Open Computer Forensics Architecture - Revision history

Joachim Metz at 05:23, 11 August 2012

2012-08-11T05:23:51Z

Capibara at 10:03, 28 August 2009

2009-08-28T10:03:30Z

Capibara at 09:28, 28 August 2009

2009-08-28T09:28:12Z

Capibara at 21:45, 3 December 2008

2008-12-03T21:45:28Z

Capibara at 19:03, 3 December 2008

2008-12-03T19:03:10Z

Capibara at 13:13, 22 June 2006

2006-06-22T13:13:58Z

Uwe Hermann: Typo.

2006-05-15T23:23:11Z

Typo.

Uwe Hermann: Wikified.

2006-05-15T23:21:12Z

Wikified.

Capibara at 07:05, 15 May 2006

2006-05-15T07:05:32Z

New page

The Open Computer Forensics Architecture (OCFA) is a modular computer forensics framework build by the "Dutch National Police Agency". The main goal
is to automate the digital forensic process to speed up the investigation and give tactical investigators direct access to the seized data through
an easy to use search and browse interface.

The architecture forms an environment where existing forensic tools and libraries can be easily plugged into the architecture and can thus be made
part of the recursive extraction of data and metadata from digital evidence.

The Open Computer Forensics Architecture aims to be highly modular, robust fault tolerant, recursive and scalable in order to be usable in large
investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.

Currently the Open Computer Forensics Architecture is only available for law enforcement. Organizations interested can send an email to
ocfa@dnpa.nl. Under NDA conditions it can also be made available for academic purposes. Questions about licensing can be directed at
license@dnpa.nl.

@@ Line 1: / Line 1: @@
-The '''Open Computer Forensics Architecture''' ('''OCFA''') is a modular [[computer forensics framework]] built by the [[Dutch National Police Agency]]. The main goal is to automate the digital forensic process to speed up the investigation and give tactical [[investigator]]s direct access to the seized data through an easy to use search and browse interface.
+{{Infobox_Software |
 The architecture forms an environment where existing forensic [[tools]] and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and [[metadata]] from digital evidence.
@@ Line 17: / Line 26: @@
 is something that should proof very useful in most investigations.
-For more information consult [http://sourceforge.net/projects/ocfa/  sourceforge.net/projects/ocfa/ ] .
+For more information consult the project site.

@@ Line 7: / Line 7: @@
 Modules in OCFA for reasons of fault tolerance are processes. The basic [[OcfaLib API]] makes it possible and relatively easy to build an OCFA module out of any data processing library or tool. OCFA comes with numerous such modules that are mostly wrappers around libraries like [[libmagic]] or tools such as those found in the [[Sleuthkit]].
-The 2.2 version of OCFA (released April 2009) makes the previously internal [[OCFA treegraph API]] available for OCFA module development. The OCFA treegraph API allows more advanced dissectors that produce data and meta-data for a treegraph representation of an input file.  The OCFA treegraph API also allows dissectors that are programed to be [[CarvFs]] aware to use [[Zero Storage Carving]].
+The 2.2 version of OCFA (released April 2009) makes the previously internal [[OCFA treegraph API]] available for OCFA module development. The OCFA treegraph API allows more advanced dissectors that produce data and meta-data for a treegraph representation of an input file.  The OCFA treegraph API also allows dissectors that are programed to be [[CarvFs]] aware to use [[zero storage carving]].
 Communication between modules within OCFA is governed by a two layered communication infrastructure as provided by OCFA. At the lowest layer is a messaging system with at is center the OCFA Anycast Relay. The Anycast Relay provides the facilities of module crash resistance, distributed processing load balancing and flow control.

@@ Line 5: / Line 5: @@
 The Open Computer Forensics Architecture aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.
-Modules in OCFA for reasons of fault tolerance are processes. The [[OcfaLib API]] makes it possible and relatively easy to build an OCFA module out of any data processing library or tool. OCFA comes with numerous such modules that are mostly wrappers around libraries like [[libmagic]] or tools such as those found in the [[Sleuthkit]].
+Modules in OCFA for reasons of fault tolerance are processes. The basic [[OcfaLib API]] makes it possible and relatively easy to build an OCFA module out of any data processing library or tool. OCFA comes with numerous such modules that are mostly wrappers around libraries like [[libmagic]] or tools such as those found in the [[Sleuthkit]].
 Communication between modules within OCFA is governed by a two layered communication infrastructure as provided by OCFA. At the lowest layer is a messaging system with at is center the OCFA Anycast Relay. The Anycast Relay provides the facilities of module crash resistance, distributed processing load balancing and flow control.

← Older revision		Revision as of 21:45, 3 December 2008
Line 1:		Line 1:
−	The '''Open Computer Forensics Architecture''' ('''OCFA''') is a modular computer forensics framework built by the [[Dutch National Police Agency]]. The main goal is to automate the digital forensic process to speed up the investigation and give tactical [[investigator]]s direct access to the seized data through an easy to use search and browse interface.	+	The '''Open Computer Forensics Architecture''' ('''OCFA''') is a modular [[computer forensics framework]] built by the [[Dutch National Police Agency]]. The main goal is to automate the digital forensic process to speed up the investigation and give tactical [[investigator]]s direct access to the seized data through an easy to use search and browse interface.

	The architecture forms an environment where existing forensic [[tools]] and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and [[metadata]] from digital evidence.		The architecture forms an environment where existing forensic [[tools]] and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and [[metadata]] from digital evidence.

← Older revision		Revision as of 19:03, 3 December 2008
Line 5:		Line 5:
	The Open Computer Forensics Architecture aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.		The Open Computer Forensics Architecture aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.

−	For more information consult [http://~~ocfa.~~sourceforge.net/ ocfa.sourceforge.net ] .	+	Modules in OCFA for reasons of fault tolerance are processes. The [[OcfaLib API]] makes it possible and relatively easy to build an OCFA module out of any data processing library or tool. OCFA comes with numerous such modules that are mostly wrappers around libraries like [[libmagic]] or tools such as those found in the [[Sleuthkit]].
		+
		+	Communication between modules within OCFA is governed by a two layered communication infrastructure as provided by OCFA. At the lowest layer is a messaging system with at is center the OCFA Anycast Relay. The Anycast Relay provides the facilities of module crash resistance, distributed processing load balancing and flow control.
		+	At a higher level of communication, the OCFA XML Router provides for the routing of individual pieces of evidence through the most appropriate tool chain for its particular type of content.
		+
		+	Although OCFA contains a rudimentary user interface, most of its power is in the backend architecture.
		+	The last and final module in the tool chain of any evidence will be the OCFA Data Store Module. This module
		+	processes the evidence XML (that contains all of the evidence data its meta data) and stores relevant parts into a postgesql database. Extending the apache based user interface with interfaces for your own case bound queries
		+	is something that should proof very useful in most investigations.
		+
		+	For more information consult [http://sourceforge.net/projects/ocfa/ sourceforge.net/projects/ocfa/ ] .

← Older revision		Revision as of 13:13, 22 June 2006
Line 5:		Line 5:
	The Open Computer Forensics Architecture aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.		The Open Computer Forensics Architecture aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.

−	~~Currently the Open Computer Forensics Architecture is only available for~~ [~~[law enforcement]]. Organizations interested can send an email to [mailto~~:ocfa~~@dnpa~~.nl ocfa~~@dnpa.nl]. Under [[NDA]] conditions it can also be made available for academic purposes. Questions about licensing can be directed at [mailto:license@dnpa~~.~~nl license@dnpa~~.nl].	+	For more information consult [http://ocfa.sourceforge.net/ ocfa.sourceforge.net ] .

← Older revision		Revision as of 23:23, 15 May 2006
Line 1:		Line 1:
−	The '''Open Computer Forensics Architecture''' ('''OCFA''') is a modular computer forensics framework ~~build~~ by the [[Dutch National Police Agency]]. The main goal is to automate the digital forensic process to speed up the investigation and give tactical [[investigator]]s direct access to the seized data through an easy to use search and browse interface.	+	The '''Open Computer Forensics Architecture''' ('''OCFA''') is a modular computer forensics framework built by the [[Dutch National Police Agency]]. The main goal is to automate the digital forensic process to speed up the investigation and give tactical [[investigator]]s direct access to the seized data through an easy to use search and browse interface.

	The architecture forms an environment where existing forensic [[tools]] and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and [[metadata]] from digital evidence.		The architecture forms an environment where existing forensic [[tools]] and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and [[metadata]] from digital evidence.

@@ Line 1: / Line 1: @@
-The Open Computer Forensics Architecture (OCFA) is a modular computer forensics framework build by the "Dutch National Police Agency". The main goal
+The '''Open Computer Forensics Architecture''' ('''OCFA''') is a modular computer forensics framework build by the [[Dutch National Police Agency]]. The main goal is to automate the digital forensic process to speed up the investigation and give tactical [[investigator]]s direct access to the seized data through an easy to use search and browse interface.
-is to automate the digital forensic process to speed up the investigation and give tactical investigators direct access to the seized data through
 an easy to use search and browse interface.
-The architecture forms an environment where existing forensic tools and libraries can be easily plugged into the architecture and can thus be made
+The architecture forms an environment where existing forensic [[tools]] and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and [[metadata]] from digital evidence.
 part of the recursive extraction of data and metadata from digital evidence.
-The Open Computer Forensics Architecture aims to be highly modular, robust fault tolerant, recursive and scalable in order to be usable in large
+The Open Computer Forensics Architecture aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.
 investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.
-Currently the Open Computer Forensics Architecture is only available for law enforcement. Organizations interested can send an email to
+Currently the Open Computer Forensics Architecture is only available for [[law enforcement]]. Organizations interested can send an email to [mailto:ocfa@dnpa.nl ocfa@dnpa.nl]. Under [[NDA]] conditions it can also be made available for academic purposes. Questions about licensing can be directed at [mailto:license@dnpa.nl license@dnpa.nl].
 ocfa@dnpa.nl. Under NDA conditions it can also be made available for academic purposes. Questions about licensing can be directed at
 license@dnpa.nl.