Difference between revisions of "PyFlag"
From Forensics Wiki
(→File Search Facilities) |
Joachim Metz (Talk | contribs) |
||
| (19 intermediate revisions by 7 users not shown) | |||
| Line 1: | Line 1: | ||
| − | + | {{Deprecated Software}} | |
| − | + | {{Infobox_Software | | |
| + | name = PyFlag | | ||
| + | maintainer = [[Michael Cohen]], [[David Collett]] | | ||
| + | os = {{Linux}}, {{Web-based}} | | ||
| + | genre = {{Analysis}} | | ||
| + | license = {{GPL}} | | ||
| + | website = [http://sourceforge.net/projects/pyflag/ sourceforge.net/projects/pyflag/] | | ||
| + | }} | ||
| − | [ | + | '''PyFlag''' is a web-based, database-backed ''forensic and log analysis GUI'' and [[Computer forensics framework]] written in [[Python]]. PyFlag stores disk images in numerous file formats, including raw, [[sgzip]], [[AFF]], and [[EnCase]] format. |
| − | + | = Features = | |
| − | =Features= | + | == Suppoprted File Systems == |
| − | + | PyFlag uses the [[Sleuthkit]] for file system support. | |
| − | ==File Systems | + | |
| − | + | ||
| − | + | ||
==File Search Facilities== | ==File Search Facilities== | ||
| Line 22: | Line 26: | ||
Can it build timelines and search by creation date? | Can it build timelines and search by creation date? | ||
| + | * Creates a "case file". | ||
==Searching Abilities== | ==Searching Abilities== | ||
| Line 30: | Line 35: | ||
==Hash Databases== | ==Hash Databases== | ||
| − | * Hashes and compares with Hashkeeper using MD5. | + | * Hashes and compares with [[Hashkeeper]] using [[MD5]]. |
==Evidence Collection Features== | ==Evidence Collection Features== | ||
| − | |||
| − | |||
=History= | =History= | ||
| − | + | * Originally started by the [[Australian Department of Defence]], PyFlag is now hosted on [[SourceForge]]. | |
| − | * | + | |
| − | + | ||
| − | + | ||
| − | + | ||
| − | + | ||
= External Links = | = External Links = | ||
| − | + | * http://sourceforge.net/projects/pyflag/ | |
| − | + | ||
| − | + | ||
| − | + | ||
Latest revision as of 06:34, 27 July 2012
|
This tool is deprecated.
|
| PyFlag | |
|---|---|
| Maintainer: | Michael Cohen, David Collett |
| OS: | Linux,Web-based |
| Genre: | Analysis |
| License: | GPL |
| Website: | sourceforge.net/projects/pyflag/ |
PyFlag is a web-based, database-backed forensic and log analysis GUI and Computer forensics framework written in Python. PyFlag stores disk images in numerous file formats, including raw, sgzip, AFF, and EnCase format.
Contents |
[edit] Features
[edit] Suppoprted File Systems
PyFlag uses the Sleuthkit for file system support.
[edit] File Search Facilities
- Lists allocated and unallocated files.
- Sorts files by type.
- Searches for keywords.
- Works with compressed zip files.
[edit] Historical Reconstruction
Can it build timelines and search by creation date?
- Creates a "case file".
[edit] Searching Abilities
- Searches for keywords.
- Builds an index.
[edit] Hash Databases
- Hashes and compares with Hashkeeper using MD5.
[edit] Evidence Collection Features
[edit] History
- Originally started by the Australian Department of Defence, PyFlag is now hosted on SourceForge.
