.FUF at 09:15, 21 September 2008

2008-09-21T09:15:59Z

Wikinb: New page: '''Selective File Dumper''' (SFDumper) is an open source free computer forensics useful tool written in Bash Script, by Nanni Bassetti and Denis Frati, for [[...

2008-03-14T19:35:07Z

New page: '''Selective File Dumper''' (SFDumper) is an open source free computer forensics useful tool written in Bash Script, by Nanni Bassetti and Denis Frati, for [[...

New page

'''Selective File Dumper''' (SFDumper) is an [[open source]] [[Free software|free]] [[computer forensics]] useful tool written in [[Bash]] Script, by Nanni Bassetti and Denis Frati, for [[Linux]] systems.

The script is fast and selective and it can retrieve all the files of the file type chosen (eg. .doc or .jpg)., active, deleted and unallocated, in interactive way.

The [[Bash]] script '''SFDUMPER.SH''', can recover active, deleted and unallocated files automatically and then it can delete the carved files duplicates of the deleted and active files retrieved by the [[Sleuthkit]], thanks to the comparison of the [[SHA256]] [[hash]] codes of the carved files and the active and deleted files.

It's possible to recognize the renamed files by the data carving and it's possible to expand the [[Foremost]] configuration file inside the script, for adding new extensions.

Finally, it is possible to do a [[keywords]] search on the set of files extracted by the [[Sleuthkit]] and [[Foremost]].

The script can work on the partition chosen from an image file or directly from the device (eg. /dev/sdb).

== Actions ==

<blockquote>
1) Choosing the partition to analyze from an image file or a device; 
2) Choosing the file type by the extension you need to have; 
3) Extracting all referenced files by their extension; 
4) Extracting all the deleted files by their extension; 
5) Carving all the partitions chosen and, automatically, the script will 
delete the duplicate files leaving only the carved files whose are not 
into the referenced or delete set of files; 
6) Executing a keyword search on all the retrieved files; 
7) Reporting all with the investigator name, date and time. 
</blockquote>

== Requirements ==

<blockquote>
[[Linux OS]] 
[[Sleuthkit]] 
[[Foremost]] 
[[Sha256deep]] 
[[grep]] 
[[awk]] 
[[sed]] 
[[dd]] 
</blockquote>

== Requirements for the GUI version ==

[[Zenity]]

== Usage ==

sudo sh sfdumper.sh 
or 
chmod +x sfdumper.sh 
./sfdumper.sh 

== Official web site ==

http://sfdumper.sourceforge.net

== External links ==

http://freshmeat.net/projects/zenity

[[Category:Computer forensics]]
[[Category:Free security software]]
[[Category:Unix software]]

@@ Line 1: / Line 1: @@
-'''Selective File Dumper''' (SFDumper) is an [[open source]] [[Free software|free]] [[computer forensics]] useful tool written in [[Bash]] Script, by Nanni Bassetti and Denis Frati, for [[Linux]] systems.
+{{Infobox_Software |
-The script is fast and selective and it can retrieve all the files of the file type chosen (eg. .doc or .jpg)., active, deleted and unallocated, in interactive way.
+'''Selective File Dumper''' (SFDumper) is a tool written in [[Bash]] Script for [[Linux]] systems.
-The [[Bash]] script '''SFDUMPER.SH''', can recover active, deleted and unallocated files automatically and then it can delete the carved files duplicates of the deleted and active files retrieved by the [[Sleuthkit]], thanks to the comparison of the [[SHA256]] [[hash]] codes of the carved files and the active and deleted files.
+It's fast and selective, it can retrieve all the files of the file type you choose with only one tool referenced, deleted and unallocated in very fast way.
 It's possible to recognize the renamed files by the data carving and it's possible to expand the [[Foremost]] configuration file inside the script, for adding new extensions.
@@ Line 10: / Line 19: @@
 The script can work on the partition chosen from an image file or directly from the device (eg. /dev/sdb).
 == Actions ==
@@ Line 25: / Line 33: @@
 ) Reporting all with the investigator name, date and time.<br />
 </blockquote>
 == Requirements ==
-<blockquote>
+* [[Linux]]
-[[Linux OS]]<br />
+* [[Sleuthkit]]
-[[Sleuthkit]]<br />
+* [[Foremost]]
-[[Foremost]] <br />
+* [[md5deep]] (sha256deep)
-[[Sha256deep]]<br />
+* [[grep]]
-[[grep]]<br />
+* [[awk]]
-[[awk]]<br />
+* [[sed]]
-[[sed]]<br />
+* [[dd]]
-[[dd]]<br />
-</blockquote>
 == Requirements for the GUI version ==
-[[Zenity]]
+* [[Zenity]]
-−
 == Usage ==
-sudo sh sfdumper.sh<br />
+''sudo sh sfdumper.sh''
-or<br />
-chmod +x sfdumper.sh<br />
-./sfdumper.sh <br />
-== Official web site ==
+''chmod +x sfdumper.sh''
-http://sfdumper.sourceforge.net
+''./sfdumper.sh''
 == External links ==
-http://freshmeat.net/projects/zenity
+* http://freshmeat.net/projects/zenity
-[[Category:Computer forensics]]
+[[Category:Linux]]
-[[Category:Free security software]]
-[[Category:Unix software]]

Selective file dumper - Revision history

.FUF at 09:15, 21 September 2008

Wikinb: New page: '''Selective File Dumper''' (SFDumper) is an open source free computer forensics useful tool written in Bash Script, by Nanni Bassetti and Denis Frati, for [[...