ToolWar | Information Security (InfoSec) Tools: Analysis

OCFA (Open Computer Forensics Architecture) :: Framework

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="OCFA Tools" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFBvdLhCyjycLRfN5dNkY5dJ8DhTpyO1-LAAjtlqcZoz2odPBUVyhs1KU3f-t8QDFAa_LJxuuVAVJRfE1niARh9DzFRqu_wZnESr3NRQFqR6wF8YVJceurWGKd0469rTy_vUIhApL46dEN/s1600/Computer-Forensics.jpg" title="OCFA TOols" /></div>
</div>
<div style="text-align: justify;">
The <b>Open Computer Forensics Architecture (OCFA)</b> is a modular computer <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a> framework built by the Dutch National Police Agency [KLPD/Dutch]. The main goal is to automate the digital forensic process to speed up the <a href="http://www.toolwar.com/search/label/Investigation" target="_blank">investigation</a> and give tactical investigators direct access to the seized data through an easy to use search and browse interface.<br />
<br />
The architecture forms an environment where existing <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic tools</a> and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and metadata from digital evidence. The <b>Open Computer Forensics Architecture</b> aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.<br />
<br />
Modules in <b>OCFA</b> for reasons of fault tolerance are processes. The basic OcfaLib API makes it possible and relatively easy to build an <b>OCFA</b> module out of any data processing library or tool. OCFA comes with numerous such modules that are mostly wrappers around libraries like libmagic or tools such as those found in the <a href="http://www.toolwar.com/2014/01/the-sleuth-kit-tsk-forensics-framework.html" target="_blank">Sleuthkit</a>.<br />
<br />
The 2.2 version of OCFA (released April 2009) makes the previously internal OCFA treegraph API available for OCFA module development. The OCFA treegraph API allows more advanced dissectors that produce data and meta-data for a treegraph representation of an input file. The OCFA treegraph API also allows dissectors that are programed to be CarvFs aware to use zero storage <a href="http://www.toolwar.com/search/label/Carving" target="_blank">carving</a>.<br />
<br />
Communication between modules within OCFA is governed by a two layered communication infrastructure as provided by <b>OCFA</b>. At the lowest layer is a messaging system with at is center the OCFA Anycast Relay. The Anycast Relay provides the facilities of module crash resistance, distributed processing load balancing and flow control. At a higher level of communication, the OCFA XML Router provides for the routing of individual pieces of evidence through the most appropriate tool chain for its particular type of content.<br />
<br />
Although <b>OCFA</b> contains a rudimentary user interface, most of its power is in the backend architecture. The last and final module in the tool chain of any evidence will be the OCFA Data Store Module. This module processes the evidence XML (that contains all of the evidence data its meta data) and stores relevant parts into a postgesql database. Extending the apache based user interface with interfaces for your own case bound queries is something that should proof very useful in most investigations. </div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>Wiki :: </b> <a href="http://ocfa.wiki.sourceforge.net/" target="_blank">Click Here</a></div>
<div style="text-align: justify;">
<b>Installation ::</b> <a href="http://ocfa.sourceforge.net/files/InstallingOcfaOnUbuntu.pdf" target="_blank">Click Here</a></div>
<div style="text-align: justify;">
<b>Practical Usages :: </b><a href="http://ocfa.sourceforge.net/files/PracticalUseOCFA.pdf" target="_blank">Click Here</a></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://sourceforge.net/projects/ocfa/files/latest/download" target="_blank">OCFA</a> (.tar.bz2)<br />
<b>Official Website ::</b> <a href="http://ocfa.sourceforge.net/">http://ocfa.sourceforge.net/</a></div>

OCFA (Open Computer Forensics Architecture) :: Framework

The Open Computer Forensics Architecture (OCFA) is a modular computer forensics framework built by the Dutch National Police Agency [...

Second Look (Linux Memory Forensics) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both;">
 <img border="0" height="124" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhj3s-HN2dZGFNYEv4wk6IGLmblttBSVAhyiADK6Tcg_sE6ucHyhB_M1xINBz418Iy8K5vLizCBYB253oHqRxFsyyY8VZykHyveoJ2XteU5fG4hbI2gGuQ-r6z4iNVCrNR0thbZCaMasHa_/s1600/secondlook.jpg" width="640" /></div>
The Incident Response edition of <b>Second Look®: Linux Memory Forensics</b> is designed for use by investigators who need quick, easy, and effective <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory acquisition</a> and analysis capabilities. Second Look® is a product of Raytheon Pikewerks Corporation. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Memory_Acquisition"> Memory Acquisition::</span></h3>
<div style="text-align: justify;">
<b>Second Look®</b> preserves the volatile system state, capturing evidence  and information that does not exist on disk and may otherwise be lost as  an investigation proceeds.  A <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command-line</a> script allows for  acquisition of <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> from running systems without introducing any  additional software.  A memory access driver is provided for use on  systems without a native interface to physical memory. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Memory_Analysis"> Memory Analysis ::</span></h3>
<div style="text-align: justify;">
<b>Second Look® </b>interprets live system memory or captured memory images,  detecting and <a href="http://www.toolwar.com/search/label/Reverse" target="_blank">reverse engineering</a> malware, including stealthy kernel <a href="http://www.toolwar.com/search/label/Rootkit" target="_blank"> rootkits</a> and backdoors.  A kernel integrity verification approach is  utilized to compare the Linux kernel in memory with a reference kernel.   Pikewerks provides thousands of reference kernels derived from original  distribution kernel packages, and a script for creating reference  kernels for other systems, such as those running custom kernels. </div>
<div style="text-align: justify;">
<b>Second Look®</b> also applies an integrity verification approach for  the analysis of each process in memory.  This enables it to detect  unauthorized applications as well as stealthy user-level <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a>. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Supported_Systems"> Supported Systems ::</span></h3>
<div style="text-align: justify;">
Second Look® is regularly updated to support analysis of the latest  kernels and the most commonly used <a href="http://www.toolwar.com/search/label/Distribution" target="_blank">Linux distributions</a>.  The following  are its capabilities as of April 2012: </div>
<ul style="text-align: justify;">
<li> Supported target kernels: 2.6.x, 3.x up to 3.2 </li>
<li> Supported target architectures: x86 32- and 64-bit </li>
<li> Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-12.04, and more! </li>
</ul>
<h3 style="text-align: justify;">
Product features (Second Look Incident Response Edition) ::</h3>
<ul style="text-align: justify;">
<li>Memory acquisition and analysis for all 32- and 64-bit x86
(i386/i486/i586/i686, amd64/x86_64) Linux systems running 2.6- and 3-series
kernels. This includes:
<ul>
<li>Amazon Linux 2010.11 through 2014.03, and higher;</li>
<li>Debian 4 through 7, and higher;</li>
<li>Fedora 2 through 20, and higher;</li>
<li>Red Hat Enterprise Linux (RHEL) and CentOS 4.x, 5.x, 6.x, and higher;</li>
<li>Ubuntu 4.10 through 14.04, and higher;</li>
<li>and other distributions.</li>
</ul>
</li>
<li>Analysis via command line interface (CLI) or graphical user interface
(GUI) applications which run on Ubuntu 12.04 (32- or 64-bit) or RHEL/CentOS 6.x
(64-bit).</li>
<li>Automatic kernel version identification — just select a memory image
and go.</li>
<li>Supported memory image formats:
<ul>
<li>raw physical memory images ("mem" format — as produced by
secondlook-memdump, Inception, and other
tools);</li>
<li>SLM memory images ("slm" format — a high-performance compressed
memory image format used by Second Look Enterprise Security Edition);</li>
<li>LiME memory images ("lime", "padded", or LiME "raw" formats — "lime"
and LiME "raw" formats require conversion with secondlook-lime2mem or
secondlook-limeraw2mem, respectively ‐ LiME "padded" is the equivalent of
a raw physical memory image);</li>
<li>VMware virtual machine snapshots ("vmem", "vmsn", or "vmss" formats —
"vmsn" and "vmss" formats, as well as "vmem" files from VMs with >4GB RAM,
require conversion with VMware's vmss2core
and secondlook-core2mem);</li>
<li>VirtualBox snapshots ("vbc" format — via conversion with
secondlook-vbc2mem); and</li>
<li>KVM Libvirt-QEMU-Save or QEMU-savevm snapshots ("lqs" or "qsv" formats
— via conversion with lqs2mem, originally
secondlook-lqs2mem, now an open source project).</li>
</ul>
</li>
<li>Support for analysis of memory images from systems running either
distribution stock kernels or custom kernels.</li>
<li>Support for analysis of memory images from
Amazon EC2 instances (under both pv and hvm virtualization types).</li>
<li>Access to a repository of over 9000 ZRKs (Zipped Reference Kernels)
providing the metadata and baseline for analysis and verification of CentOS,
Debian, Fedora, RHEL, and Ubuntu stock kernels.</li>
<li>An easy-to-use tool for creation of ZRKs for other distributions or for
custom kernels.</li>
<li>Second Look ZRKs
can also be used as Volatility profiles.</li>
<li>Integrity verification of the kernel and processes in memory.</li>
<li>Access to a pagehash database containing hashes of the executable code
pages of the ELF executables and shared libraries from over 2 million
software packages from the Amazon, CentOS, Debian, Fedora, RHEL, and Ubuntu
distributions.</li>
<li>An easy-to-use tool for the addition of pagehashes supporting verification
of custom or third-party software.</li>
<li>Detection of kernel rootkits, backdoors, and other kernel-mode malware
(known and unknown varieties).</li>
<li>Detection of shared library rootkits, keyloggers, spyware, injected
libraries, injected threads, and other user-mode malware (known and unknown
varieties).</li>
<li>Detection of unknown or unauthorized processes.</li>
<li>Recovery of device mapper crypto keys
for LUKS, TrueCrypt, and other full disk encryption schemes.</li>
<li>Extraction of system state from captured memory images, including loaded
kernel modules, running processes, memory mappings, open files, active network
connections, and more.  Output is available in the GUI, in plain text from the
CLI, and in JSON format for ingestion by other programs.</li>
<li>Offline usage is supported via a subscription to our ZRK and pagehash reference data
feeds.</li>
</ul>
<h3 style="text-align: justify;">
More Reasons to Choose Second Look</h3>
<div style="text-align: justify;">

Beyond the unique and powerful Linux Incident Response feature set listed
above, what sets Second Look apart is the team behind it and the quality
of the software they deliver.

</div>
<ul style="text-align: justify;">
<li>The Second Look Team provides professional support via phone and
email, with on-site consulting services available.  You get direct access to
experts in Linux system internals and security.</li>
<li>Customer feedback often quickly leads to new features.</li>
<li>Second Look ships with comprehensive documentation, including a
User Guide with explanations of the techniques most commonly used by
attackers to maintain stealthy persistence on Linux systems.</li>
<li>Second Look is regression tested against a large suite of sample
memory images to ensure maximum quality and compatibility.</li>
<li>If you like the visibility that Second Look gives you during
investigations, you can upgrade to the Enterprise Security edition to monitor
your systems on an ongoing basis.</li>
</ul>
<ul style="text-align: justify;">
</ul>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/wt326aXmDMA?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b>$1495 (USD) | <a href="http://secondlookforensics.com/contact/" target="_blank">Contact Here</a> for Purchase</div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://secondlookforensics.com/">http://secondlookforensics.com/</a></div>

Second Look (Linux Memory Forensics) :: Tools

The Incident Response edition of Second Look®: Linux Memory Forensics is designed for use by investigators who need quick, easy, and e...

Android Data Extractor Lite (ADEL) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQBpxZgandE5D5alwBw5L_UGL3iMqOEB0ajg_cfYZfsGPuJNAb6b2XDZfvsItEsMGGwHvN19IrpDsUI8B7mEdp8miG2w4DADZEoN2Q964MIdgKQA_fMBhm-xtiEUygQ23IwbcP7PNdMoOI/s1600/ADEL+Image.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ADEL Android" border="0" height="287" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQBpxZgandE5D5alwBw5L_UGL3iMqOEB0ajg_cfYZfsGPuJNAb6b2XDZfvsItEsMGGwHvN19IrpDsUI8B7mEdp8miG2w4DADZEoN2Q964MIdgKQA_fMBhm-xtiEUygQ23IwbcP7PNdMoOI/s1600/ADEL+Image.png" title="ADEL Android" width="400" /></a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Android Data Extractor Lite (ADEL)</b> is a <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> script that dumps all important SQLite Databases from a 
connected <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a> smartphone to the local disk and analyzes these files 
in a forensically accurate workflow. If no smartphone is connected you 
can specify a local directory which contains the databases you want to <a href="http://www.toolwar.com/search/label/Anaysis" target="_blank">analyze</a>. Afterwards this script creates a clearly structured XML report.</div>
<div style="text-align: justify;">
If you connect a smartphone you need a rooted and insecure kernel or a custom recovery installed on the smartphone.</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
ADEL needs a predefined configuration for each device to work proper. This configuration has to be added in the following file:</div>
<div style="text-align: justify;">
<pre><code>xml/phone_configs.xml</code></pre>
<pre><code> </code></pre>
</div>
<div style="text-align: justify;">
As an example we added the configuration for the Samsung Galaxy S2 running Android 2.3.3, more phone configurations will follow. Example for the use of ADEL with a connected smartphone:</div>
<div style="text-align: justify;">
<pre><code>adel.py -d device -l 4</code></pre>
<pre><code> </code></pre>
</div>
<div style="text-align: justify;">
Example for the use of ADEL with database backups:</div>
<div style="text-align: justify;">
<pre><code>adel.py -d /home/user/backup -l 4
</code></pre>
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Python Supported Platform :: </b><a href="https://github.com/mspreitz/ADEL/archive/master.zip" target="_blank">ADEL</a> (.py)<br /><b>Source Website ::</b> <a href="https://github.com/mspreitz/ADEL">https://github.com/mspreitz/ADEL</a></div>

Android Data Extractor Lite (ADEL) :: Tools

Android Data Extractor Lite (ADEL) is a Python script that dumps all important SQLite Databases from a connected Android smartphone...

MOBILedit Forensics :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilBgt_tQUcU1RnJsR6nPH7666brLrrSQj-l3nv0h9DkEVD_JpHFKxXQXxKaijN_3LcQrKPhxzpbY8st6tD-UTIMFH1y8OGZW6HmT9-SU-fAYE7BGw95pHT_t7h3K6PY7DDXFW8YqnRsqID/s1600/mobiledit-forensic-3461-1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="MOBILedit Forensics" border="0" height="283" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilBgt_tQUcU1RnJsR6nPH7666brLrrSQj-l3nv0h9DkEVD_JpHFKxXQXxKaijN_3LcQrKPhxzpbY8st6tD-UTIMFH1y8OGZW6HmT9-SU-fAYE7BGw95pHT_t7h3K6PY7DDXFW8YqnRsqID/s1600/mobiledit-forensic-3461-1.jpg" title="MOBILedit Forensics" width="400" /></a></div>
<br />
<span class="Transparent"><b>MOBILedit Forensics</b> can retrieve all data from a <a href="http://www.toolwar.com/search/label/Phone" target="_blank">phone</a> with one click Generate <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic</a> reports ready for the courtroom Relied upon by the US Military, FBI, and CIA!</span> <b>MOBILedit Forensic</b> you can view, search or retrieve all data from a  phone with only a few clicks. This data includes call history,  phonebook, text messages, multimedia messages, files, calendars, notes,  reminders and application data such as Skype, Dropbox, Evernote, etc.   It will also retrieve all phone information such as IMEI, operating  systems, <a href="http://www.toolwar.com/search/label/Firmware" target="_blank">firmware</a> including <a href="http://www.toolwar.com/search/label/SIM" target="_blank">SIM</a> details (IMSI), ICCID and location area  information. Where possible <b>MOBILedit Forensic</b> is also able to retrieve  deleted data from phones and bypass the passcode, PIN and phone backup  encryption.</div>
<div style="text-align: justify;">
<h3>
<b>Features :: </b></h3>
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Support for Almost All Phones :: </b></div>
<div style="text-align: justify;">
MOBILedit Forensic supports thousands of different phones including  common feature phones from manufacturers like Samsung, HTC, Nokia,  Sony, LG and Motorola. It also supports all smartphone operating systems  including <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a>, <a href="http://www.toolwar.com/search/label/iPhone" target="_blank">iPhone</a>, Blackberry, Symbian, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> Mobile, Windows  Phone, Bada, Meego, Chinese phones and CDMA phones.         </div>
<div style="text-align: justify;">
<br /></div>
<div class="right" style="text-align: justify;">
<div style="text-align: justify;">
<b>Extract Important Application Data :: </b></div>
<div style="text-align: justify;">
Get the most from iPhones and Androids. <b>MOBILedit</b> is able to  retrieve the list of installed apps and provides you access to all  application data such as Dropbox, Evernote, Skype, WhatsApp etc. Where  possible, it is even able to retrieve deleted data from mobile apps.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Bypass the Passcode on iOS Using the Lockdown Files Method :: </b></div>
<div style="text-align: justify;">
Although iOS has well protected data due to hardware  encrypted on the fly, <b>MOBILedit Forensic</b> is able to go through this <a href="http://www.toolwar.com/search/label/Security" target="_blank"> protection</a> and retrieve the data. It supports importing the lockdown  files that can be found on a suspect’s computer. These files are  generated when you connect an <a href="http://www.toolwar.com/search/label/iOS" target="_blank">iOS</a> device to a PC and authorize the  computer by typing the passcode. <b>MOBILedit Forensic</b> will instruct you on  how to obtain these files and if you import them to the computer where  you make the acquisition, then you will be able to retrieve all data  from the phone even if it is locked with a passcode.         </div>
<div style="text-align: justify;">
<br /></div>
<div class="right" style="text-align: justify;">
<b>Bypass the PIN Code with an Integrated SIM Cloning Tool :: </b><br />
This feature is the most modern tool of its kind. It removes the  requirement of a PIN for the original SIM card of the phone being  investigated. It also removes the need for obsolete and unreliable  Faraday bags. Now you can clone <b>SIM cards</b>, create new SIM cards with any  ICCID or just format your SIM card to renew for next use. You are able  to connect multiple SIM card readers at the same time.<br />
</div>
<div class="right" style="text-align: justify;">
</div>
<div class="right" style="text-align: justify;">
<b>Examine the Phone Data Without Having the Phone :: </b><br />
Most iOS users are using iTunes, especially for managing  music. The majority of them have connected their iPhone to iTunes at  least once. So, even if you don’t secure the phone as evidence, you can  still acquire the phone data because iTunes by default creates an  automatic backup of any connected iPhone. <b>MOBILedit Forensic</b> instructs  you on how to obtain these iTunes backup files and provides a full  extraction including contacts, messages, recordings, ringtones, notes,  calendar, photos, videos and even apps along with their data.  </div>
<div class="right" style="text-align: justify;">
<div class="right">
<br />
<b>Extract Data from iOS Even When the Phone has Setup Encryption for the Backup :: </b><br />
Standard iOS forensic tools are analyzing data from the  backup. However, when the iPhone has setup encryption, there is not much  these tools can do. <b>MOBILedit Forensic</b> will enable you to retrieve the  data from a live iPhone in a fast logical way without a need to know the  encryption key. With this extra method you will even be able to  retrieve deleted items where available such as messages, contacts and  deleted app data including support for items stored in the cloud.<br />
</div>
<div class="right">
<div class="right">
<b>Get a List of Skype, Gmail or Facebook Contacts Without Even Knowing the Accounts' Passwords :: </b><br />
MOBILedit Forensic gives you a complete support of contact  accounts for Android and iOS. Suspects store contacts not only to the  phone memory, but also to different cloud services such as MS Exchange,  Facebook, Gmail or Skype. Retrieving <a href="http://www.toolwar.com/search/label/Password" target="_blank">passwords</a> for these services might  be impossible. With MOBILedit Forensic you gain access to these sources  and get the full report of all people connected with the suspect.<br />
<br />
<b>Having Trouble Connecting Androids by Cable? Investigate Them Via Wi-Fi :: </b><br />
Some Android phones, especially cheaper ones, cannot be  connected to a PC via cable either because the connection is not  available or because some pre-installed security, firewall, antivirus or  even BYOD systems is blocking the <a href="http://www.toolwar.com/search/label/USB" target="_blank">USB</a> communication with the PC. Using a  special forensic version of the connector app you will be able to  connect these phones via Wi-Fi and make a complete logical extraction.<br />
<b>Powerful SIM Analyzer Retrieves All Possible Information From SIM Card ::</b><br />
This analyzer helps you get the ICCID without even knowing  the PIN and also retrieves Location Area Information. You will be able  to access the SIM card status information (IMSI, ICCID, LAI, PIN, PUK,  call costs) as well as review and export a list of all SIM card  applications. When available you can also read deleted messages from the  SIM card. </div>
<div class="right">
<br />
<b>We Will Navigate You Through the Phone Connection Process Without a Hassle :: </b><br />
You can quickly find any phone in our comprehensive online  database. Just enter any part of the name and you will immediately see  the complete phone feature information along with the compatible data  cable supporting the device and its position in our Connection Kit. If  you are not sure about the model number of your phone, the picture will  help you to identify the right one. Information about how to setup the  connection to a PC (instructions to turn on debugging mode, setting up a  PC suite mode after connection etc.) is also included.  </div>
<div class="right">
<div class="right">
<br />
<b>Retrieve All Important Data with a Physical Acquisition ::</b><br />
Physical acquisition of <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a> phones and <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> cards is  available. This data can then be easily viewed or exported and analyzed  by any third party software.<br />
</div>
<div class="right">
<b>Integrated Search Plugin :: </b><br />
This plugin lets you quickly search across an entire case  including all extracted phones and organizes the data acquired by this  search very efficiently. You can use wildcards to filter your search  results or simply drag & drop cases to reorder the subfolders. You  can also export the searched content with a single click.  </div>
<div class="right">
</div>
<div class="right">
<div class="right">
<b>Additional Assistance with Connection due to Unique Driver Detection and Repair System :: </b><br />
Connecting a phone to Windows can sometimes be problematic,  especially if you haven’t installed the correct phone driver prior to  connecting the phone to a PC. We have developed a special low-level  driver detection and repair system which automatically downloads and  installs the correct driver replacing the wrong one that was  preinstalled by Windows. This will solve a lot of potential troubles  with phone connection.<br />
</div>
<div class="right">
<b>The New Connection Kit with a Complete SIM Cloning Package ::</b><br />
This is a very special collection of custom-made USB  cables that covers the vast majority of phones available on the market  today. Save valuable time that you would have spent searching for older  cables because this collection also includes recently discontinued and  even ancient models.              </div>
</div>
</div>
</div>
</div>
<div style="text-align: justify;">
</div>
<h3>
Tutorials ::</h3>
<b>User Guide ::</b> <a href="http://www.mobiledit.com/forensic-guide" target="_blank">Click Here </a><br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/2FDl0obe0vE?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download ::</h3>
<div style="text-align: justify;">
<b>Windows ::</b></div>
<div style="text-align: justify;">
<a href="http://download.mobiledit.com/mobiledit!/setup_ForensicExpress_1.3.0.531.exe" target="_blank">MOBILedit Forensics Express</a> (.exe)</div>
<div style="text-align: justify;">
<a href="http://download.mobiledit.com/mobiledit!//setup_SimClone_2_0.exe" target="_blank">SIM Cloning</a> (.exe) </div>
<div style="text-align: justify;">
<a href="http://download.mobiledit.com/drivers//mefconnector_1_1_21.apk" target="_blank">Android Forensics Connector</a> (.apk)</div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.mobiledit.com/forensic">http://www.mobiledit.com/forensic</a></div>
</div>

MOBILedit Forensics :: Tools

MOBILedit Forensics can retrieve all data from a phone with one click Generate forensic reports ready for the courtroom Relied upon b...

SIMCon (SIM Card Forensics) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHcbHgI1KTIu4rmmAdo69Nj17IqYlV2WPKktjKhCbkMQBPwpqTzel7B8MPrdXLAqZkXD54OvdPGwZKqHHVuaOpP3vSrZ3rX4sOG1qP07Yuo1UUobEy1owOvZloIZbYyQb_ZslJi3c539ze/s1600/SIMCon.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="SIMCon Forensics" border="0" height="338" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHcbHgI1KTIu4rmmAdo69Nj17IqYlV2WPKktjKhCbkMQBPwpqTzel7B8MPrdXLAqZkXD54OvdPGwZKqHHVuaOpP3vSrZ3rX4sOG1qP07Yuo1UUobEy1owOvZloIZbYyQb_ZslJi3c539ze/s1600/SIMCon.gif" title="SIMCon Forensics" width="400" /></a></div>
<div style="text-align: justify;">
<b>SIMCon</b> is a program that securely images all files on a <b>GSM SIM Card</b> with a standard PC-SC smart card reader, either serial or <a href="http://www.toolwar.com/search/label/USB" target="_blank">USB</a>. After imaging, the <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic investigator</a> can then analyze the contents of the card. Remove the SIM card from any GSM phone and insert it into your forensic <b>SIMCon</b> sim card reader. Plug your sim card reader into your computer and launch the SIMCon 
application. Follow the steps of the software to access the data on the 
SIM card. Specific information regarding stored numbers, call history, and text messages are available. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
All GSM cell phones today have a subscriber identity module (SIM) to identify the phone onto the <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a>. <b>SIMCon</b> is an application to acquire all of the information from the SIM Card.</div>
<div style="text-align: justify;">
<br />The SIM Card provides secure storing of the key identifying a mobile phone service subscriber, subscription information, preferences and text messages. Network state information, such as the current location area identity (LAI), is also stored on the card. When a handset is turned off and then back on, it will search for the LAI that it was in, rather than having to search all frequencies that the phone operates in. This saves time when trying to log on to the network. <br /><br />By using <b>SIMCon</b> and a smart card reader, all of the above information and more can be pulled off of the card without knowing the PIN or the PUK of the card. The PIN and the PUK are ways to keep the information on the card secure. They also can be used as a <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> feature on the <a href="http://www.toolwar.com/search/label/Phone" target="_blank">phone</a>, not allowing anyone to use a phone to access the SIM Card without knowing the codes.<br /><br /><b>SIMCon</b> is an application developed by Inside Out <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">Forensics</a> in Norway. It is designed for use by the law enforcement community, and it can be obtained free of charge by emailing <b>SIMCon</b> and identifying the officers and unit. However, for anyone outside the law enforcement community, it is not free. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Features"> Features :: </span></h3>
<ul style="text-align: justify;">
<li> Acquire all available files on a SIM Card and store in an archive file
</li>
<li> Analyze and interpret content of files 
</li>
<li> Recover deleted text messages stored on the card 
</li>
<li> Manage PIN and PUK codes
</li>
<li> Compatible with SIM Cards and USIM Cards
</li>
<li> Print reports of evidence 
</li>
<li> Secure file archive using hashing
</li>
<li> Export items to popular spreadsheet programs
</li>
<li> Supports international charsets
</li>
<li> Contains a "content" view for plain text viewing of data, as well as a hexadecimal view for more specific analysis.
</li>
</ul>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Data_Acquisition"> Data Acquisition :: </span></h3>
<div style="text-align: justify;">
SIMCon is also capable of aquiring the following data from a SIM Card:
</div>
<ul style="text-align: justify;">
<li> Abbreviated Dialing Numbers (ADN), 
</li>
<li> Last Dialed Numbers (LDN)
</li>
<li> Short Message Service (SMS)
</li>
<li> Public Land Mobile Network (PLMN) selector
</li>
<li> Forbidden PLMNs, Location Information (LOCI)
</li>
<li> General Packet Radio Service (GPRS) location
</li>
<li> International Mobile Subscriber Identity (IMSI)
</li>
<li> Integrated Circuit Card Identifier (ICCID)
</li>
<li> Mobile Subscriber ISDN (MSISDN)
</li>
<li> Service Provider Name (SPN)
</li>
<li> Phase Identification
</li>
<li> SIM Service Table (SST)
</li>
<li> Language Preference (LP)
</li>
<li> Card Holder Verification (CHV1) and (CHV2)
</li>
<li> Broadcast Control Channels (BCCH)
</li>
<li> Ciphering Key (Kc)
</li>
<li> Ciphering Key Sequence Number
</li>
<li> Emergency Call Code
</li>
<li> Fixed Dialing Numbers (FDN)
</li>
<li> Forbidden PLMNs
</li>
<li> Local Area Identitity (LAI)
</li>
<li> Own Dialing Number
</li>
<li> Temporary Mobile Subscriber Identity (TMSI)
</li>
<li> Routing Area Identifier (RIA) netowrk code
</li>
<li> Service Dialing Numbers (SDNs)
</li>
<li> Service Provider Name
</li>
<li> Depersonalizatoin Keys </li>
</ul>
Tutorials ::<br /><b>Buy :: </b><a href="http://www.simcon.no/buy/index.html" target="_blank">SIMCon  $79.95</a><br />
<b>Official Website :: </b><a href="http://www.simcon.no/index.html">http://www.simcon.no/index.html</a>

SIMCon (SIM Card Forensics) :: Tools

SIMCon is a program that securely images all files on a GSM SIM Card with a standard PC-SC smart card reader, either serial or USB . Af...

CD/DVD Inspector (CD/DVD Forensics) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="CD/DVD Inspector" border="0" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8t5ku03fzM66A_D-zGNtFxTSIjD8cNRhTQ49guzYkRb5UYgQxwPknB-Uau7TUenSzPl680Vn6g7c4O2r1LbbS6JEO3jDFJY1tkhvqEfzk27-4WiBBtCc9D38NquQt9ntGyY0A7BNNWROd/s1600/CD-DVD+Inspector.jpg" title="CD/DVD Inspector" width="640" /></div>
<div style="text-align: justify;">
<b>CD/DVD Inspector</b> for intensive <b>analysis and extraction</b> of data from CD-R, CD-RW and all types of DVD media - including HD DVD and Blu-Ray.. Tailored for professionals in <b>data recovery, <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a>, and law enforcement.</b>  Building on the <a href="http://www.toolwar.com/search/label/Recovery" target="_blank">data recovery</a> technology in CD/DVD Diagnostic™, it adds detailed displays and enhanced media search abilities, improving performance and usability.  With the release of the 4.1 version, this is now the forensic tool you should be using.  For information about the changes in each version see the release information page.<br /><br /><b>CD/DVD Inspector</b> reads all major CD and DVD filesystem formats including ISO-9660, Joliet, UDF, HSG, HFS and HFS+.  When the disc being examined contains more than a single filesystem, all filesystems found are displayed.  Multiple filesystems are present for hybrid Macintosh/PC discs as well as for discs that are produced by DirectCD and other packet-writing software. DVD Video discs include both the UDF and ISO-9660 filesystem as well.<br /><br /><b>CD/DVD Inspector </b>now includes a flexible report generator which can be tailored to your specific requirements.  Over 50 separate data items can be selected for reports with output in direct to print, HTML, text file or CSV.  With printed and HTML reports thumbnails can be included for pictures.  Reports can be sorted by any data item included in the report.<br /><br />Now available - Robotic Loader Extension.  This is the tool to automate your handling of the massive quantities of CD and DVD evidence that is being collected.  Includes support for photographing and tracking discs!  InfinaDyne now supports TEAC disc publishing systems for automated collection of CD and DVD evidence.</div>
<h3 style="text-align: justify;">
Features ::</h3>
<div style="text-align: justify;">
<b>Flexible Report Generator ::</b><br />Reports can be produced for print, HTML, text file or CSV output with over 50 different data items selectable.  An unlimited number of user-defined reports can be created.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Automated Media Collection ::</b><br />Put up to 300 discs at once in one of the supported Robotic Loader systems and it will automatically collect all content from every disc.  Flexible reporting for each disc processed.  Import the results directly into EnCase or FTK.  Optionally photograph each disc as it is processed.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Complete CD Imaging :: </b><br />Now CD/DVD Inspector can create an image file containing all of the information required to completely process any disc in a set of two files.  The first file contains the complete "raw" track data with all subchannels from a CD and all of the user sector data from all sessions on a DVD.  The second file is in XML format and contains all of the information that CD/DVD Inspector has extracted from the various control structures on the disc and the file systems.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Transfer data collected to EnCase, FTK, etc. ::</b><br />Captures all files, even those not part of the directory structure (deleted or damaged) One-step image collection from otherwise inaccessible CD or DVD discs.Use of 'hard links" minimizes size of the image file while retaining complete content of the disc. Drag-and-drop a single file per disc<br /><br /><b>File scanning ::</b><br />“Inaccessible” discs files can be searched using scan specification syntax, including regular expressions.</div>
<div style="text-align: justify;">
<br /><b>Built-in Image Viewer :: </b><br />This tool identifies files containing graphic content (ART, BMP, GIF, JPEG, TIFF, etc.) independent of the file extension. Supports RAW images from over 125 different digital cameras.<br /><br /><b>Low-level sector examination and scanning ::</b></div>
<div style="text-align: justify;">
Displays sectors in hexadecimal and character. It  also scans all sectors of a disc for particular data   For example, it  locates an email address on a disc regardless of what file the mail  may be in.  This searches the complete disc, not just areas identified as belonging to files.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Data pane ::</b></div>
<div style="text-align: justify;">
Allows direct examination of the contents of files on the disc from the main window.  The information can be displayed in either character or hexadecimal/character form.  The data pane can be resized and scrolled as needed.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Disc Memory and Checkpoint ::</b><br />This feature eliminates lengthy re-discovery of the disc’s contents.  Additionally, it allows for interruption of a disc examination and then resumption of that same examination at a later time.  This is useful as some disc examinations can be lengthy, often taking more than 12 hours.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Intensive Disc Examination ::</b><br />Locates data on discs that has been dropped from the file system, either because of software glitches, deletion or user action.  This is now done for all format discs.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Expanded Retry Capabilities ::</b><br />Permits users to select the level of automatic retries performed whenever a data error is encountered.  This can make otherwise unreadable data sectors readable again.  This allows the user to balance examination speed with thoroughness.<br /><b> </b></div>
<div style="text-align: justify;">
<b>CD Text, ISRC and RID Audio Disc Display ::</b></div>
<ul style="text-align: justify;">
<li>CD Text contains album, track and artist names on Sony and home-produced music CDs.</li>
</ul>
<ul style="text-align: justify;">
<li>ISRC is the acronym for International Standard Recording Code.  It is a code used to identify the recording studio and publisher of a music track. </li>
</ul>
<ul style="text-align: justify;">
<li>RID is the acronym for Recorder Identification.  It is written to music CDs recorded on standalone CD recorders used with audio systems. </li>
</ul>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Buy :: </b>$699 - <a href="http://www.infinadyne.com/cddvd_inspector.html" target="_blank">Click Here for Purchase</a></div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.infinadyne.com/cddvd_inspector.html">http://www.infinadyne.com/cddvd_inspector.html</a></div>

CD/DVD Inspector (CD/DVD Forensics) :: Tools

CD/DVD Inspector for intensive analysis and extraction of data from CD-R, CD-RW and all types of DVD media - including HD DVD and Blu-R...

UFED Physical Analyzer (Mobile Forensics & Analysis) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrrfb3Vu39jG8zllB6pBzdPUOl7XnIjnKiOGJ5Fkxd-XaLP2XL1vQjPm3haFOBuClpRNQQSOPDsvnWSqf8nzx5BTRdsMPscgUQL_tvrz0MbYFvVmw2RiiPr9oSCLYKtIaVjhWf61xVy-_x/s1600/Cellebrite+Physical+Analyzer+Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Cellebrite Physical Analyzer Screenshot" border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrrfb3Vu39jG8zllB6pBzdPUOl7XnIjnKiOGJ5Fkxd-XaLP2XL1vQjPm3haFOBuClpRNQQSOPDsvnWSqf8nzx5BTRdsMPscgUQL_tvrz0MbYFvVmw2RiiPr9oSCLYKtIaVjhWf61xVy-_x/s1600/Cellebrite+Physical+Analyzer+Screenshot.png" title="Cellebrite Physical Analyzer Screenshot" width="400" /></a></div>
<b>UFED Physical Analyzer</b> is the most <b>advanced analysis, decoding and reporting</b> application in the <a href="http://www.toolwar.com/search/label/Phone" target="_blank">mobile forensic</a> industry. It includes <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware detection</a>, enhanced decoding and reporting functions, project analytics, timeline graph, exporting data capabilities and much more.<span id="copylink" style="left: -9999px; position: absolute;"><br />
Source: http://www.cellebrite.com/mobile-forensics/products/applications/ufed-physical-analyzer</span><span id="copylink" style="left: -9999px; position: absolute;"> </span> </div>
<div style="text-align: justify;">
The <b>Cellebrite 'Universal Forensic Extraction Device' (UFED)</b>  is a <a href="http://www.toolwar.com/search/label/Phone" target="_blank">tool for mobile phone</a>, smartphone, and PDA <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a>. As of  September 2010 the UFED was compatible with over 2,500 mobile phones  (including GSM, TDMA, CDMA, iDEN). The standard package containing  several dozen phone cables. The <b>UFED</b> had an intergrated SIM reader, with  Wireless connection options also being integrated, such as IR and  Bluetooth.   </div>
<div style="text-align: justify;">
The <b>UFED</b> also supports native Apple iPOD Touch, and Apple iPHONE  extraction on both 2G and 3G versions, as well as iOS4. This is  clientless, and via a physical cable, and works on <a href="http://www.toolwar.com/search/label/Jailbreak" target="_blank">jailbroken</a> and  non-jailbroken devices.  </div>
<div style="text-align: justify;">
Subject data can be retrieved via logical extraction or via  physical extraction (ie: hex dump). Moreover, all cable connectors from  subject (source) side act as a write-blocker, being read only via the  onboard hardware chipset. Extracted data includes basic handset data,  the phonebook, SMS and MMS messages, SIM data, multimedia (e.g. images  and videos stored on the phone), and time and date stamps. </div>
<div style="text-align: justify;">
<b>Supported Devices :: </b><a href="http://www.cellebrite.com/mobile-forensics/support/ufed-supported-devices" target="_blank">Click Here</a></div>
<h3 style="text-align: justify;">
Advanced capabilities for:</h3>
<div style="text-align: justify;">
<b>iOS :: </b> </div>
<ul style="text-align: justify;">
<li>Bypassing <b>simple and complex passcode</b> while performing physical and file system extraction on selected devices running iOS 3.0 or higher including iOS 6.</li>
<li>Real-time decryption and decoding of data, applications, and keychain real-time decryption while revealing user passwords.</li>
<li>Advanced decoding of applications.</li>
</ul>
<div style="text-align: justify;">
<b>BlackBerry :: </b> </div>
<ul style="text-align: justify;">
<li>Advanced decoding of BlackBerry Messenger (BBM), emails, locations, applications and more.</li>
<li>Real-time decryption of protected content from selected BlackBerry devices running OS 4+ using a given password.</li>
</ul>
<div style="text-align: justify;">
<b>Android ::</b> </div>
<ul style="text-align: justify;">
<li>Advanced decoding of all physical extractions performed on devices running any Android versions.</li>
<li>Advanced decoding of applications and application files.</li>
</ul>
<div style="text-align: justify;">
<b>GPS :: </b> </div>
<ul style="text-align: justify;">
<li>Portable GPS devices extraction and decoding.</li>
<li>Exclusive – Physical extraction of Tom Tom trip-log files.</li>
</ul>
<h3>
Tutorials :: </h3>
<div style="text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/OTa6JWwFUms?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/V-x-uJ5TRuM?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download :: <b> </b></h3>
<b>Trial (30 Days) ::</b> <a href="http://go.cellebrite.com/30DayPhysicalAnalyzerTrial" target="_blank">Click Here</a> <b> </b><br />
<b>Buy :: </b><a href="https://my.cellebrite.com/" target="_blank">Click Here</a><b><br /></b><br />
<b>Official Website :: </b><a href="http://www.cellebrite.com/">http://www.cellebrite.com/</a>

UFED Physical Analyzer (Mobile Forensics & Analysis) :: Tools

UFED Physical Analyzer is the most advanced analysis, decoding and reporting application in the mobile forensic industry. It includes ...

BitPim (Manage and Forensics Data of CDMA Phones) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGX39dkjXOp48ppF7W5r8iXJLZS1jOmRfKmVlp9jLAZFgaU5PIGahTf_Iiw0eutIdq4-D27rsZynrg-L2XzUbJA1o-uUt_JhAsfHSND1q85iTITrSMONIlUygkv81G4mk_Ytn8npz2r84N/s1600/BitPim.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="BitPim Screenshot" border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGX39dkjXOp48ppF7W5r8iXJLZS1jOmRfKmVlp9jLAZFgaU5PIGahTf_Iiw0eutIdq4-D27rsZynrg-L2XzUbJA1o-uUt_JhAsfHSND1q85iTITrSMONIlUygkv81G4mk_Ytn8npz2r84N/s1600/BitPim.jpg" title="BitPim Screenshot" width="400" /></a></div>
<b>BitPim</b> is a program that allows you to <b>view and manipulate       data on many CDMA phones</b> from LG, Samsung, Sanyo and other       manufacturers. This includes the PhoneBook, Calendar,       WallPapers, RingTones (functionality varies by phone) and the       Filesystem for most Qualcomm CDMA chipset based <a href="http://www.toolwar.com/search/label/Phone" target="_blank">phones</a>.<br />
<b>BitPim</b> is a free, open source, cross-platform program for viewing and editing data on a CDMA cell phone. Roger Binns was the founder, project manager, and lead developer of the project, first releasing it on March 1st, 2003. Since then leadership has been handed over to another party and over two million users have downloaded it. The program has been developed in python and originally only supported the LG VX4400 but it now supports a variety of phone manufactures including Audiovox, Kyocera, LG, Motorola, Nokia, Palm, Samsung, Sanyo, and Toshiba.<br /><br />In order to use the program, a data cable and it's drivers, usually available from the supplier/manufacturer, are required. <b>BitPim</b> will try and automatically detect a phone but its recommended that settings are manually configured.<br />
<h3>
<b>Features :: </b> </h3>
The program can examine the phonebook, calendar, media (e.g. sounds, ringers, images), memos, todo lists, SMS messages, call history, play lists, and raw filesystem from devices.<br /><br />Features are dependent on the phone model. For a full list of each phones supported features see BitPim's supported phones list.<br /><br />The data can be manipulated through the software and changes can be uploaded to the phone. Calendar, Phonebook, Memo, Todo, and Playlist data can all be imported from an external file. For backup purposes all of the data can be exported to external files.<br />
<h3>
Forensics :: </h3>
If doing a <a href="http://www.toolwar.com/search/label/Investigation" target="_blank">forensic investigation</a> the application should always be in read only mode, which claims to block all write commands to the phone. The program will not recover deleted data nor does it always recover all undeleted data. The file system view is a very important feature forensically as it allows a raw view of data from the phone, possibly uncovering data that <b>BitPim</b> missed or found unimportant. An advanced feature that could also be vital to a <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic</a> investigation is BitFling. This feature allows another computer to remotely access a phones data over the internet. A phone could be confiscated in California, connected to BitPim with BitFling configured, and be forensically analyzed in New York. Lastly exporting the data is very important so that copies of the data can be made, ensuring no data is lost or manipulated. <br />
<br /></div>
<div style="text-align: justify;">
<b>All Supported model of Phones ::</b> <a href="http://www.bitpim.org/help/" target="_blank">Click Here</a> </div>
<div style="text-align: justify;">
<b>FAQ ::</b> <a href="http://www.bitpim.org/help/faq.htm" target="_blank">Click Here</a></div>
<div style="text-align: justify;">
<b>Help and Support :: </b><a href="http://www.bitpim.org/help/support.htm" target="_blank">Click Here</a></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/75tNvKLz0F8?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows | Linux | Mac :: </b><a href="http://prdownloads.sourceforge.net/bitpim/bitpim-1.0.7-setup.exe?download" target="_blank">BitPim</a> (.exe) | <a href="http://prdownloads.sourceforge.net/bitpim/bitpim-1.0.7-0.i386.rpm?download" target="_blank">BitPim</a> (.rpm) | <a href="http://prdownloads.sourceforge.net/bitpim/LEOPARD-bitpim-1.0.7.dmg?download" target="_blank">BitPim</a> (.dmg)</div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.bitpim.org/">http://www.bitpim.org/</a></div>

BitPim (Manage and Forensics Data of CDMA Phones) :: Tools

BitPim is a program that allows you to view and manipulate data on many CDMA phones from LG, Samsung, Sanyo and other manuf...

Photo Investigator (Analyze and Remove Photograph's Metadata) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="Photo Investigator" border="0" height="299" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCK0G-Zs7jMrY-HrNDCmmCqngy0t8Y3-hN0je02f1Ji2L22r5EzjGJn0JJnKGceF65W-N65_xwjyAcTnFINTgGATYjqoGAk99U7YJTcF7DHxBbMCY-NBa-a8aGsuFe75WG3L3cRBT2M_wR/s1600/Photo+Investigator.jpg" title="Photo Investigator" width="640" /></div>
</div>
<div style="text-align: justify;">
The <b>Photo Investigator</b> (<b>PI</b>) is a free <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">image forensic</a> iOS App distributed on the iOS App Store.
It specializes in the <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis</a> and removal of all digital photograph metadata. The <b>Photo Investigator</b> can read all image formats and view all the photo metadata. It is best known for viewing the photo GPS location.  Scrolling 
through the devices images, an image will have an overlayed globe if GPS
 metadata is saved within the photo.  Full EXIF, IPTC, XMP, TIFF, and 
other forms of metadata are visible, which may include the photo 
location, camera's serial number, camera's software, camera hardware, 
and other settings and information.
The <b>Photo Investigator</b> interface is optimized for quick inspection of photos, including a full screen zoom mode. 
</div>
Inspect all the possible data stored ABOUT each photo (free) or remove photo metadata ($1).<br />
<ul>
<li>See which Photos have GPS Metadata while choosing image</li>
<li>Metadata includes GPS , EXIF, TIFF, IPTC, XMP and more.</li>
<li>File Size</li>
<li>File Creation Date</li>
<li>Remove Metadata (remove GPS location)</li>
<li>Map for GPS Location</li>
</ul>
<h3>
Tutorials ::<br />Download ::</h3>
<b>App Store :: </b><a href="http://www.appstore.com/danielanderson" target="_blank">Photo Investigator</a><b><br /></b><br />
<b>Official Website :: </b><a href="http://www.a-r-studios.com/pi/">http://www.a-r-studios.com/pi/</a>

Photo Investigator (Analyze and Remove Photograph's Metadata) :: Tools

The Photo Investigator ( PI ) is a free image forensic iOS App distributed on the iOS App Store. It specializes in the analysis and ...

Scalpel (Data Carving / Forensics) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="Scalpel File Carving" border="0" height="401" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3VpA7fvHWtvtTu1En4hyKfrQQ-P789lCCdh2-IYD099ppsXp5Vhruf9DLfp_3pcxvEU9irpL6sjH0wpQQua8wSJVqplQItpzc4tlOPDG__ydIAUTBDybUKBMBHnVX60mxAi3pbZ0zZSJD/s1600/Scalpel+Forensics.jpg" title="Scalpel File Carving" width="640" /></div>
<br />
<b>Scalpel</b> is a <b>file carving and indexing application</b> that runs on <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> and <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a>.  The first version of <b>Scalpel</b>, released in 2005, was based on <a href="http://www.toolwar.com/2013/11/foremost-tools.html" target="_blank">Foremost</a> 0.69. There have been a number of internal releases since the last public release, 1.60, primarily to support our own research.  The newest public release v2.0, has a number of additional features, including:<br />
<ul>
<li>Minimum carve sizes.</li>
<li>Multithreading for quicker execution on multicore CPUs.</li>
<li>Asynchronous I/O that allows disk operations to overlap with pattern matching--this results in a substantial performance improvement.</li>
<li>Regular expression support for headers/footers.</li>
<li>Embedded header/footer matching for better processing of structured file types that may contain embedded files.</li>
<li>For advanced users, support for massively-threaded execution on Graphics Processing Units (GPUs).  This feature is available only on Linux and requires installation of the NVIDIA CUDA SDK, modification of scalpel.h to enable the GPU threading mode, and compilation with the CUDA toolchain.  Our implementation also requires an NVIDIA GPU with compute capability >= 1.2, so older CUDA-capable cards probably won't work.  The NVIDIA GTX 260 is relatively inexpensive and powerful and has the appropriate compute capability.  The GPU-enhanced version of Scalpel is able to do preview carving at rates that exceed the disk bandwidth of most file servers, so for big jobs, it may be worth the extra effort required to use this feature.  Note that regular expression-based headers and footers are NOT currently supported when GPU acceleration is in use!  We might address this in a future release.</li>
</ul>
<br />
<b>Scalpel</b> performs <a href="http://www.toolwar.com/search/label/Carving" target="_blank">file carving</a> operations based on patterns that describe particular file or data fragment "types".  These patterns may be based on either fixed binary strings or regular expressions. A number of default patterns are included in the configuration file included in the distribution, <b>"scalpel.conf"</b>.  The comments in the configuration file explain the format of the file carving patterns supported by <b>Scalpel</b>.<br />
<br />
Important note: The default configuration file, "scalpel.conf", has all supported file patterns commented out--you must edit this file before running Scalpel to activate some patterns.  Resist the urge to simply uncomment all file carving patterns; this wastes time and will generate a huge number of false positives.  Instead, uncomment only the patterns for the file types you need.<br />
<br />
<b>Scalpel </b>options are described in the <b>Scalpel</b> man page, "scalpel.1". You may also execute Scalpel w/o any <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command line</a> arguments to see a list of options.<br />
<br />
NOTE: Compilation is necessary on Unix platforms and on <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X</a>.  For Windows platforms, a precompiled scalpel.exe is provided.  If you do wish to recompile <b>Scalpel</b> on Windows, you'll need a mingw (gcc) setup. Scalpel will not compile using Visual Studio C compilers.  Note that our compilation environment for <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> is currently 32-bit; we haven't tested on the 64-bit version of mingw, but will address this int the future.<br />
<br />
<b>Other Supportive Platforms :: </b></div>
<div style="text-align: justify;">
<br />
We are not currently supporting <b>Scalpel</b> on <a href="http://www.toolwar.com/search/label/Unix" target="_blank">Unix</a> variants other than Linux. Go ahead and try a ./configure and make and see what happens, but be sure to do thorough testing before using <b>Scalpel</b> in production work.  If you are interested in supporting a version of <b>Scalpel </b>on an alternate platforms, please contact us.  If you are interested in supporting a GPU-enhanced version of Scalpel on Windows, we are also interesting in hearing from you.<br />
<br />
<b>Limitations ::</b> <br />
<br />
Carving Windows physical and logical device files (e.g., \\.\physicaldrive0 or \\.\c:) isn't currently supported because it requires us to rewrite some portions of <b>Scalpel </b>to use Windows file I/O functions rather than standard Unix calls.  This may be supported in a future release.<br />
<br />
Block map features are currently disabled, as we are rewriting this subsystem to enhance interoperability with the <a href="http://www.toolwar.com/2014/01/the-sleuth-kit-tsk-forensics-framework.html" target="_blank">Sleuthkit</a>.  An improved version of the block map features will return in a subsequent release. The -s command line option ("skip") has been removed and will be replaced with a more robust facility in the next major release.<br />
<br />
<br />
<b>Dependencies ::</b><br />
<br />
Scalpel uses the POSIX threads library.  On Win32, Scalpel is distributed with the Pthreads-win32 - POSIX Threads Library for Win32, which is Copyright(C) 1998 John E. Bossom and Copyright(C) 1999,2005 by Pthreads-win32 contributors.  This library is licensed under the LGPL.<br />
<br />
Scalpel for Win32 uses the tre regular expression library and is distributed with tre-0.7.5, which is licensed under the LGPL.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<h3>
Tutorials :: </h3>
<b>COMPILE INSTRUCTIONS ON SUPPORTED PLATFORMS :: </b><br />
<b>Linux/Mac OS X ::</b> <br />
<div style="text-align: justify;">
<span style="font-family: "Courier New",Courier,monospace;">./configure and then make</span><br />
<br />
<b>Windows :: </b> </div>
cd to src directory and then:<br />
<span style="font-family: "Courier New",Courier,monospace;">mingw32-make -f Makefile.win</span><br />
<br />
and  enjoy.  If you want to install the binary and man page in a more  permanent place, just copy "scalpel" (or "scalpel.exe") and "scalpel.1"  to appropriate locations, e.g., on Linux, "/usr/local/bin" and  "/usr/local/man/man1", respectively.  On Windows, you'll also need to  copy the pthreads and tre regular expression library dlls into the same  directory as "scalpel.exe".<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/5Z9JsBazOdw?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download ::</h3>
</div>
<div style="text-align: justify;">
<b>Linux | Windows | Mac :: </b><a href="https://github.com/sleuthkit/scalpel/archive/master.zip" target="_blank">Scalpel</a> (.zip)<b>
</b></div>
<div style="text-align: justify;">
<b>Official Website :: </b> <a href="https://github.com/sleuthkit/scalpel">https://github.com/sleuthkit/scalpel</a></div>

Scalpel (Data Carving / Forensics) :: Tools

Scalpel is a file carving and indexing application that runs on Linux and Windows . The first version of Scalpel , released in 2005,...

Bulk Extractor (Computer Forensics) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Bulk Extractor" border="0" height="267" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSwFRjzP4nYzs-ILiilqCBkm5oZiif74oCtqJU8AR5h2mTI_uHT4qyVykTzAKntroljTwfaPMVl2vcJLfpgcd6GaTRTidtiwi8dgXrG0Sp6F0pMD2_DCiaA94q7R02Bz4t8-nz_dhg07WE/s1600/computer-forensic-analysis.jpg" title="Bulk Extractor" width="400" /></div>
<div style="text-align: justify;">
<b>Bulk Extractor</b> is a <b>computer forensics tool</b> that scans a disk  image, a file, or a directory of files and extracts useful information  without parsing the file system or file system structures. The results  can be easily inspected, parsed, or processed with automated tools. <b>Bulk Extractor</b>  also created a histograms of features that it finds, as features that  are more common tend to be more important. The program can be used for  law enforcement, defense, intelligence, and <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">cyber-investigation</a>  applications. </div>
<div style="text-align: justify;">
bulk_extractor is distinguished from other forensic tools by its  speed and thoroughness. Because it ignores file system structure, <b>Bulk Extractor</b> can process different parts of the disk in parallel. In  practice, the program splits the disk up into 16MiByte pages and  processes one page on each available core. This means that 24-core  machines process a disk roughly 24 times faster than a 1-core machine. <b>Bulk Extractor</b> is also thorough. That’s because <b>Bulk Extractor</b>  automatically detects, decompresses, and recursively re-processes  compressed data that is compressed with a variety of algorithms. Our  <a href="http://www.toolwar.com/search/label/Testing" target="_blank">testing</a> has shown that there is a significant amount of compressed data  in the unallocated regions of file systems that is missed by most  <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic tools</a> that are commonly in use today. </div>
<div style="text-align: justify;">
Another advantage of ignoring file systems is that <b>Bulk Extractor</b>  can be used to process any digital media. We have used the program to  process hard drives, SSDs, optical media, camera cards, <a href="http://www.toolwar.com/search/label/Phone" target="_blank">cell phones</a>,  network packet dumps, and other kinds of digital information. </div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;"><b>Compiling for MacOS or Linux</b> :: </span></span></div>
<div style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;">From the downloaded source directory run bootstrap.sh, configure and make: </span></span> </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ cd bulk_extractor </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sh bootstrap.sh </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sh configure </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ make </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo make install </span></li>
</ul>
<div style="text-align: justify;">
<b>Compiling for Windows :: </b></div>
<div style="text-align: justify;">
There are three ways to compile for Windows: </div>
<div style="text-align: justify;">
1. Cross-compiling from a Linux or Mac system with mingw. </div>
<div style="text-align: justify;">
2. Compiling natively on Windows using mingw. </div>
<div style="text-align: justify;">
3. Compiling natively on Windows using cygwin (untested)</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Cross-compiling for Windows using Debian Testing (wheezy) or Ubuntu 12.04 LTS (with mingw) :: </b></div>
<div style="text-align: justify;">
You will need to install mingw-w64 and zlib-dev: </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo apt-get update </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo apt-get upgrade </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo apt-get -y install mingw-w64 </span></li>
</ul>
<div style="text-align: justify;">
Next, download zlib from zlib.net </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ ./configure --host=i686-w64-mingw32 </span></li>
</ul>
<div style="text-align: justify;">
This allows the cross-compiling of the 64-bit and the 32-bit bulk_extractor.exe, although we do not recommend running the 32-bit version. </div>
<div style="text-align: justify;">
Now you are ready to compile: </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ git clone --recursive https://github.com/simsong/bulk_extractor.git </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ cd bulk_extractor </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sh bootstrap.sh </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ mingw64-configure</span></li>
</ul>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Installing on a Linux/MacOS/Mingw system :: </b></div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ ./configure </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ make </span></li>
<li><span style="font-family: "Courier New",Courier,monospace;">$ sudo make install  </span></li>
</ul>
<div style="text-align: justify;">
<b>Usages :: </b> </div>
<div style="text-align: justify;">
To get started and send an extract of image.raw to OUTPUT, use this command: </div>
<ul style="text-align: justify;">
<li><span style="font-family: "Courier New",Courier,monospace;">$ /usr/local/bin/bulk_extractor -o OUTPUT image.raw </span> </li>
</ul>
<div style="text-align: justify;">
<b>For more & Troubleshooting :: </b><a href="https://github.com/simsong/bulk_extractor" target="_blank">Click Here</a><br />
</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/wTBHM9DeLq4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux | Mac | Windows :: </b><a href="https://github.com/simsong/bulk_extractor/archive/master.zip" target="_blank">Bulk Extractor</a> (tarball)<b> | </b><a href="http://digitalcorpora.org/downloads/bulk_extractor/bulk_extractor-1.4.1-windowsinstaller.exe" target="_blank">Bulk Extractor</a> (.exe)<b> | </b><a href="http://digitalcorpora.org/downloads/bulk_extractor/bulk_extractor-1.4.4.tar.gz" target="_blank">Bulk Extractor</a> (.tar.gz)<b>
</b></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="https://github.com/simsong/bulk_extractor">https://github.com/simsong/bulk_extractor</a></div>

Bulk Extractor (Computer Forensics) :: Tools

Bulk Extractor is a computer forensics tool that scans a disk image, a file, or a directory of files and extracts useful information ...

XVI32 (Hex Editor) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfKbk21vbvXwrLz_cmg0bxQMruPCPz2nvYnXxCk0sGxdW_whra8hYD4-XctyMjpvphrhLmUTc5-BXdHG-0e4EvoZxnwCbNAiK9EGQ3-83G9vab2BkutNSQZnQsPXFbnxtipbJvB2WVb9Rw/s1600/XVI32+Hex+Editor+Screenshot.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="XVI32 Hex Editor Screenshot" border="0" height="265" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfKbk21vbvXwrLz_cmg0bxQMruPCPz2nvYnXxCk0sGxdW_whra8hYD4-XctyMjpvphrhLmUTc5-BXdHG-0e4EvoZxnwCbNAiK9EGQ3-83G9vab2BkutNSQZnQsPXFbnxtipbJvB2WVb9Rw/s1600/XVI32+Hex+Editor+Screenshot.gif" title="XVI32 Hex Editor Screenshot" width="400" /></a></div>
</div>
<div style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;"><b>XVI32</b> is a freeware hex editor running under <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> 9x/NT/2000/XP/Vista/7.
The name <b>XVI32</b> is derived from <i>XVI</i>, the roman notation for the number 16.
XVI32 and all of its components are developed by myself.
</span></span></div>
<div style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;">The current release 2.55 is available since June 26, 2012. It comes with a complete online 
help and requires only 1.02 MB of hard disk space. There is no setup program needed - 
just unzip the downloaded archive to your hard disk! <b>XVI32</b> doesn't write any data to your registry. </span></span></div>
<h2 style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;">Features</span></span></h2>
<div style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;">
<b>XVI32</b> has the following main features. Especially note the <b>highlighted</b> advantages of XVI32.
</span></span></div>
<ul style="text-align: justify;">
<li><span style="font-family: inherit;"><span style="font-size: small;">XVI32 is a <b>portable application</b>, i.e. no setup program is needed, you can run <b>XVI32</b> from your <a href="http://www.toolwar.com/search/label/USB" target="_blank">USB</a> stick, no data is written to the registry 
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>data inspector</b> to view decoded numbers (see screen shot; can be turned off).
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Has <b>built-in script interpreter</b>.
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Easily works with huge files.</b> Try to open a 60 MB sized text file with some other hex editor 
        (not to speak about Wordpad), then use XVI32... If you don't have such a huge text file, use my <a href="http://www.toolwar.com/search/label/Tools" target="_blank">freeware        tool</a> RndFile to create one
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>XVI32</b> allows to edit files <b>up to 2 GB</b> (enough virtual memory provided, of course)
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">For your convenience, <b>XVI32 stores settings</b> and last used search strings etc. in XVI32.INI file
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Progress indication in percent</b> for most operations
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">You can <b>abort nearly all operations</b> (reading/writing files, search, replace, print...)
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Display of both text (ASCII/ANSI) and hexadecimal representation
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Two synchronous cursors</b> in text and hex area
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Fully resizeable window (change number of rows and columns)
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Font and font size adjustable
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Overwrite or <b>insert</b> characters
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Insert text or hex string <b>n times</b></span></span>
        
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Switch byte offset (address) of first byte between <b>0 or 1</b> to examine also record structure of plain text files
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Search text or hex string</b>, e.g. find "this text" or find "0D 0A"
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Simplified search for Unicode Latin (UTF-16) strings</b></span></span>
        
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Search optionally with joker (wildcard) char</b> that will match any character, e.g. find "A.C" or "00 2E 2E 00" where "." = "2E" (user-defined) stands for any character
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Fast searching algorithm <b>(Quicksearch)</b> for <b>both</b> search directions (down/up)
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Count</b> occurences of text or hex string
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Replace</b> text or hex string, e.g. replace "0D 0A" by "0A" or replace "0D 0A" by text "EOL"
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Extremely fast "replace all"</b> mode (if needed, additional memory is allocated <i>beforehead</i>,
            not at every single replacing operation)
    </span></span></li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Menu item <b><i>Shredder data</i></b> to overwrite all bytes of a file with binary zeroes
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Auto-fill</b> feature to copy bytes from current address into input field for hex string using right arrow key
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Character conversion using self-defined character table</b></span></span>
        
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Easy <b>converting of text to hex string</b> in dialogs (e.g. "abc" -> "61 62 63")
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Decoding and encoding of 1, 2, 4, and 8 byte integers or 4/8 byte floats</b> in 2 possible byte orders
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Bit manipulation</b> (view or set bits)
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Open file in <b>Read Only Mode</b> (e.g. if opened by another application or to avoid unintentional modifications)
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Insert file contents</b> into file
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Write block to file</b></span></span>
        
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Copy, move or delete block
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Clipboard support
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Goto address <b>(absolute or relative up/down)</b></span></span>
        
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Up to <b>9 named bookmarks</b></span></span>
        
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Enter jump width and jump up/down <b>(useful for files with fixed record length)</b></span></span>
        
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Patch BORLAND PASCAL 7.0 EXE files</b> for execution on processors > 200 MHz
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;"><b>Printing with preview</b> or print to file
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Simplified search for Unicode Latin (UTF-16) strings
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Command "Reload" to open current file again
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">Easily access most recently used files
        </span></span>
    </li>
<li><span style="font-family: inherit;"><span style="font-size: small;">And last, but not least: <b>XVI32 is free!</b></span></span>
        
</li>
</ul>
<h3 style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;">Tutorials ::</span></span></h3>
<div style="text-align: justify;">
<span style="font-size: small;">
<span style="font-weight: normal;"><b>Installation :: </b></span></span></div>
<h3 style="text-align: justify;">
<span style="font-size: small;"><span style="font-weight: normal;">You don't need to execute a setup programm writing obscure data to 
your registry or updating DLLs in your Windows system folder. Simply
proceed as follows:

</span><ol>
<li><span style="font-weight: normal;">Create a directory on your hard disk, e.g. C:\Program Files\XVI32</span>
  </li>
<li><span style="font-weight: normal;">Unzip the downloaded archive xvi32.zip completely into this directory</span>
  </li>
<li><span style="font-weight: normal;">Run XVI32.EXE </span>
</li>
</ol>
</span></h3>
<span style="font-size: small;"><b>Screenshots :: </b><a href="http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm#screenshots" target="_blank">Click Here</a> </span><br />
<b>Video Tutorials ::</b> <a href="https://www.youtube.com/watch?v=MLRayJkJUCQ" target="_blank">Click Here</a><br />
<h3 style="text-align: justify;">
<span style="font-size: small;">Download ::</span></h3>
<div style="text-align: justify;">
<span style="font-family: inherit;"><b><span style="font-size: small;">Windows :: </span></b><span style="font-size: small;"><a href="http://www.handshake.de/user/chmaas/delphi/download/xvi32.zip" target="_blank">XVI32</a> (.zip)</span></span></div>
<div style="text-align: justify;">
<span style="font-family: inherit;"><span style="font-size: small;"><b>Official Website :: </b><a href="http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm">http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm</a></span></span></div>

XVI32 (Hex Editor) :: Tools

XVI32 is a freeware hex editor running under Windows 9x/NT/2000/XP/Vista/7. The name XVI32 is derived from XVI , the roman notation ...

FARADAY (Integrated Penetration Testing IDE) :: Framework

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="FARADAY Logo" border="0" height="91" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj03zjrenjfh3-P90KLn_GSw8ONyaQLqXdR6otoyPAiIMj1ETcLzdJpofOdDKILtTGY6U_4FS4zlEyLZEVF0IEjyTWLMkZrm9wa3U-YS1L8K8A1NQO_j0muNmj9wiuSaqph9OyYKddiOc-f/s1600/Faraday-Logo.png" title="FARADAY Logo" width="400" /></div>
<b>Faraday</b> introduces a new concept (IPE) <b>Integrated Penetration-Test  Environment</b> a multiuser <b>Penetration test IDE</b>. Designed for distribution,  indexation and analysis of the generated data during the process of a <a href="http://www.toolwar.com/search/label/Security" target="_blank"> security audit</a>.</div>
<div style="text-align: justify;">
The main purpose of <b>Faraday</b> is to re-use the available tools in the community to take advantage of them in a multiuser way.</div>
<div style="text-align: justify;">
Design for simplicity, users should feel no difference between their  own terminal application and the one included in <b>Faraday</b>. Developed with  a specialized set of functionalities that help users improve their own  work. Do you remember yourself programming without an IDE? Well, <b>Faraday</b>  does the same an IDE does for you when programming, but from the  perspective of a <a href="http://www.toolwar.com/search/label/Penetration" target="_blank">penetration test</a>.</div>
<div style="text-align: justify;">
<br />
<b>Requirement ::  </b></div>
<div style="text-align: justify;">
<a href="http://www.toolwar.com/search/label/Linux" target="_blank">Modern Linux</a> (Tested Debian / Ubuntu  * / <a href="http://www.toolwar.com/2013/09/kali-linux-toolwar.html" target="_blank">Kali</a> / <a href="http://www.toolwar.com/2013/09/backtrack-5-r3-distribution.html" target="_blank">Backtrack</a>)</div>
<ul style="text-align: justify;">
<li>Python 2.6.x and 2.7.x</li>
<li>Qt3</li>
<li>CouchDB >= 1.2.0<br />
</li>
<li>The following python libs:  <ul>
<li>mockito </li>
<li>couchdbkit </li>
<li>whoosh </li>
<li>argparse </li>
<li>psycopg2</li>
<li>IPy</li>
<li>requests</li>
</ul>
<h3>
</h3>
</li>
</ul>
<h3 style="text-align: justify;">
Tutorials :: </h3>
<div style="text-align: justify;">
<b>Installation :: </b> </div>
<div style="text-align: justify;">
Preferably, you can download faraday by cloning the Git repository:</div>
<div style="text-align: justify;">
<pre><code>$ git clone https://github.com/infobyte/faraday.git faraday-dev
$ cd faraday-dev
$ ./install
</code></pre>
</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Usage :: </b></div>
<div style="text-align: justify;">
To get started, simply execute faraday and use the new console to start working in the pentest: </div>
<div style="text-align: justify;">
<pre><code>$ ./faraday</code></pre>
<pre><code> </code></pre>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/EBz0g6ya7Mg?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
</div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="https://github.com/infobyte/faraday/archive/master.zip" target="_blank">Faraday</a> (tarball) <b>
</b></div>
<div style="text-align: justify;">
<b>Source Website :: </b><a href="https://github.com/infobyte/faraday">https://github.com/infobyte/faraday</a></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.faradaysec.com/">http://www.faradaysec.com/</a></div>

FARADAY (Integrated Penetration Testing IDE) :: Framework

Faraday introduces a new concept (IPE) Integrated Penetration-Test Environment a multiuser Penetration test IDE . Designed for distrib...

SNMPCheck (SNMP Enumeration) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="SNMPCheck" border="0" height="316" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNQCGr22VHfWJI20ydnqXWT0FpVBP1u6mdLTIESgT_IN6QGduciK1QWIlWG0O__y2nvACefsDE1DFwXrHO973XbWbfbepc3FXB2bD_TX7jy6oZwLrfRXAkd_PCKf9C_28TD-klFE3QJk_P/s1600/SNMPCheck.jpg" title="SNMPCheck" width="400" /></div>
<b>SNMPCheck</b> allows you to <b>enumerate the SNMP</b> devices and places the  output in a very human readable friendly format. It could be useful for  <a href="http://www.toolwar.com/search/label/Penetration" target="_blank">penetration testing</a> or <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">systems monitoring</a>. Distributed under GPL license  and based on "Athena-2k" script by jshaw.</div>
<h3 style="text-align: justify;">
Features :: </h3>
<div style="text-align: justify;">
SNMPCheck supports the following enumerations:</div>
<ul style="text-align: justify;">
<li>    contact</li>
<li>description</li>
<li> detect write access (separate action by enumeration)|</li>
<li> devices</li>
<li> domain</li>
<li> hardware and storage informations</li>
<li> hostname</li>
<li> IIS statistics</li>
<li> IP forwarding</li>
<li> listening UDP ports</li>
<li> location</li>
<li> motd</li>
<li> mountpoints</li>
<li> network interfaces</li>
<li> network services</li>
<li> processes</li>
<li> routing information</li>
<li> software components</li>
<li> system uptime</li>
<li> TCP connections</li>
<li> total memory</li>
<li> uptime</li>
<li> user accounts</li>
</ul>
<h3>
Tutorials ::</h3>
<b>Report Examples :: </b><a href="http://www.nothink.org/codes/snmpcheck/report_windows_xp.txt" target="_blank">Windows XP</a> | <a href="http://www.nothink.org/codes/snmpcheck/report_linux_ubuntu.txt" target="_blank">Linux Ubuntu</a><b><br /></b><br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/RIVV4--m4dU?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download ::</h3>
<b>Perl Script :: </b><a href="http://www.nothink.org/codes/snmpcheck/snmpcheck-1.8.pl" target="_blank">SNMPCheck</a> (.pl)
<b> </b><br />
<b>Official Website ::</b> <a href="http://www.nothink.org/codes/snmpcheck/">http://www.nothink.org/codes/snmpcheck/</a>
<br />
<div class="alert alert-success" style="text-align: justify;">
</div>

SNMPCheck (SNMP Enumeration) :: Tools

SNMPCheck allows you to enumerate the SNMP devices and places the output in a very human readable friendly format. It could be useful ...

Argus (Auditing Network Activity) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Argus Logo" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhB9EePKFj7bOOAmUlulpXxUps3bKmylywSIIPNjOKR95TlmXfzBpotmDPvTpombemgv5gs8g-qGAFLcjAB8y7S0iSCjatcaY9LTAFt-OoP0EOMiONWPCNZ_119wIkga4ZTRn1ILz9jhpfa/s1600/ArgusOptimizationCycle.gif" title="Argus Logo" /></div>
<div style="text-align: justify;">
<b>Argus</b> is a fixed-model Real Time Flow <a href="http://www.toolwar.com/search/label/Monitoring" target="_blank">Monitor</a> designed to track and 
report on the status and performance of all network transactions seen in
 a data <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> traffic stream. Argus provides a common data format for 
reporting flow metrics such as connectivity, capacity, demand, loss, 
delay, and jitter on a per transaction basis. The record format that 
Argus uses is flexible and extensible, supporting generic flow 
identifiers and metrics, as well as application/protocol specific 
information.</div>
<div style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
 <b>Argus </b>is composed of an advanced comprehensive 
network flow data generator, the<b> Argus</b> sensor, which processes packets 
(either capture files or live <a href="http://www.toolwar.com/search/label/Packet" target="_blank">packet</a> data) and generates detailed 
network flow status reports of all the flows  in the packet stream.  
Argus  captures much of the packet dynamics and semantics of each
                             flow,  with a great deal of data reduction,
 so you can store, process, inspect and <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyze</a> large amounts of network
 data
                             efficiently. <b>Argus</b> provides reachability, 
availability, connectivity, duration, rate, load, good-put, loss,
                             jitter, retransmission, and delay metrics 
for all network flows, and captures most attributes that are available 
from the
                             packet contents, such as L2 addresses, 
tunnel identifiers (MPLS, GRE, ESP, etc...), <a href="http://www.toolwar.com/search/label/IDS" target="_blank">protocol ids</a>, SAP's, 
hop-count, options,
                             L4 transport identification (RTP, RTCP 
detection), host flow control indications, etc...</div>
<div class="plaintext" style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
Argus is used by many sites to generate 
network activity reports for every network transaction on their  
networks. The network audit data that <b>Argus</b> generates is great for 
<a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a>, operations and performance management. The data is used for 
network forensics, non-repudiation,
                             network asset and service inventory,  
behavioral baselining of server and client relationships, detecting 
covert channels, and analyzing Zero day events.</div>
<div class="plaintext" style="text-align: justify;">
<br /></div>
<div class="plaintext" style="text-align: justify;">
Argus is an Open Source project, currently 
running on <a href="http://www.toolwar.com/search/label/Mac" target="_blank">Mac OS X,</a> <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a>, Solaris, FreeBSD, OpenBSD, NetBSD, AIX, 
IRIX, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> (under Cygwin) 
                             and OpenWrt, and has been ported to many 
hardware accelerated platforms, such as Bivio, Pluribus, Arista, and 
Tilera. The software should be portable to many other
                             environments  with littleor no 
modifications. Performance is such that auditing an entire enterprise's 
Internet activity
                             can be accomplished using modest computing 
resources.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>How To :: </b><a href="http://www.qosient.com/argus/howto.shtml" target="_blank">Click Here</a><b><br /></b></div>
<b>Wiki :: </b><a href="http://nsmwiki.org/index.php?title=Argus" target="_blank">Click Here</a><br />
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Windows | Mac | Linux ::  </b><a href="http://qosient.com/argus/src/argus-3.0.6.1.tar.gz" target="_blank">Argus v3.0.6.1</a><b> | </b><a href="http://qosient.com/argus/src/argus-clients-3.0.6.2.tar.gz" target="_blank">Argus v3.0.6.1 Client</a><b> </b></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.qosient.com/argus/">http://www.qosient.com/argus/</a><b><br /></b></div>
<div style="text-align: justify;">
<br /></div>

Argus (Auditing Network Activity) :: Tools

Argus is a fixed-model Real Time Flow Monitor designed to track and report on the status and performance of all network transactions s...

Foremost (File Carving) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdkN2Ugs8yPIpW9bdhSCRtfTQisB-mmEgSeRyCTN_07YHLjIom3zkuOAPeUS8z8s7WHAT-qFoxrqYH6hrVHV9q-40PTsRzLLn9SMc0DbYBMNR944nbfhqU8fPWiPYTWV_PcywGGNhbEMS8/s1600/foremost+screenshot.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="foremost screenshot" border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdkN2Ugs8yPIpW9bdhSCRtfTQisB-mmEgSeRyCTN_07YHLjIom3zkuOAPeUS8z8s7WHAT-qFoxrqYH6hrVHV9q-40PTsRzLLn9SMc0DbYBMNR944nbfhqU8fPWiPYTWV_PcywGGNhbEMS8/s400/foremost+screenshot.jpg" title="foremost screenshot" width="400" /></a></div>
<br />
<b>Foremost</b> is a <b><i>console program to recover files</i></b> based on their headers, footers, and internal data  structures.  This process is commonly referred to as data carving. <b> Foremost</b> can work on image files,  such as those generated by dd, Safeback, <a href="http://www.toolwar.com/2013/09/encase-forensics-v7-tools.html" target="_blank">Encase</a>, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command line</a> switches to specify built-in file types.  These built-in types look at the data structures of a given  file format allowing for a more reliable and faster recovery. </div>
<div style="text-align: justify;">
<br />
<h3>
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/9AkY-IefI4Q?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
</h3>
</div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux ::</b> <a href="http://foremost.sourceforge.net/pkg/foremost-1.5.7.tar.gz" target="_blank">Foremost 1.5.7 (.tar.gz)</a><br />
<b>Official Website :: </b><a href="http://foremost.sourceforge.net/" target="_blank">http://foremost.sourceforge.net/ </a></div>

Foremost (File Carving) :: Tools

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is common...

Immunity Canvas (Vulnerability Exploitation) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqwXRB2JW_wTRBZeFsPrNZqP7KK7Xyn3JC7nG4SvaFbLePxH0hRCMjN9Qmahzts9eQvlEvfqI-ZtbOgvXHS6d2EBgXNSHvEgPXs_l3QYQyy_cg2IrSmwwJThp4ddWSXS5oV4GoJEOJbLUo/s1600/img-canvas.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Immunity Canvas" border="0" height="171" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqwXRB2JW_wTRBZeFsPrNZqP7KK7Xyn3JC7nG4SvaFbLePxH0hRCMjN9Qmahzts9eQvlEvfqI-ZtbOgvXHS6d2EBgXNSHvEgPXs_l3QYQyy_cg2IrSmwwJThp4ddWSXS5oV4GoJEOJbLUo/s1600/img-canvas.gif" title="Immunity Canvas" width="400" /></a></div>
<b>Immunity Canvas</b> is a commercial <b>vulnerability exploitation tool </b>from Dave Aitel's ImmunitySec. It includes more than 370 exploits and is less expensive than Core Impact or the commercial versions of <a href="http://www.toolwar.com/2013/09/metasploit-framework.html" target="_blank">Metasploit</a>.  It comes with full source code, and occasionally even includes zero-day exploits.<b> </b><br />
<b>Immunity's CANVAS</b> makes available hundreds of exploits, an automated <a href="http://www.toolwar.com/search/label/Exploitation" target="_blank">exploitation</a> system, and a comprehensive, reliable exploit development framework to <a href="http://www.toolwar.com/search/label/Penetration" target="_blank">penetration</a> testers and <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> professionals worldwide. To see CANVAS in action please see our  movies. For users new to CANVAS or experienced users looking to get just a little more out of CANVAS we have <a href="http://www.toolwar.com/search/label/PDF" target="_blank">PDF</a> based tutorials available for download.</div>
<div style="text-align: justify;">
  </div>
<div style="text-align: justify;">
<b>Supported Platforms and Installations</b><br />
- <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> (requires Python & PyGTK)<br />
- <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a><br />
- <a href="http://www.toolwar.com/search/label/Mac" target="_blank">MacOSX</a> (requires PyGTK)<br />
- All other <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> environments such as mobile phones and commercial Unixes (command line version only supported, GUI may also be available)</div>
<div style="text-align: justify;">
<b>Architecture</b><br />
- CANVAS' completely open design allows a team to adapt CANVAS to their environment and needs.  </div>
<div style="text-align: justify;">
<b>Documentation</b><br />
- all documentation is delivered in the form of demonstration movies<br />
- exploit modules have additional information windows</div>
<div style="text-align: justify;">
<b> Exploits</b><br />
- currently over 490 exploits, an average of 4 exploits added every monthly release<br />
- Immunity carefully selects vulnerabilities for inclusion as CANVAS exploits. Top priorities are high-value vulnerabilities such as remote, pre-authentication, and new vulnerabilities in mainstream software.<br />
- Exploits span all common platforms and applications</div>
<div style="text-align: justify;">
<b> Payload Options</b><br />
- to provide maximum reliability, exploits always attempt to reuse socket<br />
- if socket reuse is not suitable, connect-back is used<br />
- subsequent MOSDEF session allows arbitrary code execution, and provides a listener shell for common actions (file management, screenshots, etc)<br />
- bouncing and split-bouncing automatically available via MOSDEF<br />
- adjustable covertness level</div>
<div style="text-align: justify;">
<b> Exploit Delivery</b><br />
- regular monthly updates made available via <a href="http://www.toolwar.com/search/label/Web" target="_blank">web</a><br />
- exploit modules and CANVAS engine are updated simultaneously<br />
- customers reminded of monthly updates via email</div>
<div style="text-align: justify;">
<b> Exploit Creation Time</b><br />
- exploits included in next release as soon as they are stable</div>
<div style="text-align: justify;">
<b> Effectiveness of Exploits</b><br />
- all exploits fully QA'd prior to release<br />
- exploits demonstrated via flash movies<br />
- exploit development team available via direct email for support</div>
<div style="text-align: justify;">
<b> Ability to make Custom Exploits</b><br />
- unique MOSDEF development environment allows rapid exploit development</div>
<div style="text-align: justify;">
<b> Product Support and Maintenance</b><br />
- subscriptions include email and phone support M-F 9am - 5pm EST, directly with development team<br />
- minimum monthly updates</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<h3>
Tutorials ::</h3>
<ol>
<li><a href="http://www.immunitysec.com/documentation/tutorials/Windows_Install.pdf">Detailed Windows Installation Instructions</a></li>
<li><a href="http://www.immunitysec.com/documentation/tutorials/canvas101-part1.pdf">CANVAS 101 (Part 1)</a></li>
<li><a href="http://www.immunitysec.com/documentation/tutorials/canvas101-part2.pdf">CANVAS 101 (Part 2)</a></li>
<li><a href="http://www.immunitysec.com/documentation/tutorials/HCN-Part1.pdf">HCN Rootkit (Part 1)</a></li>
<li><a href="http://www.immunitysec.com/documentation/tutorials/ties-that-binder-dot-py.pdf">The Ties That Binder.py</a></li>
</ol>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/FAz-Bek4RfU?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<ol></ol>
</div>
<div style="text-align: justify;">
<h3>
Download ::</h3>
</div>
<div style="text-align: justify;">
<b>Linux | Mac | Windows :: Contact Here ::</b> sales@immunityinc.com
<b> </b><br />
<b>Official Website ::</b> <a href="https://www.immunitysec.com/products-canvas.shtml">https://www.immunitysec.com/products-canvas.shtml</a></div>

Immunity Canvas (Vulnerability Exploitation) :: Tools

Immunity Canvas is a commercial vulnerability exploitation tool from Dave Aitel's ImmunitySec. It includes more than 370 exploits an...

Subscribe to: Posts ( Atom )