Difference between pages "Write Blockers" and "Plaso"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (added EPOS WriteProtector)
 
m (File formats)
 
Line 1: Line 1:
'''Write blockers''' are devices that allow acquisition of information on a [[hard drive|drive]] without creating the possibility of accidentally damaging the drive contents. They do this by allowing read commands to pass but by blocking write commands, hence their name.
+
{{Infobox_Software |
 +
  name = plaso |
 +
  maintainer = [[Kristinn Gudjonsson]], [[Joachim Metz]] |
 +
  os = [[Linux]], [[Mac OS X]], [[Windows]] |
 +
  genre = {{Analysis}} |
 +
  license = {{APL}} |
 +
  website = [https://code.google.com/p/plaso/ code.google.com/p/plaso/] |
 +
}}
  
There are two ways to build a write-blocker: the blocker can allow all commands to pass from the computer to the drive except for those that are on a particular list. Alternatively, the blocker can specifically block the write commands and let everything else through.
+
Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Plaso is intended to be applied for creating super timelines but also supports creating [http://blog.kiddaland.net/2013/02/targeted-timelines-part-i.html targeted timelines].
  
Write blockers may also include drive protection which will limit the speed of a drive attached to the blocker. Drives that run at higher speed work harder(the head moves back and forth more often due to read errors). This added protection could allow drives that can not be read at high speed (UDMA modes) to be read at the slower modes (PIO).  
+
The Plaso project site also provides [[4n6time]], formerly "l2t_Review", which is a cross-platform forensic tool for timeline creation and review by [[David Nides]].
  
There are two types of write blockers, Native and Tailgate. A Native device uses the same interface on for both in and out, for example a IDE to IDE write block. A Tailgate device uses one interface for one side and a different one for the other, for example a Firewire to SATA write block.
+
== Supported Formats ==
  
Steve Bress and Mark Menz invented hard drive write blocking (US Patent 6,813,682).  
+
=== Storage Media Image File Formats ===
 +
Storage Medis Image File Format support is provided by [[dfvfs]].
  
There are both hardware and software write blockers. Some software write blockers are designed for a specific operating system. One designed for Windows will not work on Linux. Most hardware write blockers are software independent.  
+
=== Volume System Formats ===
 +
Volume System Format support is provided by [[dfvfs]].
  
= Hardware Write Blockers =
+
=== File System Formats ===
 +
File System Format support is provided by [[dfvfs]].
  
'''Hardware write blockers''' can be either [[IDE]]-to-IDE or [[Firewire]]/[[USB]]-to-IDE. Simson prefers the IDE-to-IDE because they deal better with errors on the drive and make it easier to access special information that is only accessible over the IDE interface. You may feel differently.
+
=== File formats ===
 +
<b>TODO expand this list</b>
  
NIST test results are here: http://www.nist.gov/itl/ssd/cs/cftt/cftt-hardware-write-block.cfm
+
* Apple System Log (ASL)
 +
* Basic Security Module (BSM)
 +
* Bencode files
 +
* [[Google Chrome|Chrome cache files]]
 +
* [[Extensible Storage Engine (ESE) Database File (EDB) format]] using [[libesedb]]
 +
* [[Internet Explorer History File Format]] (also known as MSIE 4 - 9 Cache Files or index.dat) using [[libmsiecf]]
 +
* Java IDX
 +
* [[OLE Compound File]] using [[libolecf]]
 +
* [[Property list (plist)|Property list (plist) format]] using [[binplist]]
 +
* SQLite databases
 +
* Syslog
 +
* [[Windows Event Log (EVT)]] using [[libevt]]
 +
* [[Windows NT Registry File (REGF)]] using [[libregf]]
 +
* [[LNK|Windows Shortcut File (LNK) format]] using [[liblnk]]
 +
* [[Windows XML Event Log (EVTX)]] using [[libevtx]]
  
== Commercial ==
+
=== Bencode file formats ===
 +
* Transmission
 +
* uTorrent
  
; [[ICS Drive Lock]]
+
=== ESE database file formats ===
: http://www.ics-iq.com/Super-DriveLock-Write-Blocker-Write-Protector-p/f.gr-0028-0000.htm
+
* Internet Explorer WebCache format
  
; MyKey Technology, Inc. NoWrite FPU and FlashBlock II
+
=== OLE Compound File formats ===
: 1.8"/2.5"/3.5"/ IDE to IDE, FireWire/USB to IDE & SATA, all media types - NIST Ver. 2 accepted 
+
* Document summary information
: http://www.mykeytech.com/
+
* Summary information (top-level only)
  
; [[Tableau]] write blockers for IDE, SATA, SCSI, USB  NIST Ver. 1 accepted
+
=== Property list (plist) formats ===
: http://www.tableau.com/index.php?pageid=products
+
<b>TODO expand this list</b>
 +
* Airport
 +
* Apple Account
 +
* iPod/iPhone
 +
* Install History
 +
* Mac User
 +
* Software Update
 +
* Spotlight
 +
* Spotlight Volume Information
 +
* Timemachine
  
; WiebeTech write-blockers for almost any disk drive: 2.5"/3.5" IDE, SCSI, SATA, ...
+
=== SQLite database file formats ===
: http://wiebetech.com/home.php?home=5  NIST Ver. 1 accepted
+
* Android call logs
 +
* Android SMS
 +
* Chrome cookies
 +
* Chrome browsing and downloads history
 +
* Firefox browsing and downloads history
 +
* Google Drive
 +
* Launch services quarantine events
 +
* MacKeeper
 +
* Mac OS X document versions
 +
* Skype
 +
* Zeitgeist activity
  
; EPOS WriteProtector
+
=== Windows Registry formats ===
; http://www.epos.ua/view.php/en/products_epos_write_protector
+
<b>TODO expand this list</b>
 +
* AppCompatCache
 +
* CCleaner
 +
* MountPoints2
 +
* MSIE Zone
 +
* MSIE Zone Software
  
= Software Write Blockers =
+
== History ==
 +
Plaso is a Python-based rewrite of the Perl-based [[log2timeline]] initially created by [[Kristinn Gudjonsson]]. Plaso builds upon the [[SleuthKit]], [[libyal]], [[dfvfs]] and various other projects.
  
'''Software write blockers''' can be either tailored to an individual operating system or can be an independent boot disk. Their main upsides are with ease of use, since they are on a CD and do not require you to open up the case, and speed since they do not become a bottle neck.
+
== See Also ==
 +
* [[dfvfs]]
 +
* [[log2timeline]]
  
== Commercial ==
+
== External Links ==
 
+
* [https://code.google.com/p/plaso/ Project site]
; [[SAFE Block XP]]
+
* [https://sites.google.com/a/kiddaland.net/plaso/home Project documentation]
: SAFE Block XP is a software-based write blocker designed for the Windows XP Operating System. It comes in both 32 and 64 bit options. NIST Ver. 1.2 accepted
+
* [http://blog.kiddaland.net/ Project blog]
: http://www.forensicsoft.com/
+
* [https://sites.google.com/a/kiddaland.net/plaso/usage/4n6time 4n6time]
 
+
; [[MacForensicsLab Write Controller]]
+
: MacForensicsLab Write Controller is a software-based write blocker designed for the Mac OS X operating system. It runs on both 32 and 64 bit versions of Mac OS X 10.4 or later.
+
: http://www.macforensicslab.com/ProductsAndServices/index.php?main_page=product_info&cPath=1&products_id=339
+
 
+
[[Category:Disk Imaging]]
+

Revision as of 03:39, 3 June 2014

plaso
Maintainer: Kristinn Gudjonsson, Joachim Metz
OS: Linux, Mac OS X, Windows
Genre: Analysis
License: APL
Website: code.google.com/p/plaso/

Plaso (plaso langar að safna öllu) is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Plaso is intended to be applied for creating super timelines but also supports creating targeted timelines.

The Plaso project site also provides 4n6time, formerly "l2t_Review", which is a cross-platform forensic tool for timeline creation and review by David Nides.

Supported Formats

Storage Media Image File Formats

Storage Medis Image File Format support is provided by dfvfs.

Volume System Formats

Volume System Format support is provided by dfvfs.

File System Formats

File System Format support is provided by dfvfs.

File formats

TODO expand this list

Bencode file formats

  • Transmission
  • uTorrent

ESE database file formats

  • Internet Explorer WebCache format

OLE Compound File formats

  • Document summary information
  • Summary information (top-level only)

Property list (plist) formats

TODO expand this list

  • Airport
  • Apple Account
  • iPod/iPhone
  • Install History
  • Mac User
  • Software Update
  • Spotlight
  • Spotlight Volume Information
  • Timemachine

SQLite database file formats

  • Android call logs
  • Android SMS
  • Chrome cookies
  • Chrome browsing and downloads history
  • Firefox browsing and downloads history
  • Google Drive
  • Launch services quarantine events
  • MacKeeper
  • Mac OS X document versions
  • Skype
  • Zeitgeist activity

Windows Registry formats

TODO expand this list

  • AppCompatCache
  • CCleaner
  • MountPoints2
  • MSIE Zone
  • MSIE Zone Software

History

Plaso is a Python-based rewrite of the Perl-based log2timeline initially created by Kristinn Gudjonsson. Plaso builds upon the SleuthKit, libyal, dfvfs and various other projects.

See Also

External Links