|
| Title:
Autopsy Forensic Browser |
Author:
Brian Carrier |
| Description:
Autopsy is a graphical interface to the command line
tools in The Sleuth Kit and allows one to view deleted
NTFS, FAT, EXTxFS, and FFS files, perform keyword
searches, and create timelines of file activity.
|
| Website:
http://www.sleuthkit.org/autopsy
|
| Source:
http://www.sleuthkit.org/autopsy/download.php
|
|
| Title:
binutils |
Author:
GNU binutils Team |
| Description:
The GNU Binutils are a collection of binary tools. For forensics,
these are used for binary analysis, including 'strings'.
|
| Website:
http://www.gnu.org/software/binutils/
|
| Source:
http://www.gnu.org/software/binutils/
|
|
| Title:
chkrootkit |
Author:
Nelson Murilo |
| Description:
chkrootkit is a tool to locally check for signs of a rootkit.
|
| Website:
http://www.chkrootkit.org/
|
| Source:
http://www.chkrootkit.org/
|
|
| Title: Clam AntiVirus
|
Author:Tomasz Kojm
|
| Description: Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software.
|
| Website:
http://www.clamav.net
|
| Source:
http://www.clamav.net
|
|
| Title:Event Log Parser
|
Author:Jamie French
|
| Description:
A PHP script to parse through Windows event logs.
|
| Website:
http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html
|
| Source:
http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html
|
|
| Title: File AUdit Security Toolkit (FAUST)
|
Author: Frederic Raynal
|
| Description:
faust is a perl script that helps to analyze files found after an
intrusion or the compromising of a honeypot. Its goal is not to
make the analysis, but to extract the pieces of information that
_you_ will use afterward in your analysis.
|
| Website:
http://security-labs.org/index.php3?page=faust
|
| Source:
http://security-labs.org/index.php3?page=faust
|
|
| Title:
find |
Author:
GNU findutils Team |
| Description:
The find program searches a directory tree to find a file or group
of files. It traverses the directory tree and reports all occurrences
of a file matching the user's specifications. The find program
includes very powerful searching capability.
|
| Website:
http://www.gnu.org/software/findutils/
|
| Source:
http://www.gnu.org/software/findutils/
|
|
| Title:
file |
Author:
Christos Zoulas |
| Description:
Guesses file type based on magic header and footer values.
|
| Website:
ftp://ftp.astron.com/pub/file/
|
| Source:
ftp://ftp.astron.com/pub/file/
|
|
| Title:
File Ripper |
Author:
Kristofer Munsterhjelm - Maintainer |
| Description:
File Ripper is a file extractor based on header recognition. It can be used to recover files from unfragmented disk images where filesystem information has been lost or otherwise corrupted, or the files have been inadvertently deleted. It detects and extracts PNG, HTML, GIF, ZIP, LBM, PBM, ANM, BAT, BAS, RTF, HLP, WAV, WRI, JPG, ARJ, DOS EXE, ANS, ZZT, FRM, text BAS, BMP, MZB, FLI, MSP, DOC, MZX, GDM, IT, S3M, SAV, BRD, LZH/LHA, MOD, XM, VOC, SVX, ABM, Quetzal, and certain obscure bulletin board system formats.
|
| Website:
http://directory.fsf.org/project/fripper/
|
| Source:
http://directory.fsf.org/project/fripper/
|
|
| Title:
foremost |
Author:
Jesse Kornblum |
| Description:
Foremost is a Linux program to recover files based on their
headers and footers. Foremost can work on image files, such as
those generated by dd, Safeback, Encase, etc, or directly on a
drive. The headers and footers are specified by a configuration
file, so you can pick and choose which headers you want to look
for.
|
| Website:
http://foremost.sourceforge.net
|
| Source:
http://foremost.sourceforge.net
|
|
| Title: Forensic Hash Database
|
Author: Matthias Hofherr
|
| Description:
The Forensic Hash Database is a project to combine the various
hashsum sources like Dan Farmer's FUCK baseline collection, The
NIST National Software Reference Library (NSRL), Known Goods Database,
and Hashkeeper into a single meta RDBMS (relational database
management system).
|
| Website:
http://www.forinsect.de/forensics/
|
| Source:
http://www.forinsect.de/forensics/
|
|
| Title: Galleta
|
Author: Keith Jones
|
| Description:
Galleta, the Spanish word meaning "cookie", was developed to examine
the contents of the cookie files. Galleta will parse the information
in a Cookie file and output the results in a field delimited manner
so that it may be imported into your favorite spreadsheet program.
Galleta is built to work on multiple platforms and will execute on
Windows (through Cygwin), Mac OS X, Linux, and *BSD platforms.
|
| Website:
http://www.foundstone.com/resources/proddesc/galleta.htm
|
| Source:
http://sourceforge.net/project/showfiles.php?group_id=78332&release_id=152412
|
|
| Title:
grep |
Author:
GNU grep Team |
| Description:
Grep searches one or more input files for lines containing a match to a specified pattern. By default, grep prints the matching lines.
|
| Website:
http://www.gnu.org/software/grep/grep.html
|
| Source:
http://www.gnu.org/software/grep/grep.html
|
|
| Title:GrokEVT
|
Author:Sentinel Chicken Networks.
|
| Description:
GrokEVT is a collection of scripts built for reading Windows NT™ event log files.
|
| Website:
http://www.sentinelchicken.org/projects/grokevt/
|
| Source:
http://www.sentinelchicken.org/projects/grokevt/download/
|
|
| Title: Hachoir
|
Author: Julien Muchembled and Victor Stinner
|
| Description: hachoir-parser is a package of most common file format parsers written using hachoir-core.
|
| Website:
http://hachoir.org/wiki/hachoir-parser
|
| Source:
http://hachoir.org/wiki/hachoir-parser
|
|
| Title: Kregedit
|
Author: Jelmer Vernooij
|
| Description:
kregedit is KDE utility for viewing native Windows registry files. It is similar to the regedt32 utility that can be found on most Windows platforms. Only the NT registry format (NT4/2000/XP) is supported.
|
| Website:
http://samba.org/~jelmer/kregedit/
|
| Source:
http://samba.org/~jelmer/kregedit/
|
|
| Title:LibPST
|
Author:Dave Smith
|
| Description:
LibPST provides functions in library form for accessing Outlook's
Personal Folders. Included with this library is a program that will
take a PST file and convert it to an mbox format.
|
| Website:
http://sourceforge.net/projects/ol2mbox
|
| Source:
http://sourceforge.net/project/showfiles.php?group_id=18756&release_id=117314
|
|
| Title: Magic Rescue
|
Author: jbj
|
| Description:
Magic Rescue scans a block device for file types it knows how to
recover and calls an external program to extract them. It looks at
"magic bytes" in file contents, so it can be used both as an undelete
utility and for recovering a corrupted drive or partition. As long
as the file data is there, it will find it.
|
| Website:
http://jbj.rapanden.dk/magicrescue/
|
| Source:
http://jbj.rapanden.dk/magicrescue/
|
|
| Title:
md5deep |
Author:
Jesse Kornblum |
| Description:
md5deep is an MD5 program that can compute recursively, compare
hashes with a database, and estimates the time to completion.
|
| Website:
http://md5deep.sourceforge.net/
|
| Source:
http://md5deep.sourceforge.net/
|
|
| Title:
md5sum |
Author:
GNU coreutils Team |
| Description:
Calculates the MD5 hash value for a file.
|
| Website:
http://www.gnu.org/software/coreutils/
|
| Source:
http://www.gnu.org/software/coreutils/
|
|
| Title: ntreg
|
Author:Todd Sabin
|
| Description:
ntreg is a file system driver for linux, which understands the NT
registry file format. With it, you can take registry files from
NT, e.g., SAM, SECURITY, etc., and mount them on linux. Currently,
it's read-only, though I may add read-write capability in the
future.
|
| Website:
http://www.bindview.com/Services/RAZOR/Utilities/Unix_Linux/ntreg_readme.cfm
|
| Source:
http://www.bindview.com/Services/RAZOR/Utilities/Unix_Linux/ntreg_readme.cfm
|
|
| Title: Pasco
| Author: Keith Jones
|
| Description:
Pasco, the latin word meaning "browse", was developed to examine
the contents of Internet Explorer's cache files. Pasco will parse
the information in an index.dat file and output the results in a
field delimited manner so that it may be imported into your favorite
spreadsheet program. Pasco is built to work on multiple platforms
and will execute on Windows (through Cygwin), Mac OS X, Linux, and
*BSD platforms.
|
| Website:
http://www.foundstone.com/resources/proddesc/pasco.htm
|
| Source:
http://sourceforge.net/project/showfiles.php?group_id=78332&release_id=152387
|
|
| Title: RegLookup
| Author: Timothy D. Morgan
|
| Description:
RegLookup is an small command line utility for reading and querying Windows NT/2K/XP registries. RegLookup is released under the GNU GPL, and is implemented in ANSI C.
|
| Website:
http://projects.sentinelchicken.org/reglookup/
|
| Source:
http://projects.sentinelchicken.org/reglookup/
|
|
| Title: regutils
|
Author: Michael Rendell
|
| Description:
Regutils is a collection of programs that can assist in the installation of windows 9x software on diskless clients. The basic procedure is to take a snap shot of a (diskfull) system before and after a piece of software is installed and then look at what changed.
|
| Website:
http://www.cs.mun.ca/~michael/regutils/
|
| Source:
http://www.cs.mun.ca/~michael/regutils/
|
|
| Title: RegViewer
|
Author: Chris Eagle
|
| Description:
RegViewer is GTK 2.2 based GUI Windows registry file navigator. It is platform independent allowing for examination of Windows registry files from any platform. Particularly useful when conducting forensics of Windows files from *nix systems.
|
| Website:
http://sourceforge.net/projects/regviewer/
|
| Source:
http://sourceforge.net/project/showfiles.php?group_id=96788
|
|
| Title: Rootkit Hunter
|
Author: Michael Boelen, Stephane Dudzinski
|
| Description:
Rootkit scanner is scanning tool to ensure you for about 99.9% you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like:
MD5 hash compare,
Look for default files used by rootkits,
Wrong file permissions for binaries,
Look for suspected strings in LKM and KLD modules,
Look for hidden files,
Optional scan within plaintext and binary files.
|
| Website:
http://www.rootkit.nl/projects/rootkit_hunter.html
|
| Source:
http://www.rootkit.nl/projects/rootkit_hunter.html
|
|
| Title: Rifiuti
|
Author: Keith Jones
|
| Description:
Rifiuti, the Italian word meaning "trash", was developed to examine
the contents of the INFO2 file in the Recycle Bin. Rifiuti will
parse the information in an INFO2 file and output the results in
a field delimited manner so that it may be imported into your
favorite spreadsheet program. Rifiuti is built to work on multiple
platforms and will execute on Windows (through Cygwin), Mac OS X,
Linux, and *BSD platforms.
|
| Website:
http://www.foundstone.com/resources/proddesc/rifiuti.htm
|
| Source:
http://sourceforge.net/project/showfiles.php?group_id=78332&release_id=152410
|
|
| Title: Safari_download
|
Author: Jake Cunningham
|
| Description: Parses the Safari XML Downloads.plist file
and prints the results in TAB delimited format.
|
| Website:
http://jafat.sourceforge.net/files.html
|
|
| Title: safari_hist
|
Author: Jake Cunningham
|
| Description: Parses the Safari binary History.plist file
and prints the results in TAB delimited format.
|
| Website:
http://jafat.sourceforge.net/files.html
|
|
| Title: Scalpel
|
Author: Golden G. Richard III
|
| Description:
Scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel resulted from a complete rewrite of foremost 0.69, a popular open source file carver, to enhance performance and decrease memory usage.
|
| Website:
http://www.digitalforensicssolutions.com/Scalpel
|
| Source:
http://www.digitalforensicssolutions.com/Scalpel
|
|
| Title:
The Sleuth Kit |
Author:
Brian Carrier |
| Description:
A collection of command line tools for the analysis of NTFS, FAT,
FFS, and EXT2FS file systems and DOS, BSD, Sun, and Mac partitions.
The tools allow for the recovery
and analysis of deleted content, hash database lookups, sorting
by file type, and timelines of file activity.
|
| Website:
http://www.sleuthkit.org/sleuthkit/
|
| Source:
http://www.sleuthkit.org/sleuthkit/download.php
|
|
| Title: Vinetto
|
Author: Michel Roukine
|
| Description: Vinetto is a forensics tool to examine Thumbs.db files.
It is a command line python script that works on Linux, Mac OS X and Cygwin(win32).
|
| Website:
http://vinetto.sourceforge.net/
|
|
| Title: Zeitline
|
Author: Florian Buchholz
|
| Description:A graphical front-end that allows an investigator to manage event reconstruction. Super events may be created based on selected sub-events. Events may be moved around via drag-and-drop or directly assigned to a super event hierarchy. The event hierarchy can be displayed in a tree-like view allowing to collapse all or select branches. This way, an investigator can concentrate on events only relevant to his direct attention.
|
| Website:
http://www.cerias.purdue.edu/homes/forensics/timeline.php
|
| Source:
http://www.cerias.purdue.edu/homes/forensics/timeline.php
|
|