This page has links to other sites with excellent security resources and articles. We hope this helps in your pursuit of a secure environment.
- Cell Phone Forensic Tools: An overview and analysis from NIST
- Forensic memory dumping intricacies - PhysicalMemory, DD, and caching issues by Arne Vidstrom
- NIST test results for Hardware Write Block Devices (Main HW testing tool page from NIST)
- interessting articels on Windows Incident Response
- from the United States Secret Service on how to recognize digital evidence: Recognizing Potential Evidence
- interessting article about iPod forensics
- Windows Security Logging and Other Esoterica
- Rootkit.com: The Online Rootkit Magazine
- computer forensics blog of Andreas Schuster English German
- Computer Forensics for Lawyers Who Can't Set the Clock on Their VCR
- Microsoft Metadata Forensics
- Mounting disks with Linux's loopback device
- background information about CD-R/CD-RW
- looking for a specific windows eventlog ID?
- The "Tools proven in court" Question
- Know your Enemy: Phishing. Behind the Scenes of Phishing Attacks
- Web Browser Forensics
- Writing an Incident Handling and Recovery Plan
- Know your Enemy: Tracking Botnets
- RAID Reassembly - A forensic Challenge
- Dealing with Windows Eventlog
- Forensic Tools for Mac
- some Darwin Ports of Forensics Tools on Macintosh
- Guidelines for Evidence Collection and Archiving RFC3227
- PDA Forensic Tools an Overview and Analysis from NIST
- Online Forensics of Win/32 System
- Forensic Examination of Digital Evidence: A Guide for Law Enforcement
- Notes on dd and Odd Sized Disks
- Using Linux VMware and SMART to Create a Virtual Computer to Recreate a Suspect's Computer
- test results for the disk imaging tool dd from the U.S. National Insitut of Justice
- link collection about forensics with opensource tools
- File system and disk images for testing digital forensic analysis and acquisition tools by Brian Carrier
- Paper about disk cloning
- Setting up for Forensics. You have just been hacked! What do you do next?
- WebMail Forensics
- Forensics Portal
- Metadata analysis on Mac Filesystems
- Macintosh forensic analysis using OS X
- Forensic Analysis of a Compromised Mac OS X (Client) Machine
- Link Collection to Mac Forensics
- A detailed forensic analysis of a Mac OS X system using primarily open source forensic utilities on a Mac OS X analysis system
- yet another forensic tools link collection
- Forensics with Linux 101 or How to do Forensics for Free
-
Help! How do I recover that important file? (Dan Farmer)
-
Computer Forensic Analysis Class (Dan & Wietse)
-
Help! Someone has broken into my system! (Dan Farmer)
-
Computer forensics can help companies uncover the digital truth
-
Electronic Crime Scene Investigation: A Guide for First Responder
- How to duplicate a complete PC via network
- Digital Forensic - Learning from Intrusions (german language) local copy
- Computers & Forensics on Reddy's Forensic Page
- Computer Investigation on Zeno's Forensic Site
- DD and Computer Forensics: Examples of Using DD within UNIX to Create Physical Backups
- Basic Steps in Forensic Analysis of Unix Systems
- List of possible Trojan/Backdoor port activity
- E-Evidence Information Center
- Known Goods a checksum database
- File Slack Defined
- Computer Forensics News and Discussion
- Computer Forensics Tool Testing (CFTT) Project Web Site
- Forensic Examination of a RIM (BlackBerry) Wireless Device
- Default TTL values in TCP/IP (for forensic hopcount analysis)
- Using special names, when dd'ing images from cygwin/Windows
- Big wordlist of linux rootkits (you can use this list for keyword searches on forensic images)
- Articles and Whitepapers on Computer Forensics Resource Center
- How to Design a Useful Incident Response Policy
- Detecting and Removing Malicious Code
- Recovering and Examining Computer Forensic Evidence
- The National Center for Forensic Science: Digitale Evidence
- Digital Evidence: Standards and Principles
- Root Kits FAQ from Dave Dittrich
- You should take a closer look at this Root Kit List
- Clearing House for Incident Handling Tools
- The File Extension Source
- Open Source Digital Forensics
- Open Source Computer Forensics Manual
- Computer Forensics Hardware
- WiebeTECH
- You probably allready know KNOPPIX. The bootable CD with a collection of GNU/Linux software, automatic hardware detection, and support for many graphics cards, sound cards, SCSI and USB devices and other peripherals. Knoppix STD (STD: Security Tools Distribution) is a special security tools distribution with lots of forensic tools.
- F.I.R.E Forensic and Incident Response Environment Bootable CD (known as biatchux) out of maintenance!
- Helix is a customized distribution of the Knoppix Live Linux CD
- The Penguin Sleuth Kit Bootable CD
- Trinux
- Plan-B
- PHLAK Professional Hackers Linux Assault Kit
(well, not a special forensics distro
) - Local Area Security Linux
- LNX-BBC
- INSERT (Inside Security Rescue Toolkit)
- FCCU GNU/Linux Forensic Boot CD from the Belgian Police Computer Crime Unit
- Farmer's Boot CD
- Statically Stripped Incident Response and Forensic Binaries
- Free Forensic Tools from NTI (New Technologies Inc.), Free Law Enforcement Suite
- Alphabetical List of Computer Forensics Products
- EnCase Forensic Solutions
- cryptcat = netcat + encryption
- Forensic Tools and Utilities
- Recover is a utility which automates some steps as described in the Ext2fs-Undeletion howto in order to recover a lost file
- e2undel is an interactive console tool that recovers the data of deleted files on an ext2 file system under Linux
- mac-robber is a forensics and incident response program that collects Modified, Access, and Change (MAC) times from files.
- The Coroner's Toolkit TCT is a collection of programs by Dan Farmer and Wietse Venema for a post-mortem analysis of a UNIX system after break-in
- The Autopsy Forensic Browser is a graphical interface to utilities found in The Coroners Toolkit (TCT) and TCTUTILs. It allows drive images to be analyzed at a file, block, and inode level. It also allows easy searches for strings in images.
- New Versions: The @stake Sleuth Kit (TASK) and Autopsy Forensic Browser
- foremost automatic file recovering
- ILook Investigator a forensic analysis tool
- Streak - the secure forensic imaging tool
- md5deep is a cross-platform program to compute MD5 message digests on an arbitrary number of files with the following features: Recursive operation, Time estimation and Comparison mode
- SectorSpy is a forensics analysis and text data recovery tool for computer hard drives and diskettes
- PenguinBackup formerly known as "The PalmPilot single-floppy backup system"
- FTimes is a system baselining and evidence collection tool. The primary purpose of FTimes is to gather and/or develop information about specified directories and files in a manner conducive to intrusion analysis.
- HashDig technology is a collection of utilities designed to help practitioners automate the process of resolving MD5 hashes.
- IEHist dumps Internet Explorer history from index.dat files into delimited files suitable for import into other tools.
- Data recovery tools
- LADS - List Alternate DataStreams
- ASR Data - Computer Forensic Tools (SMART)
- PLAC (Portable Linux Auditing CD) is a business card sized bootable cdrom running linux. It has network auditing, disk recovery, and forensic analysis tools.
- Forensic Acquisition Utilities
- DCFL-DD - (an enhanced dd with MD5 hashing)
- Fatback- undelete files from FAT filesystems
- odessa "Open Digital Evidence Search and Seizure Architecture"
- Disk Investigator. Who needs another one?
- FileDisk is a virtual disk driver for Windows NT/2000/XP that uses one or more files to emulate physical disks. A console application is included that let you dynamically mount and unmount files. With FileDisk you can mount forensic dd-images read only for further analysis.
- Evidor is a particularly easy and convenient way for any investigator to find and gather digital evidence on computer media.
- WinHex is a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing
- Paraben's E-Mail examiner supports many mailbox formats
- NT registry filesystem for linux
- Antiword for reading ascii content of world files
- Metadata Assistant: Finding hidden data in word and excel files
- Mount Image Pro is a tool for Computer Forensic investigations. It enables you to mount ENCASE®, Unix DD, or SMART forensic images as a drive letter on your file system.
- Like dd, dd_rescue does copy data from one file or block device to another.
- AIR - Automated Image and Restore
- chaosreader can trace TCP or UDP sessions and fetch application data from tcpdump or snoop logs
- cryogenic freezes the process state of a running system
- FLAG Forensic and Log Analysis GUI
- FileSystem Investigator (fstools) is a platform independent file system viewer and data extraction tool written in Java
- PDASeizure is a comprehensive tool that allows PDA (PocketPC, PalmOS and Blackberry!) data to be acquired, viewed, and reported.
- File Date Time Extractor
- MailNavigator allows to read multiple Mailbox file formats
- Protected Storage Explorer is a freeware utility which allows you to view the protected storage in Windows 2000, Windows XP and Windows 2003 in an 'explorer style' fashion.
- CD/DVD Inspector is for forensic analysis, recovery and reporting for forensic and law enforcement use.
- accuhash for calculating checksumms
- .dat-viewer for analyzing Kazaa Traces
- Sterilize sterilizes the media to be used for working / examination copies.
- TestDisk: Tool to check and undelete partition
- X-Ways Forensics. Must have tool if you rely on windows
- Ext2IFS mounting ext2 and ext3 volumes under windows r/w
- pmdump.exe is a tool that dumps memory for a specified process to a file (as opposed to tools like memdump and dd which dump all of the RAM at once). It is useful for analysing things that might store hidden information in memory (for example, Bots, Trojan horses or VPN clients, email clients, and instant-messaging applications).
- UndeleteSMS if you have to undelete Short Text Messages (SMS) from SIM cards
- Web Historian assists users in reviewing websites (URLs) that are stored in the history files of the most commonly used browsers.
- misc Computer Forensics Software for Criminal Investigators and Consumers from Robware.com
- CDRoller is a powerful toolset for CD/DVD data recovery.
- SilentRunners checks a windows system for trojans and other malicous software
- Paraben Forensics cell phone and SIM card investigation toolbox
- Windows Forensics and Incident Recovery: The First Responder Utility (FRU)
- Windows Forensic Toolchest (WFT)
- tcpxtract is a tool for extracting files from network traffic based on file signatures.
- Mount Image Pro is a tool for Computer Forensics investigations. It enables the mounting of EnCase, Unix DD or SMART forensic images as a drive letter on your Windows.
- Scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files.
- Unmask is a demonstration of how to fingerprint users based only on their emails or IRC postings.
- ptfinder.pl from Andreas Schuster is a Perl script that parses through a dump of Windows physical memory searching for the different structures
- Memory
forensics tools from trapkit.de: Process Dumper allows you to
make a dump of a running process and Memory
Parser can be used to analyse process dumps made
with pd.