Difference between revisions of "Tools:File Analysis"

Revision as of 11:33, 20 December 2007

SurfRecon LE rapid image analysis tool, by SurfRecon, Inc.: http://www.surfrecon.com

file: The file command determines the file type of a given file, depending on its contents and not on e.g. its extension or filename. In order to do that, it uses a magic configuration file that identifies filetypes.

[[truss]: Solaris tool used to trace the system/library calls (not user calls) and signals made/received by a new or existing process. It sends the output to stderr.; http://docs.sun.com/app/docs/doc/819-2239/truss-1?l=en&a=view&q=truss

xtrace: eXtended trace utility, similar to strace, ptrace, truss, but with extended functionality and unique features, such as dumping function calls (dynamically or statically linked), dumping call stack and more.; http://sourceforge.net/projects/xtrace/

ktrace: Enables kernel process tracing on OpenBSD.; http://www.openbsd.org/cgi-bin/man.cgi?query=ktrace&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html

Valgrind: Executes a program under emulation, performing analysis according to one of the many plug-in modules as desired. You can write your own plug-in module as desired.; http://valgrind.org/

DTrace: Comprehensive dynamic tracing framework for Solaris (also ported to MacOS X - XRays and FreeBSD). DTrace provides a powerful infrastructure to permit investigation of the behavior of the operating system and user programs.; http://www.sun.com/bigadmin/content/dtrace/

strings: Strings will print the strings of printable characters in files. It allows choosing different charactersets (ASCII, UNICODE). It is a quick way to browse through files/partitions/... in order to look for words, filenames, keywords etc.

Galleta: Parses cookie files. http://www.foundstone.com/resources/proddesc/galleta.htm

Pasco
Parses 'index.dat files. http://www.foundstone.com/resources/proddesc/pasco.htm

Rifiuti
Examines the INFO2 file in the Recycle Bin http://www.foundstone.com/resources/proddesc/rifiuti.htm

yim2text
Extracts the 'encrypted' info in yahoo instant messenger log files. http://www.1vs0.com/tools.html

Hachoir: determines the file type using file header/footer (hachoir-metadata --type), able to list strings in Unicode (hachoir-grep), etc. Support more than 60 file formats.

UnxUtils: http://unxutils.sourceforge.net/; Common unix utilities compiled for a Windows environment.

@@ Line 9: / Line 9: @@
 ; [[ldd]]
-: ...
+: list  dynamic  dependencies  of  executable  files
+; [[truss]
+: Solaris tool used to trace the system/library calls (not user calls) and signals made/received by a new or existing process. It sends the output to stderr.
+: http://docs.sun.com/app/docs/doc/819-2239/truss-1?l=en&a=view&q=truss
 ; [[ltrace]]
-: ...
+: Library call tracer
+: http://linux.die.net/man/1/ltrace
 ; [[strace]]
-: ...
+: System Call Tracer
+: http://sourceforge.net/projects/strace/
+; [[xtrace]]
+: eXtended trace utility, similar to strace, ptrace, truss, but with extended functionality and unique features, such as dumping function calls (dynamically or statically linked), dumping call stack and more.
+: http://sourceforge.net/projects/xtrace/
+; [[ktrace]]
+: Enables kernel process tracing on OpenBSD.
+: http://www.openbsd.org/cgi-bin/man.cgi?query=ktrace&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html
+; [[Valgrind]]
+: Executes a program under emulation, performing analysis according to one of the many plug-in modules as desired. You can write your own plug-in module as desired.
+: http://valgrind.org/
+; [[DTrace]]
+: Comprehensive dynamic tracing framework for Solaris (also ported to MacOS X - XRays and FreeBSD). DTrace provides a powerful infrastructure to permit investigation of the behavior of the operating system and user programs.
+: http://www.sun.com/bigadmin/content/dtrace/
 ; [[strings]]