hemu1438/forensicsgpt-training-data huggingface dataset:
Belkasoft t -
Belkasoft T
Belkasoft Triage is a new digital forensic and incident response tool developed specifically for a quick analysis of a live computer and making a partial image of important data.
Belkasoft T is designed to assist in situations when an investigator or a first responder is at the scene of incident and needs to quickly identify and obtain specific digital evidence stored on a Windows machine.
The product is irreplaceable in situations of time pressure, when there is a need to quickly detect presence of specific data and obtain investigative leads instead of conducting an in-depth analysis of all the digital evidence.
Key features
Launch Belkasoft Triage from a dongle connected to a device being investigated
Detect 1500+ types of computer, mobile and cloud artifacts such as emails, chats, browsers, system settings and others
Automatically acquire a computer RAM dump
Detect presence of virtual machines, memory files and mobile backups
Detect skin tone in found pictures
Calculate file hash values and show an immediate alert on files with known hashes
Stop the analysis at any time once you got enough information
Export discovered results partially or entirely
Select evidence to be included into the resulting image
Use the same dongle to store the image
Belkasoft r -
Belkasoft R
Belkasoft Remote Acquisition (Belkasoft R) is a new digital forensic and incident response tool developed specifically for forensically sound remote extractions of hard and removable drives, RAM, connected mobile devices, and even specific types of data. Belkasoft R will be useful in cases when an incident response analyst or a digital forensic investigator needs to gather evidence quickly and the devices in question are situated in geographically distributed locations
Key benefits
Ease of agent deployment
Support for Windows and macOS operating systems
Straightforward acquisition
Mobile device support
Support for various network configurations
Quick partial acquisition
Network bandwidth management with flexible image upload scheduling
Management of a large network consisting of various devices under your control
Bibtex demo -
We have installed the BibTeX mediaWiki Extension. Even better, Simson Garfinkel has started fixing it!
Here's how it works.
You can insert BibTeX entries into any mediawiki page by enclosing them in tags, like this:
@inproceedings{garfinkel:carving07, title="Carving Contiguous and Fragmented Files with Fast Object Validation", author="Simson Garfinkel", booktitle={Proceedings of the 7th Annual Digital Forensic Research Workshop (DFRWS)}, journal="Digital Investigation", year=2007, month=Aug, location="Pittsburgh, PA", url="https://simson.net/clips/academic/2007.DFRWS.pdf" } 
This produces:
@inproceedings{garfinkel:carving07,
title="Carving Contiguous and Fragmented Files with Fast Object Validation", author="Simson Garfinkel", booktitle={Proceedings of the 7th Annual Digital Forensic Research Workshop (DFRWS)}, journal="Digital Investigation", year=2007, month=Aug, location="Pittsburgh, PA", url="https://simson.net/clips/academic/2007.DFRWS.pdf"
} 
If you have any comments about this, please contact Simson Garfinkel. Thanks!
Ip geolocation -
IP geolocation is the process of turning an IP address into a physical location. It cannot be done with 100% accuracy, but there are a growing number of both commercial and non-commercial services that can do it pretty well.
Free services
HostIP.info
Commercial Geolocation services
IP2Location (free query: 20 lookups/day)
MaxMind
Downloadable Data Sets
CountryHawk (commercial)
Java IP (InetAddress) Locator (free lookup library with database)
IPAddressGuide
Chaosreader -
Overview
Chaosreader A freeware tool to trace TCP/UDP/... sessions and fetch application data from snoop or tcpdump logs. This is a type of "any-snarf" program, as it will fetch telnet sessions, FTP files, HTTP transfers (HTML, GIF, JPEG, ...), SMTP emails, ... from the captured data inside network traffic logs. A html index file is created that links to all the session details, including realtime replay programs for telnet, rlogin, IRC, X11 and VNC sessions; and reports such as image reports and HTTP GET/POST content reports. Chaosreader can also run in standalone mode - where it invokes tcpdump or snoop (if they are available) to create the log files and then processes them.
External Links
Chaosreader author's website
Git repository
Bitflare -
BitFlare is a Software-as-a-Service offering from SunBlock Systems that allows non-experts to perform computer forensics, electronic evidence discovery, and data preservation. The software loads its own operating system on to a suspect computer, essentially utilizing the suspect machine itself a forensic platform.
Capabilities
BitFlare allows users to view and filter visible and deleted file entries of various common metadata such as timestamps, file names, file paths, and file sizes. In addition, a user can filter files by supersets of broad file categories such as Microsoft Office, MRU file links, and Image and Video files.
Keyword searches can be run across visible and deleted files as well as across slack, unallocated, and unpartitioned space across the hard drive. Keyword searching supports full PCRE regular expressions and case sensitivity.
Relevant files and keyword fragment extraction is facilitated through Evidence Discovery Packs. Files are saved in their native format.
BitFlare supports hard drive preservation. Users can save encrypted forensic copies of the hard drive to externally connected devices. Encrypted images can be sent to SunBlock Systems for decryption, third party validation, and analysis.
Sales Model
The BitFlare CD is freely available from the BitFlare website. There is no upfront licensing cost for BitFlare. Hard drive preservation, file sorting, and keyword searches are undertaken without cost.
A user must purchase an Evidence Discovery Pack from the BitFlare website in order to extract files or keyword fragments. Each EDP is configured by the user, identifying data for extraction on a particular computer. The BitFlare software executes purchased EDPs, extracting and documenting relevant evidence.
While hard drive preservation is available without a fee, SunBlock Systems may charge a fee to unencrypt a forensic copy preserved by BitFlare.
Computers deemed to have no relevant information incur no cost under this model.
External Links
Official Website
Hidden channels -
Hidden channels (covert channels) are communication channels that transmit information without the authorization or knowledge of the channel's designer, owner, or operator.
Common Uses
Bypassing network filters;
Bypassing network sniffers.
Techniques
Information can be hidden within:
IP ID;
TCP ISN;
TCP options;
DNS ID;
HTTP cookie;
etc.
Generally, it is impossible to detect well-designed hidden channels by means of traffic analysis. For example, information hidden within TLS Client/Server Hello random bytes in encrypted form cannot be distinguished from bytes produced by secure random number generator.
However, it is possible to detect hidden channels by detecting attendant events, such as successful intrusion attempts. Some hidden channels produce network anomalies, for example, hidden channels using DNS ID to hide information may produce large number of DNS queries without further communication between hosts.
External Links
Wikipedia: Covert channel
Carvpath annotations -
CarvPath annotations are a simple string-wise depiction of a hierarchically nested designation of sub entities within parent entities in what basically is a flat address space. The annotations are used in both CarvFs and MattockFS as a way to allow for Zero storage carving by different computer forensic tools. Next to zero-storage carving, the annotations can also be used in regular file-system forensics. CarvPath annotations use the visual appearance of file-system paths and as such can be used by the above user-space file-systems. A CarvPath with a file extension designates actual data in the underlying address space. Without a file extension, the CarvPath designates a pseudo directory or nesting level.
The basic structure of a CarvPath annotation is defined as follows:
CARVPATH : [CPTOKEN "/" ]* CPTOKEN ".' 
CPTOKEN : [CPCHUNK "_" ]* CPCHUNK
CPCGUNK : CPFRAGMENT | CPSPARSE | CPDIGEST
CPFRAGMENT : + 
CPSPARSE : "S" 
CPDIGEST : "D" digest(CPTOKEN)
An example of a CarvPath :
132048+42949672960/Dca7cda1bd637a30b8f4f1344b9e984713b7ca06ce5da80b953e616c56cc6c64a/0+73728_S57344_98304+4096.dat
Cellebrite ufed -
The Cellebrite 'Universal Forensic Extraction Device' (UFED) is a tool for mobile phone, smartphone, and PDA forensics. As of September 2010 the UFED was compatible with over 2,500 mobile phones (including GSM, TDMA, CDMA, iDEN). The standard package containing several dozen phone cables. The UFED had an intergrated SIM reader, with Wireless connection options also being integrated, such as IR and Bluetooth.
The UFED also supports native Apple iPOD Touch, and Apple iPHONE extraction on both 2G and 3G versions, as well as iOS4. This is clientless, and via a physical cable, and works on jailbroken and non-jailbroken devices.
Subject data can be retrieved via logical extraction or via physical extraction (ie: hex dump). Moreover, all cable connectors from subject (source) side act as a write-blocker, being read only via the onboard hardware chipset. Extracted data includes basic handset data, the phonebook, SMS and MMS messages, SIM data, multimedia (e.g. images and videos stored on the phone), and time and date stamps.
External Links
Product website
Sim manager -
SIM Manager is program designed to read the contents of a SIM card and display it in a human readable form. It is compatible with 2G, 3G and Nextel iDEN cards.
Feature highlights
Read the details of the SIM card (ICCID, IMSI, ATR)
Change PIN codes
Undelete SMS
Wipe SMS (so that it cannot be recovered)
Unicode support
Compatible with Nextel cards
Backup and restore SIM cards
Synchronization with Google contacts
Requirements
Any PC/SC compliant smart card reader.
Screenshots
External Links
How to recover a deleted SMS using SIM Manager (video tutorial)
Bruce allen -
Bruce Allen is a Faculty Associate - Research at the Naval Postgraduate School in Monterey, California.
Interests include Software architecture, computer languages, parallel computing, parallel processor architectures, and supporting open-source software. Software contributions include development of the hashdb tool, development of the Bulk Extractor Viewer User Interface (used to browse Features extracted using the Bulk Extractor digital media triage tool), some of the Bulk Extractor scanners, the jlibewf and libewfcs readers, and implementations of high speed encryption and hashing algorithms that run on the Cell Broadband Engine processor.
Kismac -
KisMAC is a free, open source wireless stumbling and security tool for Mac OS X.
Overview
Uses monitor mode and passive scanning
KisMAC supports many third party USB devices: Intersil Prism2, Ralink rt2570, rt73, and Realtek rtl8187 chipsets. All of the internal AirPort hardware is supported for scanning
Features
Reveals hidden / cloaked / closed SSIDs
Shows logged in clients (with MAC Addresses, IP addresses and signal strengths)
Mapping and GPS support
Can draw area maps of network coverage
PCAP import and export
Support for 802.11b/g
Different attacks against encrypted networks
De-authentication attacks
AppleScript-able
Kismet drone support (capture from a Kismet drone)
Supported hardware chipsets
Apple AirPort and AirPort Extreme (dependent upon Apple's drivers)
Intersil Prism 2, 2.5, 3 USB devices
Ralink rt2570 and rt73 USB devices
Realtek RTL8187L USB (such as the Alfa AWUS036H, which does not work on Mac OS 10.6.7 or later)
Crypto support
Bruteforce attacks against LEAP, WPA and WEP
Weak scheduling attack against WEP
Newsham 21-bit attack against WEP
Links
KisMAC official page
Chip off forensics -
Definition
Wikipedia on Forensic desoldering
The process is commonly referred to as a "chip-off" technique. The procedure is often the last and often most intrusive method to acquire a non-volatile image from a device. The process involves desoldering the non-volatile memory circuit, and connecting it to a specialized reader for acquisition. It is possible to destroy the circuit during the processes through physical or heat damage.
Forensic Application
Chip-off forensics is an acquisition procedure which involves physically removing the non-volatile integrated circuit (IC) from a device and reading it directly on an external specialized reader. It is often considered a last-option technique, as repairing the phone to a working state post-IC removal, is difficult.
Tools and Equipment
JTAG and Chip-Off Tools and Equipment
Procedures
Chip-Off BlackBerry Curve 9300
Chip-Off BlackBerry Curve 9315
Chip-Off BlackBerry Curve 9320
Chip-Off BlackBerry Bold 9780
Chip-Off BlackBerry Bold 9900
Chip-Off_BlackBerry_Z10
Moto X Play (XT1563) Chip Off
External links
Understanding surface mount, by Al Williams, September 7, 2015
Nat detection -
NAT detection is the process of determining hosts running Network Address Translators.
Approaches
Active detection
Port scanning
Some software NAT solutions (such as Kerio WinRoute Firewall), as well as many hardware solutions, provide a control port, which allows users to monitor and control their server (e.g. using a web browser). These control ports can be easily detected by means of port scanning (see Nmap.
Routing test
Some improperly configured NAT allows IP packets to be translated from an external network. Routing test can detect these translators by trying to contact external server (e.g. forensicswiki.org:80) with modified routing tables.
Passive detection
IP TTL
Network Address Translators decrement IP TTL values of all translated packets.
Leaked real IP address
Some network protocols leak real IP address of a client. These protocols include:
SMTP, HELO/EHLO commands:
These commands are used to identify the SMTP client to the SMTP server. The argument field contains the fully-qualified domain name of the SMTP client if one is available. In situations in which the SMTP client system does not have a meaningful domain name (e.g., when its address is dynamically allocated and no reverse mapping record is available), the client SHOULD send an address literal (see section 4.1.3), optionally followed by information that will help to identify the client system. 
(see RFC 2821)
DNS, reverse lookups to an external DNS server:
Reverse DNS lookups made to an external DNS server can leak information about hosts in an internal network.
Oscar (ICQ), MSN, MRA (Mail.Ru Agent), direct connections.
Strict source port translation
Some network protocols use strict source ports for communication. These protocols include: NTP, Valve.
Non-heuristic port translators (such as ICS in Windows always translate source port numbers.
OS fingerprinting
Network Address Translators can be detected by passively fingerprinting all transferred IP packets.
Generally, single host will not produce different OS fingerprints in a short period of time. However, this method can be extended to fingerprinting different hosts running the same operating system by using IP IDs and TCP timestamps.
Tools
p0f can do NAT detection using passive OS fingerprinting. It uses a variety of identifiers to create a score on the confidence level of device doing NAT.
SMTP HELO/EHLO commands;
Oscar direct connections;
DNS reverse lookup requests;
NTP time synchronization;
Routing test.
External Links
TCP Timestamp to count hosts behind NAT, Phrack
Compression -
LZ-based
Deflate/Inflate
Used in:
Expert Witness (Compression) Format (ewf)
gzip
Personal Folder File (PAB, PST, OST), in compressed Offline Storage Table (OST) files.
QCOW Image Format, in compressed images
VMWare Virtual Disk Format (vmdk), in compressed images
LZNT1
Used in:
NTFS
Windows SuperFetch Format
LZSS
Wikipedia: Lempel–Ziv–Storer–Szymanski
LZX
Used in:
Microsoft Cabinet Format
The Windows implementation of LZX can be found in lz32.dll and is used by the WINAPI LZ functions e.g. LZOpenFile.
LZXPRESS
Used in:
Extensible Storage Engine (ESE) Database File (EDB) format
LZXPRESS Huffman
Variant of LZXPRESS that uses Huffman encoding.
Used in:
Windows SuperFetch Format, Windows 7
LZXPRESS Huffman stream
Variant of LZXPRESS Huffman that allows for LZ compression tuples that refer to previous blocks of uncompressed data.
Used in:
Windows Prefetch File Format, Windows 10
Windows SuperFetch Format, Windows 8
External Links
Wikipedia: Lempel-Ziv
Microsoft Compression Formats
Deflate/Inflate
Wikipedia: DEFLATE
RFC1950 - ZLIB Compressed Data Format Specification, by IETF
RFC1951 - DEFLATE Compressed Data Format Specification, by IETF
LZXpress
MS-XCA: Xpress Compression Algorithm, by Microsoft
Networkminer -
NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows. NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files.
The purpose of NetworkMiner is to collect data (such as forensic evidence) about hosts on the network rather than to collect data regarding the traffic on the network. The main view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames).
NetworkMiner performs OS fingerprinting based on TCP SYN and SYN+ACK packet by using OS fingerprinting databases from p0f (by Michal Zalewski) and Ettercap (by Alberto Ornaghi and Marco Valleri). NetworkMiner can also perform OS fingerprinting based on DHCP packets (which usually are broadcast packets) by making use of the Satori (by Eric Kollmann) OS fingerprinting database from FingerBank. NetworkMiner also uses the MAC-vendor list from Nmap (by Fyodor).
NetworkMiner can extract files and certificates transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This is a neat function that can be used to extract and save media files (such as audio or video files) which are streamed across a network. Supported protocols for file extraction are FTP, HTTP and SMB.
User credentials (usernames and passwords) for supported protocols are extracted by NetworkMiner and displayed under the "Credentials" tab. Please be considerate when displaying the contents of this tab to the public.
Another very useful feature is that the user can search sniffed or stored data for keywords. NetworkMiner allows the user to insert arbitrary string or byte-patterns that shall be searched for with the keyword search functionality.
Version 0.84 (and newer) of NetworkMiner support sniffing and parsing of WLAN (IEEE 802.11) traffic. NetworkMiner does however currently only support WiFi sniffing with AirPcap adapters.
There is also a commercial version available of NetworkMiner from Netresec. The commercial version is called NetworkMiner Professional and has additional features such as:
Port Independent Protocol Identification (PIPI)
Export results to CSV / Excel
Configurable file output directory
Geo IP localization
Host coloring support
Command line scripting support
Computer forensics research lab -
Useful equipment for setting up an computer forensics research lab:
Computer Equipment
internal SATA hard drives (useful for moving around data and short-term archiving)
Docks to connect the SATA drives to your computer and server
A fast server (we use a MacPro with 12 cores, 32GB of RAM, and fibre channel)
A RAID array to hold your corpus (we use an ActiveStorage system with FC)
10Gig or Gigabit switch
Workstations for researchers (we use MacPros; you can use Dells also.)
Commercial Disk Processing Software
FTK Academic License
EnCase Forensic Academic License
Commercial Phone Software
EnCase Nutrino phone forensic kit
Paraben phone forensic kit
Misc. Lab Equipment
Ergonomic chairs for students
Desks for students
Lab stools
anti-static mats
lab lamps with magnifying lamps
Lab benches
Misc. tools from Home Depot
Content Creation
Get your own equipment so there are no PII or copyright issues.
HD video camera
Digital camera
Cortana -
Cortana is a digital personal assistant originally introduced in Windows Phone 8.1.
With the release of Windows 10 Cortana become integrated with the desktop operating system (OS). Cortana can be used for a number of tasks within the OS; setting a reminder, searching the local files and the web, answering simple queries.
Artefacts
There are a number of artefacts associated with Cortana; 2 backend Extensible Storage Engine (ESE) databases, and other configuration files. The 2 Cortana Databases are located:
• \Users\user_name\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\AppData\Indexed DB\IndexedDB.edb • \Users\user_name\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\LocalState\ESEDatabase_CortanaCoreInstance\CortanaCoreDb.dat
The IndexedDB.edb contains the following tables:
- DatabaseAndObjectStoreCatalog - HeaderTable - IndexCatalog - MSysDefrag - MSysLocales - MSysObjects - MSysObjectsShadow - MSysObjids - T-n - T-n
The other database, CortanaCoreDb.dat, contains table data that relates to a users’ interaction with Cortana; it contains the following tables:
- Attachments - Contact - ContactPermissions - ContactTriggers - Diagnostic - Geofences - LocationTriggers - Metadata - MSysLocales - MSysObjects - MSysObjectsShadow - MSysObjids - Notification - Reminders - RulesDescriptions - RulesInstances - RulesInstancesDisplayParameters - RulesInstancesParameters - RulesTemplates - RulesTemplatesParameters - RulesTemplatesParameterTypes - Signals - TimeTriggers - Triggers
Unlike IndexedDB.edb, CortanaCoreDB.dat is a goldmine for evidentiary artefacts, some of the more interesting tables are:
• Geofences
This table contains Latitude/Longitude for where location based reminders are triggered.
• LocationTriggers
This table contains Latitude/Longitude as well as the actual Name of place results for reminders.
• Reminders
This table contains actual text inputed by the user, as well as Creation, Access, and Completion times.
• Triggers
This table contains the ReminderID value matches with the ID field in the Reminders table.
What is interesting, especially for a forensic investigator, is that Cortana will keep track of when Reminders are completed, including where and when a reminder was finalised. This is particularly invasive, but can provide a wealth of information useful for pinning someone to a time and place.
--Bsmuir 11:56, 23 August 2015 (UTC)
External Links
Microsoft (2015), What is Cortana
Deception indicators -
The following indicators may indicate that the user of a computer system is trying to hide their presence, implicate another individual, convey erroneous information, or otherwise attempt to deceive a forensic analysis or tool.
Unfortunately, many of the deception indicators are also indicators of good security practice.
File System Indicators
Files having the wrong extension (e.g. file.jpg instead of file.doc).
Very large files (may indicate use of cryptographic file systems, virtual machines, etc.)
Virtual Machine Players (VMWare, VirtualBox, Parallels)
TrueCrypt or RealCrypt
PGP files or Volumes
PointSec
Encrypted email
Date or time wrong
Repeating data over the drive
Truncated history files
Log File Indicators
Log files that are:
Missing
Truncated
With time gaps
With one or more incomplete lines, or other lines that start midway (happens if the attacker removes the last 4K of a file without respect to line boundaries)
Inconsistencies (e.g. email that is forwarded without being received.)
Network Communications
Presence or use of VPN software.
Use of anonymity websites, such as:
anonymizer.com
hidemyass.com
Open Proxy Servers (got a list?)
hushmail.com
Setting a proxy server
ssh
Redaction Indicators
Evidence Eliminator
ccleaner
list of Drive Cleaner tools; searches for drive cleaning software