Difference between pages "Network forensics" and "Data Compass"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
(General)
 
(What can Data Compass do?)
 
Line 1: Line 1:
'''Network forensics''' is the process of capturing information that moves over a [[network]] and trying to make sense of it in some kind of forensics capacity. A [[network forensics appliance]] is a device that automates this process.
+
== Overview ==
  
There are both open source and proprietary network forensics systems available.
+
According to our pioneer 3+1 Data Recovery process, the stage following the drive restoration will be data recovery using Data Compass.
  
== General ==
+
After bringing the failed drive back to life, as a data recovery professional, you know now you need to recover the damaged file system by using file system recovery software; and maybe you know also you need to do a disk imaging in order to work from an accurate, stable hard drive image.
  
<!--
+
Unfortunately, traditional disk imaging tools and methods are designed for and work on good HDDs only, not the patient HDDs that are unstable or inaccessible because of media defects and instable head, which are common challenges of Stage 2 in practice. Even more, with those traditional imaging tools, the time involved and the ordinary user-level repeated-read access to the media bring a risk of damaging the disk and head, making data lost irretrievable.
  
  PLEASE DO NOT ADD ENTRIES THAT DO NOT HAVE AN ARTICLE.
+
But now there's a better way: The disk probing equipment included in the Data Compass suite bypassing the disk-level problems such as multiple bad sectors, damaged surfaces, malfunctioning head assembly, or corrupted servo info, In the meantime you can use the default software or any other defined software you have been familiar with (R-studio, Winhex, any) to perform file recovery. Through the Data Compass, problem drives will become intact hard drives and ready for file recovery attempts..
  
  Please keep these in alphabetical order.
 
  
  When updating any table, please update all tables as appropriate.
+
== What can Data Compass do? ==
  
-->
 
  
{| class="wikitable sortable" style="width: auto; font-size: smaller"
+
Data recovery from physically damaged HDDs is what Data Compass designed for.
|-
+
! System
+
! [[software license|License]]
+
! User Interface
+
! Supported Platform
+
! Supported Protocols
+
! class="unsortable" | Refs <!-- This column is for a general reference and does not replace the need to identify references for specific features if the feature is not explained in the general reference -->
+
|
+
|
+
|-
+
| [[Argus]]
+
| [[Open Source]]
+
| Command Line, GUI via [http://www.datenspionage.de/arguseye/ ArgusEye]
+
| Mac OS X, Linux, Solaris, FreeBSD, OpenBSD, NetBSD, AIX, IRIX, Windows (under Cygwin) and OpenWrt
+
| L2 addresses, tunnel identifiers (MPLS, GRE, ESP, etc...), protocol ids, SAP's, hop-count, options, L4 transport identification (RTP, RTCP detection), host flow control indication; netflow
+
|
+
|
+
|-
+
| [[Chaosreader]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Solaris, RedHat, Windows
+
| FTP files, HTTP transfers (HTML, GIF, JPEG, ...), SMTP emails, ... from the captured data inside network traffic logs
+
|
+
|
+
|-
+
| [[DataEcho]]
+
| [[Open Source]]
+
| GUI
+
| Windows
+
| www, http
+
|
+
|
+
|-
+
| [[Junkie]]
+
| [[Open Source]]
+
| GUI
+
| unknown
+
| unknown
+
|
+
|
+
|-
+
| [[kisMAC]]
+
| [[Open Source]]
+
| GUI
+
| Mac OS X, Linux, Solaris, FreeBSD, OpenBSD, NetBSD, AIX, IRIX, Windows (under Cygwin) and OpenWrt
+
| L2 addresses, tunnel identifiers (MPLS, GRE, ESP, etc...), protocol ids, SAP's, hop-count, options, L4 transport identification (RTP, RTCP detection), host flow control indication; netflow
+
|
+
|
+
|-
+
| [[kismet]]
+
| [[Open Source]]
+
| Command Line /GUI via [http://www.datenspionage.de/arguseye/ ArgusEye]
+
| Mac OS X
+
| unknown
+
|
+
|-
+
| [[n2disk]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Ubuntu, CentOS
+
| unknown
+
|
+
|
+
|-
+
| [[net-sniff-ng]]
+
| [[Open Source]]
+
| unknown
+
| unknown
+
| unknown
+
|
+
|
+
|-
+
| [[netfse]]
+
| [[Open Source]]
+
| GUI
+
| unknown
+
| TCP/IP, UDP
+
|
+
|
+
|-
+
| [[netsleuth]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Windows, [[Backtrack]]
+
| Apple MDNS / Bonjour, SMB / CIFS / NetBios, DHCP (using the www.fingerbank.org resource), SSDP (as used in Microsoft Zero Config)
+
|
+
|
+
|-
+
| [[NetworkMiner]]
+
| [[Open Source]]
+
| Windows GUI, Commandline
+
| Linux / Mac OS X / FreeBSD, Windows
+
| http, smb, ftp, tfpt, ssl , tls, tor
+
|
+
|
+
|-
+
| [[ntop]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Unix (including Linux, *BSD, Solaris, and MacOSX), linux, windows
+
| DPI via OpenDPI Library; FTP POP SMTP IMAP DNS IPP HTTP MDNS NTP NFS SSDP BGP SNMP XDMCP SMB SYSLOG DHCP PostgreSQL MySQL TDS DirectDownloadLink I23V5 AppleJuice DirectConnect Socrates WinMX MANOLITO PANDO Filetopia iMESH Kontiki OpenFT Kazaa/Fasttrack Gnutella eDonkey Bittorrent (Extended) OFF AVI Flash OGG MPEG QuickTime RealMedia Windowsmedia MMS XBOX QQ MOVE RTSP Feidian Icecast PPLive PPStream Zattoo SHOUTCast SopCast TVAnts TVUplayer VeohTV QQLive Thunder/Webthunder Soulseek GaduGadu IRC Popo Jabber MSN Oscar Yahoo Battlefield Quake Second Life Steam Halflife2 World of Warcraft Telnet STUN IPSEC GRE ICMP IGMP EGP SCTP OSPF IP in IP RTP RDP VNC PCAnywhere SSL SSH USENET MGCP IAX TFTP
+
|
+
|
+
|
+
|-
+
| [[OSSEC]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Windows 7, XP, 2000 and Vista Windows Server 2003 and 2008 VMWare ESX 3.0,3.5 (including CIS checks) FreeBSD (all versions) OpenBSD (all versions) NetBSD (all versions) Solaris 2.7, 2.8, 2.9 and 10 AIX 5.3 and 6.1 HP-UX 10, 11, 11i MacOSX 10 remote syslog: Cisco PIX, ASA and FWSM (all versions) Cisco IOS routers (all versions) Juniper Netscreen (all versions) SonicWall firewall (all versions) Checkpoint firewall (all versions) Cisco IOS IDS/IPS module (all versions) Sourcefire (Snort) IDS/IPS (all versions) Dragon NIDS (all versions) Checkpoint Smart Defense (all versions) McAfee VirusScan Enterprise (v8 and v8.5) Bluecoat proxy (all versions) Cisco VPN concentrators (all versions) Database monitoring is available for the following systems: MySQL (all versions) PostgreSQL (all versions) Oracle, MSSQL (to be available soon)"
+
| Unknown
+
|
+
|
+
|-
+
| [[Snort]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Linux, Windows
+
| Unknown
+
|
+
|
+
|-
+
| [[Wireshark]]
+
| [[Open Source]]
+
| Command Line, GUI
+
| Windows, Linux, Mac OS X, Solaris, FreeBSD, NetBSD, and others
+
| IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2; Wireshark can decrypt IEEE 802.11 WLAN data with user specified encryption keys, and others
+
|
+
|
+
|-
+
| [[xplico]]
+
| [[Open Source]]
+
| Unknown
+
| Unknown
+
| ARP Radiotap Ethernet PPP VLAN L2TP IPv4 IPv6 TCP UDP DNS HTTP SMTP POP IMAP SIP MGCP H323 RTP RTCP SDP FB chat FTP IPP CHDLC PJL NNTP MSN IRC YAHOO GTALK EMULE SSL/TLS IPsec 802.11 LLC MMSE Linux cooked TFTP SNOOP PPPoE Telnet WebMail Paltalk Exp. Paltalk NetBIOS SMB PPI syslog G711ulaw, G711alaw, G722, G729, G723, G726 and RTAudio (x-msrta: Real Time Audio).
+
| Unknown
+
|
+
|
+
|- class="sortbottom"
+
! System
+
! [[software license|License]]
+
! User Interface
+
! Supported Platform
+
! Supported Protocols
+
! class="unsortable" | Refs <!-- This column is for a general reference and does not replace the need to identify references for specific features if the feature is not explained in the general reference -->
+
|}
+
  
== Open Source Network Forensics ==
+
    * Data recovery from HDDs with severe multiple BAD sectors, which appear because of platter surface scratch or malfunction or instability of the magnetic head assembly (MHA).
  
* [[Wireshark]]
+
    * Data recovery from HDDs that start to produce "clicking" sounds, which may be caused by corruption of sector servo labels or a MHA malfunction. If some heads or surfaces are damaged it is possible (before installation of MHA replacement) to create a copy of data using the remaining good surfaces or drive heads.
* [[Kismet]]
+
* [[Snort]]
+
* [[Argus]]
+
* [[OSSEC]]
+
* [[NetworkMiner]] is [http://sourceforge.net/apps/mediawiki/networkminer/index.php?title=NetworkMiner an open source Network Forensics Tool available at SourceForge]
+
* [[Xplico]] is an Internet/IP Traffic Decoder (NFAT). Protocols supported: [http://www.xplico.org/status.html HTTP, SIP, FTP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...]
+
* [[DataEcho]]
+
* [[ntop]]
+
* [[KisMAC]] is a free, open source wireless stumbling and security tool for Mac OS X. [http://kismac-ng.org]
+
* [[Chaosreader]] is a session reconstruction tool (supports both live or captured network traffic)
+
* [[NetFSE]] is a web-based search and analysis application for high-volume network data [http://www.netfse.org available at NetFSE.org]
+
* [http://www.netgrab.co.uk NetSleuth] is a live and retrospective network analysis and triage tool.
+
  
== Commercial Network Forensics ==
+
    * Availability of tools for logical analysis of FAT and NTFS file systems in the software complex allows data recovery in cases, when a drive is functional and only logical data structure is corrupted.
  
===Deep-Analysis Systems===
+
    * When used with malfunctioning drives, Data Compass complex often allows selective extraction of data necessary to your customers without reading all data from a drive ("recover data by file" without creating a complete disk image) saving a lot of time. In some cases, when drive malfunctions cause constant self-damage (like scratches on disks or instable MHA) these are the only means to accomplish this task. With the ShadowDisk technology adopted, users need not to worry about the drive degradation problem.
* WildPackets [[OmniPeek]] [http://www.wildpackets.com/solutions/it_solutions/network_forensics] [http://www.wildpackets.com/products/distributed_network_analysis/omnipeek_network_analyzer/forensics_search]
+
* E-Detective [http://www.edecision4u.com/] [http://www.digi-forensics.com/home.html]
+
* Code Green Networks [http://www.codegreennetworks.com Content Inspection Appliance] - Passive monitoring and mandatory proxy mode. Easy to use Web GUI. Linux platform. Uses Stellent Outside In to access document content and metadata.
+
* NETRESEC [http://www.netresec.com/?page=NetworkMiner NetworkMiner Professional (portable network forensic analysis tool for Windows)]
+
* NetWitness Corporation - Freeware/Commercial, Enterprise-Wide, Real-Time Network Forensics [http://www.netwitness.com/ NetWitness]
+
* Network Instruments [http://www.networkinstruments.com/]
+
* NIKSUN's [[NetDetector]]
+
* PacketMotion [http://www.packetmotion.com/]
+
* Sandstorm's [http://www.sandstorm.net/products/netintercept/ NetIntercept] - Passive monitoring appliance. Qt/X11 GUI. FreeBSD platform. Uses forensic parsers written by Sandstorm to access document content and metadata.
+
* Mera Systems [http://netbeholder.com/ NetBeholder]
+
* [http://www.infowatch.com InfoWatch Traffic Monitor]
+
* MFI Soft [http://sormovich.ru/ SORMovich] (in Russian)
+
* Solera Networks - Provider of full packet capture network forensics appliances [http://www.soleranetworks.com/ Solera Networks]
+
  
===Flow-Based Systems===
+
== Related links ==
* Arbor Networks
+
* GraniteEdge Networks
+
* Lancope http://www.lancope.com/
+
* Mantaro Product Development Services http://www.mantaro.com/products/MNIS/index.htm
+
* Mazu Networks http://www.mazunetworks.com/
+
  
===Hybrid Systems===
+
[http://www.salvationdata.com Official Webiste]
These systems combine flow analysis, deep analysis, and security event monitoring and reporting.
+
* Q1 Labs  http://www.q1labs.com/
+
 
+
== Tips and Tricks ==
+
 
+
* The time between two events triggered by an intruder (as seen in logfiles, for example) can be helpful. If it is very short, you can be pretty sure that the actions were performed by an automated script and not by a human user.
+
 
+
== See also ==
+
* [[Wireless forensics]]
+
* [[SSL forensics]]
+
 
+
* [[IP geolocation]]
+
* [[Tools:Network Forensics]]
+
* [[Tools:Logfile Analysis]]
+
 
+
[[Category:Network Forensics]]
+

Revision as of 07:35, 16 July 2009

Overview

According to our pioneer 3+1 Data Recovery process, the stage following the drive restoration will be data recovery using Data Compass.

After bringing the failed drive back to life, as a data recovery professional, you know now you need to recover the damaged file system by using file system recovery software; and maybe you know also you need to do a disk imaging in order to work from an accurate, stable hard drive image.

Unfortunately, traditional disk imaging tools and methods are designed for and work on good HDDs only, not the patient HDDs that are unstable or inaccessible because of media defects and instable head, which are common challenges of Stage 2 in practice. Even more, with those traditional imaging tools, the time involved and the ordinary user-level repeated-read access to the media bring a risk of damaging the disk and head, making data lost irretrievable.

But now there's a better way: The disk probing equipment included in the Data Compass suite bypassing the disk-level problems such as multiple bad sectors, damaged surfaces, malfunctioning head assembly, or corrupted servo info, In the meantime you can use the default software or any other defined software you have been familiar with (R-studio, Winhex, any) to perform file recovery. Through the Data Compass, problem drives will become intact hard drives and ready for file recovery attempts..


What can Data Compass do?

Data recovery from physically damaged HDDs is what Data Compass designed for.

   * Data recovery from HDDs with severe multiple BAD sectors, which appear because of platter surface scratch or malfunction or instability of the magnetic head assembly (MHA).
   * Data recovery from HDDs that start to produce "clicking" sounds, which may be caused by corruption of sector servo labels or a MHA malfunction. If some heads or surfaces are damaged it is possible (before installation of MHA replacement) to create a copy of data using the remaining good surfaces or drive heads.
   * Availability of tools for logical analysis of FAT and NTFS file systems in the software complex allows data recovery in cases, when a drive is functional and only logical data structure is corrupted.
   * When used with malfunctioning drives, Data Compass complex often allows selective extraction of data necessary to your customers without reading all data from a drive ("recover data by file" without creating a complete disk image) saving a lot of time. In some cases, when drive malfunctions cause constant self-damage (like scratches on disks or instable MHA) these are the only means to accomplish this task. With the ShadowDisk technology adopted, users need not to worry about the drive degradation problem.

Related links

Official Webiste