Category:Digital Forensics XML - Revision history

Ajnelson: Correct wiki syntax error

2013-02-07T03:14:22Z

Correct wiki syntax error

2013-02-07T03:13:16Z

Note draft DFXML schema

2013-01-17T02:20:34Z

‎See Also

2013-01-17T02:19:51Z

‎DFXML Toolkits

2012-06-24T17:03:35Z

‎Tools that produce DFXML

2012-06-19T05:51:28Z

2012-03-30T20:45:41Z

‎Tools that consume DFXML

2012-01-19T17:11:28Z

‎Presentations

2012-01-19T17:10:59Z

2012-01-19T16:59:44Z

‎Tools that produce DFXML

@@ Line 1: / Line 1: @@
 ''Digital Forensics XML'' (DFXML) is the effort to create an XML schema to allow for easy interoperability between different forensic tools.
-Currently there is no Digital Forensics XML standard and there is no fixed schema.  There is a [[http://www.nsrl.nist.gov/DFXML/fileobject.xsd|draft schema]] available [[http://www.nsrl.nist.gov/Downloads.htm|from NIST]]. Instead, we are slowly creating a set of tools that can produce or ingest XML with a common set of tags. It would be nice to have a more aggressive effort, but to date there has not been sufficient funding.
+Currently there is no Digital Forensics XML standard and there is no fixed schema.  There is a [[http://www.nsrl.nist.gov/DFXML/fileobject.xsd draft schema]] available [[http://www.nsrl.nist.gov/Downloads.htm from NIST]]. Instead, we are slowly creating a set of tools that can produce or ingest XML with a common set of tags. It would be nice to have a more aggressive effort, but to date there has not been sufficient funding.
 Given this state of affairs, our current strategy is to:

@@ Line 1: / Line 1: @@
 ''Digital Forensics XML'' (DFXML) is the effort to create an XML schema to allow for easy interoperability between different forensic tools.
-Currently there is no Digital Forensics XML standard and there is no fixed schema. Instead, we are slowly creating a set of tools that can  produce or ingest XML with a common set of tags. It would be nice to have a more aggressive effort, but to date there has not been sufficient funding.
+Currently there is no Digital Forensics XML standard and there is no fixed schema.  There is a [[http://www.nsrl.nist.gov/DFXML/fileobject.xsd|draft schema]] available [[http://www.nsrl.nist.gov/Downloads.htm|from NIST]]. Instead, we are slowly creating a set of tools that can produce or ingest XML with a common set of tags. It would be nice to have a more aggressive effort, but to date there has not been sufficient funding.
 Given this state of affairs, our current strategy is to:

@@ Line 64: / Line 64: @@
 * [http://www.cgsecurity.org/wiki/Data_Carving_Log XML Log Sample for photorec]
 * [http://mark0.net/soft-tridscan-e.html TrIDScan], which has an XML language to describe file types.
 [[Category:Top-Level]]

@@ Line 42: / Line 42: @@
-===DFXML Toolkits===
+===DFXML Toolkit===
 The following toolkits are useful for building new tools that read and write DFXML:
 * The dfxml.py Python module implements objects for reading and writing DFXML.
 * The xml.cpp and xml.h files that are included in the bulk_extractor and md5deep (version 4) source code are a good C++ implementation for DFXML generation.
 * The xml.c and xml.h files that are included in the photorec (new version) source code are a good C implementation for DFXML generation.
 ===XML Forensics Tools and Toolkits===

@@ Line 12: / Line 12: @@
 ===Tools that produce DFXML===
 The following tools are known to produce DFXML:
 * The [[fiwalk]] C++ program produces DFXML for files from disk images using SleuthKit.
-* The following carvers use (or will soon use) DFXML for their report files to indicate the sectors from which carved objects are found:
+* [[frag_find]], the hash-based carver, uses DFXML to document where files physically reside in the disk image.
-** [[frag_find]] (hash-based carver)
+* [[photorec]], the popular carver, uses DFXML to document its configuration and where files physically reside in the disk image.
-** [[photorec]]
-** scalpel
 * [[bulk_extractor]] uses DFXML to report the configuration of each run and the provenance of the input files.
 * [[afxml]], part of AFFLIB, converts metadata for disk images into DFXML format.
 * [[libewf | ewfinfo]], part of libewf, can output metadata for EWF disk images in DFXML format.
-* [[md5deep]], [[sha1deep]], [[hashdeep]], and the other programs in the md5deep package will produce DFXML hash files in the new Version 4 of the program (currently under development).
+* [[md5deep]], [[sha1deep]], [[hashdeep]], and the other programs in the md5deep package produce DFXML hash files when provided with the '''-d''' option. .
 ===Tools that consume DFXML===

@@ Line 31: / Line 31: @@
 * imicrosoft_redact.py, part of the [[fiwalk]] distribution, will break the Microsoft binaries in a disk image.
 * iverify.py, part of the [[fiwalk]] distribution, will verify that the contents of files in a DFXML file haven't been changed.
 ===Tools that transform DFXML===

@@ Line 50: / Line 50: @@
 #Garfinkel, Simson., [http://simson.net/clips/academic/2009.SADFE.xml_forensics.pdf Automating Disk Forensic Processing with SleuthKit, XML and Python], Systematic Approaches to Digital Forensics Engineering (IEEE/SADFE 2009), Oakland, California. (Acceptance rate: 32%, 7/22)
 ===Presentations===
-# [http://simson.net/ref/2011/2011-12-07%20DFXML.pdf DFXML, Simson Garfinkel, December 7, 2011]
+# [http://simson.net/ref/2011/2011-12-07%20DFXML.pdf Digital Forensic Tool Integration], Simson Garfinkel, December 7, 2011
 ==See Also==