31 projects tagged "Forensics"
Updated 23 Apr 2013
Mobius Forensic Toolkit
| Pop | 464.49 |
|---|---|
| Vit | 52.67 |
Mobius Forensic Toolkit is a forensic framework written in Python/GTK that manages cases and case items, providing an abstract interface for developing extensions. Cases and item categories are defined using XML files for easy integration with other tools.
Updated 19 Apr 2013
MASTIFF
| Pop | 111.42 |
|---|---|
| Vit | 2.43 |
MASTIFF is a static analysis framework which automates the process of extracting key characteristics from a number of different file formats. To ensure the framework remains flexible and extensible, a community-driven set of plugins is used to perform file analysis and data extraction. While originally designed to support malware, intrusion, and forensic analysis, the framework is well-suited to support a broader range of analytic needs. In a nutshell, MASTIFF allows analysts to focus on analysis rather than figuring out how to parse files.
Updated 13 Mar 2013
Fortools_dd
| Pop | 164.76 |
|---|---|
| Vit | 2.05 |
Fortools_dd is a set of forensic apps, created with zenity, for terminal commandos and bash scripts in Linux. It includes Mount_dd (a mounting images app), kijknekerap (a Dutch Terminal app), fgrep_dd (grep apps), convert_dd (a conversion app for aff > dd > EWF), shred_dd (a shredding app), filecopy_dd (a search-and-copy app), forensic_wine_dd (a Windows software with Wine app), reportmaker_dd (a small reportmaking app), Browserhistory_dd (a history app), and Offsetgrabber_dd (an offset viewing app).
Updated 24 Feb 2013
ANNFiD
| Pop | 107.94 |
|---|---|
| Vit | 1.20 |
ANNFiD is an experimental forensic tool that identifies file types using neural networks. A GUI tool is used to train the network for new file types. It is intended to be used to determine the nature of corrupted files.
Updated 17 Feb 2013
WTMParse
| Pop | 49.17 |
|---|---|
| Vit | 9.65 |
WTMParse is a script originally intended for use in forensic examinations which parses WTMP files from Unix-like operating systems and generates a CSS-styled HTML report containing the login terminal, username, log start date, and login time/date in a table. It's good for postmortem forensic examinations or as a way of getting "last"-like information when you don't have the ability to boot the machine in question but can grab the wtmp.
Updated 14 Feb 2013
mount_dd
| Pop | 128.37 |
|---|---|
| Vit | 4.11 |
Mount_dd is a GUI for mounting a raw image in Gnome. You can mount a dd-image in read-write or read-only mode. You can mount ISO, .img, raw, .00x formats, EWF, and AFF in read-only mode. You can also mount exfat partitions in read-only mode.
Updated 30 Oct 2012
Xplico
| Pop | 284.34 |
|---|---|
| Vit | 13.82 |
Xplico is an IP traffic decoder that extracts data from an Internet traffic capture. From a pcap file, it can extracts each email (POP, IMAP, and SMTP protocols), all HTTP content, VoIP calls (SIP, RTP, H323, MEGACO, MGCP), IRC, MSN, and so on. It isn't a packet sniffer or a network protocol analyzer, but rather an IP/Internet traffic decoder or network forensic analysis tool (NFAT).
Updated 29 Jan 2012
LynxFS
| Pop | 49.80 |
|---|---|
| Vit | 1.00 |
LynxFS is a filesystem driver for LynxOS filesystem images. It is based on FUSE. The LynxOS filesystem appears to be very similar to BSD's FFS. This driver may be of use to people inspecting or debugging embedded systems.
Updated 25 Dec 2011
Lynis
| Pop | 230.91 |
|---|---|
| Vit | 11.06 |
Lynis is an auditing tool for Unix (specialists). It scans systems to detect software and security issues. Besides security-related information, it will also scan for general system information, installed packages, and possible configuration mistakes. The software is aimed at assisting automated auditing, software patch management, and vulnerability and malware scanning of Unix-based systems.
Updated 24 Dec 2011
NetXtract
| Pop | 61.16 |
|---|---|
| Vit | 1.04 |
Xtract attempts to demonstrate how Wireshark's powerful network traffic analysis capabilities can be combined with the file carving capabilities of programs such as Foremost and NetworkMiner in a manner that is portable and extensible (hence the choice of Perl). Specifically, it offers automated extraction of network stream sessions; visualization of networks via GraphViz; and integration of file carving capability. The scripts are intended as a proof-of-concept for how tedious tasks of reassembling TCP/UDP streams from network capture files and file carving based on these streams can be automated.
