within the byte are not reversed because the whole byte represents one number. For example, the hexadecimal number 39 05 must be reversed to 05 39 before being converted to the decimal 1337.
Intel based processors like the x86 usually represent numbers in little endian form. Motorola based processor architectures like the PowerPC tend to be big endian.
Middle endian (PDP).
Network endian (big endian).
External Links
Wikipedia: Endianness
Epilogue to gutmann's 1996 paper -
In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques. As a result, they advocate applying the voodoo to PRML and EPRML drives even though it will have no more effect than a simple scrubbing with random data. In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods (if you don't understand that statement, re-read the paper). If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, "A good scrubbing with random data will do about as well as can be expected". This was true in 1996, and is still true now.
Looking at this from the other point of view, with the ever-increasing data density on disk platters and a corresponding reduction in feature size and use of exotic techniques to record data on the medium, it's unlikely that anything can be recovered from any recent drive except perhaps one or two levels via basic error-cancelling techniques. In particular the the drives in use at the time that this paper was originally written have mostly fallen out of use, so the methods that applied specifically to the older, lower-density technology don't apply any more. Conversely, with modern high-density drives, even if you've got 10KB of sensitive data on a drive and can't erase it with 100% certainty, the chances of an adversary being able to find the erased traces of that 10KB in 80GB of other erased traces are close to zero.''
https://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
Compiling open source forensic tools with mingw -
Many open source computer forensic tools can be cross-compiled with MinGW. This allows you to create Windows executable directly from a Macintosh computer or Linux machine without using the Microsoft VC++ environment.
Installing MinGW
On a Mac using MacPorts:
$ sudo port selfupdate $ sudo port install i386-mingw32-binutils i386-mingw32-gcc \ i386-mingw32-libunicows i386-mingw32-runtime \ i386-mingw32-w32api 
note: If you get the error message 'warnings treated as errors' you will need to find the Makefile where -Werror is defined and erase it
Gnome -
GNOME is a desktop environment and graphical user interface that runs on top of, commonly a Linux/Unix-style, operating system.
GVfs
GVfs is the virtual file system for the GNOME desktop.
The GVfs metadata can be analyzed to determine connected removable media and its content. This data is commonly found in:
.local/share/gvfs-metadata/ 
External Links
Wikipedia: GNOME
Wikipedia: GVfs