Forensics Wiki - Recent changes [en]

Windows

2013-05-25T07:26:33Z

‎Windows Error Reporting (WER):

Chaosreader

2013-05-24T15:26:47Z

‎External Links: Link to enhanced version

Upcoming events

2013-05-24T15:19:16Z

‎Calls For Papers:

User talk:Douglas Figueiredo

2013-05-24T15:13:09Z

Welcome!

New page

'''Welcome to ''Forensics Wiki''!'''
We hope you will contribute much and well.
You will probably want to read the [[Help:Contents|help pages]].
Again, welcome and have fun! [[User:Simsong|Simsong]] ([[User talk:Simsong|talk]]) 10:13, 24 May 2013 (CDT)

User:Douglas Figueiredo

2013-05-24T15:13:09Z

Creating user page for new user.

New page

Graduando do Curso de Engenharia da Computação, atualmente resido na cidade de Manaus/Amazonas/Brasil.

User:Douglas Figueiredo

2013-05-24T15:13:09Z

User account Douglas Figueiredo was created by Simsong

User talk:Joe Shestak

2013-05-24T15:12:57Z

Welcome!

New page

User:Joe Shestak

2013-05-24T15:12:57Z

Creating user page for new user.

New page

I belongs to a forensic profession in which I have experienced many cyber cases. Thus I came across with one more forensic email analysis tool while investigation. Being a thoughtful person I get impressed with many forensic tools but this programs produces literally accurate results of forensic investigation.

User:Joe Shestak

2013-05-24T15:12:57Z

User account Joe Shestak was created by Simsong

User talk:Jens Lechtenbörger

2013-05-24T15:12:48Z

Welcome!

New page

User:Jens Lechtenbörger

2013-05-24T15:12:47Z

Creating user page for new user.

New page

I'm interested in privacy and free software. In my professional life I'm a lecturer in computer science.

User:Jens Lechtenbörger

2013-05-24T15:12:47Z

User account Jens Lechtenbörger was created by Simsong

Approximate Matching

2013-05-24T15:12:24Z

Show changes

Similarity Functions

2013-05-24T15:11:05Z

Simsong moved page Similarity Functions to Approximate Matching New terminology

Similarity Functions

2013-05-24T14:38:28Z

IOS security

2013-05-23T15:13:03Z

‎See also:

IOS

2013-05-23T15:11:50Z

‎See Also:

IOS security

2013-05-23T02:43:39Z

Created page with "==See also== * [https://developer.apple.com/library/mac/#documentation/security/Conceptual/cryptoservices/KeyManagementAPIs/KeyManagementAPIs.html Managing Keys, Certificates ..."

New page

==See also==
* [https://developer.apple.com/library/mac/#documentation/security/Conceptual/cryptoservices/KeyManagementAPIs/KeyManagementAPIs.html Managing Keys, Certificates and Passwords]
* [http://developer.apple.com/library/mac/#documentation/security/conceptual/security_overview/CryptographicServices/CryptographicServices.html Cryptographic Services]
* [https://developer.apple.com/library/mac/#documentation/security/Conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html Encrypting and Hashing Data]
* [https://developer.apple.com/library/mac/#documentation/Cocoa/Reference/Foundation/Classes/NSFileManager_Class/Reference/Reference.html NSFileManager class]
* [http://images.apple.com/iphone/business/docs/iOS_Security_Oct12.pdf iOS Security, October 2012]

Upcoming events

2013-05-22T19:17:12Z

‎Calls For Papers:

Gurls

2013-05-20T19:47:08Z

Gurls

2013-05-20T14:35:04Z

Tcpflow

2013-05-20T14:21:59Z

‎Overview:

File:Tcpflow14-demo.png

2013-05-20T14:20:57Z

Simsong uploaded "File:Tcpflow14-demo.png" Demonstration of the time histogram created by tcpflow.

Tcpflow

2013-05-20T14:20:13Z

Gurls

2013-05-19T21:15:06Z

Gurls

2013-05-19T20:43:10Z

New page

Gruls is a bash script and is short for grep urls.

#!/bin/bash
protocol="(ftp|http|https|gopher|mailto|pop|smtp|news|nntp|telnet|whois|file|imap|prospero|peercast|ed2k|irc|aim|mime|ftam|pnm|rtsp|ldap)"
ip="([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.((0|[1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.){2}([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])"
fqdn="(\w(-?\w+)*\.)+[a-z]{2,}"
host="(${ip}|${fqdn})"
port="(:[0-9]+)?"
urlregexp="${protocol}://${host}${port}/?"

(
if [ "$1" ]
then
while [ "$1" ]
do
egrep -o "$urlregexp" "$1"
shift
done
else
egrep -o "$urlregexp" /dev/stdin
fi
) | sed 's;/$;;g'

Upcoming events

2013-05-18T18:18:45Z

‎Calls For Papers:

@@ Line 107: / Line 107: @@
 The %SID%\ProfileImagePath value should also contain the username.
 == Advanced Format (4KB Sector) Hard Drives ==
@@ Line 158: / Line 175: @@
 * [http://windowsir.blogspot.ch/2006/10/restore-point-forensics.html Restore Point Forensics], by [[Harlan Carvey]], October 20, 2006
 * [http://www.ediscovery.co.nz/wip/srp.html System Restore Point Log Decoding]
 === Windows Firewall ===

← Older revision		Revision as of 15:26, 24 May 2013
Line 15:		Line 15:

	* [http://www.brendangregg.com/chaosreader.html Chaosreader author's website]		* [http://www.brendangregg.com/chaosreader.html Chaosreader author's website]
		+	* [http://www.informationelle-selbstbestimmung-im-internet.de/chaosreader.html Enhanced, non-official version of Chaosreader (with diffs)]

	[[Category:Network Forensics]]		[[Category:Network Forensics]]

@@ Line 19: / Line 19: @@
 ! width="15%"|Notification Date
 ! width="40%"|Website
 |-
 |29th Annual Computer Security Applications Conference

@@ Line 22: / Line 22: @@
 # Determining if the target object is derived from the target object.
-===Functions and Implementations===
+The leading similarity systems in use are are:
-The first widely used binary similarity algorithm was the piecewise hash comparison algorithm implemented by Jesse Kornblum in [[ssdeep]].
+* [[sdhash]], developed by Vassil Roussev.
-Vassil Roussev has created a replacement algorithm called [[sdhash]].
+==Text Similarity==

@@ Line 43: / Line 43: @@
 * UFED and Physical Analyzer by Cellebrite [[http://www.cellebrite.com/]]
 * XRY by Micro Systemation [[http://www.msab.com/]]
 == External Links ==

@@ Line 1: / Line 1: @@
 ==See also==
 * [https://developer.apple.com/library/mac/#documentation/security/Conceptual/cryptoservices/KeyManagementAPIs/KeyManagementAPIs.html Managing Keys, Certificates and Passwords]
 * [http://developer.apple.com/library/mac/#documentation/security/conceptual/security_overview/CryptographicServices/CryptographicServices.html Cryptographic Services]

@@ Line 19: / Line 19: @@
 ! width="15%"|Notification Date
 ! width="40%"|Website
 |-
 |29th Annual Computer Security Applications Conference
@@ Line 44: / Line 34: @@
 |Nov 2013
 |http://www.aafs.org/aafs-66th-annual-scientific-meeting
 |-
 |}
@@ Line 55: / Line 50: @@
 ! width="20%"|Date/Location
 ! width="40%"|Website
 |-
 |IEEE Symposium on Security & Privacy
@@ Line 187: / Line 174: @@
 |Dec 09-13<br>New Orleans, LA
 |http://www.acsac.org
 |-
 |AAFS 66th Annual Scientific Meeting

@@ Line 3: / Line 3: @@
   #!/bin/bash
   protocol="(ftp|http|https|gopher|mailto|pop|smtp|news|nntp|telnet|whois|file|imap|prospero|peercast|ed2k|irc|aim|mime|ftam|pnm|rtsp|ldap)"
-  ip="([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.((0|[1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.){2}([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])"
+  ip4="([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.((0|[1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.){2}([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])"
   fqdn="(\w(-?\w+)*\.)+[a-z]{2,}"
-  host="(${ip}|${fqdn})"
+  host="(${ip4}|${fqdn})"
   port="(:[0-9]+)?"
   urlregexp="${protocol}://${host}${port}/?"
@@ Line 32: / Line 32: @@
   root@forensic# strings /dev/sdb1 | gurls > /tmp/urls
 ==See Also==
 * [[bulk_extractor]] provides similar functionality but on a much larger scale. Still, scripts like ''gurls'' are good for quickly searching through data.
-{{Linux}}

← Older revision		Revision as of 14:35, 20 May 2013
Line 32:		Line 32:

	root@forensic# strings /dev/sdb1 \| gurls > /tmp/urls		root@forensic# strings /dev/sdb1 \| gurls > /tmp/urls
		+
		+	==See Also==
		+	* [[bulk_extractor]] provides similar functionality but on a much larger scale. Still, scripts like ''gurls'' are good for quickly searching through data.

	{{Linux}}		{{Linux}}

← Older revision		Revision as of 14:21, 20 May 2013
Line 23:		Line 23:

	Specify the '''-e netviz''' option to enable the network visualization layer, and make a pretty picture like this:		Specify the '''-e netviz''' option to enable the network visualization layer, and make a pretty picture like this:
		+
		+	[[Image:Tcpflow14-demo.png]]

	== Limitations ==		== Limitations ==

@@ Line 10: / Line 10: @@
 '''tcpflow''' is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging. Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction. tcpflow can also process stored ‘tcpdump’ packet flows.
-tcpflow is similar to ‘tcpdump’, in that both process packets from the wire or from a stored file. But it’s different in that it reconstructs the actual data streams and stores each flow in a separate file for later analysis.
+tcpflow is similar to ‘tcpdump’, in that both process packets from the wire or from a stored file. It's also similar to WireShark, in that both allow analysis of network traffic. But unlike either tcpdump or WireShark, tcpflow reconstructs thousands (or millions) of TCP connections at a time and saves the results in ordinary files, making it easy to analyze the data with conventional tools.
 tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery.
 Jeremy Elson developed the first version of tcpflow in 1999 but stopped maintaining it in 2003. In 2006 Simson Garfinkel took over maintenance of the program and added:
@@ Line 25: / Line 41: @@
 tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like ‘tcpdump’ support. It should compile under most popular versions of UNIX; see the INSTALL file for details.
 == Distributions==

@@ Line 1: / Line 1: @@
-Gruls is a bash script and is short for grep urls.
+Gruls is a bash script and is short for grep urls :
   #!/bin/bash
@@ Line 21: / Line 21: @@
   fi
   ) | sed 's;/$;;g'

@@ Line 24: / Line 24: @@
+|
 |http://www.basistech.com/about-us/events/open-source-forensics-conference/
 |-
 |2nd Cyberpatterns: Unifying Design Patterns with Security, Attack and Forensic Patterns Workshop