Forensics - Revision history

PhilippeTeuwen: /* See also */

2013-12-13T18:51:12Z

2012-08-19T19:25:30Z

Photodex Proshow mangled jpeg

← Older revision		Revision as of 19:25, 19 August 2012
Line 133:		Line 133:
	====Photodex Proshow mangled jpeg====		====Photodex Proshow mangled jpeg====
	A special mention for jpeg files embedded in Photodex presentations: if you try to extract them with one of the aforementioned programs (e.g. recoverjpeg -b 1 diaporama.exe), you'll find those files corrupted. It's because they're chunk in blocks interleaved with some metadata to remove.		A special mention for jpeg files embedded in Photodex presentations: if you try to extract them with one of the aforementioned programs (e.g. recoverjpeg -b 1 diaporama.exe), you'll find those files corrupted. It's because they're chunk in blocks interleaved with some metadata to remove.
	<br>Here is a little script to do so: [{{#file: photodex_proshow_fix_jpeg.py}} photodex_proshow_fix_jpeg.py]		<br>Here is a little script to fix those jpeg files: [{{#file: photodex_proshow_fix_jpeg.py}} photodex_proshow_fix_jpeg.py]
	<source lang=python>		<source lang=python>
	#!/usr/bin/env python		#!/usr/bin/env python

2012-08-19T19:24:01Z

Photodex Proshow mangled jpeg

← Older revision		Revision as of 19:24, 19 August 2012
Line 134:		Line 134:
	A special mention for jpeg files embedded in Photodex presentations: if you try to extract them with one of the aforementioned programs (e.g. recoverjpeg -b 1 diaporama.exe), you'll find those files corrupted. It's because they're chunk in blocks interleaved with some metadata to remove.		A special mention for jpeg files embedded in Photodex presentations: if you try to extract them with one of the aforementioned programs (e.g. recoverjpeg -b 1 diaporama.exe), you'll find those files corrupted. It's because they're chunk in blocks interleaved with some metadata to remove.
	<br>Here is a little script to do so: [{{#file: photodex_proshow_fix_jpeg.py}} photodex_proshow_fix_jpeg.py]		<br>Here is a little script to do so: [{{#file: photodex_proshow_fix_jpeg.py}} photodex_proshow_fix_jpeg.py]
	<source lang=py>		<source lang=python>
	#!/usr/bin/env python		#!/usr/bin/env python

2012-08-19T19:23:38Z

Agnostic (any fs)

@@ Line 131: / Line 131: @@
 So all in all PhotoRec seems the best but painful to use with this interactive mode rather than using command line options
 <br>See also [http://sid.rstack.org/static/articles/d/i/g/Digital_photos_recovery.html Sid's notes] on photo recovery
 ===Recovering information from files===

2011-02-28T14:08:59Z

On live systems

← Older revision		Revision as of 14:08, 28 February 2011
Line 33:		Line 33:
	* '''[http://staff.washington.edu/dittrich/talks/blackhat/blackhat/cryogenic.c Cryogenic.c]'''		* '''[http://staff.washington.edu/dittrich/talks/blackhat/blackhat/cryogenic.c Cryogenic.c]'''
	** Captures process information stored in Linux's Proc_fs on a best effort basis		** Captures process information stored in Linux's Proc_fs on a best effort basis
	*'''[http://www.chkrootkit.org Chkrootkit]'''		* '''[http://www.chkrootkit.org Chkrootkit]'''
	** Checks for signs of rootkits on the local system		** Checks for signs of rootkits on the local system
	** apt-get install chkrootkit		** apt-get install chkrootkit
	** '''chkdirs''': détecte les anomalies entre le nombre de liens d'un répertoire père et le nombre de sous-répertoires de ce dernier		** '''chkdirs''': détecte les anomalies entre le nombre de liens d'un répertoire père et le nombre de sous-répertoires de ce dernier
	** '''chkprocs''': compare le contenu du répertoire /proc avec la sortie de la commande ps		** '''chkprocs''': compare le contenu du répertoire /proc avec la sortie de la commande ps
			* '''[http://www.unhide-forensics.info Unhide]'''
			** Detecting hidden processes
			** apt-get install unhide
	* '''Kstat'''		* '''Kstat'''
	** Détecte le détournement d'appels systèmes		** Détecte le détournement d'appels systèmes

2011-02-28T13:32:13Z

Anti-forensic resources

← Older revision		Revision as of 13:32, 28 February 2011
Line 140:		Line 140:
	* secure-delete: tools to wipe files, free disk space, swap and memory		* secure-delete: tools to wipe files, free disk space, swap and memory
	* [http://dban.sourceforge.net Darik's Boot and Nuke (dban)]: secure harddrive deletion		* [http://dban.sourceforge.net Darik's Boot and Nuke (dban)]: secure harddrive deletion
	* [http://~~www~~.~~sysinternals~~.com/~~Utilities~~/~~SDelete~~.~~html~~ SDelete] from Sysinternals		* [http://technet.microsoft.com/en-us/magazine/2009.08.utilityspotlight.aspx SDelete] from Sysinternals
	* [http://www.phrack.org/~~phrack/59/p59-0x06~~.txt Defeating Forensic Analysis on Unix]		* [http://www.phrack.org/issues.html?issue=59&id=6&mode=txt Defeating Forensic Analysis on Unix]
	* [http://hack.lu/~~images/8/80~~/Venema.ppt Software Engineering Security (PPT)] by Wietse Venema at Hack.lu 2006		* [http://archive.hack.lu/2006/Venema.ppt Software Engineering Security (PPT)] by Wietse Venema at Hack.lu 2006
	* [http://www.iusmentis.com/security/filewiping/realdelete/ Article at Ius Mentis]		* [http://www.iusmentis.com/security/filewiping/realdelete/ Article at Ius Mentis]

2011-02-28T13:12:52Z

On live systems

← Older revision		Revision as of 13:12, 28 February 2011
Line 33:		Line 33:
	* '''[http://staff.washington.edu/dittrich/talks/blackhat/blackhat/cryogenic.c Cryogenic.c]'''		* '''[http://staff.washington.edu/dittrich/talks/blackhat/blackhat/cryogenic.c Cryogenic.c]'''
	** Captures process information stored in Linux's Proc_fs on a best effort basis		** Captures process information stored in Linux's Proc_fs on a best effort basis
	*'''[http://www.~~chrootkit~~.org Chkrootkit]'''		*'''[http://www.chkrootkit.org Chkrootkit]'''
	** Checks for signs of rootkits on the local system		** Checks for signs of rootkits on the local system
	** apt-get install chkrootkit		** apt-get install chkrootkit

2011-01-21T09:09:42Z

Tools

← Older revision		Revision as of 09:09, 21 January 2011
Line 17:		Line 17:

	== Tools ==		== Tools ==
			See also [https://infond.fr/wiki/Outils_Analyse_Forensique this list] (fr)

	=== Generic forensic tools ===		=== Generic forensic tools ===
	* '''[http://www.porcupine.org/forensics/tct.html The Coroner Toolkit]'''		* '''[http://www.porcupine.org/forensics/tct.html The Coroner Toolkit]'''

2010-12-22T14:25:41Z

On live systems

← Older revision		Revision as of 14:25, 22 December 2010
Line 44:		Line 44:
	** Presentation by A. Boileau: [http://www.security-assessment.com/files/presentations/ab_firewire_rux2k6-final.pdf Hit by a Bus: Physical Access Attacks with Firewire (PDF)]		** Presentation by A. Boileau: [http://www.security-assessment.com/files/presentations/ab_firewire_rux2k6-final.pdf Hit by a Bus: Physical Access Attacks with Firewire (PDF)]
	** [http://www.storm.net.nz/projects/16 More on his page]		** [http://www.storm.net.nz/projects/16 More on his page]
			* [http://wiki.yobi.be/wiki/Debian_Commands#System_management Cruft]
			** Not a forensics tool per se but of great help to find files in the system directories that are not coming from legit Debian packages

	=== Dumping data supports ===		=== Dumping data supports ===

2010-11-24T20:35:52Z

Reverted edits by Etegohy (Talk) to last revision by PhilippeTeuwen

Can't load revision 6861

← Older revision		Revision as of 18:51, 13 December 2013
Line 239:		Line 239:

	==See also==		==See also==
	* [[Forensics on ~~Incidents~~]]		* [[Forensics on Incident 1]]
	* [[~~Network~~ ~~Security~~]]		* [[Forensics on Incident 2]]
			* [[LaCie_5big_Network_2#Two_faulty_disks_on_a_5-disk_RAID5]]
			* [[Network security tools]]