Difference between pages "Nickfile (NK2)" and "Second Look"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(See also)
 
 
Line 1: Line 1:
[[Microsoft]] [[Outlook]] uses the '''Nickfile (NK2)''' to store e-mail address aliases.
+
[[File:second_look_logo.png]]
  
The file type is also known as the Outlook AutoComplete File or the Nickname file.
+
The Incident Response edition of '''Second Look®: Linux Memory Forensics''' is designed for use by investigators who need quick, easy, and effective Linux memory acquisition and analysis capabilities.
  
== MIME types ==
+
== Memory Acquisition ==
 +
Second Look® preserves the volatile system state, capturing evidence and information that does not exist on disk and may otherwise be lost as an investigation proceeds.  A command-line script allows for acquisition of memory from running systems without introducing any additional software.  A memory access driver is provided for use on systems without a native interface to physical memory.
  
The actual mime type of the NK2 format is unspecified
+
== Memory Analysis ==
 +
Second Look® interprets live system memory or captured memory images, detecting and reverse engineering malware, including stealthy kernel rootkits and backdoors.  A kernel integrity verification approach is utilized to compare the Linux kernel in memory with a reference kernel.  Pikewerks provides thousands of reference kernels derived from original distribution kernel packages, and a script for creating reference kernels for other systems, such as those running custom kernels.
  
== File signature ==
+
Second Look® also applies an integrity verification approach for the analysis of each process in memory.  This enables it to detect unauthorized applications as well as stealthy user-level malware.
  
The NK2 has the following file signature:
+
== Supported Systems ==
hexadecimal: 0D F0 AD BA
+
Second Look® is regularly updated to support analysis of the latest kernels and the most commonly used Linux distributions.  The following are its capabilities as of April 2012:
 
+
* Supported target kernels: 2.6.x, 3.x up to 3.2
Note that other sources claim that the file signature is
+
* Supported target architectures: x86 32- and 64-bit
hexadecimal: 0D F0 AD BA 0A 00 00 00
+
* Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-12.04, and more!
 
+
== Contents ==
+
 
+
The NK2 basically contains a list of items. The attributes of these items are defined by the [[Microsoft]] [[Outlook]] [[Message API (MAPI)]].
+
  
 
== External Links ==
 
== External Links ==
 
+
Second Look® is a product of [[Raytheon Pikewerks Corporation]]:
* [http://code.google.com/p/libnk2/downloads/detail?name=Nickfile%20%28NK2%29%20format.pdf Nickfile (NK2) format specification], by the [[libnk2|libnk2 project]]
+
* http://secondlookforensics.com
* [http://code.google.com/p/libpff/downloads/detail?name=MAPI%20definitions.pdf MAPI definitions], by the [[libpff|libpff project]]
+
 
+
[[Category:File Formats]]
+

Revision as of 09:53, 17 April 2012

Second look logo.png

The Incident Response edition of Second Look®: Linux Memory Forensics is designed for use by investigators who need quick, easy, and effective Linux memory acquisition and analysis capabilities.

Memory Acquisition

Second Look® preserves the volatile system state, capturing evidence and information that does not exist on disk and may otherwise be lost as an investigation proceeds. A command-line script allows for acquisition of memory from running systems without introducing any additional software. A memory access driver is provided for use on systems without a native interface to physical memory.

Memory Analysis

Second Look® interprets live system memory or captured memory images, detecting and reverse engineering malware, including stealthy kernel rootkits and backdoors. A kernel integrity verification approach is utilized to compare the Linux kernel in memory with a reference kernel. Pikewerks provides thousands of reference kernels derived from original distribution kernel packages, and a script for creating reference kernels for other systems, such as those running custom kernels.

Second Look® also applies an integrity verification approach for the analysis of each process in memory. This enables it to detect unauthorized applications as well as stealthy user-level malware.

Supported Systems

Second Look® is regularly updated to support analysis of the latest kernels and the most commonly used Linux distributions. The following are its capabilities as of April 2012:

  • Supported target kernels: 2.6.x, 3.x up to 3.2
  • Supported target architectures: x86 32- and 64-bit
  • Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-12.04, and more!

External Links

Second Look® is a product of Raytheon Pikewerks Corporation: