Difference between pages "Tcpflow" and "File Carving Bibliography"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
m
 
m (Basic Techniques)
 
Line 1: Line 1:
{{Infobox_Software |
+
==File Carving Bibliography==
  name = tcpflow |
+
'''In chronological order, oldest to most recent'''
  maintainer = Simson Garfinkel |
+
===Basic Techniques===
  os = {{Linux}} |
+
  genre = Network forensics |
+
  license = {{GPL}} |
+
  website = [http://afflib.org/software/tcpflow/] |
+
}}
+
  
'''tcpflow''' is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging. Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction. tcpflow can also process stored ‘tcpdump’ packet flows.
+
<bibtex>
 +
@INPROCEEDINGS{Shanmugasundaram02automaticreassembly,
 +
    author = {Kulesh Shanmugasundaram},
 +
    title = {Automatic Reassembly of Document Fragments via Data Compression},
 +
    booktitle = {Presented at the 2nd Digital Forensics Research Workshop},
 +
    year = {2002},
 +
    pages = {152--159}
 +
}
 +
</bibtex>
  
tcpflow is similar to ‘tcpdump’, in that both process packets from the wire or from a stored file. But it’s different in that it reconstructs the actual data streams and stores each flow in a separate file for later analysis.
+
[http://handle.dtic.mil/100.2/ADA432468 An analysis of disc carving techniques], Mikus, Nicholas A. " Master's Thesis, Naval Postgraduate School. March 2005.
  
tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery.  
+
Garfinkel, S., "Carving Contiguous and Fragmented Files with Fast Object Validation", Digital Forensics Workshop (DFRWS 2007), Pittsburgh, PA, August 2007.  http://www.simson.net/clips/academic/2007.DFRWS.pdf
  
Jeremy Elson developed the first version of tcpflow in 1999 but stopped maintaining it in 2003. In 2006 Simson Garfinkel took over maintenance of the program and added:
+
===Sector Discrimination===
  
* support for VLANs
+
<bibtex>
* support for IPv6
+
@article{
* [[DFXML]] output of the connections in a '''report.xml''' file.
+
  journal="Journal of Digital Forensic Practice", 
* Improved performance through the use of the C++ STL classes.
+
  publisher="Taylor & Francis",
* Support for continuous operation (tcpflow now purges out old flows).
+
  author="Yoginder Singh Dandass and Nathan Joseph Necaise and Sherry Reede Thomas",
* Variable Filename specifications.
+
  title="An Empirical Analysis of Disk Sector Hashes for Data Carving",
* A plug-in architecture.
+
  year=2008,
 +
  volume=2,
 +
  issue=2,
 +
  pages="95--106",
 +
  abstract="Discovering known illicit material on digital storage devices is an important component of a digital forensic investigation. Using existing data carving techniques and tools, it is typically difficult to recover remaining fragments of deleted illicit files whose file system metadata and file headers have been overwritten by newer files. In such cases, a sector-based scan can be used to locate those sectors whose content matches those of sectors from known illicit files. However, brute-force sector-by-sector comparison is prohibitive in terms of time required. Techniques that compute and compare hash-based signatures of sectors in order to filter out those sectors that do not produce the same signatures as sectors from known illicit files are required for accelerating the process.
  
tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like ‘tcpdump’ support. It should compile under most popular versions of UNIX; see the INSTALL file for details.
+
This article reports the results of a case study in which the hashes for over 528 million sectors extracted from over 433,000 files of different types were analyzed. The hashes were computed using SHA1, MD5, CRC64, and CRC32 algorithms and hash collisions of sectors from JPEG and WAV files to other sectors were recorded. The analysis of the results shows that although MD5 and SHA1 produce no false-positive indications, the occurrence of false positives is relatively low for CRC32 and especially CRC64. Furthermore, the CRC-based algorithms produce considerably smaller hashes than SHA1 and MD5, thereby requiring smaller storage capacities. CRC64 provides a good compromise between number of collisions and storage capacity required for practical implementations of sector-scanning forensic tools.",
tcpflow stores all captured data in files that have names of the form:
+
  url="http://www.informaworld.com/10.1080/15567280802050436"
    128.129.130.131.02345-010.011.012.013.45103[VLAN]
+
}
where the contents of the above file would be data transmitted from host 128.129.131.131 port 2345, to host 10.11.12.13 port 45103. VLAN information, if provided is stored in brackets.
+
</bibtex>
  
== Overview ==
+
[[Category:Bibliographies]]
 
+
tcpflow stores all captured data in files that have names of the form
+
: 128.129.130.131.02345-010.011.012.013.45103
+
where the contents of the above file would be data transmitted from host ''128.129.131.131'' port ''2345'', to host ''10.11.12.13'' port ''45103''.
+
 
+
== Limitations ==
+
 
+
* tcpflow does not understand IP fragments;
+
* tcpflow does not understand 802.11 headers.
+
 
+
 
+
[[Category:Network Forensics]]
+

Revision as of 22:59, 20 October 2008

File Carving Bibliography

In chronological order, oldest to most recent

Basic Techniques

Kulesh Shanmugasundaram - Automatic Reassembly of Document Fragments via Data Compression
Presented at the 2nd Digital Forensics Research Workshop pp. 152--159,2002
Bibtex
Author : Kulesh Shanmugasundaram
Title : Automatic Reassembly of Document Fragments via Data Compression
In : Presented at the 2nd Digital Forensics Research Workshop -
Address :
Date : 2002

An analysis of disc carving techniques, Mikus, Nicholas A. " Master's Thesis, Naval Postgraduate School. March 2005.

Garfinkel, S., "Carving Contiguous and Fragmented Files with Fast Object Validation", Digital Forensics Workshop (DFRWS 2007), Pittsburgh, PA, August 2007. http://www.simson.net/clips/academic/2007.DFRWS.pdf

Sector Discrimination

Yoginder Singh Dandass, Nathan Joseph Necaise, Sherry Reede Thomas - An Empirical Analysis of Disk Sector Hashes for Data Carving
2:95--106,2008
http://www.informaworld.com/10.1080/15567280802050436
Bibtex
Author : Yoginder Singh Dandass, Nathan Joseph Necaise, Sherry Reede Thomas
Title : An Empirical Analysis of Disk Sector Hashes for Data Carving
In : -
Address :
Date : 2008