Search the Community

Digital Forensics with Open Source Tools is the definitive book on investigating and analyzing computer systems and media using open source tools. The book is a technical procedural guide, and explains the use of open source tools on Mac, Linux and Windows systems as a platform for performing computer forensics. Both well-known and novel forensic methods are demonstrated using command-line and graphical open source computer forensic tools for examining a wide range of target systems and artifacts. Written by world-renowned forensic practitioners, this book uses the most current examination and analysis techniques in the field. It consists of 9 chapters that cover a range of topics such as the open source examination platform; disk and file system analysis; Windows systems and artifacts; Linux systems and artifacts; Mac OS X systems and artifacts; Internet artifacts; and automating analysis and extending capabilities. The book lends itself to use by students and those entering the field who do not have means to purchase new tools for different investigations. This book will appeal to forensic practitioners from areas including incident response teams and computer forensic investigators; forensic technicians from legal, audit, and consulting firms; and law enforcement agencies. Download Link -> [Hidden Content]

Learn the “What” and “How” of the modern network technologies and the associated Wireshark capabilities Understand how to capture secured control and data plane traffic for network forensic. Explains setting up Wireshark 802.11 captures for various OS types Sections Table of contents About this book Keywords Authors and Affiliations About the authors Bibliographic Information [Hidden Content] [hide][Hidden Content]]

RS Browser Forensics es una herramienta muy interesante que ofrecerá a sus usuarios la posibilidad de recuperar los datos de navegación de cualquier explorador, incluso de aquellos que hayan quedado registrados durante las sesiones en modo incógnito o hayan intentado ser eliminados. Perfecto para aquellos que quieran llevar un seguimiento preciso de la actividad que se lleva a cabo en su ordenador, RS Browser Forensics se presenta como la herramienta definitiva con la que complementar a otros limitadores de uso. Utilizar RS Browser Forensics es realmente sencillo: una vez hayamos ejecutado el programa este se encargará de analizar, de forma completamente automática, el explorador que hayamos seleccionado. En cuestión de segundos tendremos acceso al historial de navegación, contraseñas guardadas, sesiones almacenadas, marcadores, archivos almacenados en la memoria caché y otros datos de interés. Si lo deseamos, podremos configurar un sistema de recuperación más profundo que se encargará de acceder a datos que hayan intentado ser borrados y reconstruir cualquier registro de información que haya podido realizarse durante una sesión de exploración en modo incógnito. RS Browser Forensics es fácil, eficaz y cuenta con una serie de funciones únicas que conseguirán resaltarla muy por encima de otras herramientas similares. [Hidden Content] [hide][Hidden Content]]

WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features depend on the license type (license type comparison), among them: Disk editor for hard disks, floppy disks, CD-ROM & DVD, ZIP, Smart Media, Compact Flash, ... Native support for FAT12/16/32, exFAT, NTFS, Ext2/3/4, Next3®, CDFS, UDF Built-in interpretation of RAID systems and dynamic disks Various data recovery techniques RAM editor, providing access to physical RAM and other processes' virtual memory Data interpreter, knowing 20 data types Editing data structures using templates (e.g. to repair partition table/boot sector) Concatenating and splitting files, unifying and dividing odd and even bytes/words Analyzing and comparing files Particularly flexible search and replace functions Disk cloning (under DOS with X-Ways Replica) Drive images & backups (optionally compressed or split into 650 MB archives) Programming interface (API) and scripting 256-bit AES encryption, checksums, CRC32, hashes (MD5, SHA-1, ...) Erase (wipe) confidential files securely, hard drive cleansing to protect your privacy Import all clipboard formats, incl. ASCII hex values Convert between binary, hex ASCII, Intel Hex, and Motorola S Character sets: ANSI ASCII, IBM ASCII, EBCDIC, (Unicode) Instant window switching. Printing. Random-number generator. Supports files of any size. Very fast. Easy to use. Extensive program help. More Having all the bits and bytes in a computer at your fingertips has become a reality. Try before you buy. Computer forensics edition of WinHex with even more features: X-Ways Forensics. [Hidden Content] [hide][Hidden Content]]

CAINE 11 - GNU/Linux Live Distribution For Digital Forensics Project, Windows Side Forensics And Incident Response CAINE (Computer Aided INvestigative Environment) is an Italian GNU/Linux live distribution created as a Digital Forensics project. Currently, the project manager is Nanni Bassetti (Bari - Italy). CAINE offers a complete forensic environment that is organized to integrate existing software tools as software modules and to provide a friendly graphical interface. The main design objectives that CAINE aims to guarantee are the following: an interoperable environment that supports the digital investigator during the four phases of the digital investigation a user-friendly graphical interface user-friendly tools CAINE represents fully the spirit of the Open Source philosophy because the project is completely open, everyone could take on the legacy of the previous developer or project manager. The distro is open source, the Windows side is freeware and, the last but not least, the distro is installable, thus giving the opportunity to rebuild it in a new brand version, so giving a long life to this project... The important news is CAINE 11.0 blocks all the block devices (e.g. /dev/sda), in Read-Only mode. You can use a tool with a GUI named BlockON/OFF present on CAINE's Desktop. This new write-blocking method assures all disks are really preserved from accidentally writing operations, because they are locked in Read-Only mode. If you need to write a disk, you can unlock it with BlockOn/Off or using "Mounter" changing the policy in writable mode. CAINE is always more fast during the boot. CAINE 11.0 can boot to RAM (toram). IMPORTANT CHANGES: All devices are blocked in Read-Only mode, by default. New tools, new OSINT, Autopsy 4.13 onboard, APFS ready,BTRFS forensic tool, NVME SSD drivers ready! SSH server disabled by default (see Manual page for enabling it). SCRCPY - screen your android device Autopsy 4.13 + additional plugins by McKinnon. X11VNC Server - to control CAINE remotely. hashcat NEW SCRIPTS (Forensics Tools - Analysis menu) AutoMacTc - a forensics tool for Mac. Bitlocker - volatility plugin Autotimeliner - Automagically extract forensic timeline from volatile memory dumps. Firmwalker - firmware analyzer. CDQR - Cold Disk Quick Response tool many others fixing and software updating. [HIDE][Hidden Content]]