hemu1438/forensicsgpt-training-data huggingface dataset:
Tdma -
Time Division Multiple Access (TDMA) is a digital communication channel allowing many users to access a single communication channel.
Usage
TDMA is used in the largest available networks in the world. TDMA is aimed at dealing with multiple access to the same communication medium. Each individual user is given a unique time slot within the defined communication channel. This methodology increases the efficiency of transmission by allowing multiple users simultaneous access to a time slot. TDMA can be easily adapted to transmission of data as well as voice communication.
Features
TDMA offers the ability to carry date rates of 64 kbps to 120 MBPS, which enables options of communication such as fax, voiceband data, sms, as well as bandwidth intensive apps. TDMA allows the mobile device to have extended battery life, since the cellular device is only transmitting a portion of the time during sessions. In addition, TDMA is the most cost effective technology for upgrading an analog system to digital 1. TDMA also enables some vital features for system operation in an advanced cellular or PCS environment.
How It Works
It’s necessary for TDMA to rely upon that fact that the audio signal has been digitized. These signals are divided into a number of milliseconds and distributed into time slots. TDMA is also the access technique used in the European digital cellular standard, GSM, and the Japanese digital standard, personal digital cellular (PDC). A single channel can carry all four conversations if each conversation is divided into relatively short fragments, is assigned a time slot, and is transmitted in synchronized timed. For instance, if there are four people: Jan, Tom, Bill, and Bob making calls, each would be assigned a time slot on a single channel. However, if Bob was no longer using his phone, his time slot would still be used, wasting bandwidth. 2.
Techniques -
Although the techniques for investigating computer forensics are limited only by an investigator's imagination, here are some guidelines on tried and true methodologies.
Techniques
Data Reduction - By eliminating information that doesn't matter, an investigator is left with information that does matter.
Locard's exchange principle
Guidelines
RFC 3227, "Guidelines for Evidence Collection and Archiving," D. Brezinski and T. Killalea, February 2002.
Testing and validation -
Testing and validation are 2 important elements for forensics.
External Links
Computer Forensics Tool Testing Program (CFTT), by NIST
Working Group on Digital Evidence (SWGDE)
Evaluating Digital Forensic Tools (DFTs), by Flavien Flandrin, Prof William J. Buchanan, Richard Macfarlane, Bruce Ramsay, Adrian Smales,
Validation and verification of computer forensic software tools — Searching Function, by Yinghua Guo, Jill Slay, Jason Beckett, September 2009
Forensic Science Regulator Guidance: Method Validation in Digital Forensics, by Crown, 2020
Testing digital forensic data processing tools, by Joachim Metz, September 25, 2020
25 Days, 25 Questions: Part 4 – Lab And Tool Standards, by Forensic Focus, November 2, 2020
Standards
ISO/IEC 27037:2012 Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence
ISO/IEC 27041:2015 Information technology — Security techniques — Guidance on assuring suitability and adequacy of incident investigative method
ISO/IEC 27042:2015 Information technology — Security techniques — Guidelines for the analysis and interpretation of digital evidence
ISO/IEC 27043:2015 Information technology — Security techniques — Incident investigation principles and processes
ISO/IEC 17025 TESTING AND CALIBRATION LABORATORIES
The farmer's boot cd -
THE FARMER'S BOOT CD (FBCD) is a Linux bootable CD developed by Thomas Rude.
Taking a different approach than other Live CDs, this CD was designed and optimized for previewing systems before acquiring. It contains a number of programs forensic practitioners can utilize to preview both Windows and Linux systems in a forensically sound manner.
Preview Capabilities
THE FARMER'S BOOT CD has been designed for previewing both Windows and Linux systems. On-site previews before acquisitions is an emerging trend in the U.S.A. due to legal and technological reasons.
Below is a short list of what can be accomplished in a simple GUI on this CD;
Mount file systems read-only, including journalled file system types
Obtain a list of deleted files for ext2, FAT12/16/32, and NTFS file system types
Undelete deleted files from NTFS file systems
Obtain both E-mail and URL addresses from the Windows "pagefile.sys" file
Read the Recycle Bin INFO2 records
Read Windows event log files (AppEvent.Evt, SecEvent.Evt, SysEvent.Evt)
Read many log files from Linux systems (shell histories, system logs, security logs, accounting logs, etc.)
Obtain file system metainformation (creation date, last mount and write date, version, label, UUID, etc.)
Parse Internet cache files from IE, Mozilla, and Opera, pulling cookies and histories
Catalog target file system, selecting files of interest by extension or header
Convert date/time between UNIX 32bit, UNIX hex, human readable, Windows 64bit, and Windows hex
Generate thumbnails for all graphics in fully qualified path filename
Obtain drive information (serial number, make/model, firmware, HPA status, etc.)
Obtain system BIOS table information (serial numbers, dates, UUIDs, etc.)
Obtain system hardware catalog
Double-clicking on most common file types opens them (Documents, Graphics, Presentations, Movies, Audio, etc.)
External Links
The Farmer’s Boot CD, by Thomas Rude, May 2006
Thunderbird header format -
Mozilla Thunderbird version 1.0 running on Microsoft Windows generates headers in the following format:
Message-ID: <41B5F981.5040504@sendinghost.com> Date: Tue, 07 Dec 2004 13:42:09 -0500 From: User Name <username@sendinghost.com> User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) X-Accept-Language: en-us, en MIME-Version: 1.0 To: username@receivinghost.com Subject: Testing Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit 
Extensions such as enigmail may add extra headers.
The Message-ID field has three parts:
The time the message was sent in seconds past the epoch in hexadecimal.
A random value called a salt. The salt is of the format #0#0#0# where # is a random digit. Because Thunderbird treats the salt like a number, it may be shorter if the leading digits are zeros. For example, a salt of "0030509" would display as "30509".
The fully qualified domain name of the sender.
Message-ID: [time].[salt]@[domain-name] 
References
Information on the Message-ID header was derived from the source code, specifically the function msg_generate_message_id in mozilla/mailnews/compose/src/nsMsgCompUtils.cpp.
Tools
Thunderbird MSF Viewer to view Thunderbird email messages header, message body along-with attachments.
Tool template -
This really isn't the tool template that we want to use, because it is not a wiki template...
Tool Name is a ...
Features
File Systems Understood
File Search Facilities
Historical Reconstruction
Can it build timelines and search by creation date?
Searching Abilities
Can it search? Does it build an index? Can it focus on file types or particular kinds of metadata?
Hash Databases
Can it create hashes of files and/or blocks? Can it compare these hash values to any databases? What sort of hash functions does it use?
Evidence Collection Features
Can it sign files? Does it keep an audit log?
History
License Notes
Is it proprietary, free, or open source? Are there other licensing options?
External Links
External Reviews
Tools file analysis -
Software Forensics
CodeSuite by Software Analysis & Forensic Engineering CodeSuite comprises BitMatch, CodeCross, CodeDiff, CodeMatch, and SourceDetective for comparing and analyzing source code and object code to find copyright infringement and trade secret theft. It can be used for free on small sets of code.
CodeSuite also includes FileCount and FileIsolate for counting file attributes and quickly copying or deleting entire file trees. Both are free utilities.
http://www.safe-corp.com/
Open Source Tools
file The file command determines the file type of a given file, depending on its contents and not on e.g. its extension or filename. In order to do that, it uses a magic configuration file that identifies filetypes.
ldd List dynamic dependencies of executable files.
truss Solaris tool used to trace the system/library calls (not user calls) and signals made/received by a new or existing process. It sends the output to stderr.
PDF Miner "...suite of programs that aims to help analyzing text data from PDF documents. It includes a PDF parser, a PDF renderer (though only rendering text is supported for now), and a couple of nice tools to extract texts. Unlike other PDF-related tools, it allows to obtain the exact location of texts in a page, as well as other layout information such as font size or font name, which could be useful for analyzing the document. It also infers text running within a page by using clustering technique."
ltrace Library call tracer.
strace System Call Tracer.
xtrace eXtended trace utility, similar to strace, ptrace, truss, but with extended functionality and unique features, such as dumping function calls (dynamically or statically linked), dumping call stack and more.
ktrace Enables kernel process tracing on OpenBSD.
Valgrind Executes a program under emulation, performing analysis according to one of the many plug-in modules as desired. You can write your own plug-in module as desired.
DTrace Comprehensive dynamic tracing framework for Solaris (also ported to MacOS X - XRays and FreeBSD). DTrace provides a powerful infrastructure to permit investigation of the behavior of the operating system and user programs.
strings Strings will print the strings of printable characters in files. It allows choosing different charactersets (ASCII, UNICODE). It is a quick way to browse through files/partitions/... in order to look for words, filenames, keywords etc.
The Open Computer Forensics Architecture https://ocfa.sourceforge.net/
Rifiuti Examines the INFO2 file in the Recycle Bin.
Pasco Parses index.dat files.
Galleta Parses cookie files.
dumpster_dive.pl MS Windows Recycle Bin INFO2 parser
cookie_cruncher.pl MS IE cookie file parser
Hachoir Determines the file type using file header/footer (hachoir-metadata --type), able to list strings in Unicode (hachoir-grep), etc. Support more than 60 file formats.
Cygwin
Linux like environment for Windows.
UnxUtils
Common unix utilities compiled for a Windows environment.
GnuWin32
Common GNU utilities compiled for a Windows Environment.
File Sharing Analysis Tools
P2P Marshal Tools to discover and analyze peer-to-peer files for Windows.
Steganography -
Steganography is a science that pertains to the art of concealing data in a communication in such a way that only the sender and receiver know of its existance and method of access. The platform used for transmission can be anything from a paper document to a digital file. Additionally, it is more common than not to encrypt the hidden data whenever possible such as with digital files or images. The detection of steganographically encoded packages is called steganalysis.
External links
Algorithms and Tools
StegoArchive.com An excellent resource for freeware/shareware steganography application downloads.
Digital Invisible Ink Toolkit is a Java steanography tool that hides any file in a JPEG.
Hide In Picture is an open source stegnographic tool.
M5, by Andreas Westfeld, is both a steganographic tool and algorithm. It hides information in JPEGs. An attack was developed by Jessica Fridrich, Miroslav Goljan, and Dorin Hogea.
Publimark hides text in audio files.
DeepSound is a Windows tool that hides data in audio files
Stroz friedberg -
Stroz Friedberg helps clients manage their digital risks and delivers unassailable results in the areas of computer forensics, mobile phone forensics, electronic discovery, data breach, cybercrime response, and investigations. Strategy and risk management in the form of sound, ethical consulting advice is the foundation of everything we do: it provides the context in which we deploy unparalleled investigative skills and proprietary technologies and cost-effectively resolve our clients’ most pressing matters. Corporations, law firms, government agencies, and the courts rely on us for our objective and thorough analyses and solutions that invariably withstand the scrutiny of opposing counsel and their experts.
We successfully operate at the intersection of technology, law, investigations, and behavioral science: we uncover key digital evidence; we ensure compliance; we provide assurance to all parties; we identify and protect against the malicious acts of real adversaries.
Blackberry -
)
The RIM BlackBerry is a personal wireless handheld device that supports e-mail, mobile phone capabilities, text messaging, web browsing, and other wireless information services. It is most commonly utilized for business purposes.
History
The BlackBerry was first introduced in 1999 by a company called Research In Motion (RIM).
Operating System
The BlackBerry OS provides easy access to applications such as e-mail, to do list, memos, address book, and many other features. With the newer operating systems 4.1 and later, composing messages are much more convenient by providing auto text.
Models
6200 Series
6500 Series
6700 Series
7100 Series
7130 Series
7200 Series
7700 Series
7500 Series
7700 Series
8100 Series
8300 Series
8700 Series
8800 Series
BlackBerry Storm
BlackBerry Bold
BlackBerry Pearl
BlackBerry Curve
Forensics
Forensics on the RIM platform is complicated by the fact that this is a "push" device --- the RIM server will push device to the PDA whenever the PDA's radio is on and there is data available.
RIM devices also feature a remote self-destruct feature. This feature cannot be activated if the radio is turned off, of course.
Both of these features mean that you need to be sure that the radio is off when doing a forensic investigation.
Depending on the setting, entering a wrong password a certain number of times will wipe the device.
References
BlackBerry.com, the BlackBerry main site.
BlackBerry Frequently Asked Questions, Largest collaboration of Answers to Questions for BlackBerry
Forensic Examination of a RIM (BlackBerry) Wireless Device
Cellebrite -
Founded in 1999 by a team of highly experienced telecom and mobile telephony professionals, Cellebrite is a global company known for its technological breakthroughs in the cellular industry. Wireless Retailers
The pioneers in mobile phone to phone content transfer, today Cellebrite provides a complete range of solutions for the mobile retail industry, from stand-alone content transfer at the POS to OTA applications for subscriber content management.
With proven ability to impact sales of phones, upgrades, and services, Cellebrite customers include the world’s largest mobile operators and deployments by more than 140 major carriers. Mobile Forensics
Building on its expertise in mobile data technology, in 2007, Cellebrite introduced a new line of products targeted to the mobile forensics industry.
Cellebrite’s solution enables extraction and analysis of evidentiary data from more than 3,000 mobile phones and GPS devices.
The most complete mobile forensics experience available on the market today, Cellebrite technology is in use by military, law enforcement, and government agencies across the world.
Cellebrite is a fully-owned subsidiary of the Sun Corporation, a listed Japanese company (6736/JQ).
-- Universal Forensic Extraction Device
Logical and physical data extraction
Supports more than 3000 handset models
Standalone kit - portable and easy to use
1
Defense cyber investigations training academy -
The Defense Cyber Investigations Training Academy, or DCITA, is the training division of the Defense Cyber Crime Center based in Linthicum, Maryland. DCITA is a nationally accredited academy that provides training in four areas of study, including:
Computer Technology
Digital Forensics
Incident Response
Network Intrusion and Investigations
Training is provided to all branches of the U.S. Government including Federal law enforcement. Training is provided in a hierarchical progression of courses that range from basic Introduction to Networks and Computer Hardware to the pinnacle of Live Network Investigations. Over 20 different courses are provided in-house at the DCITA facility, with a number of courses delivered remotely on-site. DCITA also provides online distance learning to students that features remote access to virtualized forensic workstations, allowing students to practice methodologies online in a safe, sandbox environment.
DCITA instructors research and develop the curriculum that is used for courses. Instructors also provide formal presentations of their research at various security conferences including the DoD Cyber Crime Conference.
External Links
Official website
Dekart -
Dekart is a company headquartered in Chişinău, the capital of Moldova.
Its software solutions are focused on information security, specifically in the following areas: encryption, authentication, digital signatures and SIM card management.
The following Dekart software is described on Forensics Wiki:
SIM Explorer, a tool to read hidden SIM card data.
SIM Manager, a tool designed to manage the contents of SIM cards, it also provides an SMS recovery option.
External links
Dekart website
The company's philosophy
Digital assembly -
Digital Assembly offers computer forensics and data recovery software. Their products include:
Adroit Photo Forensics, an advanced data carving and analyis tool for photos, capable of recovering fragmented photos as well.
Adroit Photo Recovery, a consumer oriented photo recovery tool capable of recovering fragmented photos.
Notes
The founders of Digital Assembly, won the best paper award at DFRWS 2008 for their research work in SmartCarving. SmartCarving is a file carving technique used to recover fragmented files.
Dod cyber crime center -
The DoD Cyber Crime Center, or DC3, is a Department of Defense organization run by the Air Force Office of Special Investigations. The center consists of four divisions:
Defense Computer Forensics Lab
Defense Cyber Investigations Training Academy (DCITA)
Defense Cyber Crime Institute
Futures Exploration (FX)
Events
The DC3 sponsors an annual conference, the DoD Cyber Crime Conference. They also run an annual forensics contest, the DC3 Digital Forensics Challenge. The winner of the challenge receives a free trip to the DoD Cyber Crime Conference.
History
The DC3 was formed in 2001 when the newly created DCCI was merged with the existing DCFL and DCITA (at the time called the Defense Computer Investigations Training Program (DCITP).
External Links
Official website
Dolphin data lab -
Dolphin Data Lab is one world's leading data recovery tools manufacturer and supplier offering complete data recovery solutions, training courses and tools for people who are going to start a data recovery business, grow data recovery capabilities and set up in-house data recovery center.
The most popular data recovery tools from Dolphin Data Lab are the DFL series tools including:
DFL-SRP All-In-One USB3.0 Data Recovery Equipment
DFL-FRP HDD Firmware Repair Tool
DFL-DE Data Recovery Tool
DFL-DDP Data Recovery Equipment
DFL-URE USB Device Data Recovery Equipment
Dolphin Data Lab has sold its data recovery products to over 90 countries including USA, UK, China, South Korea, France, Germany, Canada, Brazil, India, Japan, Egypt, Chile, Nigeria, Pakistan, Australia, New Zealand, Indonesia, Philippines, Maylasia, Portugal, Italy, Belgium, Poland, Argentina, Cuba, Greece, Spain, Denmark, Sweden, Saudi Arabia, UAE, South Africa, Turkey, Dubai, Palestine, Iran, etc. Dolphin Data Lab has gained a lot of happy users and reputation among them.
External Links
Dolphin Data Lab Official Website
Dolphin Data Lab Facebook
Dolphin Data Lab Twitter
Federal bureau of investigation -
The Federal Bureau of Investigation (or FBI) is a US government agency responsible the primary role in investigation of federal crimes except for those crimes allocated to other agencies.
Disambiguation on the FBI
Relevant to computer forensics are the current Primary National Priorities include Counterintelligence, Counterterrorism and Cyber Crime FBI role in Cyber Crime.
Ongoing missions include Public Corruption, Civil rights, White Collar Crime, Organized Crime, and Major thefts and Violent Crime.
FBI and Cyber Crime
The FBI investigates computer intrusions (bots, malware, etc), predators, piracy and intellectual property theft, and internet fraud.
Key Cases relevant to FBI and CyberCrime
The Titan Rain attacks provides insight both into Chinese attacks on US companies and the limits of legal risks taken by non Law Enforcement persons in collecting data on foreign attackersTitan Rain
Russian Attacks Moonlight Maze
How to report cyber crime
Do file an online report at the FBI's IC3 Internet Crime Complaint Center
Do not break wiretapping, pen register or trap and trace laws (which restrict this to Law Enforcement).
Forensic Evidence
Carnivore and the Collection of Internet Data Carnivore
Limitations on the FBI and collection of Computer Forensic Evidence
The FBI is limited by specific laws including the US Patriot Act,Communications Assistance for Law Enforcement Act (CALEA), and the Foreign Intelligence Surveillance Act of 1978 or FISA (USC 50).
Books
Diffie and Landau : Privacy on the Line (2007) MIT Press
Defense cyber crime institute -
The Defense Cyber Crime Institute, or DCCI, is the Research and Development section of the Defense Cyber Crime Center based in Linthicum, Maryland. They not only develop new tools, but also rigorously test existing tools to make sure they meet the standards for DoD investigations. The DCCI consists of four branches:
Research, Development, Testing & Evaluation - Develops new tools and tests exitsing ones.
Analysis and Assessment
Plans and Policy
DCCI Reports
Reports generated by the DC3 are available to US government agencies and law enforcement organizations. Members of these agencies can request copies at any time. Vendors can request that the DCCI evaluate their products too.
DCCI Dispatch
The DCCI dispatch is a post-only mailing list, updated once a day, with news stories relating to computer crime investigations, the Department of Defense and the U.S. Government.
External Links
Official website
Forensicsoft -
ForensicSoft Inc ForensicSoft's System Acquisition Forensic Environment (SAFE) products use innovative thinking to bring the speed, reliability, and convenience of software write blocking to the protection of digital evidence. Their products include:
SAFE Boot Disk, The first and only commercially available forensically sound windows boot disk
SAFE Block XP, A Windows XP software write blocker which replaces the need for hardware write blocker.
Trivia
ForensicSoft's System Acquisition Forensic Environment (SAFE) is the first and only commercially available Windows boot disk and incorporates built in NTFS support, driver availability, and built in write blocking.
External Links
Official Website