hemu1438/forensicsgpt-training-data huggingface dataset:
Hard drive data recovery -
Hard Drive Data Recovery application is a commercial application programmed to repair and restore data lost from a Windows hard drive partition.
Features
Recovery of lost, deleted, formatted and corrupt data files from a Windows hard drive partition is offered by the tool. Data recovery from NTFS and FAT partitions supported in cases of corruption and formatting of media files, documents, databases, backups, etc., along with permanently deleted data.
Note: Permanently deleted data recovery can only be performed if data has not been overwritten.
External Links
Official Website
Forensic explorer -
Forensic Explorer (FEX) is a commercial forensic software package distributed by GetData Forensics.
Features
Forensic Explorer (FEX) can parse FAT, NTFS, HFS and EXT filesystems. It can use image files created by AFF, DD, EnCase, NUIX, Safeback, SMART and XWAYS.
FEX includes modules for Keyword search, Drive indexing (using dtSearch, Registry analysis, Email analysis, Bookmarking, Reporting, and Scripting.
Virtual Forensics
FEX includes Mount Image Pro (MIP) and together these products are used to boot and analyze forensic images of Windows files systems under VMWare.
External Links
Official Website
Bkf viewer -
BKF Viewer is a freeware program built to scan and open Windows backup files for viewing content within
Features
The application comes under the freeware category and offers scanning and preview of Windows backup data. Moreover, the algorithms integrated in the tool makes it consistently work with both healthy as well as corrupt Windows .bkf files via quick and deep scan option respectively.
Note: Kindly note that the application is supporting Windows XP.
External Links
Official Website
Livediscover -
LiveDiscover™ Forensic Edition
LiveDiscover Forensic Edition (FE) is the premier tool for rapid full distributed network assessment and mapping, which is a critical first step in any digital investigation. Designed for forensic investigators, LiveDiscover FE rapidly scans a range of IP addresses and generates comprehensive forensic reports including easy to view graphs on each located device within the specified network. With the case management features, investigators can tailor reports and case details,making evidence court ready. Built-in customization allows for the creation of modified vulnerability scripts making LiveDiscover FE field extensible.
Key Features:
Live forensic network discovery, Live forensic vulnerability assessment, Automatically identify operating systems including Windows, Unix, Linux, Mac, VMS, Novell, and Sunsystems, Remote detection of system status including running services, attached devices, and open shares, Forensically map communication devices, printers and more, Forensic detailed report generation
System Recommendations:
Microsoft Windows® 2000, XP, Vista, 20 MB free disk space, 256 MB RAM, Pentium® III 1GHz processor
License:
Single user license, Site licenses are available upon request
Contact Information:
1-877-WETSTONE ext. 2
www.wetstonetech.com
Scalpel -
Scalpel is an open source program for recovering deleted data originally based on foremost, although significantly more efficient. Originally developed by Golden G. Richard III and presented at the DFRWS conference in 2005, it allows an examiner to specify a number of headers and footers to recover filetypes from a piece of media. Scalpel is maintained by Golden G. Richard III and Lodovico Marziale.
Currently, Scalpel is being incorporated into the The Sleuth Kit and is now hosted on GitHub.
External Links
Scalpel: A frugal, high-performance file carver from the Proceedings of the 2005 Digital Forensic Research Workshop
Testdisk -
TestDisk is a free software data recovery utility licensed under the terms of the GNU General Public License (GPL). It was primarily designed to help recover lost data storage partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally erasing a partition table).
Forensics usage of TestDisk and PhotoRec is described on the website.
Summary
TestDisk queries the BIOS or the operating system in order to find the hard disks and their characteristics (LBA size and Cylinder-head-sector geometry). TestDisk does a quick check of your disk's structure and compares it with your Partition Table for entry errors. If the Partition Table has entry errors, TestDisk can repair them.
However, it's up to the user to look over the list of possible partitions found by TestDisk and to select the one(s) which were being used just before the drive failed to boot or the partition(s) were lost. In some cases, especially after initiating a detailed search for lost partitions, TestDisk may show partition data which is simply from the remnants of a partition that had been deleted and overwritten long ago.
TestDisk has features for both novices and experts. For those who know little or nothing about data recovery techniques, TestDisk can be used to collect detailed information about a non-booting drive which can then be sent to a tech for further analysis. Those more familiar with such procedures should find TestDisk a handy tool in performing onsite recovery.
Supported operating systems
DOS;
Microsoft Windows (NT4, 2000, XP, 2003, Vista);
Linux;
FreeBSD, NetBSD, OpenBSD;
SunOS and
Mac OS X
File systems
TestDisk can find lost partitions of the following file systems:
Be File System (BeOS)
BSD disklabel (FreeBSD/OpenBSD/NetBSD
Cramfs, Compressed File System
DOS/Windows FAT 12, 16, and 32
(Classic) HFS, HFS+ and HFSX, Hierarchical File System
IBM Journaled File System 2 (JFS2), IBM's Journaled File System
Linux ext2 and ext3
Linux RAID
RAID 1: mirroring
RAID 4: striped array with parity device
RAID 5: striped array with distributed parity information
RAID 6: striped array with distributed dual redundancy information
Linux Swap (versions 1 and 2)
Linux Logical Volume Manager (LVM and LVM2)
Mac partition map
Novell Storage Services (NSS)
NTFS (Windows NT/2000/XP/2003/Vista/2008)
ReiserFS 3.5, 3.6 and 4
Sun Solaris i386 disklabel
Unix File System: UFS and UFS2 (Sun/BSD/...)
XFS, SGI's Journaled File System
External links
TestDisk Wiki
TestDisk main functions review
Livewire investigator -
LiveWire Investigator™
LiveWire Investigator is the ultimate tool for incident response, vulnerability assessment, compliance audits and criminal investigations. Quickly and inconspicuously examine live running computer systems, providing the ability to assess vulnerabilities, collect evidence directly from suspect computers, and perform enterprise-wide malware scans. LiveWire does not require pre-installed software deployed on target computers. Investigators can now rapidly and easily collect evidence on live running target systems from anywhere in the world (requires credential authentication).
Key Features:
Simultaneous enterprise wide discovery and triage, Physical memory imaging, Application and process state discovery, Windows service discovery, Active port mapping, Windows log discovery and analysis, Remote screenshots, File system blueprinting, Installed software cataloging, High assurance time stamped audit trail, Single User License
System Recommendations:
Microsoft Windows® 2000, XP, Vista, 230 MB free disk space, 1 GB RAM, Pentium® 2 GHz processor or better
Currently Supported Targets:
Microsoft® Windows® NT4
Microsoft® Windows® 2000 Professional
Microsoft® Windows® XP Professional
Microsoft® Windows® Server 2003
Microsoft® Windows® Vista
External Links
Official website
Leveldb format -
LevelDB is an Open Source key-value store database format.
The LevelDB database format is used to store various kinds of application-level information such as the Google Chrome local storage.
A LevelDB database consists of a directory that contains the following files:
[0-9]{6}.ldb (sorted tables file)
[0-9]{6}.log (write ahead log file)
CURRENT (contains the name of the current MANIFEST file)
LOCK
LOG, LOG.old (log with informational messages)
MANIFEST-000001 (information about the sorted tables that make up the database)
MIME types
Currently there are no know mime type for the LevelDB formats .
File signature
Only sorted tables files are known to have an unique signature "\x57\xfb\x80\x8b\x24\x75\x47\xdb" in the last 8 bytes of the file.
File types
LevelDB is known to use several different file formats
log descriptor format, used by MANIFEST-000001
log format, used by [0-9]{6}.log
table format, used by [0-9]{6}.ldb
text, used by CURRENT, LOG, LOG.old
External Links
LevelDB: Files
LevelDB: leveldb File format
LevelDB: leveldb Log format
Wikipedia: LevelDB
Recovering Deleted Data from LevelDB, by Kevin Kwok, December 2, 2015
IndexedDB
Chromium - LevelDB Coding Scheme
How the browsers store IndexedDB data, by Aaron Powell, October 5, 2012
Mac marshal -
Mac Marshal is a tool to analyze Mac OS X file system images. It scans a Macintosh disk image, automatically detects and displays Macintosh and Windows operating systems and virtual machine images, then runs a number of analysis tools on the image to extract Mac OS X-specific forensic evidence written by the OS and common applications.
Mac Marshal Forensic Edition runs on an investigator's workstation to analyze a Mac disk image.
Mac Marshal Field Edition runs on a Mac target machine from a USB drive. It extracts volatile system state data, including a snapshot of physical RAM.
Mac Marshal follows forensic best practices, maintains a detailed log file of all activities it performs, and produces reports in RTF, PDF, and HTML formats.
Version 1.0 was released in January 2009, available at no cost to US law enforcement, with a commercial version available to non-law enforcement. Version 2.0 was released in November 2010, adding live analysis in the Field Edition and the ability to take a snapshot of the target machine's physical RAM. Version 3.0 was released in November 2011 and can run on both Mac OS X and Windows XP and later.
Mac Marshal was developed by ATC-NY, supported in part by the US National Institute of Justice (NIJ). The project was originally named MEGA.
External Links
DFRWS'08 Mac Marshal paper (pdf)
Architecture Technology Corporation
Mailpro -
MailPro+ is a commercial application built to view and export email files of multiple desktop based email clients.
Features
The application is programmed to read and display the email contents of files from 14 different desktop based email clients. The email contents can be viewed in different modes, featured for a distinct purpose each like; Hex view mode for viewing the hexadecimal coding of a particular message. A search option is featured to pick out a particular email and the mails can further be exported out in a different formatting.
Note: No additional application installation for support is required to run the tool. Just ensure that the operating system is Windows based regardless of its version.
External Links
Official Website
Notes storage facility (nsf) -
Lotus Notes and Domino database to store e-mails, appointments, tasks, contacts, notes, etc.
MIME types
application/x-lotus-notes
application/vnd.lotus-notes
File signature
The NSF has the following file signature: hexadecimal: 1a 00 (which is often followed by: 00 04 00 00)
File types
NSF defines an on-disk structure (ODS) version.
16 (Notes 1.x, 2x)
17 (Notes 3.x)
20 (Notes 4.x)
41 (Notes 5.x)
43 (Notes 6, 7 and 8)
48 (Notes 8)
51 (Notes 8.5)
One significant change in the Record Relocation Vector (RRV) seems to be introduced in format revision 22.
Contents
The NSF basically is a collection of Notes. A Note in concept is similar to that of an object or item; mainly a container for data and metadata. Notes are used to store a vast variety of items, e.g. emails, documents, appointments, log-entries, data-views, forms, etc.
Encryption
Notes can use various forms of encryption.
See also
Wikipedia: HCL Domino
Notes Storage Facility (NSF) database file format.pdf, by the libnsfdb project, February 2010
Lotus Notes Forensics
Libcarvpath -
LibCarvPath is a library designed to be used by carving and file system analysis tools. LibCarvPath allows fragments represented by offset and size to be combined in a CarvPath annotation that take the form of file system paths. LibCarvPath addresses the limits of file system paths by mapping extremely fragmented files to a uniquely identifying key in a long-path database.
The following tools use LibCarvPath and/or CarvPath Annotations:
CarvFs
tsk-cp
scalpelcp
Modules for the Open Computer Forensics Architecture that use the OCFA treegraph API.
Next to these, in Photorec work has started to include LibCarvPath support.
External Links
Project site
Paraben cell seizure -
Paraben Cell Seizure is a piece of software that serves the main purpose of collection and examining data pulled from various types of cell phones. It is part of Paraben’s collection of forensics tools.
The main goal of Cell Seizure is to organize and report various types of files. Following the same guidelines as other Paraben products, Cell Seizure is able to generate comprehensive HTML reports of acquired data. Moreover the software is able to retrieve deleted files and check for file integrity.
Advantages
One important advantage that separates Paraben’s Cell Seizure from other similar products is the fact that it is designed not to change the data stored on the SIM card or cell phone. In other words, all of the data can be examined while keeping the process undetected. Most commercial or free software for cell phones is designed do not only view data but to upload data to cell phones. This is not a safe way to perform a forensic evaluation of cell phone data. In fact, even some forensic software warns of possible data loss. Cell Seizure does not allow data to be changed on the phone.
Disadvantages
A disadvantage of Cell Seizure is that it does not support all makes and models of cell phones. As with most mobile device forensics software, Cell Seizure is frequently updated with support for new devices as they proliferate in the consumer market. However, this application can acquire information from most models made by the following companies:
LG
Motorola
Nokia
Samsung
Siemens
Sony-Ericcson
Also can acquire GSM SIM Cards.
Another disadvantage would be that the format of acquired data can sometimes be confusing. The data is not organized nice and neat and given to the user in a way that they can easily understand what they are seeing. It is not the most user-friendly way of displaying the data that has been acquired.
Features
Supports GSM, TDMA, and CDMA cell phones
Acquires text messages, address books, call logs, etc.
Acquires complete GSM SIM card
Recovers deleted data and full flash downloads
Supports multiple languages
Contains comprehensive HTML reporting and other reporting formats
Provides advanced searching including text & hex values
Contains viewers for proprietary media file formats;
Allows viewing of multiple workspaces at one time
External Links
Product website
Dfvfs -
dfVFS, or Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
dfVFS is currently implemented as a Python module.
Supported Formats
The information below is based of version 20230503.
Storage media types
Encase image file format or EWF (EWF-E01, EWF-Ex01, EWF-S01) using libewf
Mac OS disk image using libmod
Sparse bundle disk image
Sparse disk image
Universal Disk Image Format (UDIF) image
Parallels Hard Disk image format version 2 using libphdi
QCOW Image Format or QCOW using libqcow
currently no differential image support
Raw Image Format RAW using libsmraw
Storage media devices using libsmdev
Virtual Disk Image (vdi) or VHD(X) using libvhdi
VMWare Virtual Disk Format (vmdk) using libvmdk
currently no differential image support
Volume systems
Apple Partition Map or APM using The Sleuth Kit and pytsk
Apple File System or APFS container version 2 using libfsapfs
BitLocker Disk Encryption or BDE using libbde
BSD disklabel APM using The Sleuth Kit and pytsk
Core Storage (CS) including FileVault Disk Encryption or FVDE, or FileVault 2 using libfvde
GPT using libvsgpt with fallback to The Sleuth Kit and pytsk
Linux Logical Volume Manager or Linux LVM using libvslvm
At the moment only single physical volume LVM support
Linux Unified Key Setup or LUKS using libluksde
MBR using The Sleuth Kit and pytsk
Windows Shadow Volumes or VSS using libvshadow
File systems
Apple File System or APFS version 2 using libfsapfs
Extended File System (ext) version 2, 3, 4 using libfsext with fallback to The Sleuth Kit and pytsk
FAT-12, FAT-16, FAT-32 and exFAT using The Sleuth Kit and pytsk with fallback to libfsfat
HFS+, HFSX using libfshfs with fallback to The Sleuth Kit and pytsk
ISO-9660 version 1 using The Sleuth Kit and pytsk
New Technology File System or NTFS version 3 using libfsntfs with fallback to The Sleuth Kit and pytsk
Unix File System or UFS version 1, 2 using The Sleuth Kit and pytsk
XFS version 4, 5 using libfsxfs
History
dfVFS originates from Plaso. It was largely rewritten and made into a stand-alone project to provide more flexibility and allow other projects to make use of the VFS functionality. dfVFS originally was named PyVFS, but that name conflicted with another project.
See Also
dfWinReg
Plaso
External Links
Project site
Project documentation
Developing Python code using dfVFS
Paraben device seizure -
Paraben's Device Seizure is a handheld forensics tool that provides deleted data recovery, full data dumps of certain cell phone models, logical and physical acquisitions of PDAs, data cable access, and advanced reporting. The amount and quality of data you can get from a full physical acquisition surpasses the information you can get from a simple logical acquisition. Device Seizure does not change data on the device.
Note: Accessing phones via IrDA and Bluetooth should only be used when other data connections are not available due to the insecure nature of these communication methods.
Supported Cell Phone Manufacturers
LG
Motorola - Including iDen
Nokia
Siemens
Samsung
Sony-Ericsson
Paraben's Device Seizure supports PDAs with the following Operating Systems:
Palm through 5.4
Windows CE/Pocket PC/Mobile 5.0 and earlier
BlackBerry 4.x and earlier
Symbian 6.0, 6.1, 7.X, 8.X, & 9.X
EPOC 16/32 (Psion devices)
Paraben's Device Seizure supports GSM SIM cards with use of a SIM card reader (which can be found in Device Seizure Toolbox).
Paraben's Device Seizure also supports the following types of GPS Devices with more manufacturers to follow:
Garmin
External links
Product website
Omnipeek -
The OmniPeek Distributed Analysis Suite is a set of tools by WildPackets to collect and analyze network traffic. Designed to process large amounts of data, the tools provide a number of mechanisms to search and identify items of interest. These features include frame decoding, on-the-fly capture filters, filters to identify related items, aliases, multiple simulatenous capture windows, and more. Captured data can be stored in a MySQL database if desired.
The suite contains an API for automation and analysis.
Other features are designed to be compliant with United States legal frameworks such as Sarbanes Oxley and HIPAA.
External Links
Official website
ProDiscovery -
This tool from Tech Pathways will gather data from most major file systems and perform some analysis.
Features
File Systems Understood
FAT12, FAT16, FAT32
NTFS
Solaris UFS
Linux ext2/ext3
File Search Facilities
Uses a set of Perl scrypts.
Historical Reconstruction
Can it build timelines and search by creation date?
Searching Abilities
Can it search? Does it build an index? Can it focus on file types or particular kinds of metadata?
Hash Databases
Can it create hashes of files and/or blocks? Can it compare these hash values to any databases? What sort of hash functions does it use?
Evidence Collection Features
Generates an XML-based report about the analysis.
History
License Notes
Commercial.
"Each single end-user license purchased of ProDiscover® entitles a single user the right to use the ProDiscover® software. Copies of ProDiscover® may be installed on up to three machines provided, however, that only one copy is in use at any given time. ProDiscover® installations may also be moved as needed. See the ProDiscover® End-User License Agreement for details. Site and Enterprise licenses are also available for ProDiscover®."
External Links
website
Pyflag -
PyFlag is a web-based, database-backed forensic and log analysis GUI and Computer forensics framework written in Python. PyFlag stores disk images in numerous file formats, including raw, sgzip, AFF, and EnCase format.
Features
Suppoprted File Systems
PyFlag uses the The Sleuth Kit for file system support.
File Search Facilities
Lists allocated and unallocated files.
Sorts files by type.
Searches for keywords.
Works with compressed zip files.
Historical Reconstruction
Can it build timelines and search by creation date?
Creates a "case file".
Searching Abilities
Searches for keywords.
Builds an index.
Hash Databases
Hashes and compares with Hashkeeper using MD5.
Evidence Collection Features
History
Originally started by the Australian Department of Defence and was open sourced
External Links
Github: Pyflags
https://code.google.com/archive/p/pyflag
https://sourceforge.net/projects/pyflag/
Snorkel -
Snorkel is a Java software library that is used by developers of forensic software. Snorkel is not a standalone forensic application, but it is an important piece of infrastructure that can be used by many forensic applications: Snorkel gives access to digital evidence files, file systems, files, slack space, unallocated clusters, etc. This type of access is a key enabler in the development of forensic software systems, ranging from single-purpose stand-alone tools to integrated forensic processing systems.
Snorkel is developed by the Netherlands Forensic Institute
Features
Snorkel recognizes and gives access to numerous storage formats for digital evidence, disk partitioning schemes, volume managers, file systems, and structured files. The formats supported are summarized below.
Image File Formats Understood
Image file formats	EnCase	
	RAW (dd)	
	VMWare (vmdk)	
File Systems Understood
Volume managers	Windows (ldm)	
Partitioning schemes	PC/MBR	
	Apple	
	GPT	
	BSD	
File systems	Windows (fat, NTFS)	
	Apple (mfs, (Classic) HFS, HFS+)	
	Linux (ext, Reiser)	
	Solaris, BSD (ufs)	
	CD (ISO9660)	
File Formats	Windows registry (Win 9x, NT)	
	Microsoft Office (OLE2)	
License Notes
Snorkel is has a proprietary license. An evaluation version is available from the website.
External Links
the Netherlands Forensic Institute
Recon for mac os x -
RECON for Mac OS X is a software tool developed by SUMURI to automate the forensic data gathering process on the Mac OS X operating system. It automates what an experienced examiner would need weeks to accomplish in minutes.
Product Overview
RECON for Mac OS X automatically finds important artifacts, parses the data and presents them to you in a unified format that can be refined to produce automated reports.
Main Features
RECON for Mac OS X includes all current versions of PALADIN, which comes with a full featured open source Forensic Suite, bootable forensic imager, a software write-blocker, and other advanced digital forensics tools.
Forensic Tools Included
• Software Write-Blocker, Imager and Full Forensic Suite included.
• Advanced Timeline Analysis.
• Process forensic images or live Macs.
• Identify the origin of files.
• Automatic chat timeline construction for Messages and Skype.
• Complete a Mac exam in minutes, not weeks.
• Image mounting supporting popular forensic image formats and Fusion drives.
• Built-in Live Imaging.
• Automatic identification of Spoliation artifacts.
• Create customized reports – PDF, HTML, CSV and XML.
• Image RAM, capture Volatile Data
External Links
Official Website