37 projects tagged "Forensics"

Download No website Updated 06 Dec 2013 gpart

Screenshot
Pop 69.11
Vit 1.55

Gpart is a small tool which tries to guess which partitions are on a PC harddisk in case the primary partition table was damaged. It works by scanning through the device (or file) given on the commandline on a sector basis. Each guessing module is asked if it thinks a filesystem it knows about could start at a given sector. Several filesystem guessing modules are built in, and others can be added dynamically.

No download No website Updated 26 May 2010 libpff

Screenshot
Pop 36.62
Vit 1.52

libpff is a library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used by Outlook in PAB (Personal Address Book), PST (Personal Storage Table), and OST (Offline Storage Table) files.

Download No website Updated 30 Jul 2010 mbrChunker

Screenshot
Pop 84.53
Vit 2.03

mbrChunker is a utility that allows you to mount raw disk images (created by dd, dcfldd, dc3dd, ftk imager, etc.) and create VMDK files. It does this by taking the raw image, analyzing the master boot record (physical sector 0), and getting specific information that is need to create a working VMDK file that points to your raw image. It can also extract information such as heads, cylinders, and sectors per track. With version 0.3.15, the tool now has the ability to search for hex byte offsets within any binary file. It will give you the byte location for every hex pattern found. More information about this can be found in the README.

Download Website Updated 14 Feb 2013 mount_dd

Screenshot
Pop 84.75
Vit 3.87

Mount_dd is a GUI for mounting a raw image in Gnome. You can mount a dd-image in read-write or read-only mode. You can mount ISO, .img, raw, .00x formats, EWF, and AFF in read-only mode. You can also mount exfat partitions in read-only mode.

Download Website Updated 23 May 2008 msn-proxy

Screenshot
Pop 82.19
Vit 1.49

The msn-proxy is a lightweight transparent proxy for MSN Messenger clients. It allows you to control and monitor the use of Messenger on your network.

No download Website Updated 20 Sep 2011 picviz

Screenshot
Pop 43.08
Vit 2.43

Picviz is a parallel coordinates plotter which enables easy scripting from various types of input (such as tcpdump, syslog, iptables logs, or Apache logs) to visualize your data and discover interesting results quickly. Its primary goal is to graph data in order to be able to quickly analyze problems and find correlations among variables. With security analysis in mind, the program has been designed to be very flexible, able to graph millions of events.

Download No website Updated 01 Oct 2009 tableau-parm

Screenshot
Pop 50.68
Vit 1.72

tableau-parm is an small commandline utility designed to interact with Tableau forensic write blockers. It performs functions similar to the Tableau Disk Monitor, except that it operates under select UNIX platforms.

Screenshot

Project Spotlight

Retro

A concatenative language with roots in Forth

Screenshot

Project Spotlight

InfoList

An application to edit the INFO list chunk in a RIFF file.