Search Results for "forensic data"

Live-Forensicator is a toolkit intended for live forensic collection and initial triage on Windows machines. It automates the capture of volatile information—running processes, network connections, loaded drivers, account sessions, and in-memory artifacts—into a consistent artifact set that investigators can analyze offline. The tool tries to be non-invasive while collecting sensitive data quickly and logs the collection steps to preserve chain-of-custody details and to help auditors understand potential collection side effects. ...

A powerful utility to hunt down Bitcoin private keys from deleted wallet.dat files or damaged hard drives. If you accidentally deleted your Bitcoin Core wallet or formatted your disk, this tool can help. It bypasses the file system and scans the raw data directly, looking for the unique "fingerprint" (ASN.1 signature) of Bitcoin private keys to recover them from the digital wreckage.The Graphical User Interface (GUI) is the advanced/premium version. If needed, please visit:...

Xplico is a Network Forensic Analysis Tool (NFAT). The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP, MGCP, MEGACO, RTP), IRC, WhatsApp... Xplico is able to classify more than 140 (application) protocols.

CapAnalysis is a web visual tool for information security specialists, system administrators and everyone who needs to analyze large amounts of captured network traffic. Analyze TCP and UDP streams Support multible datasets Perform deep packet inspection Support filtering capability Source Code: https://github.com/xplico/CapAnalysis

This project contains various scripts and code snippets that can easily be deployed by an incident responder or forensic analyst to aid them in either acquiring or analyzing critical data. You can contact me at: interrupt08@users.sf.net or visit my blog, fork(), at https://forksec.wordpress.com/

IOS6 and recent iTunes updates have broken a few features. We have made some partial fixes, but they are not complete. If you'd like to help support our development, or take over the development please let us know. Explore the internal file structure of your iphone (or of a seized phone in the case of forensic teams) using either the iphone's own backup files or (for jail broken iphones) ssh. Viewing of plist, sqlite, and hex are supported. IOS 5 is now supported iOS 6 only partially...

XML carver which can carve damaged or non-standard XML out of any file. It rebuilds the XML tree, along with giving the offsets for all the carved XML data. This tool was developed for the DFRWS 2010 Forensics Challenge.

Hide your data from any scans for fingerprints at forensic analysis. Fragger is an concept to fragment files into many small files by scrambling the content of the source file.

Outdated! Only works for Firefox 3.0-3.2. ff3hr is a forensic tool to recover deleted history records from Firefox 3. FF3 uses various SQLite databases to store the history, and this tool can recover records from different tables in an disk image.

FLAG was designed to simplify the process of log file analysis and forensic investigations. FLAG facilitates efficient analysis of large quantities of data within an interactive environment. PyFlag is the reimplementation of FLAG in Python.

Discover hidden files you never seen before! NTFS ADS is an forensic/security utility to reveal, list, delete, determine contents, extract and copy hidden files from NTFS Alternate Data Streams.

FragMend is a GUI tool that allows a forensic investigator to classify and view sectors of raw or unallocated data. The sectors can then be ordered and grouped into files.

LINReS is a tool which can be used by Incident Response and Computer Forensic Teams during initial response phase to collect volatile and other non-volatile data from a compromised Linux machine using statically compiled binaries.