Based on OS
Windows tools:
Specific Tools:
- Log Parser -
- EnCase -
- ILook(LEO Only) -
- Paraben -
- ProDiscover -
- TCPView -
- AccessData -
- COFEE(LEO Only) -
- WinHex
- X-Way Forensics/WinHex Pro
- FileControl-DD etc.
- Wireshark-Ethereal(packet sniffer)
- Dsniff-Dug Song
(Read more: Top 5 Big Data Vulnerability Classes)
Websites & Tools
- Sysinternals.com
- Foundstone.com
UNIX:
- Grep
- Nmap
- DEFT-Linux Distribution
- Can Opener-Abbott systems
- BlackLight-Blackbag
- Expert Witness-ASR Data
- coroner's tool kit( pcat,ils,icat,File,unrm,Lazarus)
- TCTUtils(bcat,blockcalc,fls,find_file,find_inode,Istat,mac_merge)
- Autopsy Forensic Browser
Based on Functionality
Imaging tools:
- FTK Imager
- Encase Professional
- Symantec Norton Ghost
- Power Quest - drive image, drive copy
- Freeware 'dd' utility
- Fastbloc (Encase)
- AVCDEF(Vogon)
- Caveat
Logs:
- Event logs(system,security,application,router)
- specific application log(IIS,SQL Server..)
Memory Collection
- Dumping event logs(dumpevt.exe,dumpevt.pl)
DumpIt
Volatility
- Mandiant RedLine
- HBGary Responder CE
(Read more: Cyber Safety in Cars and Medical Devices)
String:
- Strings.exe
- Finfo.pl
network tools:
WireShark(free tool)
NetworkMiner
Netwitness Investigator
Network Appliance Forensic Toolkit (NAFT)
Carving:
- PhotoRec
- Scalpel
- ParseRS/RipRS
Image Mounting:
- OSFMount
- ImDisk
- FTK Imager
- vhdtool
- raw2vmdk
- LiveView
- VirtualBox
File system:
- analyzeMFT
- INDXParse
- PDF Tools from Didier Stevens
- PDFStreamDumper
- SWF Mastah
Registry:
- RegRipper
- Shellbag Forensics
(Read more: How to write a great article in less than 30 mins)
password recovery:
- Ntpwedit
- Ntpasswd
- pwdump7
- SAMInside
- OphCrack
- L0phtcrack
based:
Individual Tools
- Sysinternals Suite
Script Based Tools
- First Responder's Evidence Disk (FRED)
- Microsoft COFEE
- Windows Forensic Toolchest (WFT)
- RAPIER
Agent Based Tools
- GRR
- Mandiant First Response
Note:http://www.forensicswiki.org/wiki/Incident_Response
- Keeping a list of comprehensive tools for the organizational infrastructure and training your team on using them can prove to be very helpful at the time of incidence.
- It is also very important to validate the list of tools is comprehensive and capable of providing coverage to major security areas.
- Maintaining it a form of ROM (eg. CD) is preferable, so they don't get infected in any form.
Others:
- evidence-dd,mount
- acqusition & reconnaisance-grave-robber,ils,ils2mac,fls-m
- analysis-timelining,AFB,lazarus
- recovery-icat,urnm
References:
http://www.blackhat.com/presentations/bh-asia-02/bh-asia-02-khoo.pdf
http://oreilly.com/catalog/incidentres/chapter/ch07.html
Comments