34 projects tagged "Forensics"
Updated 07 Oct 2008
FCCU GNU/Linux Forensic Bootable CD
| Pop | 239.98 |
|---|---|
| Vit | 4.03 |
FCCU GNU/Linux Forensic Bootable CD is a bootable CD based on Debian-live that contains a lot of tools suitable for computer forensic investigations, including bash scripts. Its main purpose is to create images of devices prior to analysis, and it is used by the Belgian Federal Computer Crime Unit.
Updated 22 Mar 2005
FCCU evtreader
| Pop | 78.23 |
|---|---|
| Vit | 1.42 |
FCCU evtreader is a forensic script made to parse MS Windows event log files.
Updated 02 Oct 2011
RegLookup
| Pop | 138.77 |
|---|---|
| Vit | 8.53 |
The RegLookup project is devoted to direct analysis of Windows NT-based registry files. RegLookup provides command line tools, a C API, and a Python module for accessing registry data structures. The project has a focus on providing tools for digital forensic examiners (though it is useful for many purposes), and includes algorithms for retrieving deleted data structures from registry hives.
Updated 20 Jun 2011
GrokEVT
| Pop | 115.18 |
|---|---|
| Vit | 6.08 |
GrokEVT is a collection of scripts built for reading Windows® NT/2K/XP/2K3 event log files. The scripts work together on one or more mounted Windows partitions to extract all information needed (registry entries, message templates, and log files) to convert the logs to a human-readable format.
Updated 23 Aug 2005
fccu-docprop
| Pop | 53.29 |
|---|---|
| Vit | 1.00 |
fccu-docprop is a command line utility that tries to print the properties of MS OLE files. MS OLE Files are mainly MS Office DOC and XLS files. This software uses the libgsf library to get the metadata. This software can be used for forensic purposes.
Updated 01 Oct 2009
tableau-parm
| Pop | 56.82 |
|---|---|
| Vit | 1.79 |
tableau-parm is an small commandline utility designed to interact with Tableau forensic write blockers. It performs functions similar to the Tableau Disk Monitor, except that it operates under select UNIX platforms.
Updated 07 Mar 2008
MITRE Honeyclient Project
| Pop | 109.73 |
|---|---|
| Vit | 1.83 |
A 'honeypot' is designed to detect server-side attacks. In contrast, a 'honeyclient' is designed to detect client-side attacks. Specifically, a honeyclient is a dedicated host that drives specially instrumented applications to access remote servers to see if those servers are behaving in a malicious manner (by compromising the client). Honeyclients can proactively detect exploits against client applications without known signatures. This framework uses a client-server model with SOAP messaging as the primary communication method, and uses the free version of VMware Server as a means of virtualizing the client environment.
Updated 29 Jan 2012
LynxFS
| Pop | 49.80 |
|---|---|
| Vit | 1.00 |
LynxFS is a filesystem driver for LynxOS filesystem images. It is based on FUSE. The LynxOS filesystem appears to be very similar to BSD's FFS. This driver may be of use to people inspecting or debugging embedded systems.
Updated 25 Oct 2007
TFTPgrab
| Pop | 19.49 |
|---|---|
| Vit | 1.00 |
TFTPgrab is a TFTP (Trivial File Transfer Protocol) stream extractor that reads from tcpdump/libpcap capture files. It attempts to reconstruct data that has been transferred via TFTP, and may be useful in some network forensics situations.
Updated 25 Dec 2011
Lynis
| Pop | 229.04 |
|---|---|
| Vit | 11.04 |
Lynis is an auditing tool for Unix (specialists). It scans systems to detect software and security issues. Besides security-related information, it will also scan for general system information, installed packages, and possible configuration mistakes. The software is aimed at assisting automated auditing, software patch management, and vulnerability and malware scanning of Unix-based systems.
