hemu1438/forensicsgpt-training-data huggingface dataset:
Kernel for password unmask -
Kernel Password Unmask is a password recovery freeware to reveal hidden passwords contained in the standard password-text-box of any Windows application or program. The software has advanced programming algorithms to quickly and accurately unmask the password characters, concealed behind the asterisks symbols of the provided application.
Overview
Kernel Password Unmask is a free utility to view hidden password of the currently-opened window of any FTP client software like FlashFXP, CuteFTP, SmartFTP etc. It can be a helpful utility to retrieve missing, misplaced or forgotten passwords of different FTP accounts, without being affected from various factors like length and complexity incorporated by the passwords.
Kernel Password Unmask is one of the many free tools developed by Kernel Data Recovery, which is offered in the specified category of Kernel Free Tools.
Interface
The program is easy to download and use. It involves only a single step to unmask the password of the desired password screen, upon the successful installation. The freeware requires no necessary set of technical skills for the users to operate the tool.
Features
Suitable for multiple FTP Clients
Kernel Password Unmask is an independent software to unveil the unmasked password of open password window from any selected FTP clients including CuteFTP, FlashFXP, SmartFTP etc. The password is displayed conveniently in the password window of the selected application or program.
Windows-compatible program
The software is exclusively developed to work with Windows-supported operating systems. It supports all the modern versions of the Windows platform including Windows 8.1, 8, 7, Vista, XP, 2000, 98, NT, and 95.
Licensing
The freeware is accessible for free download and public use. Refer the official website to get more information related to Licensing.
External Links
Official Website
Full volume encryption -
Full Volume Encryption, or FVE, is a method for encrypting a single partition, either physical or virtual, on a hard drive. It is different than Full Disk Encryption as parts of the disk are left unencrypted.
Implementations
BitLocker Included with certain versions of Microsoft Windows as of Vista.
FileVault Disk Encryption Included with certain versions of Apple Mac OS X.
FreeOTFE A free and open source FVE program for Microsoft Windows and Windows Mobile PDAs.
TrueCrypt A free and open source FVE program for Microsoft Windows.
Appledouble header file -
A separate file in a filesystem containing the Apple resource fork for a related data file, developed by Apple for A/UX and therefore compatible with other filesystems including those mounted remotely. They are heavily used under Mac OS X.
This file is named the same as the data file, with "._" prepended to the original name. These header files are automatically included in ZIP files under a hierarchy starting with "__MACOSX" when utilizing the Finder's "Archive as..." function.
References
http://bitsavers.org/pdf/apple/mac/a_ux/aux_2.0/030-0787-A_AUX_Toolbox_Macintosh_ROM_Interface_1990.pdf from "A/UX Toolbox: Macintosh ROM Interface manual", Chapter 6 File Systems and File Formats
identifies the magic number 0x00051607 for AppleDouble files as the first 4 bytes in the file
https://en.wikipedia.org/wiki/AppleSingle_and_AppleDouble_formats background and additional information
https://www.ietf.org/rfc/rfc1740.txt MIME Encapsulation of Macintosh files - MacMIME
Kernel for pst add -
Kernel for PST ADD is a freeware developed under Kernel Data recovery tools that enables addition of multiple PST files or single PST file to MS Outlook application in a single click. The tool ensures complete file exportation by maintaining its integrity throughout the process.
Overvuiew
Kernel for PSTADD is a free tool that facilitates user with option to add more than one PST file to existing MS Outlook application running on the system. It enable user to fetch PST files of different Outlook profiles at one place and allows user to manage them efficiently. User can add or remove PST files from the organized list and carryout the PST addition process as per requirement. The software can be operated with minimum technical efficiency as it offers a user-friendly platform.
Features
Kernel for PST ADD is user centric application with simple and understanding features. It provides a trouble free procedure to complete the PST addition task. It is compatible with all the versions of MS Outlook including the latest version 2013 and with all the versions of Windows OS from Windows 85 to Windows 8.1.
Integrity Maintainer
The software maintains the integrity and original structural format of the data carried by PST files, throughout the PST file addition procedure. The software developers triggered the security feature of the software while developing it to provide 100% satisfactory results to the users.
Error prevention
The software provides an error free PST file addition process by preventing the files from various corruption issues like malicious software affect, virus attack, fluctuating power backup etc. The software ensures that the files remain unaffected by any means of damage.
Freeware
The software is available under free tools category of Kernel Data Recovery. It can be downloaded and utilized free without any extra hidden cost.
Licensing
Information related to the license of the software can be studied in detail from the software’s official website.
Support
Kernel for PST ADD is a free tool with lifetime validity and free updates. User can get free technical assistance via phone, live chat or email at any time, before and after download.
External Links
Official Website
Eraser -
Eraser is a Windows tool that allows you to securely remove files from your computers hard drive and securely wipe free space so as to remove the residual data of previously deleted files by overwriting with specially selected wiping paterns.
Eraser currently works with Windows 95, 98, ME, NT, 2000, XP, Windows 2003 Server and DOS and supports FAT and NTFS formatted IDE/SATA/SCSI hard drives. Support for Vista was introduced in 5.83beta.
The software supports the scheduled wiping of files via its Scheduler console as well as on demand file wiping which can be done via an Explorer context menu or dragging files to the Eraser application. It can attempt to wipe locked files (e.g. index.dat files) after the next reboot by forcing a wipe before Windows takes control again.
Methodology
Eraser overwrites the filename for each deleted file with zeros up to the maximum filename length.
Supported wiping patterns include
Erase File Erase Free Space 
Gutmann	Gutmann	
US DoD 5220.22-M (8-306 /E, C and E)	US DoD 5220.22-M (8-306 /E, C and E)	
US DoD 5220.22-M (8-306 /E)	US DoD 5220.22-M (8-306 /E)	
Pseudorandom Data	Pseudorandom Data	
First and Last 2kb	-	
Schneier's 7 Pass	Schneier's 7 Pass	
Eraser was originally developed by Sami Tolvanen and now maintained by Garrett Trant of Heidi Computers Ltd.
External Links
Official website
Libwrc -
The libwrc package contains a library and applications to read the Windows Resource Compiler (WRC) format.
This format is used in the .rsrc section of PE/COFF executables.
Tools
The libwrc package contains the following tools:
wrcinfo, which shows information about Resources in PE/COFF executable files.
History
Libwrc was created by Joachim Metz in 2011 as part of libevt and libevtx to read the Event Log message strings from resource DLL files.
External Links
Project site
Gbde -
GBDE or GEOM Based Disk Encryption is a FreeBSD block device-layer disk encryption that uses 128-bit AES designed and implemented by Poul-Henning Kamp and Network Associates Inc.
A more efficient implementation of FreeBSD GEOM based Disk Encryption. GELI was later written later by Pawel Jakub Dawidek.
External Links
FreeBSD official website
GBDE - GEOM Based Disk Encryption, by Poul-Henning Kamp
man page: gbde(8)
Wikipedia: GBDE
Kernel yahoo archive reader -
Kernel Yahoo Archive reader is an instant message decoder developed by Kernel Data Recovery that retrieves conversation logs and contact list lost due to uninstallation of the Yahoo messenger from the computer system. The tool extracts the complete information from the Yahoo archive directory that is stored by default on user’s computer hard disk.
Features
Kernel Yahoo Archive Reader offers intuitive options to access and restore Yahoo messenger’ archive messages and chat logs swiftly. It is compatible with all the major versions of Yahoo messenger.
Flexible Instant message decoder
The software decodes chat conversations, archive SMS and other activities accumulated in the Yahoo Archive directory without requiring any login information such as username, email id or password in the absence of internet connection. In addition, it offers two different modes to read the archives. User can read either all Yahoo messenger conversation from Yahoo Archive directory or can view specific archives using .dat files.
Reads External Archives
Kernel Yahoo Archive reader provides facility to import external Archives and extract required information from them. Archives can be imported from a portable device, mobile phone or any remote device.
Facilitates Archive restoration
After decoding and reading the Yahoo messenger conversations, user can even restore them in HTML format with this software. In specific situations user need to extract information and save them for future purposes, this software fulfills such intentions splendidly.
Monitors activities
From monitoring point of view, user can install this software to keep a check on other people’s conversation such as an employer can extract employee’s conversation archives. Even SMS sent from Yahoo messenger can be tracked with this software.
Licensing
Read the licensing information regarding the software in detail from the Official website of Kernel Yahoo Archive reader.
Support
With every license of Kernel Yahoo Archive reader, user gets lifetime free technical assistance to resolve any kind of issues at any time. A software manual is embedded in the help section of the software for user’s feasibility. For any kind of queries can reach the technical team via phone, email or live chat.
External Links
Official Website
Logfile analysis -
Log files are used to maintain a record of activities, e.g. activities of the operating system, certain applications, etc.
Log files come in various formats, in general these formats can be divided in the following categories:
Binary formats
Text-based formats
in-database
Binary formats
Windows Event Log (evt)
Windows XML Event Log (evtx)
Text-based formats
Apache HTTP Server access log format
Tools
Windows
Log Parser 2.2
From Microsoft, claims to parse a variety of log files, including XML and CSV, as well as Windows Event Log, Registry, and Active Directory
Also see: Microsoft Log Parser Toolkit, by Gabriele Giuseppini, Mark Burnett, ISBN: 1-93226-652-6
Logpresso Mini
From Logpresso, claims to parse a variety of log files, including CSV, JSON, XML, CEF, LEEF, and WELF, as well as Windows Event Log, Registry
Web Logfile Analytics
Web logfile analytics software can process a log file and print a report. Normally this software is used by organizations that host the website. It can also be used for analysis of webserver logfiles.
phpMyVisites
New "clicks heatmap" shows where people are clicking on your website; depends on JavaScript. (on the other hand, doesn't need access to your logfiles)
AWStats
"Free powerful and featureful tool that generates advanced web, streaming, ftp or mail server statistics, graphically."
JasperReports
Java reporting tool.
Open Web Analytics
"An open source web analytics framework written in PHP."
Breadboard BI Web Analytics
"Uses open source tools to collect and distribute web analytics data."
Libesedb -
The libesedb package contains a library and tools to read the Extensible Storage Engine (ESE) Database File (edb) format.
Tools
The libesedb package contains the following tools:
esedbexport, which exports the items stored in ESE database files.
esedbinfo, which shows the information about ESE database files.
History
Libesedb was created by Joachim Metz in 2009, while working for Hoffmann Investigations.
See Also
Extensible Storage Engine (ESE) Database File (EDB) format
External Links
Project site
Libvslvm -
The libvslvm package contains a library and applications to read Linux Logical Volume Manager (lvm) volumes.
Tools
The libvslvm package contains the following tools:
vslvminfo, which shows information about a Linux Logical Volume Manager (LVM) volume system.
vslvmmount, which FUSE mounts a Linux Logical Volume Manager (LVM) volume system.
History
Libvslvm was created by Joachim Metz in 2014.
External Links
Project site
Building libvslvm and tools from source
Mounting a Linux Logical Volume Manager (LVM) volume system
Linux unified key setup (luks) -
Linux Unified Key Setup (LUKS) is commonly used by Linux to encrypt storage media volumes. LUKS is implemented in the Linux kernel in dm-crypt (dm = Device Mapper) and the user-space component cryptsetup.
LUKS supports various encryption methods, like:
Alleged RC4 (arc4)
AES
Anubis
BlowFish
Cast5
Cast6
Serpent
Tnepres a reversed variant of Serpent
TwoFish
These encryption methods can be used in various chaining modes and with various initialization vector modes.
How to detect
A LUKS encrypted volume starts with the "LUKS\xba\xbe" signature.
A hexdump of the start of the volume should look similar to:
00000000 4c 55 4b 53 ba be 00 01 61 65 73 00 00 00 00 00 |LUKS....aes.....| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000020 00 00 00 00 00 00 00 00 63 62 63 2d 65 73 73 69 |........cbc-essi| 00000030 76 3a 73 68 61 32 35 36 00 00 00 00 00 00 00 00 |v:sha256........| 00000040 00 00 00 00 00 00 00 00 72 69 70 65 6d 64 31 36 |........ripemd16| 00000050 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |0...............| 
The encryption method in the example is:
aes 
The encryption mode is in the format:
chaining_mode[-initialization_vector_mode[:initialization_vector_options]] 
Which in the example is:
cbc-essiv:sha256 
And the password hashing method in the example is:
ripemd160 
How to decrypt
sudo cryptsetup luksOpen
Provide the passphrase when prompted. The will be created as a device mapper entry (i.e. /dev/mapper/thename) and this device will expose the filesystem.
sudo cryptsetup luksDump
See the cryptsetup(8) man page for other operations.
External Links
New Methods in Hard Disk Encryption, by Clemens Fruhwirth, July 18, 2005
LUKS On-Disk Format Specification - Version 1.2.3, by Clemens Fruhwirth, October 16, 2011
LUKS Disk Encryption format specification, by the libluksde project, July 2013
Practical malleability attack against CBC-Encrypted LUKS partitions, by Jakob Lell, December 22, 2013
Seqbox -
SeqBox (SBX) is a single file container/archive that can be reconstructed even after total loss of file system structures.
An SBX container is composed of a collections of blocks with size sub/equal to that of a sector, so they can survive any level of fragmentation. Each block have a minimal header that include a unique file identifier, block sequence number, checksum, version. Additional, non critical info/metadata are contained in block 0 (like name, file size, crypto-hash, other attributes, etc.).
If disaster strikes, recovery can be performed simply scanning a volume/image, reading sector sized slices and checking blocks signatures and then CRCs to detect valid SBX blocks. Then the blocks can be grouped by UIDs, sorted by sequence number and reassembled to form the original SeqBox containers.
Tech spec
Byte order: Big Endian
pos to pos size desc 
0	2	3	Recoverable Block signature = ‘SBx’	
3	3	1	Version byte (1)	
4	5	2	CRC-16-CCITT of the rest of the block (Version is used as starting value)	
6	11	6	file UID	
12	15	4	Block sequence number	
Block 0
pos to pos size desc 
16	n	var	encoded metadata	
n+1	blockend	var	padding (0x1a)	
Blocks > 0 & \< last:
pos to pos size desc 
16	blockend	var	data	
=== Blocks == last: ===
pos to pos size desc 
16	n	var	data	
n+1	blockend	var	padding (0x1a)	
Metadata encoding:
Bytes Field 
3	ID	
1	Len	
n	Data	
IDs
ID Desc 
FNM	filename (utf-8)	
SNM	sbx filename (utf-8)	
FSZ	filesize (8 bytes)	
HSH	crypto hash (SHA256, using Multihash protocol)	
External Links
SeqBox GitHub repository with encoder, decoder and recovery tools
SeqBox page at Marco Pontello's Home
Microsoft outlook -
Microsoft Outlook is an email client that also works as a Personal Information Management (PIM) tool. Outlook can be obtained as a part of Microsoft's Office suite. Outlook is most widely used by the organizations, corporate professionals and other corporations in union with Microsoft Exchange Server and Microsoft SharePoint Server. Outlook is embedded with various attributes in addition to emailing such as calendar, task manager, contact archive, notes and journals.
Features
Outlook 2013 was released on January 2013. The features embedded in Outlook 2013 include: -
Attachment Reminder. Outlook 2013 notifies the user about the availability of attachment before any email is sent; thus, allowing the user to insert attachments if required. The attachment reminder can also be turned off.
Exchange ActiveSync (EAS). The EAS protocol now allows Outlook to work in synchronization with emailing services such as Outlook.com.
Add-in Resiliency. To enhance its performance and resiliency; Outlook, now automatically turns off any sort of malicious add – in. These add–ins, if required, can be re – enabled manually.
Cached Exchange Mode Improvements. Outlook 2013 now executes the caching of email messages from the past 12 months only. Any email message older than last 12 months is automatically dropped from the local cache folder. The Exchange Fast Access attribute now promises enhanced performance, even if, the user is accessing the application in offline mode.
IMAP Improvements. The IMAP networks operations are now carried out in the background of Outlook 2013. This feature replaces the foreground operations in previous versions. The access to the IMAP emails is now enhanced in the similar manner as experienced while viewing in cached mode.
Outlook .ost File Compression. The new format of Outlook Data File OST (.ost) that is created now is approximately 40% smaller; in comparison to those that were created in the previous versions of Microsoft Outlook.
People Hub. Introduced as the new default view for contacts in Outlook 2013; it can also store the contacts from the social networks.
Performance Improvements. The Microsoft Outlook 2013 is committed to provide boosted and improved performance in comparison to the previous versions.
See Also
Microsoft Office
Personal Folder File (PAB, PST, OST)
External Links
Personal Folder File (PFF) forensics - Analyzing the horrible reference file format, by Joachim Metz, March 11, 2009
E-mail and appointment falsification analysis - Analysis of e-mail and appointment falsification on Microsoft Outlook/Exchange, by Joachim Metz, August 17, 2009
Libevt -
The libevt package contains a library and applications to read Windows Event Log (evt) files.
Tools
The libevt package contains the following tools:
evtinfo, which shows information about EVT files.
evtexport, which exports information from EVT files.
History
Libevt was created by Joachim Metz in 2011.
External Links
Project site
How to export the EventLog with full messages from EVT files
Libevtx -
The libevtx package contains a library and applications to read Windows XML Event Log (evtx) files.
Tools
The libevtx package contains the following tools:
evtxinfo, which shows information about EVTX files.
evtxexport, which exports information from EVTX files.
History
Libevtx was created by Joachim Metz in 2011.
External Links
Project site
$mft -
In an NTFS volume the \$MFT metadata file keeps records of all file entries in the volume.
Note that analysis of a stand-alone \$MFT (versus a full file system analysis) has limitations.
\$MFT
The NTFS file system contains a file called the master file table, or MFT. There is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself. All information about a file, including its size, time and date values, permissions, and data content, is stored either in MFT entries, or in space outside the MFT that is described by MFT entries.
The NTFS file system reserves space for the MFT to keep the MFT as contiguous as possible as it grows. The space reserved by the NTFS file system for the MFT in each volume is called the MFT zone. Space for files and directories are also allocated from this space, but only after all of the volume space outside of the MFT zone has been allocated.
The first record of this table describes the master file table itself, followed by an MFT mirror record.
If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror files are recorded in the boot sector.
Structure
The master file table allocates a certain amount of space for each file record. The attributes of a file are written to the allocated space in the MFT. Small files and directories (typically 512 bytes or smaller), can entirely be contained within the master file table record.
MFT Record for a Small File or Directory
This design makes file access very fast. Consider, for example, the FAT file system, which uses a file allocation table to list the names and addresses of each file. FAT directory entries contain an index in the file allocation table.
When you want to view a file, FAT first reads the file allocation table and assures that it exists. Then FAT retrieves the file by searching the chain of allocation units assigned to the file. As soon as you look up the file with NTFS, it's there for you to use.
Directory records are housed within the master file table just like file records. Instead of data, directories contain index information.
Small directory records reside entirely within the MFT structure. Large directories are organized into B-trees, have records with pointers to external clusters containing directory entries that could not be contained within the MFT structure.
Location
The \$MFT file is located under the root of each volume and can be extracted using FTKImager.
Also see
New Technology File System (ntfs)
External Links
Master File Table (Local File Systems), by Microsoft
NTFS Master File Table (MFT), by Ntfs.com
Parsing the \$MFT NTFS metadata file, by Joachim Metz, April 30, 2020
Windows Container Forensics, by Jonathan Greig, July 13, 2021
Tools
analyzeMFT, no longer maintained and has known shortcomings https://github.com/dkovar/analyzeMFT/issues/56
MFTECmd and MFTExplorer
Mft2Csv
MFTDump, no longer maintained
mft2bodyfile