Search Results for "forensics disk"

This modification of the ext2 kernel module allows to create files (cover files) whose block arrangement gets manipulated to represent a binary code, which can be extracted later. The information hiding approach used in this project was introduced by Khan et. al in 'Designing a cluster-based covert channel to evade disk investigation and forensics' (1st approach). Algorithm: When a cover file is written, an even blocknr. (for the 1st datablock) is choosen to represent a 0 or an odd...

The file contains here is a disk image. You are supposed to find the information as per the CTF requirement.

FLSmac provides a simple to use interface written in perl to integrate the most commonly used FLS and mactime commands to create a forensics timeline from a disk image. In addition, it shows you the command as it is being built so that you can verify its accuracy AND learn how the commands were assembled. Installation Simply un-tar the folder to the location of your choosing (ex: tar -xvf flsmac.tar). Usage ./flsmac.pl Optional Parameters -h Displays help file [image_name...

File System Carver (fsc) is a tool used to separate partitions on disk or disk image. First the fsc tool will hash the entire disk. Second it will look for partitions on the disk to separate. Then fsc will carve out each partition on the disk to its own file and each gap between partitions. Each new file will be hashed on its own. Finally the fsc will make sure when the files are put back together in order that their hash matches the original overall hash.

DWIP is short for Disk Wiping and Imaging Tool. This tool is being built for Mississippi State Universities National Forensics Training Center for use on a live cd to give out to it's students.

LiveView is a forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image. This allows an examiner to "boot up" the image and gain an interactive, user-level perspective of the environment, all without modifying the imag

Hard disk forensics in the lisp way.

An Enhanced version of gnu dd with features useful for forensics and security. Key features include on-the-fly hashing, status output and faster disk wiping.