hemu1438/forensicsgpt-training-data huggingface dataset:
Cyber threat intelligence -
Note that the term cyber is arguably misused in the context of "Cyber Threat Intelligence" 1 and should be considered more as an equivalent for "Digital Threat Intelligence" or "Internet Threat Intelligence".
Terminology
Indicator
Cyber Threat Indicator: A set of cyber observables combined with contextual information intended to represent artifacts and/or behaviors of interest within a cyber security context. 2
TTP
TTP, in the context of cyber threat intelligence, is short for Tactics, Techniques and Procedures also sometimes referred to as Tools, Techniques, Procedures.
TTPs are representations of the behavior or modus operandi of cyber adversaries. It is a term taken from the traditional military sphere and is used to characterize what an adversary does and how they do it in increasing levels of detail. 3
Note that the abbreviation TTP is highly ambiguous, e.g. in another context it can mean Trusted Third Party.
Standards
CAPEC
IDMEF
IODEF
OpenIOC
Oval
Stix/Cybox/MAEC
Veris
Yara
OpenIOC
Cons:
Highly Mandiant product centric standard, though seems to have digressed a bit from this since version 1.1
External Links
Driving a Collectively Stronger Security Community with Microsoft Interflow, by Jerry Bryant, June 23, 2014
NIST Special Publication 800-150 (Draft) - Guide to Cyber Threat 6 Information Sharing (Draft), by NIST
Feeds (or equivalent)
Cyber Campaigns
CAPEC
Common Attack Pattern Enumeration and Classification (CAPEC)
IODEF
RFC 5070 - The Incident Object Description Exchange Format
OpenIOC
The OpenIOC framework
Stix/Cybox/MAEC
Cyber Observable eXpression
Structured Threat Information eXpression
Malware Attribute Enumeration and Characterization (MAEC)
Standardizing Cyber Threat Intelligence Information with the Structured Threat Information eXpression (STIX™), by Sean Barnum, 2014
Tools
Mantis
Dfl ddp data recovery equipment -
DFL-DDP Data Recovery Equipment is the world’s first professional high-speed USB3.0 data recovery equipment, it does not only what other data recovery equipment do, but does what other data recovery equipment cannot do. Besides imaging and recovering all brands’ of patient hard drives, DFL-DDP is able to quickly repair many common firmware damaged drives of Seagate, WD, Samsung, Toshiba, Hitachi, etc at high success rate.
See Also
Dolphin_Data_Lab
Tools: Data Recovery
External Links
DFL-DDP Data Recovery Equipment
Datamining for forensics -
This page is a place-holder for algorithms and approaches that might be useful in dataming as applied for computer forensics.
Algorithms
https://en.wikipedia.org/wiki/DBSCAN — DBScan clustering algorithm.
https://en.wikipedia.org/wiki/Okapi_BM25 — Okapi BM25 — A ranking function used by search engines.
https://en.wikipedia.org/wiki/Soundex — Soundex, for doing "sounds like" searching.
Cyberspeak podcast -
An podcast by Bret Padres and Ovie Carroll, both former agents of the Air Force Office of Special Investigations, since 4 Dec 2005. The show usually features at least one interview, although some shows do not have any. The hosts also discuss current issues in the field and give links to new or interesting websites. A set of detailed show notes are usually posted to a separate website, although the link is given on the show's official website.
See Also
List of Cyberspeak Podcast Interviews
External Links
Official website
Dfl frp hdd firmware repair tool -
DFL-FRP HDD Firmware Repair Tool is one very professional USB firmware repair hardware Tool and it is designed to be compatible with any of current software program of DFL-WDII, DFL-STII and the other coming DFL series firmware repair tools such as DFL-Samsung, DFL-Hitachi, DFL-Toshiba, DFL-Fujitsu, etc. This is the newly created USB hardware design for all DFL firmware repair tools.
External Links
DFL-FRP HDD Firmware Repair Tool
Dolphin_Data_Lab
Tools:Data_Recovery
Data reduction -
Data reduction is the science of eliminating information from consideration. Although that may sound counter to the goal of computer forensics, today's computers contain too much information for a single investigator to completely evaluate. Thus, those data that can be eliminated from consideration should be removed, freeing an investigator to concentrate on the truly meaningful pieces.
Hash Analysis
A hash is a mathmatical transform that reduces an input of arbitrary size to a fixed value. It has the property that any two inputs that have the same hash are almost certainly the same. In this vein, an investigator can compute hashes of known good and known bad inputs (e.g. files) and use those hashes to search for those known files in a set of unknown files. For example, the NIST National Software Reference Library provides several million hashes of known good operating system files. If an invesigator can match those known hashes into an unknown set of files, the matching files can be eliminated from consideration.
Dfl srp usb3.0 for data extraction -
DFL-SRP USB3.0 For Data Extraction is one world famous recovery equipment with disk imaging, file extraction & common firmware repair modules. It recovers three hard drives at high speed synchronously, up to 180mb/s each channel & over 300mb/s for ssd. Engineers worldwide are using this equipment with big success. Users with this tool usually have a higher success rate and stay more competitive.
External Links
DFL-SRP USB3.0 For Data Extraction
Dolphin_Data_Lab
Tools:Data_Recovery
Dfl srp usb3.0 for samsung firmware repair -
DFL-SRP For Samsung Firmware Repair Tool is one top-class USB3.0 Samsung hard drive firmware repair hardware tool fixing firmware failures of three Samsung hard drives at the same time, 2 SATA and 1 IDE hard drive! Users use this tool to repair Samsung hard drive firmware modules, reset smart, remove password, repair bad sectors, edit SN, models, capacities, etc. Users with this tool usually have a higher success rate and stay more competitive.
External Links
DFL-SRP For Samsung Firmware Repair Tool
Dolphin_Data_Lab
Tools:Data_Recovery
Dfl srp usb3.0 for seagate firmware repair -
DFL-SRP For Seagate Firmware Repair Tool is one top-class USB3.0 Seagate hard drive firmware repair hardware tool fixing firmware failures of three Seagate hard drives at the same time, 2 SATA and 1 IDE hard drive! DFL-SRP USB3.0 Seagate Firmware Repair Tool supports both new and old Seagate hard drives of 5400.6, 7200.4, 7200.11, 7200.12, 7200.14, 7200.10, 7200.9, 7200.8, 7200.7, etc. Users use this tool to repair Seagate firmware modules, reset smart, remove password, repair bad sectors, edit Seagate SN, models, capacities, etc. Users can work in both ATA and COM modes. Users with this tool usually have a higher success rate and stay more competitive.
External Links
DFL-SRP For Seagate Firmware Repair Tool
Dolphin_Data_Lab
Tools:Data_Recovery
Dfl srp usb3.0 for wd firmware repair -
DFL-SRP For WD Firmware Repair Tool is one top-class USB3.0 Western Digital hard drive firmware repair hardware tool fixing firmware failures of three WD hard drives at the same time, 2 SATA and 1 IDE hard drive! DFL-SRP USB3.0 WD Firmware Repair Tool supports Marvell L and ROYL series with latest drives supported. Users use this tool to repair WD hard drive firmware modules, reset smart, remove password, repair bad sectors, edit SN, models, capacities, etc. Users with this tool usually have a higher success rate and stay more competitive.
External Links
DFL-SRP For WD Firmware Repair Tool
Dolphin_Data_Lab
Tools:Data_Recovery
Dfl ure usb device data recovery equipment -
DFL-URE USB Device Recovery Equipment contains disk imaging module, file recovery module, common hdd repair module, bad sector scan module, general function module including password set and unlock modules/tools.
DFL-URE Functions and Features
DFL-URE is one USB3.0 data recovery equipment for all USB hard drives which can be detected
or undetected drives which can be fixed by its built-in common repair solutions;
DFL-URE is able to connect USB hard drives directly with its two built-in USB3.0 interfaces and recover two USB hard drives at the same time;
DFL-URE is able to image the USB hard drives to another target disk, image the patient drives to one image file or image selective heads or image wanted partitions and files only;
DFL-URE supports selective head image of Seagate, WD and Toshiba hard drives and will add Samsung USB hard drive selective head image in the upgrade.
DFL-URE is able to extract lost partitions, file folders, scan MFT, recover data by file types and recover selective files and partitions;
DFL-URE is able to unlock the WD USB hard drives if the password is given for smartware encryption;
DFL-URE is able to remove passwords for Seagate, WD, Samsung USB hard drives and will upgrade to support other USB hdd brands such as Toshiba;
DFL-URE is able to scan bad sectors and offer users initial diagnosis on how to move forward for a better recovery method;
DFL-URE has also many other fast solutions to common hdd failures of Seagate, WD, Toshiba etc;
External Links
DFL-URE USB Device Recovery Equipment
Dolphin_Data_Lab
Tools:Data_Recovery
Dfwinreg -
dfWinReg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects. The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
History
dfWinReg originates from the Plaso project and is also based on ideas from the winreg-kb project. It was largely rewritten and made into a stand-alone project to provide more flexibility and allow other projects to make use of Windows Registry functionality.
See Also
dfvfs
plaso
External Links
Project site
Dfl srp all in one usb3.0 data recovery equipment -
DFL-SRP All-In-One USB3.0 Data Recovery Equipment is the world’s top data recovery equipment supporting all hard drive brands (Seagate, WD, Hitachi/IBM, Samsung, Toshiba, Fujitsu) on logical data recovery, bad sector data recovery, repairing bad sectors, editing models, editing SN and capacities, password removal, reset smart, repairing firmware failures, updating firmware, repairing undetected and busy hard drives and getting lost data back.
DFL-SRP All-In-One USB3.0 Data Recovery Equipment contains the following modules:
DFL-SRP USB3.0 For Data Extraction
DFL-SRP USB3.0 For Seagate Firmware Repair
DFL-SRP USB3.0 For WD Firmware Repair
DFL-SRP USB3.0 For Samsung Firmware Repair
See Also
Dolphin_Data_Lab
External Links
DFL-SRP All-In-One USB3.0 Data Recovery Equipment
Digital forensics lab -
For an instructional lab
Goals of the Lab
Teach basic forensic practices
Acquaint with procedures
Hardware
High performance workstation with:
At least 16GiB of RAM.
At least 3TB of local storage, ideally >8TB.
SATA docks to allow SATA drives to be plugged and unplugged. Ideally connect the docks with USB3 or eSATA. Be sure you have docks that can handle hard drives > 2TB.
Open Source Software
Sleuth Kit
Commercial Software
In general we do not recommend commercial software for instructional purposes, but if you need it, here's stuff to buy:
For a research lab
Goals of the Lab
Insight on how to conduct research
Edge -
Enhanced Data rates for Global Evolution, or EDGE is a mobile phone technology that enhances upon GPRS. Thoeretically, this allows data transfers three times faster than standard GPRS, but is not always the case. The maxinmum data tranfer rate is 236 kbps but most networks runing EDGE are only configured for a data transfer rate of 135 kbps. It can be used on GSM and TDMA networks including Cingular and T-Mobile. EDGE can be implemented with no modification to the core network, the base station subsytem only need a transceiver installed to support EDGE.
Eforensics magazine -
eForensics Magazine is a downloadable magazine focused on digital forensics. It features articles by digital forensics specialists and enthusiasts, experts in Mobile, Computer, Network and Database Forensics. It covers all aspects of electronic forensics, from theory to practice, from methodologies and standards to tools and real-life solutions. Each magazine features a cover focus, and articles from our regular contributors, covering news and up-to-date topics. The magazine also offers online courses on various aspects of digital forensics.
Online courses offered by eForensics Magazine
Course Name Course page Instructor 
Advanced Smartphone Forensics	https://eforensicsmag.com/course/advanced-smartphone-forensics-w14/	Massa Fabio	
CCFP Training	https://eforensicsmag.com/course/isc2-ccfp-training-preview-w13-2/	Jay C. Grant	
CFIP Masterclass	https://eforensicsmag.com/course/cfip-masterclass-w12/	IICFIP	
Computer Forensics in Practice	https://eforensicsmag.com/course/computer-forensics-in-practise-w4-2/	Shweta A. Chawla	
Forensics Imaging	https://eforensicsmag.com/course/forensics-imaging-practical-course-w10-2/	Bridgette Braxton	
How to Build a PenTest Lab	https://eforensicsmag.com/course/how-to-build-a-pentest-lab-w17/	Paul Janes	
Learn Acquisition of a Digital Evidence Using Caine GNU/Linux Forensics Distro	https://eforensicsmag.com/course/digital-forensics-using-caine-gnulinux-forensics-distro-w9-2/	Nanni Basatti	
Malware Analysis StarterKit	https://eforensicsmag.com/course/cyber-intelligence-2/	Anderson Tamborim	
Master Your CSA Star	https://eforensicsmag.com/course/csa/	John DiMaria	
Packet Analysis With Wireshark and PCAP Analysis Tools	https://eforensicsmag.com/course/packetanalysis/	Eric A. Vanderburg	
Practical Social Engineering	https://eforensicsmag.com/course/social-engineering-w16/	Anderson Tamborim	
Windows Forensic Analysis	https://eforensicsmag.com/course/windows-forensics-analysis-w14/	Muhammad Irfan	
Wireless Security Attacks	https://eforensicsmag.com/course/wireless-security-attack-w18/	Shad Malloy	
			
Free issues
Free Issues
External Links
eForensics Magazine Website
Facebook Profile
Twitter Page
Disabling macintosh disk arbitration daemon -
Start Terminal (in the Utilities folder).
Type:
cd /etc/mach_init.d ls
Look for the file called diskarbitrationd.plist. If this file is in this directory, then disk arbitration is turned on. The disk arbitration file will attempt to mount any device it sees connected to the Mac, so one way you can stop disk arbitration from mounting the suspect's drive is by hiding this file. Simply renaming the file may not work. To do this, store a backup copy of diskarbitrationd.plist under the root directory and then delete the original.
Type
sudo cp diskarbitrationd.plist /
Confirm that the copy is there.
ls /
Remove the original file from the mach-int.d directory by typing:
sudo rm diskarbitrationd.plist.
You can restore disk arbitration when your done by typing:
sudo cp /diskarbitrationd.plist /etc/mach_init.d.
You can leave the copy in root for the next time, as it will have no effect on your system if it is left in that directory. When you are done, reboot your computer to make sure that the disk arbitration daemon is not running.
Elcomsoft mobile forensic bundle -
Elcomsoft Mobile Forensic Bundle (EMFB) is the complete mobile forensic kit in a single pack by Elcomsoft. EMFB enables law enforcement, corporate and government customers to acquire and analyze the content of a wide range of mobile devices. The kit allows experts to perform physical, logical and over-the-air acquisition of smartphones and tablets, break mobile backup passwords and decrypt encrypted backups, view and analyze information stored in mobile devices.
Physical and logical acquisition of iOS devices
Logical acquisition of locked iOS devices
Break passwords to iOS system backups
Obtain iCloud backups, download photos and synced data, access iCloud passwords
Google Account forensics
Windows Phone, Windows 10 Mobile and BlackBerry 10 support
Windows and Mac editions
View and analyze evidence
Access to instant messaging apps (iMessage, WhatsApp, Telegram, Skype, Signal)
Comprehensive Mobile Forensic Solution
Elcomsoft Premium Forensic Bundle includes the most essential tools for acquiring and analyzing evidence from a wide range of mobile platforms.
Physical and logical acquisition of iOS devices
Extract evidence from Apple iOS devices with or without a jailbreak. Low-level extraction and keychain acquisition on jailbroken devices, advanced logical for devices without a jailbreak. The use of lockdown records enables extracting evidence from locked iOS devices without a passcode.
Break passwords to iOS system backups
Brute-force passwords protecting encrypted iOS backups with a high-end tool. GPU acceleration helps achieve unprecedented performance, while access to users' stored passwords enables targeted attacks with custom dictionaries.
Obtain iCloud backups, download photos and synced data, access iCloud passwords
ElcomSoft provides the most comprehensive iCloud acquisition solution on the market, enabling forensic access to evidence stored in the cloud with and without the Apple ID password. Access cloud backups, call logs, messages, passwords, contacts, iCloud Photo Library, iCloud files and a lot more.
Google forensics
Extract and analyze user’s detailed location history, search queries, Chrome passwords and browsing history, Gmail messages, contacts, photos, and a lot more.
Windows and Mac editions
Most tools comprising the Bundle are provided in both Windows and Mac editions.
View and analyze evidence
Use the lightweight tool to browse, search and analyze evidence. Discover deleted messages (including deleted SMS and iMessages in iOS backups), view passwords stored in the user's Google Account and iOS keychain.
Access conversations from various Instant Messengers
Extract, decrypt and view WhatsApp, Telegram, Skype, Signal and iMessage communication histories from a wide range of devices and cloud services.
Error correction code -
Error Correction Code (ECC Errors)
All modern hard disk drives are ATA (Advanced Technology Attachment) compliant. Part of this compliancy means that drives must have the ability to detect errors while reading data from individual sectors on the drive. This is to prevent corrupted data from being propagated through to the operating system which would lead to system crashes.
In order to accomplish this, every sector has a built in checksum and error correction code that is written at the time that data is written to the sector. Upon reading the sector, the drive recalculates the checksum and compares it to the one previously written. If it does not match, the error correction code will attempt to correct the data. Every sector has a standard 512 bytes of user data. A typical ECC is capable of correcting between 10 and 12 bytes. If repairing the corruption is beyond the capability of the ECC, the data will not be returned to the operating system. The drive will then return an error. This is typically a UNC (uncorrectable) error.
These types of errors occur when data is written to the sector improperly or inadvertently. Additionally, these errors can be due to read instability in the drive where the data itself is not actually corrupted but the drive is incapable of reading it correctly. This can be due to factors such as minute mechanical wear of the parts inside the head disk assembly.
Evolution -
Subject: header test From: Username <username@sendinghost.com> To: Username <username@receivinghost.com> Content-Type: text/plain Date: Sat, 28 Jul 2007 11:52:35 +0200 Message-Id: <1185616355.19231.0.camel@localhost> Mime-Version: 1.0 X-Mailer: Evolution 2.10.1 Content-Transfer-Encoding: 7bit
Hd hpe pro -
Overview
HD HPE PRO is a hard drive platter replacement and disk head exchange tool built to handle head stack and DSM issues produced by SalvationDATA.
Besides firmware problem and well known file system problems, as a data recovery professional, you must have experiences that drives click and drive spin motor got stuck or burnt. For few of you, these kinds of problems can be fixed by replacing the damaged parts manually, but for most of the non-experts who want to lay their hands on this bite of cake, it is better if they work in a stable environment with assistance of industrial designed utilities to prevent further damages or misalign because of incorrect operations to maintain the user data intact.
Highlights of HD HPE PRO
Universal-fit workbench assures you to operate on your HD on a relatively stable table, making your job easier and more reliable.
Platter exchanger maintains the original cylinder status by removing and placing each platter of the multiple platters together, so that allows you to change multiple platters without moving the platters out of alignment with each other which otherwise will result in data corruption.
Special Actuator Remover assures you to perform easy operation (removal, installation) on the upper magnet of the actuator which is very hard to be removed and put back because of its strong magnetism and it’s sensitive and embarrassed position (being very close to both the Head Stack and Media Platter), in case it slips out and touch either of its fragile neighbors during the operations — the consequences will be a disaster.
Facebook forensics -
URL Signatures
When a user views a JPEG or PNG from Facebook (from a profile, album, etc.) the URLs tend to have "fbcdn" or "facebook" in the hostname. Profile pictures tend to contain "profile" in the hostname as well. To that subset of URLs you can apply all of these regular expressions to capture the user ID who owned that particular image. The a, s, n, and q characters in the URL refer to the size of the image. There are a few main varieties of image URLs, and these three expressions should help you parse them.
/\d+(\d+)\d+_[qs]\. q is small, s is large
[as](\d+)\d+\d+\. s is small, a is large
\d+\d+(\d+)\d+\d+_[asnq]\. ''s is small, a is medium, n is large, q is square'
See also
Residual Data
Facebook Forensics, SANS Computer Forensics and Incident Response Blog Entry, June 11, 2009. A few musings and links (that are reported above). Mostly with tracking photos to facebook.
Facebook Memory Forensics, SANS Computer Forensics Incident Response Log, Nov. 20, 2009. Discussion about facebook details left in memory.
Facebook Chat Forensics, March 20, 2009, details of how to recover chat from the JavaScript and JSON entries.
Facebook Forensics, Valkyrie-X Security Research Group, July 5, 2011. Notes the groups successes and failures in recovering Facebook artifacts from RAM and storage.
Network Forensics
Thoughts about the impact of Facebook's SSL decision on network forensics, by Netresec, January 30, 2011
Tools
Facebook Forensic Toolkit eDiscovery toolkit to identify and clone full profiles; including wall posts, private messages, uploaded photos/tags, group details, graphically illustrate friend links, and generate expert reports.
Belkasoft Evidence Center allows for carving Facebook data such as chats, wall posts and photos from Live RAM dumps, hibernation and pagefiles.
Hivexml -
Hivexml is a command-line program that is part of libguestfs that extracts registry entries from a Hive file into an XML file.
Below is an pretty-printed example of what the XML looks like; note that the tags have not been pretty-printed to avoid changing the semantics of the file.
<?xml version="1.0" ?> <hive> <node name="CMI-CreateHive{6A1C4018-979D-4291-A7DC-7AED1C75B67C}"> <node name="AppEvents"> <node name="EventLabels"> <node name=".Default"> <value default="1" type="string">Default Beep</value> <value key="DispFileName" type="string">@mmres.dll,-5824</value> </node> <node name="ActivatingDocument"> <value default="1" type="string">Complete Navigation</value> <value key="DispFileName" type="string">@ieframe.dll,-10321</value> </node> <node name="AppGPFault"> <value default="1" type="string">Program Error</value> <value key="DispFileName" type="string">@mmres.dll,-5825</value> </node> 
See also
https://rwmj.wordpress.com/2009/10/29/hivexget-get-values-from-a-windows-registry-hive/ for information on how to extract individual entries.