Difference between pages "Category:Disk imaging" and "Malware"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Unix-based imagers)
 
(Exploit Kit)
 
Line 1: Line 1:
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#dddddd; align:center;">
+
'''Malware''' is a short version of '''Malicious Software'''.
'''Note:''' We're trying to use the same [[tool template]] for all devices. Please use this if possible.
+
</div>
+
  
'''TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...'''
+
Malware is software used for data theft, device damage, harassment, etc. It is very similar to computer malware. It installs things such as trojans, worms, and botnets to the affected device. It is illegal to knowingly distribute malware.
  
= Hardware imagers =
+
== Virus ==
; [[DFL-DE Data Recovery Tool]]
+
A computer program that can automatically copy itself and infect a computer.
: Including three main modules: disk imaging modules, file recovery modules and automatic hdd repair modules, fixing both detected and undetected hard drives. http://www.datarecoverytools4u.com/product/data-extractor-dfl-de/.
+
;[[Data Compass]]
+
:A hardware and software tool by [[SalvationDATA]] that can image data from bad sectors, unstable heads and other drives.
+
; [[DeepSpar Disk Imager]]
+
: Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html  - Data Sheet and Whitepaper available for download from product web page.
+
; [[ICS Solo3]]
+
: Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
+
; [[Logicube Talon]]
+
: Supports USB
+
; [[PSIClone]]
+
: Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
+
: Enhanced Error Handling and Logging
+
; [[Voom HardCopy III]]
+
: Allows destination drive to be formatted in NTFS.
+
  
= Unix-based imagers=
+
== Worm ==
 +
A self-replicating computer program that can automatically infect computers on a network.
  
; '''ewfacquire''', '''ewfacquirestream'''
+
== Trojan horse ==
: The tools '''ewfacquire''' and '''ewfacquiresteam''' are part of the [[libewf]] library package. They can create evidence files in the [[EnCase]] and [[FTK Imager]] .E0* (EWF-E01) and [[SMART]] .s0* (EWF-S01) formats. '''ewfacquire''' is intended to read from devices and '''ewfacquirestream''' from pipes. Both tools calculate an [[MD5]] hash on default while the data is being acquired. They are able to calculate a [[SHA1]] message digest as well, but because of compatibility with [[EnCase]] they only store the [[SHA1]] hash in the Extended EWF (EWF-X) format. '''ewfacquire''' and '''ewfacquirestream''' provide support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
+
A computer program which appears to perform a certain action, but actually performs many different forms of codes.
: [[libewf]]
+
  
; [[Adepto]]
+
== Spyware ==
: http://www.e-fense.com/helix/
+
A computer program that can automatically intercept or take partial control over the user's interaction.
  
; [[aimage]]
+
== Exploit Kit ==
: Part of the [[AFF]] system, [[aimage]] can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. [[aimage]]  can optionally compress and calculate [[MD5]] or [[SHA-1]] hash residues while the data is being copied. It has intelligent error recovery, similar to what is in [[ddrescue]].
+
A toolkit that automates the exploitation of client-side vulnerabilities, targeting browsers and programs that a website can invoke through the browser [http://blog.zeltser.com/post/1410922437/what-are-exploit-kits]. Often utilizing a drive-by-download.
  
; [[AIR]]
+
=== Drive-by-download ===
: AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
+
Any download that happens without a person's knowledge [http://en.wikipedia.org/wiki/Drive-by_download].
: http://air-imager.sourceforge.net/
+
  
; [[dcfldd]]
+
== See Also ==
: A version of [[dd]] created by the [[Digital Computer Forensics Laboratory]]. [[dcfldd]] is an enhanced version of [[GNU]] dd with features useful for forensics and security, such as calculating [[MD5]] or [[SHA-1]] [[hash]]es on the fly and faster disk wiping.
+
  
; [[dd]]
+
== External Links ==
: A program that converts and copies files, is one of the oldest [[Unix]] programs. I can copy data from any Unix "file" (including a [[raw partition]]) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces [[raw image files]]. Extended into [[dcfldd]].
+
* [http://en.wikipedia.org/wiki/Malware Wikipedia entry on malware]
 +
* [http://en.wikipedia.org/wiki/Drive-by_download Wikipedia drive-by-download]
 +
* [http://www.viruslist.com/ Viruslist.com]
 +
* [http://code.google.com/p/androguard/wiki/DatabaseAndroidMalwares Androguard]: A list of recognized Android malware
  
; EnCase [[LinEn]]
+
=== Exploit Kit ===
: Linux-based version of EnCase's forensic imaging tool.
+
* [http://blog.zeltser.com/post/1410922437/what-are-exploit-kits What Are Exploit Kits?], by [[Lenny Zeltser]], October 26, 2010
 +
* [http://nakedsecurity.sophos.com/2013/07/02/the-four-seasons-of-glazunov-digging-further-into-sibhost-and-flimkit/ The four seasons of Glazunov: digging further into Sibhost and Flimkit], by Fraser Howard, July 2, 2013
  
; GNU [[ddrescue]]
+
[[Category:Malware]]
: http://www.gnu.org/software/ddrescue/ddrescue.html
+
 
+
; [[dd_rescue]]
+
: http://www.garloff.de/kurt/linux/ddrescue/
+
: A tool similar to [[dd]], but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
+
 
+
; iLook [[IXimager]]
+
: The primary imaging tool for [[iLook]]. It is [[Linux]] based and produces compressed authenticatable [[image file]]s that may only be read in the iLook analysis tool.
+
 
+
; [[MacQuisition Boot CD]]
+
: Provides software to safely image [[Macintosh]] drives.
+
 
+
; [[rdd]]
+
: http://sourceforge.net/projects/rdd
+
: Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
+
 
+
; [[sdd]]
+
: Another [[dd]]-like tool. It is supposed to be faster in certain situations.
+
 
+
= Windows-based imagers =
+
 
+
; [[AccessData]]
+
: Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
+
 
+
; [[ASR]]
+
: A tool for [[imaging]] and analyzing disks.
+
 
+
; [[DIBS]]
+
: Can image and convert many file formats. Also builds mobile toolkit.
+
 
+
; [[EnCase]]
+
: Can image with out dongle plugged in. Only images to E0* file.
+
 
+
; [[FTK Imager]] by [[AccessData]]
+
: Can image and convert many image formats. Including [[E0*]] (EWF-E01), s0* (EWF-S01) and [[dd]]. Also a free tool.
+
 
+
; [[Ghost]]
+
: FTK can read forensic, uncompressed [[Ghost image]]s.
+
 
+
; [[iLook]]
+
: The [[IRS]]'s set of forensic tools and utilities.  iLook V8 can image in Windows.
+
 
+
; [[Paraben]]
+
: A complete set of tools for [[Windows]] (and [[handheld]]) products.
+
 
+
; [[ProDiscovery]]
+
: Images and searches [[FAT12]], [[FAT16]], [[FAT32]] and all [[NTFS]] files.
+
 
+
; [[X-Ways Forensics]]
+
: Has some limited imaging capabilities. The output is [[raw format]].
+
 
+
; [[X-Ways Replica]]
+
: Performs [[hard disk]] [[cloning]] and imaging. The output is [[raw format]].
+
 
+
 
+
[[Category:Tools]]
+
 
+
[[Category:Tools]]
+

Revision as of 02:05, 21 October 2013

Malware is a short version of Malicious Software.

Malware is software used for data theft, device damage, harassment, etc. It is very similar to computer malware. It installs things such as trojans, worms, and botnets to the affected device. It is illegal to knowingly distribute malware.

Virus

A computer program that can automatically copy itself and infect a computer.

Worm

A self-replicating computer program that can automatically infect computers on a network.

Trojan horse

A computer program which appears to perform a certain action, but actually performs many different forms of codes.

Spyware

A computer program that can automatically intercept or take partial control over the user's interaction.

Exploit Kit

A toolkit that automates the exploitation of client-side vulnerabilities, targeting browsers and programs that a website can invoke through the browser [1]. Often utilizing a drive-by-download.

Drive-by-download

Any download that happens without a person's knowledge [2].

See Also

External Links

Exploit Kit