hemu1438/forensicsgpt-training-data huggingface dataset:
Belkasoft -
About Belkasoft
Belkasoft is a digital forensic software manufacturer since 2002. The company develops a range of forensic products aimed at law enforcement officials, investigators and experts in IT security and intelligence. The company delivers solutions that work right out of the box, without requiring a steep learning curve or any specific skills to operate. Belkasoft is registered within DUNS, SAM, CCR, ORCA and WAWF. 'Belkasoft' is a registered trademark.
Products
The company’s flagship product is Belkasoft Evidence Center, an all-in-one digital forensic solution. Belkasoft Evidence Center makes it easy for an investigator to acquire, search, analyze, store and share digital evidence found inside computer and mobile devices, RAM and cloud. The toolkit will quickly extract digital evidence from multiple sources by analyzing hard drives, drive images, cloud, memory dumps, iOS, Blackberry and Android devices, GrayKey, UFED, OFB, ZIP/TAR, TWRP images, JTAG, and chip-off dumps. Evidence Center X automatically analyzes the data source and lays out the most forensically important artifacts for an investigator to review, examine more closely or add to a report.
Belkasoft Triage is digital forensic and incident response tool developed specifically for a quick analysis of a live computer and making a partial image of important data. The product is designed to assist in situations when an investigator or a first responder is at the scene of incident and needs to quickly identify and obtain specific digital evidence stored on a Windows machine.
Belkasoft Remote Acquisition is a digital forensic and incident response tool developed specifically for forensically sound remote acquisition and extraction.
In addition to commercial products, Belkasoft offers a range of free forensic tools.
Belkasoft Live RAM Capturer is a tiny free forensic tool to reliably extract the entire content of the computer's volatile memory - even if protected by an active anti-debugging or anti-dumping system. Separate 32-bit and 64-bit builds are available in order to minimize the tool's footprint as much as possible. Memory dumps captured with Belkasoft Live RAM Capturer can be analyzed with any forensic tool including Live RAM Analysis in Belkasoft Evidence Center.
Belkasoft Evidence Reader enables Evidence Center users to share evidence collected with the main suite. Users of Evidence Reader can access evidence collected during an investigation from any computer, even if Belkasoft Evidence Center is not installed on that PC.
Customer Base
Belkasoft customers include government and private organizations in more than 130 countries, including the FBI, US Army, DHS, police departments in Germany, Norway, Australia and New Zealand, PricewaterhouseCoopers, and Ernst & Young.
External Links
Official website
Tln -
TLN is a timeline format (as far known) introduced in a blog post by Harlan Carvey.
He specifies the following 5 | separated fields:
Time|Source|Host|User|Description 
Time - 32-bit POSIX (or Unix) epoch timestamp
It is unclear if negative timestamps are supported or how values that overflow the 32-bit should be represented.
Since the author has been, so far, unable provide the actual representation this field it is assumed to be a (decimal) numeric string of the number of seconds since Jan 1, 1970 00:00:00 (both positive and negative) in an externally defined time zone. This would make it equivalent to that of the (Linux) date command e.g.
date -u -d@0 Thu Jan 1 00:00:00 UTC 1970 date -u -d@$(( 1 << 31 )) Tue Jan 19 03:14:08 UTC 2038 date -u -d@$(( -1 * ( 1 << 31 ) )) Fri Dec 13 20:45:52 UTC 1901 
Note that the 32-bit size of the value is only an artificial limitation and modern versions of (Linux) date have support for signed 64-bit values.
Source - fixed-length field for the source of the data (i.e., file system, Registry, EVT/EVTX file, AV or application log file, etc.) and may require a key or legend.
According to the author the field is approx 8 char in length.
Host - The host system, defined by IP or MAC address, NetBIOS or DNS name, etc. (may also require a key or legend)
User - User, defined by user name, SID, email address, IM screenname, etc. (may also require a key or legend)
Description - The description of what happened; this is where context comes in...
In addition the Description field seems to be allowed to be overloaded with ; separated values. An example from the same blog post:
1123619888|EVT|PETER|S-1-5-18|Userenv/1517;EVENTLOG_WARNING_TYPE;PETER\Harlan 
Where it looks like the separated fields in the Description are not pre-defined.
Variants
Known variants of TLN are:
l2tTLN (log2timeline TLN); which extends the format with a TZ (time zone) and Notes field.
Known issues
it is unclear if | (the pipe-character) can be used in the fields, currently it assumed that it is not
date and time values do not indicate a time zone or if daylight savings applies
date and time values are in second-only granularity and therefore limit the usefulness of the format for timelines with a vast amount of sub-second activity
As far known there is no list of predefined common sources. The author indicates there is none but there might be an implicit one in the tools by the same author.
External Links
TimeLine Analysis, pt III, by Harlan Carvey, February 28, 2009
Timeline Analysis...do we need a standard?, by Harlan Carvey, February 08, 2010
Deepsound -
Overview
DeepSound is a Windows specific steganography tool that can hide data into and also extract data from audio files.
Description and Review
Similar to hiding data in images, DeepSound allows the user to encode files into audio files. These audio files can even be burned to a CD (DeepSound cannot burn the actual CD). Thus files can be hid in an audio CD and unless it is known to contain data, no one would know to check it. DeepSound can also reverse this process, and upon opening the correct track, it will prompt the user for a passphrase. This will then reveal the concealed data. DeepSound has the ability to use AES 256 bit encryption.
External Links
Official Site
See Also
Steganography
Hacking bootcamp exploits and live incident investigation -
Hacking BootCamp: Exploits and Live Incident Investigation
WetStone has engineered a three-day interactive lab environment that allows each student to experience real investigative scenarios in a cyber safe environment. WetStone’s multi-pronged approach to this bootcamp allows each student to utilize the latest tools and technologies used by today’s criminals, and to practice the requisite live approach to investigation. This learning environment is the most effective approach to acquiring deep knowledge regarding both the latest threats and to practice in live investigation techniques and methodologies.
Classroom Environment
WetStone has created a unique virtualized cyber-safe environment where investigator and IT professionals can use and experiment with some of the best ...
* Botnet * Rootkit * Wireless Cracking * Live Triage * Memory Analysis * Live Triage * Memory Analysis * Log Analysis * Process Port Linkage
Our trainers take you inside the minds of today’s criminals and students completeing the class will be able to execute a full investigation in the respective discipline. Participants proficiency in the above skills will be tested with certification exams.
Contact Information:
1-877-WETSTONE ext. 2
www.wetstonetech.com
Introduction to steganography -
Introduction to Steganography: Steganography and Data Exfiltration
This virtual one-day class will introduce you to the latest methods,techniques and threats posed by steganography. Students will learn how steganography has evolved, where it is going and how it is being used by criminals and terrorist organizations. Learn about the latest techniques to detect, shunt, disrupt and destroy steganography communications. Identify those using steganography and stop the leak of vital information from your organization.
Steganography is Global Threat!
Steganography is capable of concealing the mere existence of incriminating information and/or covert communications. Steganography weapons are easy to use, and are readily available to our adversaries.
When Steganogpraphy is used in conjunction with the internet, it becomes a globally effective tool for command control communication and intelligence.
Criminals are armed with the ability to:
* Conceal incriminating information * Covertly communicate with accomplices * Innocuously share large amounts of potentially dangerous information
Who Should Attend?
* Forensic Investigators * Local, state and federal law enforcement * Private investigators * IT security professionals * Security auditors
Our trainers take you inside the minds of today’s criminals and students completeing the class will be able to execute a full investigation in the respective discipline. Participants proficiency in the above skills will be tested with certification exams.
Contact Information:
1-877-WETSTONE ext 2
www.wetstonetech.com
The art of keylogging -
The Art of Keylogging
WetStone has created a unique virtualized cyber-safe environment where investigators and information technology professionals can experiment with key logging technologies, including both software based and hardware based. Beyond the offensive use of these tools, investigators will discover how to investigate keyloggers with varied sophistication levels. To truly get into the mind of a cyber criminal an investigator must know what they are looking for, and then deeply understand how the tools they uncover work. Establishing this can mean the difference between pulling the plug on a memory resident keyloggers, and losing all traces of evidence, or uncovering the activity needed for prosecution.
Is Someone Looking Over Your Shoulder?
Desktops without keyboards, and laptops without keys are like baseball without a bat. It is impossible to take away keyboards from computers and still be efficient and functional. The question that then surfaces is, how do we secure them? Keyboards are under attack from software and hardware based tools designed to steal the content typed on the keys. Whether infected at home or at work, keyloggers are responsible for massive amounts of identity theft and corporate leakage of data.
Who Should Attend?
* Forensic Investigators * Local, state and federal law enforcement * Private investigators * IT security professionals * Security auditors
Our trainers take you inside the minds of today’s criminals and students completeing the class will be able to execute a full investigation in the respective discipline. Participants proficiency in the above skills will be tested with certification exams.
Contact Information:
1-877-WETSTONE ext 2
www.wetstonetech.com
Logical disk manager (ldm) -
The Windows Logical Disk Manager, is commonly abbreviated to LDM.
On-disk structures
According to TECHNET:
The location of the database is determined by the partition style of the disk.
On MBR disks, the database is contained in the last 1 megabyte (MB) of the disk.
On GPT disks, the database is contained in a 1-MB reserved (hidden) partition known as the Logical Disk Manager (LDM) Metadata partition.
Types of dynamic volumes
Simple volume
Spanned volume
Striped volume
Mirrored volume (Server editions of Windows 2000, Windows 2003)
RAID-5 volume (Server editions of Windows 2003)
Also see
File Systems
External Links
Basic and Dynamic Disks, by Microsoft
What Are Dynamic Disks and Volumes?, by Microsoft, March 2003
Dynamic disks and volumes, by Microsoft, January 2005
Logical Disk Manager documentation
Opensavepidlmru -
The OpenSaveMRU Windows registry key was renamed starting in Windows Vista to OpenSavePidlMRU
Notable Changes from Windows XP
The * sub-key of OpenSavePidlMRU was extended to track the last twenty files opened or saved of any type via the Windows Common Dialog 2.
Value data is stored as binary (REG_BINARY) and was previously stored as a string value (REG_SZ) in OpenSaveMRU.
Windows application compatibility -
sysmain.sdb
System compatibility database.
RecentFileCache.bcf
In Windows 7 the RecentFileCache.bcf file is stored in:
C:\Windows\AppCompat\Programs\ 
Amcache.hve
See: AMCache
AppCompatCache
In Windows 2000 and XP:
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility 
In Windows 2003 and later:
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache 
External Links
Demystifying Shims - or - Using the App Compat Toolkit to make your old stuff work with your new stuff, by Microsoft
Application Compatibility Database, by Microsoft
Secrets of the Application Compatilibity Database (SDB) – Part 1, by Alex Ionescu, May 20, 2007
Secrets of the Application Compatilibity Database (SDB) – Part 2, by Alex Ionescu, May 21, 2007
Secrets of the Application Compatilibity Database (SDB) – Part 3, by Alex Ionescu, May 26, 2007
Leveraging the Application Compatibility Cache in Forensic Investigations by Andrew Davis, May 4, 2012
Revealing Program Compatibility Assistant HKCU AppCompatFlags Registry Keys, by Corey Harrell, December 17, 2013
Persist It Using and Abusing Microsoft’s Fix It Patches, by Jon Erickson, BlackHat Asia 2014
To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence
RecentFileCache
Revealing the RecentFileCache.bcf File, by Corey Harrell, December 2, 2013
Triaging with the RecentFileCache.bcf File, by Corey Harrell, April 21, 2014
Md5sum -
This MD5 hashing tool, part of the GNU Coreutils suite, has been a standard in the computer forensics community for some time. It is intended for *nix systems, but has been ported to the Windows platform. It should be noted that the program has options to read files in "binary" or "text" mode, which can produce different hashes. The text mode is the default on most platforms, which is different from other hashing utilities such as md5deep.
To use this tool in binary mode on Linux systems you would use the command:
md5sum -b [filename|volume]
e.g.
md5sum -b /dev/sda
or
md5sum -b file.dd
External Links
Official website for GNU Coreutils
Wikipedia: md5sum
A slew of ported tools for Windows include md5sum
Epoch -
tags: * Articles that need to be expanded
The phrase Epoch is commonly used to describe the date and time that is represented by the number "0".
The following Epochs are known:
Applications Date and Time Reference 
Microsoft Windows	January 1, 1601 UTC	File Times	
Unix File Systems	January 1, 1970 UTC		
Apple File Systems	January 1, 1904 UTC		
Palm OS	January 1, 1904 UTC
Websites -
Websites about digital forensics and related topics.
Digital Forensics
Bruce Nikkel's Computer Forensics Homepage
Presentations, links, references
Certfied Computer Examiner Website
Open certification process for digital forensics.
Computer Forensics and Investigations
Computer Forensics articles, and website of Igor Michailov
Computer Forensics Tool Catalog
The Computer Forensics Tool Catalog provides an easily searchable catalog of forensic tools to enable practitioners to find tools that meet their specific technical needs.
Computer Forensics Tool Testing (CFTT) project
The Computer Forensic Tool Testing (CFTT) project establishes methodologies for testing computer forensic tools by development of general tool specifications, test procedures, test criteria, test sets, and test hardware.
Computer Forensics World
Website with online discussion forums relating to computer forensics.
Cyberspeak podcast
Computer forensics, network security, and computer crime podcast.
Digital Forensic Research Workshop (DFRWS)
Open forum for research in digital forensic issues, hosting annual meeting and annual forensics challenge.
eForensics Magazine
Magazine, blog, online courses, community.
Belgian Computer Forensic Website - Forensic Boot CD - Linux
Forensic Focus
News, blog, forums, and other resources for folks engaged in or interested in digital forensics.
NIST: Secure Hashing
The Computer Security Division's (CSD) Security Technology Group (STG) is involved in the development, maintenance, and promotion of a number of standards and guidance that cover a wide range of cryptographic technology.
National Software Reference Library (NSRL)
The National Software Reference Library (NSRL) collects software from various sources and incorporates file profiles computed from this software into a Reference Data Set (RDS) of information.
University of Rhode Island Digital Forensics Center 
Computer Forensics Lab Resource Site.
Non-Digital Forensics
NIST Image Group
Many reports, including the NIST report on AFIS fingerprint testing.