Forensics Wiki - User contributions [en]

User:Zakiakhmad

2009-03-23T03:24:32Z

Zakiakhmad: New page: My name is Zaki Akhmad. Currently I live on Bandung, Indonesia. You can follow my microblogging on [http://twitter.com/zakiakhmad twitter]. Email address: za at design.paume.itb.ac.id --...

My name is Zaki Akhmad. Currently I live on Bandung, Indonesia. You can follow my microblogging on [http://twitter.com/zakiakhmad twitter].

Email address: za at design.paume.itb.ac.id
--[[User:Zakiakhmad|Zakiakhmad]] 03:24, 23 March 2009 (UTC)

Talk:Main Page

2009-03-23T03:16:57Z

Zakiakhmad: /* Forensics Mailing List */

== what about the validation of legal/illegal licenses of commercial software? ==

I'm sometimes requested by the Courts to process with investigations in order to detect is a company is using software (e.g. AutoCad, MS Office, Adobe) with licenses or not.
The evidence of such stuff is easy or not. The display of the "About" is sometimes enough but for some software the evidence is not so easy.

May I propose we open a new section to address such topics?

What do you think? --[[User:Chuv|Chuv]] 04:16, 19 July 2007 (PDT)

: Sounds like a good idea. How about [[How to determine if software is legally licensed]]? It should probably go in the [[:Category:Howtos]]. [[User:Jessek|Jessek]] 16:11, 19 July 2007 (PDT)

== Global Directory of Analysts ==

I am setting up a global directory of computer forensics analysts, and am looking for feedback to the idea. Although the directory is in the UK, I want it to be global. Any thoughts, please put them on Computer Forensics [http://www.computer-forensics.co.uk] in the forums section. Thanks and regards, Simon
: Given the lack of response I'm not sure this is a viable idea. [[User:Jessek|Jessek]] 21:13, 26 February 2007 (PST)
: Doesn't seem like a good idea to me. [[User:Simsong|Simsong]] 18:50, 15 March 2007 (PDT)
: Response is small because the very idea and both sites are not well known within North America. Computer forensics here has been mostly a secondary role rather than a principal focus. To raise awareness of both efforts, this wiki and computer-forensics.co.uk, you need to get their existence promoted in major publications and the primary professional organizations.

== List of OS changed files at boot time or poweroff. ==

Some times i found useful to know which files are changed on boot time of OS or on poweroff. For example to know what happened with OS ( Windows or Linux or ... ) what files to exclude or include by investigation. So i started collect this information with qemu and mactime. I think this wiki is the best place to post it, what do you think haw should i name it and the category? Also i will thankful if some one can correct my English.

I would encourage you to post it at [[Files changed at boot:Windows XP]], [[Files changed at boot:Windows Vista]], and the like. [[User:Simsong|Simsong]] 18:53, 25 October 2007 (PDT)

== Anti-forensic Tools Link on Homepage ==

The anti-forensic tools link on the homepage of this wiki doesn't appear to go to the proper page, but rather goes to a pro-forensic tools page. Do we have a page just for anti-forensic tools? It would appear to me that the internal link should point to that type of a page rather than one on pro-forensic tools. Thoughts? [[User:Cobalt2020|AEI Forensics]]

== Organizing Anti-Forensics and Page Naming query ==
I've made a start on trying to organize the Anti-Forensics information creating a number of sections including Category:Anti-Forensics. I created a category for Category:Anti-Forensics Tools(uppercase) with out realising there was already a Category:Anti-forensics tools (lowercase). Is there any standardization on whether page titles should be upper or lower case? I would have though upper case being the better option...
[[User:Fsck|Fsck]] 22:43, 4 July 2008 (UTC)

== File Header Page ==

Do we have a page on this forensic wiki devoted to File Header information such as specific file header and footer signatures or at least a page of links to known file header compendiums? Do we want one? [[User:Cobalt2020|AEI Forensics]]

I've started a weekly posting of forensics research. In my quick review of the other websites that come up when doing a google search for "computer forensics" it seems that nothing is really up-to-date, so perhaps we can start a more active community here. Perhaps this will grow into a blog roll. [[User:Simsong|Simsong]] 23:46, 5 July 2008 (UTC)
:: What about next Selected Forensics Research? Two months passed without updates [[User:.FUF|.FUF]] 21:10, 17 October 2008 (UTC)
:::I got radically overcommitted. I'll try to post something this weekend. [[User:Simsong|Simsong]] 06:35, 18 October 2008 (UTC)
== Removal of non-contributing users ==

I've written a little SQL statement which will remove the 1100 or so usernames that have been registered but which have never contributed anything and have no talk. This was considered for the mediawiki project but never implemented (weird). Anyway, unless there is a suggestion, I'll go ahead and do it... [[User:Simsong|Simsong]] 05:10, 20 August 2008 (UTC)

== Tools table ==

Is it possible to add [[Wireshark]] and [[NetworkMiner]] to the Tools table on the Main Page (here: ''Network Forensics: Snort, ... '')? [[User:.FUF|.FUF]] 17:08, 11 September 2008 (UTC)
: Done [[User:Simsong|Simsong]] 04:40, 12 September 2008 (UTC).

== Did you know? ==

What about organizing "Did you know?" section with some interesting facts from articles (like in Wikipedia)? [[User:.FUF|.FUF]] 12:34, 29 October 2008 (UTC)

== Wiki News ==

I have updated the version of SpamBlacklist. [[User:Simsong|Simsong]] 23:49, 30 October 2008 (UTC)

I have fixed the server config file so we now get /wiki/ URLs. [[User:Simsong|Simsong]] 20:33, 3 November 2008 (UTC)

== Forensics Mailing List ==
Hello all. I would like to ask, are there any mailing list focus on forensics? I need reference here. --[[User:Zakiakhmad|Zakiakhmad]] 09:48, 13 March 2009 (UTC)

: It seems a little bit passive this discussion --[[User:Zakiakhmad|Zakiakhmad]] 03:16, 23 March 2009 (UTC)

MacQuisition Boot CD

2009-03-13T15:44:40Z

Zakiakhmad:

{{Infobox_Software |
name = MacQuisition Boot CD |
maintainer = [[BlackBag Technologies, Inc.]] |
os = {{Mac OS X}} |
genre = {{Live CD}}, {{Disk imaging}} |
license = ??? |
website = [http://www.blackbagtech.com/products/macquisition.htm http://www.blackbagtech.com/products/macquisition.htm] |
}}

The '''MacQuisition Boot CD''' is a forensic [[Boot CD]]/[[Live CD]] built for imaging [[Macintosh]] systems.

=Features=

==File Systems Understood==

* For Macs! Produces a [[dd]] image.

==File Search Facilities==

==Historical Reconstruction==

Can it build timelines and search by creation date?

==Searching Abilities==

Can it search? Does it build an index? Can it focus on file types or particular kinds of metadata?

==Hash Databases==

Can it create hashes of files and/or blocks? Can it compare these hash values to any databases?
What sort of hash functions does it use?

==Evidence Collection Features==

Can it sign files? Does it keep an audit log?

=History=

==License Notes==

Is it commercial or open source? Are there other licensing options?

= External Links =

==External Reviews==

DEFT Linux 2

2009-03-13T15:42:39Z

Zakiakhmad:

{{Infobox_Software |
name = DEFT v2 Linux |
maintainer = [[Stefano Fratepietro]] |
os = {{Linux}} |
genre = {{Live CD}} |
license = {{GPL}}, others |
website = [http://www.deftlinux.net http://www.deftlinux.net] |
}}

'''DEFT v2''' is a [[Live CD]] built on top of Kubuntu 7.04 with the best tools for Computer Forensic and incident response.

== Tools included ==

'''Deft v2 computer and network forensic packages list:'''

: - [[Sleuthkit]], collection of UNIX-based command line tools that allow you to investigate a computer
: - [[Autopsy]], graphical interface to the command line digital investigation tools in The Sleuth Kit
: - [[AFF]] lib, advanced forensic format
: - gpart, tool which tries to guess the primary partition table of a PC-type hard disk
: - dd rescue, copy data from one file or block device to another
: - [[foremost]], console program to recover files based on their headers, footers, and internal data structures
: - hexdump, combined hex and ascii dump of any file
: - khexedit, a versatile and customizable hex editor
: - stegdetect, a steganography detection software
: - outguess, a stegano tool
: - ophcrack, Windows password recovery
: - [[wireshark]], network sniffer
: - ettercap, network sniffer
: - nessus, vulnerability and security scanner (client)
: - nessusd, vulnerability and security scanner (server)
: - [[nmap]], the best network scanner
: - airsnort, wireless LAN (WLAN) tool which recovers encryption keys
: - [[kismet]], sniffer and intrusion detection system that work with any wireless card
: - dmraid, discover software RAID devices
: - [[testdisk]], tool to recover damaged partitions
: - qtparted, a Partition Magic clone written in C++ using the Qt toolkit
: - [[vinetto]], tool to examine Thumbs.db files
: - trID, tool to identify file types from their binary signatures
: - [[libpst | readpst]], a tools to read ms-Outlook pst files
: - john, john the ripper password cracker
: - clam, antivirus

'''Deft v2 utility package list:'''

: - Linux Kernel 2.6.20
: - KDE 3.5.6
: - k3b
: - krdc
: - rdesktop
: - [[VMware]] client
: - Samba client
: - OpenSSH client & server
: - speedcrunch

Talk:Main Page

2009-03-13T09:49:17Z

Zakiakhmad: /* Forensics Wiki Mailing List */

Talk:Main Page

2009-03-13T09:48:54Z

Zakiakhmad:

== what about the validation of legal/illegal licenses of commercial software? ==

I'm sometimes requested by the Courts to process with investigations in order to detect is a company is using software (e.g. AutoCad, MS Office, Adobe) with licenses or not.
The evidence of such stuff is easy or not. The display of the "About" is sometimes enough but for some software the evidence is not so easy.

May I propose we open a new section to address such topics?

What do you think? --[[User:Chuv|Chuv]] 04:16, 19 July 2007 (PDT)

: Sounds like a good idea. How about [[How to determine if software is legally licensed]]? It should probably go in the [[:Category:Howtos]]. [[User:Jessek|Jessek]] 16:11, 19 July 2007 (PDT)

== Global Directory of Analysts ==

I am setting up a global directory of computer forensics analysts, and am looking for feedback to the idea. Although the directory is in the UK, I want it to be global. Any thoughts, please put them on Computer Forensics [http://www.computer-forensics.co.uk] in the forums section. Thanks and regards, Simon
: Given the lack of response I'm not sure this is a viable idea. [[User:Jessek|Jessek]] 21:13, 26 February 2007 (PST)
: Doesn't seem like a good idea to me. [[User:Simsong|Simsong]] 18:50, 15 March 2007 (PDT)
: Response is small because the very idea and both sites are not well known within North America. Computer forensics here has been mostly a secondary role rather than a principal focus. To raise awareness of both efforts, this wiki and computer-forensics.co.uk, you need to get their existence promoted in major publications and the primary professional organizations.

== List of OS changed files at boot time or poweroff. ==

Some times i found useful to know which files are changed on boot time of OS or on poweroff. For example to know what happened with OS ( Windows or Linux or ... ) what files to exclude or include by investigation. So i started collect this information with qemu and mactime. I think this wiki is the best place to post it, what do you think haw should i name it and the category? Also i will thankful if some one can correct my English.

I would encourage you to post it at [[Files changed at boot:Windows XP]], [[Files changed at boot:Windows Vista]], and the like. [[User:Simsong|Simsong]] 18:53, 25 October 2007 (PDT)

== Anti-forensic Tools Link on Homepage ==

The anti-forensic tools link on the homepage of this wiki doesn't appear to go to the proper page, but rather goes to a pro-forensic tools page. Do we have a page just for anti-forensic tools? It would appear to me that the internal link should point to that type of a page rather than one on pro-forensic tools. Thoughts? [[User:Cobalt2020|AEI Forensics]]

== Organizing Anti-Forensics and Page Naming query ==
I've made a start on trying to organize the Anti-Forensics information creating a number of sections including Category:Anti-Forensics. I created a category for Category:Anti-Forensics Tools(uppercase) with out realising there was already a Category:Anti-forensics tools (lowercase). Is there any standardization on whether page titles should be upper or lower case? I would have though upper case being the better option...
[[User:Fsck|Fsck]] 22:43, 4 July 2008 (UTC)

== File Header Page ==

Do we have a page on this forensic wiki devoted to File Header information such as specific file header and footer signatures or at least a page of links to known file header compendiums? Do we want one? [[User:Cobalt2020|AEI Forensics]]

I've started a weekly posting of forensics research. In my quick review of the other websites that come up when doing a google search for "computer forensics" it seems that nothing is really up-to-date, so perhaps we can start a more active community here. Perhaps this will grow into a blog roll. [[User:Simsong|Simsong]] 23:46, 5 July 2008 (UTC)
:: What about next Selected Forensics Research? Two months passed without updates [[User:.FUF|.FUF]] 21:10, 17 October 2008 (UTC)
:::I got radically overcommitted. I'll try to post something this weekend. [[User:Simsong|Simsong]] 06:35, 18 October 2008 (UTC)
== Removal of non-contributing users ==

I've written a little SQL statement which will remove the 1100 or so usernames that have been registered but which have never contributed anything and have no talk. This was considered for the mediawiki project but never implemented (weird). Anyway, unless there is a suggestion, I'll go ahead and do it... [[User:Simsong|Simsong]] 05:10, 20 August 2008 (UTC)

== Tools table ==

Is it possible to add [[Wireshark]] and [[NetworkMiner]] to the Tools table on the Main Page (here: ''Network Forensics: Snort, ... '')? [[User:.FUF|.FUF]] 17:08, 11 September 2008 (UTC)
: Done [[User:Simsong|Simsong]] 04:40, 12 September 2008 (UTC).

== Did you know? ==

What about organizing "Did you know?" section with some interesting facts from articles (like in Wikipedia)? [[User:.FUF|.FUF]] 12:34, 29 October 2008 (UTC)

== Wiki News ==

I have updated the version of SpamBlacklist. [[User:Simsong|Simsong]] 23:49, 30 October 2008 (UTC)

I have fixed the server config file so we now get /wiki/ URLs. [[User:Simsong|Simsong]] 20:33, 3 November 2008 (UTC)

== Forensics Wiki Mailing List ==
Hello all. I would like to ask, are there any mailing list focus on forensics? I need reference here. --[[User:Zakiakhmad|Zakiakhmad]] 09:48, 13 March 2009 (UTC)