RSS 37 projects tagged "Forensics"

No download Website Updated 07 Apr 2008 Yet Another Flowmeter

Screenshot
Pop 32.68
Vit 1.00

Yet Another Flowmeter (YAF) is a tool for network flow capture, primarily designed to operate efficiently on white box hardware and generate IPFIX flow records. It is designed to operate primarily on Unix-based systems (including Mac OS X), and is supported by the Network Situational Awareness team at CERT.

Download Website Updated 30 Mar 2008 adelaide

Screenshot
Pop 21.63
Vit 1.00

Adelaide is a shell script to automate the checking of important files for unauthorized changes on Linux and Unix systems. It will email the system administrator with the details if anything has changed.

Download Website Updated 07 Mar 2008 MITRE Honeyclient Project

Screenshot
Pop 92.03
Vit 1.82

A 'honeypot' is designed to detect server-side attacks. In contrast, a 'honeyclient' is designed to detect client-side attacks. Specifically, a honeyclient is a dedicated host that drives specially instrumented applications to access remote servers to see if those servers are behaving in a malicious manner (by compromising the client). Honeyclients can proactively detect exploits against client applications without known signatures. This framework uses a client-server model with SOAP messaging as the primary communication method, and uses the free version of VMware Server as a means of virtualizing the client environment.

Download Website Updated 25 Oct 2007 TFTPgrab

Screenshot
Pop 14.07
Vit 1.00

TFTPgrab is a TFTP (Trivial File Transfer Protocol) stream extractor that reads from tcpdump/libpcap capture files. It attempts to reconstruct data that has been transferred via TFTP, and may be useful in some network forensics situations.

No download Website Updated 21 Aug 2007 Karmasphere Parallel Data Processing Language

Screenshot
Pop 66.51
Vit 1.00

The Karmasphere DP language is a high-performance non-blocking parallel language for performing data processing. It is designed to give the user a high degree of control over the usage of system resources, such as how many CPU cores or how much disk I/O time to use, without requiring the software developer to explicitly consider these issues in code. The implementation is a stand-alone library that can be used in any Java 1.5 environment. It can take full advantage of multiprocessor (SMP or NUMA) systems, and may be scaled sideways: since the interpreter and environment are stateless, an entire cluster of machines may run the interpreter in parallel without any need for synchronization.

Download Website Updated 23 Aug 2005 fccu-docprop

Screenshot
Pop 51.82
Vit 1.00

fccu-docprop is a command line utility that tries to print the properties of MS OLE files. MS OLE Files are mainly MS Office DOC and XLS files. This software uses the libgsf library to get the metadata. This software can be used for forensic purposes.

Download Website Updated 22 Mar 2005 FCCU evtreader

Screenshot
Pop 69.58
Vit 1.42

FCCU evtreader is a forensic script made to parse MS Windows event log files.

Screenshot

Project Spotlight

Fileevent

A rules-based utility that notices files and perform actions on them.

Screenshot

Project Spotlight

Catharsis.NET.Domain

A .NET library that provides domain business entities.