hemu1438/forensicsgpt-training-data huggingface dataset:
Welcome to the Forensics Wiki
The Forensics Wiki has transitioned to this new domain and platform; read more about it at Transitioning Forensics Wiki to GitHub.
The Forensics Wiki is an open source website providing information related to digital forensics. The articles on the website cover a wide range of information from tools used during investigations to papers people and organizations that contribute to the field.
Please see the community page if you would like to contribute.
Discover Content
Tags
In order to make content discoverable, articles are being categorized using tags. Each page on this website is labled with tags. The page could have one tag or multiple tags depending on the content of the site. Tags are placed at the top of the article.
For example, the Full Disk Encryption article has three tags: Encryption, Disk Encryption and Anti-Forensics. If you clicked on anyone of the tags, it will bring you to all content categorized under that tag.
Topics
tags Articles 
Operating Systems	
Windows: windows_vista, windows 7, windows 8, windows 10
Unix: freebsd, netbsd, openbsd, solaris, aix
Mobile OS: android, ios, windows mobile
	
Tools	
File Analysis: bless, ghidra, PST File Viewer, hachoir
Timeline Analysis: timesketch, Plaso
Disk Analysis: sleuthkit, bulk_extractor, fiwalk
Network Analysis: snort, tcpdump, nmap
	
File Formats	
Archive: zip, tar, gfzip
Database: sqlite, olm, Thumbs.db
Disk Image: aff, raw image, qcow image format
	
Articles that need to be expanded
There are a number of articles that could use some love. If you want to help out, please read about contributing.
Contribute on to the Forensics Wiki on GitHub
The Forensics Wiki is now on GitHub and accepting content contributions from the community. Please see the community page for instructions if you would like to add or edit content. 
For more information about Forensics Wiki on MediaWiki see:
Transitioning Forensics Wiki to GitHub
Contributions Forensics Wiki on MediaWiki
Nmap -
Nmap (Network Mapper) is a network security scanner.
Features
General features:
Host discovery
Port scanning (enumerating open/closed/filtered ports on one or more target hosts)
Service detection (determining service types and version numbers)
OS detection
Other features:
IP protocol scan
Uptime detection (using TCP timestamps
Traceroute
DNS resolution
Idle scan (using "zombies")
FTP bounce scan (using proxy FTP connections)
etc
Typical uses
Identifying open ports on a compromised host
Auditing the security of a network, by identifying unexpected computers
External Links
nmap.org
Olm -
OLM aka Outlook For Mac files are the proprietary file format of Microsoft Outlook For Mac. Outlook for Mac as suggested by the name is supported in Macintosh operating system and is analogous to MS Outlook that is supported in Windows operating system. A single OLM file stores the entire Mac Outlook data comprising of emails, contacts, calendars, etc.
Overview
Originally, OLM files came into existence with the introduction of Microsoft Outlook 2011 for Mac in the year 2011. Although the OLM files are the master repository for storing local data of Outlook for Mac but it is not created by default. The OLM files can be generated via different export methods. While exporting data to an OLM file, the information can be filtered out depending on the type of data that is required to reside in the file. In case there is a need to export only Networking information to an OLM file, the items that have been assigned to the Network category should be exported in the OLM file. To prevent exceeding the maximum size limit, the emails in the Outlook for Mac can be archived in an OLM file.
Support
OLM files were first introduced with Microsoft. The maximum size of the OLM files is not specified but in general the size should not exceed above 2 GB. Exceeding the 2 GB size may lead to failure in exporting the OLM file if needed.
No corroboration so far has been released for supporting Outlook Mac OLM files in Windows or any other non-Macintosh machines. Although third party implementations have successfully achieved this success in accessing OLM files in Windows machine.
Also see
DMG
Tools
Free Mac Mail Email Extractor
Microsoft Outlook 2011 For Mac
OLM Viewer
OLK14* Viewer
Thumbs.db -
Thumbs.db is a file created by Windows when thumbnail view is used. It is a hidden file not viewed by most users and not updated when files are moved from a folder which images have passed through or deleted. This gives a secondary chance that someone will leave behind at least partial evidence of an image in their Windows folders.
The thumbnails in Thumbs.db are stored in the OLE Compound File format. It's the same format that Microsoft Office uses.
There is a forensic open source application developed at sourceforge called vinetto at https://sourceforge.net/projects/vinetto that can extract them. It does require a python environment. Additionally, there are several other Java solutions based around the Jakarta project that is apart of Apache. Additional resources about thumbs.db can be found in a white paper at https://www.exterro.com.
MiTeC Windows File Analyzer 1 is a tool for forensic analysis of Thumbnail Databases, Prefetch files, shortcuts, IExplore Index.DAT files and Recycle Bin contents on a Windows system. It will print a report of analyzed files.
Windows Vista/7
See Windows thumbcache
Thumbs.db no longer exists in Vista/7 as individual files. This data has been moved to a centralized database located in \Users\%username%\AppData\Local\Microsoft\Windows\Explorer
Windows Vista will save thumbnails for files on mounted encrypted file systems (except EFS.
In Windows 7, thumbs.db files are not created under normal usage when a user browses a folder in explorer. However, they are created if the same folder is browsed through its network path such as via \\localhost\c\$. These files do not follow the xp thumbs.db format. The format is still an OLE container but without the Catalog stream and with a few other changes.
Windows 8/8.1
In Windows 8 and 8.1, both thumbcache and thumbs.db are present. Thumbs.db will only be created in folders which reside under a user profile folder (C:\Users\USERNAME\*). But accessing other folders using their network paths such as \\localhost\c\$ will create thumbs.db in other folders as well. The format of these thumbs.db files is the same as Windows 7 thumbs.db.
External Links
Windows thumbnail cache (thumbs.db)
Windows 7 generated Thumbs.db
Windows 8 Thumbs.db files
Raw image format -
The RAW Image Format is used to store a disk or volume image.
File types
Some variants of the RAW Image Format split the data among multiple segment files, which is also known as split RAW.
There are various naming schemes for RAW Image Format files, some of the more common used for disk or volume images are:
PREFIX.dd
PREFIX.dmg
PREFIX.img
PREFIX.raw
PREFIX.0 - PREFIX.#; variations: starting with either 0 or 1, consisting of multiple digits e.g. PREFIX.000
PREFIX0 - PREFIX#; variations: starting with either 0 or 1, consisting of multiple digits e.g. PREFIX000
PREFIXaa - PREFIXzz; variations: consisting of more letters e.g. PREFIX.aaa
PREFIX.1of5 - PREFIX.5of5; variations: consisting of multiple segment files
PREFIX001.asb - PREFIX###.asb
PREFIX-f001.vmdk - PREFIX-f###.vmdk; variations: starting with 001
Note that there are also RAW Image Formats specific to the storage media, e.g. RAW optical disc image.
These often are accompanied by a table of contents file often in the CUE Sheet format, e.g.
BIN/CUE
ISO/CUE
Contents
The RAW Image Format is basically a bit-for-bit copy of the RAW data of either the disk or the volume, without any additions or deletions.
There is no metadata stored in RAW Image Format files. However sometimes the metadata is stored in additional files.
The RAW Image Format was originally used by dd, but is supported by most of the computer forensics applications.
See Also
Disk Images
Tools
dd
dc3dd
dcfldd
dd_rescue
ddrescue
Windows vista -
New Features
BitLocker
Search integrated in operating system
ReadyBoost
SuperFetch
Transactional NTFS (txf)
Transactional Registry (txr)
Shadow Volumes; the volume-based storage of the Volume Shadow Copy data
\$Recycle.Bin
Windows XML Event Log (evtx)
User Account Control (uac)
File System
The file system used by Windows Vista is primarily NTFS.
In Windows Vista, NTFS no longer tracks the Last Access time of a file by default. This feature can be enabled by setting the NtfsDisableLastAccessUpdate value to '0' in the Registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem 
Note that this feature has been around since as early as Windows 2000 1.
Prefetch
Note that the prefetch hash function is different then that of Windows XP.
The Windows Prefetch File Format was changed to version 23.
Registry
The Windows Registry remains a central component of the Windows Vista operating system.
User Interface Privilege Isolation (UIPI)
As part of the secure initiative in Vista, applications with UI will run in three different levels of privilege. Application windows can interact with others windows of the same or lower levels, but cannot interact with applications at higher level/permission.
See Also
SuperFetch
Windows
Windows 7
Windows 8
External Links
Windows Vista Network Attack Surface Analysis, by Tim Newsham, James Hoagland
Inside the Windows Vista Kernel: Part 1, by Mark Russinovich, February 2007
Inside the Windows Vista Kernel: Part 2, by Mark Russinovich, March 2007
Inside the Windows Vista Kernel: Part 3, by Mark Russinovich, April 2007
Forensic Implications of Windows Vista, by Barrie Stewart, September 2007
Windows 8 -
Initially Windows 8 had a workstation and server edition. The server edition became Windows Server 2012.
New Features
The following new features were introduced in Windows 8:
File History
Storage Spaces
Search Charm History
File System
The file system used by Windows 8 is primarily NTFS.
The Resilient File System (refs) was initially available in the Windows 8 server edition but became part of Windows 2012 server edition.
Jump Lists
Jump Lists are Task Bar artifacts that were first introduced on Windows 7 and are also available on Windows 8.
Prefetch
The prefetch hash function is similar to Windows 2008.
The Windows Prefetch File Format was changed on Windows 8.1 to version 26. (note this could be Windows 8 as well but has not been confirmed)
Registry
The Windows Registry remains a core component of the Windows operating system.
Application Experience and Compatibility
On Windows 8 Amcache.hve replaces RecentFileCache.bcf and uses the Windows NT Registry File (regf) format. A common location for Amcache.hve is:
C:\Windows\AppCompat\Programs\Amcache.hve 
See Also
Windows
Windows Vista
Windows 7
External Links
Features new to Windows 8, Wikipedia
Windows 8 Registry Forensics
Windows 8 Forensic Guide, by Amanda C. F. Thomson, 2012
Windows 8 Forensics - A First Look, by Josh Brunty, August 2012
Windows 8: Tracking Opened Photos, by Jason Hale, March 8, 2013
Windows 8 and 8.1: Search Charm History, by Jason Hale, September 9, 2013
Amcache.hve in Windows 8 - Goldmine for malware hunters, by Yogesh Khatri, December 4, 2013
Amcache.hve - Part 2, by Yogesh Khatri, December 16, 2013
Unix -
Unix or UNIX is a general-purpose multi-user operating system developed mostly by Ken Thompson and Dennis Ritchie during 1969 at Bell Labs. About one year later during the early 1970s UNIX was unveiled to the general public. The original goal as it is today was to create a stable, secure, and powerful operating system that is portable to many different hardware platforms
Today UNIX has evolved into three main categories which all flavors of UNIX derive from: BSD, System V Release 4, and hybrid. Some of the most poplar flavors of UNIX are:
IBM’s AIX
Sun Microsystems' Solaris
SGI’s IRIX
Linux
OpenBSD
FreeBSD
External Links
Wikipedia: Time Line of UNIX
The Single UNIX Specification, Version 4
File permissions
Wikipedia: File-system permissions
Windows 10 -
Cortana
Cortana is a digital personal assistant originally introduced in Windows Phone 8.1, first introduced in the desktop space with Windows 10.
Prefetch
The Windows Prefetch File Format was changed on Windows 10 to version 30 and is now stored using LZXPRESS Huffman stream compression.
See Also
Windows
External Links
Windows 10 Forensics, by Patrick Leahy Center for Digital Investigation (LCDI), April 22, 2015
AppCompatCache changes in Windows 10, by Eric Zimmerman, April 22, 2015
Windows 10 Forensics: OS Evidentiary Artefacts by Brent Muir, July 25, 2015
Parsing the Windows 10 Notification database, by Yogesh Khatri, June 3, 2016
Tools
DisableWinTracking known methods that attempt to disable tracking in Windows 10
Solaris -
Solaris is a highly scalable enterprise grade UNIX Operating System from Sun Microsystems. Solaris is known to run on SPARC and x86/x86-64 architectures, although it has also been ported to PowerPC and IBM zSeries mainframes in a joint effort with IBM.
Commonly used filesystems and / or volume managers on the Solaris Operating System are:
AVS
QFS
SAMFS
Solaris Volume Manager (solstice)
UFS
Veritas VxFS and Veritas VxVM
ZFS
External Links
Sun Solaris homepage
Sun Blueprints - Using Computer Forensics When Investigating System Attacks
Solaris Internals - The UFS File System - specifications, on disk layout
Ios -
iOS (pronounced i-O.S.) is the name of the operating system for Apple's mobile devices (iPhone/iPad/iPod Touch).
File System
iOS runs a reduced variant of OSX and HFSX as a file system.
A majority of the useful information is stored in /private/var2/mobile/ However there is other useful information stored in the keychains and db folders.
iOS uses sqlite and plist files to store information.
/private/var2/mobile
This contains three folders: Applications, Library and Media
Applications contains a series of folders, which contain the data for all of the apps stored on the phone. The name of each app is stored in its iTunesMetadata.plist.
Library contains the most useful information: - Address Book - Calendar - Safari - favorites, open tabs, web history - Mail - mail is encrypted and therefore requires the keychain to be decrypted before it can be accessed - SMS - sms.db, which may include deleted SMS messages - Notes - notes.sqlite, which may include deleted notes - Voicemail - Spotlight - Spotlight database may contain text messages that have since been deleted.
Media contains all Photos loaded onto the device, Books, Purchases, Podcasts, Recordings and Pictures/Videos taken
There are several tools available to extract information out of iOS operating systems (listed alphabetically):
Aceso by Radio Tactics
Nuix Desktop
Oxygen Forensic Suite
UFED and Physical Analyzer by Cellebrite 5
XRY by Micro Systemation
See Also
Cell Phone Forensics
External Links
The Future of Mobile Forensics, article by Belkasoft
Database Parsing Tools
iOS (iPhone OS) Forensics
Microsoft windows mobile -
Windows Mobile is an operating system that has both a look-and-feel and a programmer API that are similar to Microsoft Windows but which runs in a dramatically reduced footprint. Windows Mobile is the successor operating system to Windows CE.
Windows Mobile Versions
Windows Mobile runs on multiple hardware platforms including Pocket PCs, smartphones, Portable Media Center, and automobiles. These hardware platforms did not always exist from the inception of Windows Mobile.
Windows Mobile 2003
Windows Mobile 2003 was released on June 23, 2003, and was the first release under the Windows Mobile banner. It came in four editions: "Windows Mobile 2003 for Pocket PC Premium Edition", "Windows Mobile 2003 for Pocket PC Professional Edition", "Windows Mobile 2003 for Smartphone" and "Windows Mobile 2003 for Pocket PC Phone Edition". The last was designed especially for Pocket PCs which include phone functionality. The Professional Edition was used in Pocket PC budget models such as the iPAQ rz1700 series. It lacked a number of features that were in the Premium Edition, such as a client for L2TP/IPsec VPNs. Windows Mobile 2003 was powered by Windows CE 4.20.
Windows Mobile 2003 Second Edition
Windows Mobile 2003 Second Edition, also known as "Windows Mobile 2003 SE", was released on March 24, 2004 and first offered on the Dell Axim x30.
Windows Mobile 5.0
The biggest difference between Windows Mobile 5.0 and previous editions is that user data in WM5 is no longer stored in volatile memory. This means that the user data saved on the mobile phone will not be erased if the battery is disconnected or has depleted. In Windows Mobile 2003, if the battery depletes, or is disconnected for more than 15 minutes, all user data is lost.
Windows Mobile 6
Windows Mobile 6 was released in 2007. Some users are able to update their Windows Mobile 5 to the new 6.0 version for free. WM6 will integrate tightly with Windows Vista. Challenges facing forensic investigators are the support for VoIP and advanced multimedia. While it is too early to offer details or experiences, it is touting to be more in line with the Blackberry "push" model then the previous Windows CE "pull" model.
Windows Mobile 6.1
Windows Mobile 6.1 was announced April 1, 2008. It is a minor upgrade to the existing Windows Mobile 6 platform which brings with it a redesigned Home screen featuring horizontal tiles that expand on clicking to display more information, although this new home screen is featured only on Windows Mobile Standard edition. Several other improvements such as threaded SMS, full page zooming in IE and 'Domain Enroll' have also been added. Domain Enroll is functionality to connect the device to System Center Mobile Device Manager 2008, a product to manage mobile devices.
Bless -
Description
Bless is a free hex editor available on Linux platforms. It is fully functional and easy-to-use.
Bless's website says that the following are the main features:
Efficient editing of large data files and block devices.
Multilevel undo - redo operations.
Customizable data views.
Fast data rendering on screen.
Multiple tabs.
Fast find and replace operations.
A data conversion table.
Advanced copy/paste capabilities.
Highlighting of selection pattern matches in the file.
Plugin based architecture.
Export of data to text and html (others with plugins).
Bitwise operations on data.
A comprehensive user manual.
Installation Instructions
Bless can be installed by using the command: sudo apt-get install bless
Ghidra -
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.
In support of NSA's Cybersecurity mission, Ghidra was built to solve scaling and teaming problems on complex SRE efforts, and to provide a customizable and extensible SRE research platform. NSA has applied Ghidra SRE capabilities to a variety of problems that involve analyzing malicious code and generating deep insights for SRE analysts who seek a better understanding of potential vulnerabilities in networks and systems.
The full release build can be downloaded from the project homepage.
This repository contains the source for the core framework, features, and extensions. If you would like to contribute, please take a look at our contributor guide to see how you can participate in this open source project.
Source Code
Project site
Android -
Versions and API levels
Android 13 (Developer Preview)
Android 12 (API levels 31, 32)
Android 11 (API level 30)
Android 10 (API level 29)
Android 9 (API level 28)
Android 8.1 (API level 27)
Android 8.0 (API level 26)
Android 7.1 (API level 25)
Android 7.0 (API level 24)
Android 6.0 (API level 23)
Android 5.1 (API level 22)
Android 5.0 (API level 21)
Android 4.4W (API level 20)
Android 4.4 (API level 19)
Android 4.3 (API level 18)
Android 4.2 (API level 17)
Android 4.1 (API level 16)
Android 4.0.3 (API level 15)
Android 4.0 (API level 14)
Android 3.2 (API level 13)
Android 3.1 (API level 12)
Android 3.0 (API level 11)
Android 2.3.3 (API level 10)
Android 2.3 (API level 9)
File system hierarchy
/boot
/cache
/data
/misc
/recovery
/sdcard
/sd-ext
/system
Also see
How To Decrypt Android Full Disk Encryption
Extended File System (ext)
YAFFS
External links
Android developers: SDK Platform release notes
Android File Hierarchy : System Structure Architecture Layout
Explore The Android File System Hierarchy In-Depth
Practical android phone forensics, by Hashim Shaikh, July 21, 2017
Pst file viewer -
Free PST Viewer Free PST Viewer is a freeware application to open, read and view PST files without the help of MS Outlook. This freeware tool is made by SysInfoTools Software to help users to open any type of MS Outlook PST files whether is is a Unicode, ANSI or corrupted files.2
Features
A freeware application to read and view PST file even without Microsoft Outlook. It also allows to open corrupted or inaccessible PST files
External Links
Official Website
Hachoir -
Hachoir is a generic framework for binary file manipulation. Written in Python, it's operating system independent and has many text/graphic user interfaces (ncurses, wxWidget, Gtk+). Although it contains a few functions to modify files, it is generally intended for examining existing files. Hachoir currently supports more than sixty file formats. File format recognition is based on the headers and footers in a disk image of file. It has a fault tolerant parser designed to handle truncated or buggy files. The framework also automatically adjusts for endian or character set issues. The framework can be scripted and extended.
External Links
Official website