Difference between revisions of "PyFlag"

From ForensicsWiki
Jump to: navigation, search
m (Reverted edit of Porker, changed back to last version by Uwe Hermann)
Line 1: Line 1:
Man shot dead at vehicle checkpoint
+
'''PyFlag''' is a web-based, database-backed ''forensic and log analysis GUI'' written in [[Python]].
A man has been shot dead by police at a vehicle checkpoint in Northern Ireland. Officers fired a number of rounds during the incident on Church Street in Ballynahinch, County Down. The man shot dead was the
+
 
 +
=Features=
 +
 
 +
==File Systems Understood==
 +
 
 +
==File Search Facilities==
 +
 
 +
* Lists allocated and unallocated files.
 +
* Sorts files by type.
 +
* Searches for keywords.
 +
* Works with compressed zip files.
 +
 
 +
==Historical Reconstruction==
 +
 
 +
Can it build timelines and search by creation date?
 +
* Creates a "case file".
 +
 
 +
==Searching Abilities==
 +
 +
* Searches for keywords.
 +
* Builds an index.
 +
 
 +
==Hash Databases==
 +
 +
* Hashes and compares with [[Hashkeeper]] using [[MD5]].
 +
 
 +
==Evidence Collection Features==
 +
 
 +
=History=
 +
 
 +
* Originally started by the [[Australian Department of Defence]], PyFlag is now hosted on [[SourceForge]].
 +
 
 +
==License Notes==
 +
 
 +
* GNU GPL
 +
 
 +
= External Links =
 +
 +
* [http://pyflag.sourceforge.net/ Official website]
 +
 
 +
==External Reviews==

Revision as of 12:57, 16 April 2006

PyFlag is a web-based, database-backed forensic and log analysis GUI written in Python.

Features

File Systems Understood

File Search Facilities

  • Lists allocated and unallocated files.
  • Sorts files by type.
  • Searches for keywords.
  • Works with compressed zip files.

Historical Reconstruction

Can it build timelines and search by creation date?

  • Creates a "case file".

Searching Abilities

  • Searches for keywords.
  • Builds an index.

Hash Databases

Evidence Collection Features

History

License Notes

  • GNU GPL

External Links

External Reviews