ToolWar | Information Security (InfoSec) Tools

OCFA (Open Computer Forensics Architecture) :: Framework

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="OCFA Tools" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFBvdLhCyjycLRfN5dNkY5dJ8DhTpyO1-LAAjtlqcZoz2odPBUVyhs1KU3f-t8QDFAa_LJxuuVAVJRfE1niARh9DzFRqu_wZnESr3NRQFqR6wF8YVJceurWGKd0469rTy_vUIhApL46dEN/s1600/Computer-Forensics.jpg" title="OCFA TOols" /></div>
</div>
<div style="text-align: justify;">
The <b>Open Computer Forensics Architecture (OCFA)</b> is a modular computer <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a> framework built by the Dutch National Police Agency [KLPD/Dutch]. The main goal is to automate the digital forensic process to speed up the <a href="http://www.toolwar.com/search/label/Investigation" target="_blank">investigation</a> and give tactical investigators direct access to the seized data through an easy to use search and browse interface.<br />
<br />
The architecture forms an environment where existing <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic tools</a> and libraries can be easily plugged into the architecture and can thus be made part of the recursive extraction of data and metadata from digital evidence. The <b>Open Computer Forensics Architecture</b> aims to be highly modular, robust, fault tolerant, recursive and scalable in order to be usable in large investigations that spawn numerous terabytes of evidence data and covers hundreds of evidence items.<br />
<br />
Modules in <b>OCFA</b> for reasons of fault tolerance are processes. The basic OcfaLib API makes it possible and relatively easy to build an <b>OCFA</b> module out of any data processing library or tool. OCFA comes with numerous such modules that are mostly wrappers around libraries like libmagic or tools such as those found in the <a href="http://www.toolwar.com/2014/01/the-sleuth-kit-tsk-forensics-framework.html" target="_blank">Sleuthkit</a>.<br />
<br />
The 2.2 version of OCFA (released April 2009) makes the previously internal OCFA treegraph API available for OCFA module development. The OCFA treegraph API allows more advanced dissectors that produce data and meta-data for a treegraph representation of an input file. The OCFA treegraph API also allows dissectors that are programed to be CarvFs aware to use zero storage <a href="http://www.toolwar.com/search/label/Carving" target="_blank">carving</a>.<br />
<br />
Communication between modules within OCFA is governed by a two layered communication infrastructure as provided by <b>OCFA</b>. At the lowest layer is a messaging system with at is center the OCFA Anycast Relay. The Anycast Relay provides the facilities of module crash resistance, distributed processing load balancing and flow control. At a higher level of communication, the OCFA XML Router provides for the routing of individual pieces of evidence through the most appropriate tool chain for its particular type of content.<br />
<br />
Although <b>OCFA</b> contains a rudimentary user interface, most of its power is in the backend architecture. The last and final module in the tool chain of any evidence will be the OCFA Data Store Module. This module processes the evidence XML (that contains all of the evidence data its meta data) and stores relevant parts into a postgesql database. Extending the apache based user interface with interfaces for your own case bound queries is something that should proof very useful in most investigations. </div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>Wiki :: </b> <a href="http://ocfa.wiki.sourceforge.net/" target="_blank">Click Here</a></div>
<div style="text-align: justify;">
<b>Installation ::</b> <a href="http://ocfa.sourceforge.net/files/InstallingOcfaOnUbuntu.pdf" target="_blank">Click Here</a></div>
<div style="text-align: justify;">
<b>Practical Usages :: </b><a href="http://ocfa.sourceforge.net/files/PracticalUseOCFA.pdf" target="_blank">Click Here</a></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b><a href="http://sourceforge.net/projects/ocfa/files/latest/download" target="_blank">OCFA</a> (.tar.bz2)<br />
<b>Official Website ::</b> <a href="http://ocfa.sourceforge.net/">http://ocfa.sourceforge.net/</a></div>

OCFA (Open Computer Forensics Architecture) :: Framework

The Open Computer Forensics Architecture (OCFA) is a modular computer forensics framework built by the Dutch National Police Agency [...

Shellter (Dynamic Shellcode Injection) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Shellter Tool Image" border="0" height="361" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoCFTJcSTQINV_sfK7AZLw_70-JcIoAkc47RndYmYREK6nCYviWJX0NHZWC8v57DqpRcode3mTmcXkovY1gp7aZNEH08v3-Wcd-bg13_CPfeQuMQt7Fq7GftMh4LemIyth1rYp_V2KlFPS/s1600/Shellter+Image.JPG" title="Shellter Tool Image" width="640" /></div>
<div style="text-align: justify;">
<b>Shellter</b> is a <b>dynamic shellcode injection tool</b>, and probably the first dynamic PE infector ever created. It can be used in order to inject shellcode into native <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> applications (currently 32-bit apps only). The shellcode can be something yours or something generated through a <a href="http://www.toolwar.com/search/label/Frameworks" target="_blank">framework</a>, such as Metasploit.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Shellter </b>takes advantage of the original structure of the PE file and
 doesn’t apply any modification such as changing <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> access 
permissions in sections, adding an extra section with RWE access,and 
whatever would look dodgy under an AV scan.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Shellter</b> uses a unique dynamic approach which is based on the execution flow of the target application.</div>
<div style="text-align: justify;">
<b>Shellter</b> uses a unique dynamic approach which is based on the execution flow of
the target application. This means that no static/predefined locations are used
for shellcode injection. <b>Shellter </b>will launch and trace the target, while at the
same time will log the execution flow of the application.
</div>
<div style="text-align: justify;">
<b>Shellter</b> traces the entire execution flow that occurs in userland. That means,
code inside the target application itself (PE image), and code outside of it
that might be in a system dll or on a heap, etc. This happens in order to ensure
that functions actually belonging to the target executable, but are only used as
callback functions for Windows APIs will not be missed.

However, the tracing engine will not log any instructions that are not in the
memory range of the PE image of the target application, since these cannot be
used as a reference to permanently inject the shellcode.</div>
<div style="text-align: justify;">
<b>Why Need :: </b>Executables created through <a href="http://www.toolwar.com/2013/09/metasploit-framework.html" target="_blank">Metasploit</a> are most likely detected by most AV
vendors. By using Shellter, you automatically have an infinitely polymorphic
executable template, since you can use any 32-bit 'standalone' native Windows
executable to host your shellcode. By 'standalone' means an executable that 
doesn't need any proprietary DLLs, apart from the system DLLs to load and run.
For example, notepad.exe, and many other applications you can find online, or 
create by yourself as your own custom templates.

You can also use applications that make use of proprietary DLLs if those are
not required to create the process in the first place, and are normally loaded
later on if needed to execute code for a specific task. In case you select an
application that needs one or more proprietary DLLs to create the process in the
first place then you will have to include them in the same directory from where
you load the main executable. However, this is not recommended since it is more
convenient to have just a single executable to upload to the target. </div>
<h3>
Tutorials ::</h3>
<b>System Requirement ::</b> Windows XP SP3 (x32/x64) or Higher <br />
<b>Full Description :: </b><a href="https://www.shellterproject.com/Downloads/Shellter/Readme.txt" target="_blank">Click Here</a><br />
<b>Video Tutorial :: </b><a href="https://www.youtube.com/watch?v=91QmSy-dUEA" target="_blank">Click Here</a><br />
<h3>
Download ::</h3>
<div style="text-align: justify;">
<b>Windows :: </b><a href="https://www.shellterproject.com/Downloads/Shellter/Old/Shellter_v1.0.rar" target="_blank">Shellter v1.0 </a>(.rar)<b><br /></b></div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="https://www.shellterproject.com/introducing-shellter/">https://www.shellterproject.com/introducing-shellter/</a></div>

Shellter (Dynamic Shellcode Injection) :: Tools

Shellter is a dynamic shellcode injection tool , and probably the first dynamic PE infector ever created. It can be used in order to inj...

DFF (Digital Forensics Framework) :: Framework

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIl1DdbsO0WfC9qJDGu02Asu8jmU-fMvvGqJMnoXYIsycbH4eFW775XwZteITm_g2b8WSSdGZMbd7O8O3wZHb-6a1jsPqXb98HsFnIMVxzOlcFkVtQFC1j5SodKKFdqH5k_nWuugslcbtP/s1600/DFF+LOgo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="DFF Logo" border="0" height="166" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgIl1DdbsO0WfC9qJDGu02Asu8jmU-fMvvGqJMnoXYIsycbH4eFW775XwZteITm_g2b8WSSdGZMbd7O8O3wZHb-6a1jsPqXb98HsFnIMVxzOlcFkVtQFC1j5SodKKFdqH5k_nWuugslcbtP/s1600/DFF+LOgo.png" title="DFF Logo" width="400" /></a></div>
<div style="text-align: justify;">
<b>DFF (Digital Forensics Framework)</b> is a free and Open Source <b>computer  forensics software</b> built on top of a dedicated Application Programming  Interface (API). It can be used both by professional and non-expert people in order to quickly  and easily collect, preserve and reveal digital evidences without  compromising systems and data.</div>
<h3 style="text-align: justify;">
Features :: </h3>
<ul style="text-align: justify;">
<li>Preserve digital chain of custody - Software write blocker, cryptographic <a href="http://www.toolwar.com/search/label/Hash" target="_blank">hash</a> calculation</li>
<li>Access to local and remote devices - Disk drives, removable devices, remote file systems</li>
<li>Read standard <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">digital forensics</a> file formats - Raw, Encase EWF, AFF 3 file formats</li>
<li><a href="http://www.toolwar.com/search/label/Virtual" target="_blank">Virtual machine</a> disk reconstruction - VmWare (VMDK) compatible</li>
<li><a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> and <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux OS</a> forensics - <a href="http://www.toolwar.com/search/label/Registry" target="_blank">Registry</a>, Mailboxes, NTFS, EXTFS 2/3/4, FAT 12/16/32 file systems</li>
<li>Quickly triage and search for (meta-)data - Regular expressions, dictionaries, content search, tags, time-line</li>
<li><a href="http://www.toolwar.com/search/label/Recovery" target="_blank">Recover</a> hidden and deleted artifacts - Deleted files / folders, unallocated spaces, carving</li>
<li>Volatile <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory forensics</a> - Processes, local files, binary extraction, network connections</li>
</ul>
<div style="text-align: justify;">
<b>Digital Forensics Framework (DFF)</b> is an open source computer forensics software. It advertises the ability to be used by both professionals and non-experts to collect, preserve, and reveal digital evidence without compromising systems and data. </div>
<div style="text-align: justify;">
<b>Digital Forensics Framework</b> offers two user interfaces, a graphical one developed in PyQt and providing classical tree view but also more advanced features such as recursive view, tagging, live search or bookmarking. Its command line interface enables to perform <a href="http://www.toolwar.com/search/label/Investigation" target="_blank">digital investigation</a> remotely and comes with usual functionnalities available in common shell such as completion, tasks management, globing or keyboard shortcuts. DFF can also run batch scripts at startup to automate repetitive tasks. Advanced users and developers can also use DFF directly from a <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> interpreter to script their investigation.</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>DFF Blog :: </b><a href="http://www.digital-forensic.org/blog/" target="_blank">Click Here</a><b><br />
</b></div>
<b>DFF Wiki :: </b><a href="http://wiki.digital-forensic.org/" target="_blank">Click Here</a><br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/02uZv72KS88?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux | Windows :: </b><a href="http://www.digital-forensic.org/en/downloads/dff/" target="_blank">DFF v1.3.0</a> (Free Edition)</div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://wiki.digital-forensic.org/index.php/Main_Page">http://wiki.digital-forensic.org/index.php/Main_Page</a></div>

DFF (Digital Forensics Framework) :: Framework

DFF (Digital Forensics Framework) is a free and Open Source computer forensics software built on top of a dedicated Application Progra...

Liffy (Local File Inclusion Exploitation) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEHgUv3G2cSh18uLQRim8Gb5IXVYRmDrm0RRYDS4PNvOY9nqx1BixII41qCSV_QuR3s_OemRkq0lnNGMxMxDVuUZSsKF7L_yVBxEjzkNtuPb0tWrQVme-kk6yZvRanaLs-Vo9GRkRU6CSJ/s1600/Liffy.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Liffy Tool" border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEHgUv3G2cSh18uLQRim8Gb5IXVYRmDrm0RRYDS4PNvOY9nqx1BixII41qCSV_QuR3s_OemRkq0lnNGMxMxDVuUZSsKF7L_yVBxEjzkNtuPb0tWrQVme-kk6yZvRanaLs-Vo9GRkRU6CSJ/s1600/Liffy.jpg" title="Liffy Tool" width="400" /></a></div>
<div style="text-align: justify;">
<b>Liffy</b> is a tool to exploit local file inclusion <a href="http://www.toolwar.com/search/label/Vulnerability" target="_blank">vulnerability</a> using 
the built-in wrappers php://input, data://, and a process control 
extension called 'expect'. <b>Liffy</b> is written in <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a>.</div>
<ul class="task-list" style="text-align: justify;">
<li>Updates * Now comes with ability to use poisoned Apache access logs,
 and php://filter for code execution and arbitrary file reads.</li>
</ul>
<div style="text-align: justify;">
<b>Liffy</b> requires the following libraries: requests, argparse, blessings, urlparse In order to host the payload you may use Node's HTTP server. Or you can simply spawn python's SimpleHTTPServer in /tmp on port 
8000.  Further development of the tool will eventually include spawning a
 built-in web server in order to download, for now you can adjust the 
location and port in the source code for your needs.  These can be 
changed in core.py under the execute functions.</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
<b>Example Use ::</b> ./liffy --url http://target/pdfs/vulnerable.php?= --data </div>
<h3 style="text-align: justify;">
Download :: </h3>
<div style="text-align: justify;">
<b>Linux | Windows | Mac :: </b><a href="https://github.com/rotlogix/liffy/archive/master.zip" target="_blank">Click Here</a><b><br /></b></div>
<div style="text-align: justify;">
<b>Source Website :: </b><a href="https://github.com/rotlogix/liffy">https://github.com/rotlogix/liffy</a></div>

Liffy (Local File Inclusion Exploitation) :: Tools

Liffy is a tool to exploit local file inclusion vulnerability using the built-in wrappers php://input, data://, and a process control ...

Swift (Programming Language for iOS and OS X) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="Swift Programming Language" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHLPRk4n2fNLfn9xWCpenPoEdy3NgFcyc_Lv36k6psamOuzRHW4Ps9ALpSPtXgelL4ecZYqkpxSOTN3BGzy9hdNeZItnPAw3FDZZZGtlIqhhfmJ0M-_M0ntROBfayLY-SsdWMnYjBbGtev/s1600/swift.jpg" title="Swift Programming Language" /></div>
<div style="text-align: justify;">
<b>Swift</b> is an innovative new <a href="http://www.toolwar.com/search/label/Language" target="_blank">programming language</a> for <b>Cocoa and Cocoa 
Touch</b>. Writing code is interactive and fun, the syntax is concise yet 
expressive, and apps run lightning-fast. <b>Swift</b> is ready for your next <a href="http://www.toolwar.com/search/label/iOS" target="_blank">iOS</a> and OS X project — or for addition into your current app — because 
Swift code works side-by-side with Objective-C.</div>
<div style="text-align: justify;">
<b>Swift</b> is a new programming language for creating<b> iOS and OS X apps</b>. 
Swift builds on the best of C and Objective-C, without the constraints 
of C compatibility. Swift adopts safe programming patterns and adds 
modern features to make programming easier, more flexible, and more fun.
 Swift’s clean slate, backed by the mature and much-loved Cocoa and 
Cocoa Touch frameworks, is an opportunity to reimagine how software 
development works. </div>
<div style="text-align: justify;">
<b>Swift</b> is the result of the latest research 
on programming languages, combined with decades of experience building 
Apple platforms. Named parameters brought forward from Objective-C are 
expressed in a clean syntax that makes APIs in Swift even easier to read
 and maintain. Inferred types make code cleaner and less prone to 
mistakes, while modules eliminate headers and provide namespaces. <a href="http://www.toolwar.com/search/label/Memory" target="_blank">Memory</a>
 is managed automatically, and you don’t even need to type semi-colons.</div>
<div style="text-align: justify;">
Swift has many other features to make your code more expressive:</div>
<ul class="circle" style="text-align: justify;">
<li>Closures unified with function pointers</li>
<li>Tuples and multiple return values</li>
<li>Generics</li>
<li>Fast and concise iteration over a range or collection</li>
<li>Structs that support methods, extensions, protocols.</li>
<li>Functional programming patterns, e.g.: map and filter</li>
</ul>
<h3 class="padding-top-20 padding-bottom-5" style="text-align: justify;">
Interactive Playgrounds</h3>
<div style="text-align: justify;">
Playgrounds make writing <b>Swift code</b> incredibly simple and fun. 
Type a line of code and the result appears immediately. If your code 
runs over time, for instance through a loop, you can watch its progress 
in the timeline assistant. The timeline displays variables in a graph, 
draws each step when composing a view, and can play an animated 
SpriteKit scene. When you’ve perfected your code in the playground, 
simply move that code into your project. With playgrounds, you can:</div>
<ul class="circle" style="text-align: justify;">
<li>Design a new algorithm, watching its results every step of the way</li>
<li>Create new tests, verifying they work before promoting into your test suite</li>
<li>Experiment with new APIs to hone your Swift coding skills</li>
</ul>
<div class="padding-top-10" style="text-align: justify;">
<b>Read-Eval-Print-Loop (REPL)</b>. The 
debugging console in Xcode includes an interactive version of the Swift 
language built right in. Use Swift syntax to evaluate and interact with 
your running app, or write new code to see how it works in a script-like
 environment. Available from within the Xcode console, or in Terminal.</div>
<h3 class="padding-bottom-5" style="text-align: justify;">
Designed for Safety</h3>
<div style="text-align: justify;">
<b>Swift</b> eliminates entire classes of unsafe code. Variables are 
always initialized before use, arrays and integers are checked for 
overflow, and memory is managed automatically. Syntax is tuned to make 
it easy to define your intent — for example, simple three-character 
keywords define a variable (var) or constant (let).</div>
<div style="text-align: justify;">
The safe patterns in Swift are tuned for the powerful Cocoa and 
Cocoa Touch APIs. Understanding and properly handling cases where 
objects are nil is fundamental to the frameworks, and Swift code makes 
this extremely easy. Adding a single character can replace what used to 
be an entire line of code in Objective-C. This all works together to 
make building <a href="http://www.toolwar.com/search/label/iOS" target="_blank">iOS</a> and Mac apps easier and safer than ever before.</div>
<h3 class="padding-top-30 padding-bottom-5" style="text-align: justify;">
Fast and Powerful</h3>
<div style="text-align: justify;">
From its earliest conception, Swift was built to be fast. Using 
the high-performance LLVM compiler, Swift code is transformed into 
optimized native code, tuned to get the most out of modern Mac, iPhone, 
and iPad hardware. The syntax and standard library have also been tuned 
to make the most obvious way to write your code also perform the best.</div>
<div style="text-align: justify;">
Swift takes the best features from the C and Objective-C 
languages. It includes low-level primitives such as types, flow control,
 and operators. It also provides object-oriented features such as 
classes, protocols, and generics, giving Cocoa and Cocoa Touch 
developers the performance and power they demand.</div>
<h3 class="padding-top-30 padding-bottom-5" style="text-align: justify;">
Ready Today</h3>
<div style="text-align: justify;">
You can begin using Swift code immediately to implement new 
features in your app, or enhance existing ones. New Swift code co-exists
 along side your existing Objective-C files in the same project, making 
it easy to adopt. And when iOS 8 and OS X Yosemite are released this 
fall, you can submit apps that use Swift to the App Store and Mac App 
Store.</div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/NQXnYeI6wJ4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
</h3>
<h3 style="text-align: justify;">
</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/c8BGQ3CfPBs?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>iTunes :: </b><a href="https://itunes.apple.com/us/book/the-swift-programming-language/id881256329?mt=11#" target="_blank">Click Here</a><b><br /></b></div>
<div style="text-align: justify;">
<b>Swift :: </b><a href="https://itunes.apple.com/us/book/the-swift-programming-language/id881256329?mt=11" target="_blank">Click Here</a><b><br /></b></div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="https://developer.apple.com/swift/">https://developer.apple.com/swift/</a></div>
<div style="text-align: justify;">
<br /></div>

Swift (Programming Language for iOS and OS X) :: Tools

Swift is an innovative new programming language for Cocoa and Cocoa Touch . Writing code is interactive and fun, the syntax is concise...

Second Look (Linux Memory Forensics) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both;">
 <img border="0" height="124" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhj3s-HN2dZGFNYEv4wk6IGLmblttBSVAhyiADK6Tcg_sE6ucHyhB_M1xINBz418Iy8K5vLizCBYB253oHqRxFsyyY8VZykHyveoJ2XteU5fG4hbI2gGuQ-r6z4iNVCrNR0thbZCaMasHa_/s1600/secondlook.jpg" width="640" /></div>
The Incident Response edition of <b>Second Look®: Linux Memory Forensics</b> is designed for use by investigators who need quick, easy, and effective <a href="http://www.toolwar.com/search/label/Linux" target="_blank">Linux</a> <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory acquisition</a> and analysis capabilities. Second Look® is a product of Raytheon Pikewerks Corporation. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Memory_Acquisition"> Memory Acquisition::</span></h3>
<div style="text-align: justify;">
<b>Second Look®</b> preserves the volatile system state, capturing evidence  and information that does not exist on disk and may otherwise be lost as  an investigation proceeds.  A <a href="http://www.toolwar.com/search/label/CLI" target="_blank">command-line</a> script allows for  acquisition of <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> from running systems without introducing any  additional software.  A memory access driver is provided for use on  systems without a native interface to physical memory. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Memory_Analysis"> Memory Analysis ::</span></h3>
<div style="text-align: justify;">
<b>Second Look® </b>interprets live system memory or captured memory images,  detecting and <a href="http://www.toolwar.com/search/label/Reverse" target="_blank">reverse engineering</a> malware, including stealthy kernel <a href="http://www.toolwar.com/search/label/Rootkit" target="_blank"> rootkits</a> and backdoors.  A kernel integrity verification approach is  utilized to compare the Linux kernel in memory with a reference kernel.   Pikewerks provides thousands of reference kernels derived from original  distribution kernel packages, and a script for creating reference  kernels for other systems, such as those running custom kernels. </div>
<div style="text-align: justify;">
<b>Second Look®</b> also applies an integrity verification approach for  the analysis of each process in memory.  This enables it to detect  unauthorized applications as well as stealthy user-level <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware</a>. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Supported_Systems"> Supported Systems ::</span></h3>
<div style="text-align: justify;">
Second Look® is regularly updated to support analysis of the latest  kernels and the most commonly used <a href="http://www.toolwar.com/search/label/Distribution" target="_blank">Linux distributions</a>.  The following  are its capabilities as of April 2012: </div>
<ul style="text-align: justify;">
<li> Supported target kernels: 2.6.x, 3.x up to 3.2 </li>
<li> Supported target architectures: x86 32- and 64-bit </li>
<li> Supported target distributions: Debian 4-6, RHEL/CentOS 4-6, Ubuntu 4.10-12.04, and more! </li>
</ul>
<h3 style="text-align: justify;">
Product features (Second Look Incident Response Edition) ::</h3>
<ul style="text-align: justify;">
<li>Memory acquisition and analysis for all 32- and 64-bit x86
(i386/i486/i586/i686, amd64/x86_64) Linux systems running 2.6- and 3-series
kernels. This includes:
<ul>
<li>Amazon Linux 2010.11 through 2014.03, and higher;</li>
<li>Debian 4 through 7, and higher;</li>
<li>Fedora 2 through 20, and higher;</li>
<li>Red Hat Enterprise Linux (RHEL) and CentOS 4.x, 5.x, 6.x, and higher;</li>
<li>Ubuntu 4.10 through 14.04, and higher;</li>
<li>and other distributions.</li>
</ul>
</li>
<li>Analysis via command line interface (CLI) or graphical user interface
(GUI) applications which run on Ubuntu 12.04 (32- or 64-bit) or RHEL/CentOS 6.x
(64-bit).</li>
<li>Automatic kernel version identification — just select a memory image
and go.</li>
<li>Supported memory image formats:
<ul>
<li>raw physical memory images ("mem" format — as produced by
secondlook-memdump, Inception, and other
tools);</li>
<li>SLM memory images ("slm" format — a high-performance compressed
memory image format used by Second Look Enterprise Security Edition);</li>
<li>LiME memory images ("lime", "padded", or LiME "raw" formats — "lime"
and LiME "raw" formats require conversion with secondlook-lime2mem or
secondlook-limeraw2mem, respectively ‐ LiME "padded" is the equivalent of
a raw physical memory image);</li>
<li>VMware virtual machine snapshots ("vmem", "vmsn", or "vmss" formats —
"vmsn" and "vmss" formats, as well as "vmem" files from VMs with >4GB RAM,
require conversion with VMware's vmss2core
and secondlook-core2mem);</li>
<li>VirtualBox snapshots ("vbc" format — via conversion with
secondlook-vbc2mem); and</li>
<li>KVM Libvirt-QEMU-Save or QEMU-savevm snapshots ("lqs" or "qsv" formats
— via conversion with lqs2mem, originally
secondlook-lqs2mem, now an open source project).</li>
</ul>
</li>
<li>Support for analysis of memory images from systems running either
distribution stock kernels or custom kernels.</li>
<li>Support for analysis of memory images from
Amazon EC2 instances (under both pv and hvm virtualization types).</li>
<li>Access to a repository of over 9000 ZRKs (Zipped Reference Kernels)
providing the metadata and baseline for analysis and verification of CentOS,
Debian, Fedora, RHEL, and Ubuntu stock kernels.</li>
<li>An easy-to-use tool for creation of ZRKs for other distributions or for
custom kernels.</li>
<li>Second Look ZRKs
can also be used as Volatility profiles.</li>
<li>Integrity verification of the kernel and processes in memory.</li>
<li>Access to a pagehash database containing hashes of the executable code
pages of the ELF executables and shared libraries from over 2 million
software packages from the Amazon, CentOS, Debian, Fedora, RHEL, and Ubuntu
distributions.</li>
<li>An easy-to-use tool for the addition of pagehashes supporting verification
of custom or third-party software.</li>
<li>Detection of kernel rootkits, backdoors, and other kernel-mode malware
(known and unknown varieties).</li>
<li>Detection of shared library rootkits, keyloggers, spyware, injected
libraries, injected threads, and other user-mode malware (known and unknown
varieties).</li>
<li>Detection of unknown or unauthorized processes.</li>
<li>Recovery of device mapper crypto keys
for LUKS, TrueCrypt, and other full disk encryption schemes.</li>
<li>Extraction of system state from captured memory images, including loaded
kernel modules, running processes, memory mappings, open files, active network
connections, and more.  Output is available in the GUI, in plain text from the
CLI, and in JSON format for ingestion by other programs.</li>
<li>Offline usage is supported via a subscription to our ZRK and pagehash reference data
feeds.</li>
</ul>
<h3 style="text-align: justify;">
More Reasons to Choose Second Look</h3>
<div style="text-align: justify;">

Beyond the unique and powerful Linux Incident Response feature set listed
above, what sets Second Look apart is the team behind it and the quality
of the software they deliver.

</div>
<ul style="text-align: justify;">
<li>The Second Look Team provides professional support via phone and
email, with on-site consulting services available.  You get direct access to
experts in Linux system internals and security.</li>
<li>Customer feedback often quickly leads to new features.</li>
<li>Second Look ships with comprehensive documentation, including a
User Guide with explanations of the techniques most commonly used by
attackers to maintain stealthy persistence on Linux systems.</li>
<li>Second Look is regression tested against a large suite of sample
memory images to ensure maximum quality and compatibility.</li>
<li>If you like the visibility that Second Look gives you during
investigations, you can upgrade to the Enterprise Security edition to monitor
your systems on an ongoing basis.</li>
</ul>
<ul style="text-align: justify;">
</ul>
<h3 style="text-align: justify;">
Tutorial ::</h3>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/wt326aXmDMA?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Linux :: </b>$1495 (USD) | <a href="http://secondlookforensics.com/contact/" target="_blank">Contact Here</a> for Purchase</div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://secondlookforensics.com/">http://secondlookforensics.com/</a></div>

Second Look (Linux Memory Forensics) :: Tools

The Incident Response edition of Second Look®: Linux Memory Forensics is designed for use by investigators who need quick, easy, and e...

Android Data Extractor Lite (ADEL) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQBpxZgandE5D5alwBw5L_UGL3iMqOEB0ajg_cfYZfsGPuJNAb6b2XDZfvsItEsMGGwHvN19IrpDsUI8B7mEdp8miG2w4DADZEoN2Q964MIdgKQA_fMBhm-xtiEUygQ23IwbcP7PNdMoOI/s1600/ADEL+Image.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ADEL Android" border="0" height="287" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQBpxZgandE5D5alwBw5L_UGL3iMqOEB0ajg_cfYZfsGPuJNAb6b2XDZfvsItEsMGGwHvN19IrpDsUI8B7mEdp8miG2w4DADZEoN2Q964MIdgKQA_fMBhm-xtiEUygQ23IwbcP7PNdMoOI/s1600/ADEL+Image.png" title="ADEL Android" width="400" /></a></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Android Data Extractor Lite (ADEL)</b> is a <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> script that dumps all important SQLite Databases from a 
connected <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a> smartphone to the local disk and analyzes these files 
in a forensically accurate workflow. If no smartphone is connected you 
can specify a local directory which contains the databases you want to <a href="http://www.toolwar.com/search/label/Anaysis" target="_blank">analyze</a>. Afterwards this script creates a clearly structured XML report.</div>
<div style="text-align: justify;">
If you connect a smartphone you need a rooted and insecure kernel or a custom recovery installed on the smartphone.</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<div style="text-align: justify;">
ADEL needs a predefined configuration for each device to work proper. This configuration has to be added in the following file:</div>
<div style="text-align: justify;">
<pre><code>xml/phone_configs.xml</code></pre>
<pre><code> </code></pre>
</div>
<div style="text-align: justify;">
As an example we added the configuration for the Samsung Galaxy S2 running Android 2.3.3, more phone configurations will follow. Example for the use of ADEL with a connected smartphone:</div>
<div style="text-align: justify;">
<pre><code>adel.py -d device -l 4</code></pre>
<pre><code> </code></pre>
</div>
<div style="text-align: justify;">
Example for the use of ADEL with database backups:</div>
<div style="text-align: justify;">
<pre><code>adel.py -d /home/user/backup -l 4
</code></pre>
</div>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Python Supported Platform :: </b><a href="https://github.com/mspreitz/ADEL/archive/master.zip" target="_blank">ADEL</a> (.py)<br /><b>Source Website ::</b> <a href="https://github.com/mspreitz/ADEL">https://github.com/mspreitz/ADEL</a></div>

Android Data Extractor Lite (ADEL) :: Tools

Android Data Extractor Lite (ADEL) is a Python script that dumps all important SQLite Databases from a connected Android smartphone...

Fern WiFi Cracker (Wireless Security Auditing) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_r9FW3TnXSaixk_XdPQeulTjkmnrUgCEaSMttahhSYB74fXxI7yrdv1fpiOwsdke6A8UYl_jOglpFZZF0snnVewT3z3Er5LlcI-Roo6j-vtoGbv6kPZMrd9BUb6gl3IdqLt_Iqp2tDCCF/s1600/fern+wifi+cracker+toolwar.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_r9FW3TnXSaixk_XdPQeulTjkmnrUgCEaSMttahhSYB74fXxI7yrdv1fpiOwsdke6A8UYl_jOglpFZZF0snnVewT3z3Er5LlcI-Roo6j-vtoGbv6kPZMrd9BUb6gl3IdqLt_Iqp2tDCCF/s1600/fern+wifi+cracker+toolwar.png" /></a></div>
<div style="text-align: justify;">
<b>Fern Wifi Cracker</b> is a <b><i>Wireless security auditing</i></b> and attack software program written using the <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> Programming Language and the Python Qt GUI library,  the program is able to crack and recover WEP/WPA/WPS keys and also run  other <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a> based <a href="http://www.toolwar.com/search/label/Attack" target="_blank">attacks</a> on wireless or ethernet based networks.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Features :-</b></div>
<div style="text-align: justify;">
<ul>
<li>WEP <a href="http://www.toolwar.com/search/label/Cracking" target="_blank">Cracking</a> with Fragmentation,Chop-Chop, Caffe-Latte, Hirte, ARP Request Replay or WPS attack </li>
<li>WPA/WPA2 Cracking with Dictionary or WPS based attacks</li>
<li>Automatic saving of key in database on successful crack</li>
<li>Automatic Access Point Attack System</li>
<li>Session Hijacking (Passive and Ethernet Modes)</li>
<li>Access Point MAC Address Geo Location Tracking</li>
<li>Internal <a href="http://www.toolwar.com/search/label/MITM" target="_blank">MITM</a> Engine</li>
<li>Bruteforce Attacks (HTTP,HTTPS,TELNET,FTP)</li>
<li>Update Support</li>
</ul>
<h3>
<b>Tutorials ::  </b></h3>
<b>Session Hijacking Demonstration ::</b><br />
<b> </b> <br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/Bi-8JRNpMqo?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<b>Bruteforcing Routers with Fern-Wifi-Cracker ::</b>  <br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/_ztQQWMoVX4?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<b>Cracking WEP Security with Fern-Wifi-Cracker ::</b>  <br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/vpiOPEZD6qw?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<h3>
<b>Download :: </b></h3>
<b>Download Here :: </b><a href="http://code.google.com/p/fern-wifi-cracker/downloads/list" target="_blank">Fern WiFi Cracker</a> <b> </b><br />
<b>Source Website ::</b> <a href="http://code.google.com/p/fern-wifi-cracker/">http://code.google.com/p/fern-wifi-cracker/</a></div>
</div>

Fern WiFi Cracker (Wireless Security Auditing) :: Tools

Fern Wifi Cracker is a Wireless security auditing and attack software program written using the Python Programming Language and the P...

MOBILedit Forensics :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilBgt_tQUcU1RnJsR6nPH7666brLrrSQj-l3nv0h9DkEVD_JpHFKxXQXxKaijN_3LcQrKPhxzpbY8st6tD-UTIMFH1y8OGZW6HmT9-SU-fAYE7BGw95pHT_t7h3K6PY7DDXFW8YqnRsqID/s1600/mobiledit-forensic-3461-1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="MOBILedit Forensics" border="0" height="283" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilBgt_tQUcU1RnJsR6nPH7666brLrrSQj-l3nv0h9DkEVD_JpHFKxXQXxKaijN_3LcQrKPhxzpbY8st6tD-UTIMFH1y8OGZW6HmT9-SU-fAYE7BGw95pHT_t7h3K6PY7DDXFW8YqnRsqID/s1600/mobiledit-forensic-3461-1.jpg" title="MOBILedit Forensics" width="400" /></a></div>
<br />
<span class="Transparent"><b>MOBILedit Forensics</b> can retrieve all data from a <a href="http://www.toolwar.com/search/label/Phone" target="_blank">phone</a> with one click Generate <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic</a> reports ready for the courtroom Relied upon by the US Military, FBI, and CIA!</span> <b>MOBILedit Forensic</b> you can view, search or retrieve all data from a  phone with only a few clicks. This data includes call history,  phonebook, text messages, multimedia messages, files, calendars, notes,  reminders and application data such as Skype, Dropbox, Evernote, etc.   It will also retrieve all phone information such as IMEI, operating  systems, <a href="http://www.toolwar.com/search/label/Firmware" target="_blank">firmware</a> including <a href="http://www.toolwar.com/search/label/SIM" target="_blank">SIM</a> details (IMSI), ICCID and location area  information. Where possible <b>MOBILedit Forensic</b> is also able to retrieve  deleted data from phones and bypass the passcode, PIN and phone backup  encryption.</div>
<div style="text-align: justify;">
<h3>
<b>Features :: </b></h3>
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<b>Support for Almost All Phones :: </b></div>
<div style="text-align: justify;">
MOBILedit Forensic supports thousands of different phones including  common feature phones from manufacturers like Samsung, HTC, Nokia,  Sony, LG and Motorola. It also supports all smartphone operating systems  including <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a>, <a href="http://www.toolwar.com/search/label/iPhone" target="_blank">iPhone</a>, Blackberry, Symbian, <a href="http://www.toolwar.com/search/label/Windows" target="_blank">Windows</a> Mobile, Windows  Phone, Bada, Meego, Chinese phones and CDMA phones.         </div>
<div style="text-align: justify;">
<br /></div>
<div class="right" style="text-align: justify;">
<div style="text-align: justify;">
<b>Extract Important Application Data :: </b></div>
<div style="text-align: justify;">
Get the most from iPhones and Androids. <b>MOBILedit</b> is able to  retrieve the list of installed apps and provides you access to all  application data such as Dropbox, Evernote, Skype, WhatsApp etc. Where  possible, it is even able to retrieve deleted data from mobile apps.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Bypass the Passcode on iOS Using the Lockdown Files Method :: </b></div>
<div style="text-align: justify;">
Although iOS has well protected data due to hardware  encrypted on the fly, <b>MOBILedit Forensic</b> is able to go through this <a href="http://www.toolwar.com/search/label/Security" target="_blank"> protection</a> and retrieve the data. It supports importing the lockdown  files that can be found on a suspect’s computer. These files are  generated when you connect an <a href="http://www.toolwar.com/search/label/iOS" target="_blank">iOS</a> device to a PC and authorize the  computer by typing the passcode. <b>MOBILedit Forensic</b> will instruct you on  how to obtain these files and if you import them to the computer where  you make the acquisition, then you will be able to retrieve all data  from the phone even if it is locked with a passcode.         </div>
<div style="text-align: justify;">
<br /></div>
<div class="right" style="text-align: justify;">
<b>Bypass the PIN Code with an Integrated SIM Cloning Tool :: </b><br />
This feature is the most modern tool of its kind. It removes the  requirement of a PIN for the original SIM card of the phone being  investigated. It also removes the need for obsolete and unreliable  Faraday bags. Now you can clone <b>SIM cards</b>, create new SIM cards with any  ICCID or just format your SIM card to renew for next use. You are able  to connect multiple SIM card readers at the same time.<br />
</div>
<div class="right" style="text-align: justify;">
</div>
<div class="right" style="text-align: justify;">
<b>Examine the Phone Data Without Having the Phone :: </b><br />
Most iOS users are using iTunes, especially for managing  music. The majority of them have connected their iPhone to iTunes at  least once. So, even if you don’t secure the phone as evidence, you can  still acquire the phone data because iTunes by default creates an  automatic backup of any connected iPhone. <b>MOBILedit Forensic</b> instructs  you on how to obtain these iTunes backup files and provides a full  extraction including contacts, messages, recordings, ringtones, notes,  calendar, photos, videos and even apps along with their data.  </div>
<div class="right" style="text-align: justify;">
<div class="right">
<br />
<b>Extract Data from iOS Even When the Phone has Setup Encryption for the Backup :: </b><br />
Standard iOS forensic tools are analyzing data from the  backup. However, when the iPhone has setup encryption, there is not much  these tools can do. <b>MOBILedit Forensic</b> will enable you to retrieve the  data from a live iPhone in a fast logical way without a need to know the  encryption key. With this extra method you will even be able to  retrieve deleted items where available such as messages, contacts and  deleted app data including support for items stored in the cloud.<br />
</div>
<div class="right">
<div class="right">
<b>Get a List of Skype, Gmail or Facebook Contacts Without Even Knowing the Accounts' Passwords :: </b><br />
MOBILedit Forensic gives you a complete support of contact  accounts for Android and iOS. Suspects store contacts not only to the  phone memory, but also to different cloud services such as MS Exchange,  Facebook, Gmail or Skype. Retrieving <a href="http://www.toolwar.com/search/label/Password" target="_blank">passwords</a> for these services might  be impossible. With MOBILedit Forensic you gain access to these sources  and get the full report of all people connected with the suspect.<br />
<br />
<b>Having Trouble Connecting Androids by Cable? Investigate Them Via Wi-Fi :: </b><br />
Some Android phones, especially cheaper ones, cannot be  connected to a PC via cable either because the connection is not  available or because some pre-installed security, firewall, antivirus or  even BYOD systems is blocking the <a href="http://www.toolwar.com/search/label/USB" target="_blank">USB</a> communication with the PC. Using a  special forensic version of the connector app you will be able to  connect these phones via Wi-Fi and make a complete logical extraction.<br />
<b>Powerful SIM Analyzer Retrieves All Possible Information From SIM Card ::</b><br />
This analyzer helps you get the ICCID without even knowing  the PIN and also retrieves Location Area Information. You will be able  to access the SIM card status information (IMSI, ICCID, LAI, PIN, PUK,  call costs) as well as review and export a list of all SIM card  applications. When available you can also read deleted messages from the  SIM card. </div>
<div class="right">
<br />
<b>We Will Navigate You Through the Phone Connection Process Without a Hassle :: </b><br />
You can quickly find any phone in our comprehensive online  database. Just enter any part of the name and you will immediately see  the complete phone feature information along with the compatible data  cable supporting the device and its position in our Connection Kit. If  you are not sure about the model number of your phone, the picture will  help you to identify the right one. Information about how to setup the  connection to a PC (instructions to turn on debugging mode, setting up a  PC suite mode after connection etc.) is also included.  </div>
<div class="right">
<div class="right">
<br />
<b>Retrieve All Important Data with a Physical Acquisition ::</b><br />
Physical acquisition of <a href="http://www.toolwar.com/search/label/Android" target="_blank">Android</a> phones and <a href="http://www.toolwar.com/search/label/Memory" target="_blank">memory</a> cards is  available. This data can then be easily viewed or exported and analyzed  by any third party software.<br />
</div>
<div class="right">
<b>Integrated Search Plugin :: </b><br />
This plugin lets you quickly search across an entire case  including all extracted phones and organizes the data acquired by this  search very efficiently. You can use wildcards to filter your search  results or simply drag & drop cases to reorder the subfolders. You  can also export the searched content with a single click.  </div>
<div class="right">
</div>
<div class="right">
<div class="right">
<b>Additional Assistance with Connection due to Unique Driver Detection and Repair System :: </b><br />
Connecting a phone to Windows can sometimes be problematic,  especially if you haven’t installed the correct phone driver prior to  connecting the phone to a PC. We have developed a special low-level  driver detection and repair system which automatically downloads and  installs the correct driver replacing the wrong one that was  preinstalled by Windows. This will solve a lot of potential troubles  with phone connection.<br />
</div>
<div class="right">
<b>The New Connection Kit with a Complete SIM Cloning Package ::</b><br />
This is a very special collection of custom-made USB  cables that covers the vast majority of phones available on the market  today. Save valuable time that you would have spent searching for older  cables because this collection also includes recently discontinued and  even ancient models.              </div>
</div>
</div>
</div>
</div>
<div style="text-align: justify;">
</div>
<h3>
Tutorials ::</h3>
<b>User Guide ::</b> <a href="http://www.mobiledit.com/forensic-guide" target="_blank">Click Here </a><br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/2FDl0obe0vE?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download ::</h3>
<div style="text-align: justify;">
<b>Windows ::</b></div>
<div style="text-align: justify;">
<a href="http://download.mobiledit.com/mobiledit!/setup_ForensicExpress_1.3.0.531.exe" target="_blank">MOBILedit Forensics Express</a> (.exe)</div>
<div style="text-align: justify;">
<a href="http://download.mobiledit.com/mobiledit!//setup_SimClone_2_0.exe" target="_blank">SIM Cloning</a> (.exe) </div>
<div style="text-align: justify;">
<a href="http://download.mobiledit.com/drivers//mefconnector_1_1_21.apk" target="_blank">Android Forensics Connector</a> (.apk)</div>
<div style="text-align: justify;">
<b>Official Website :: </b><a href="http://www.mobiledit.com/forensic">http://www.mobiledit.com/forensic</a></div>
</div>

MOBILedit Forensics :: Tools

MOBILedit Forensics can retrieve all data from a phone with one click Generate forensic reports ready for the courtroom Relied upon b...

SIMCon (SIM Card Forensics) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHcbHgI1KTIu4rmmAdo69Nj17IqYlV2WPKktjKhCbkMQBPwpqTzel7B8MPrdXLAqZkXD54OvdPGwZKqHHVuaOpP3vSrZ3rX4sOG1qP07Yuo1UUobEy1owOvZloIZbYyQb_ZslJi3c539ze/s1600/SIMCon.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="SIMCon Forensics" border="0" height="338" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHcbHgI1KTIu4rmmAdo69Nj17IqYlV2WPKktjKhCbkMQBPwpqTzel7B8MPrdXLAqZkXD54OvdPGwZKqHHVuaOpP3vSrZ3rX4sOG1qP07Yuo1UUobEy1owOvZloIZbYyQb_ZslJi3c539ze/s1600/SIMCon.gif" title="SIMCon Forensics" width="400" /></a></div>
<div style="text-align: justify;">
<b>SIMCon</b> is a program that securely images all files on a <b>GSM SIM Card</b> with a standard PC-SC smart card reader, either serial or <a href="http://www.toolwar.com/search/label/USB" target="_blank">USB</a>. After imaging, the <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensic investigator</a> can then analyze the contents of the card. Remove the SIM card from any GSM phone and insert it into your forensic <b>SIMCon</b> sim card reader. Plug your sim card reader into your computer and launch the SIMCon 
application. Follow the steps of the software to access the data on the 
SIM card. Specific information regarding stored numbers, call history, and text messages are available. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
All GSM cell phones today have a subscriber identity module (SIM) to identify the phone onto the <a href="http://www.toolwar.com/search/label/Network" target="_blank">network</a>. <b>SIMCon</b> is an application to acquire all of the information from the SIM Card.</div>
<div style="text-align: justify;">
<br />The SIM Card provides secure storing of the key identifying a mobile phone service subscriber, subscription information, preferences and text messages. Network state information, such as the current location area identity (LAI), is also stored on the card. When a handset is turned off and then back on, it will search for the LAI that it was in, rather than having to search all frequencies that the phone operates in. This saves time when trying to log on to the network. <br /><br />By using <b>SIMCon</b> and a smart card reader, all of the above information and more can be pulled off of the card without knowing the PIN or the PUK of the card. The PIN and the PUK are ways to keep the information on the card secure. They also can be used as a <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a> feature on the <a href="http://www.toolwar.com/search/label/Phone" target="_blank">phone</a>, not allowing anyone to use a phone to access the SIM Card without knowing the codes.<br /><br /><b>SIMCon</b> is an application developed by Inside Out <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">Forensics</a> in Norway. It is designed for use by the law enforcement community, and it can be obtained free of charge by emailing <b>SIMCon</b> and identifying the officers and unit. However, for anyone outside the law enforcement community, it is not free. </div>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Features"> Features :: </span></h3>
<ul style="text-align: justify;">
<li> Acquire all available files on a SIM Card and store in an archive file
</li>
<li> Analyze and interpret content of files 
</li>
<li> Recover deleted text messages stored on the card 
</li>
<li> Manage PIN and PUK codes
</li>
<li> Compatible with SIM Cards and USIM Cards
</li>
<li> Print reports of evidence 
</li>
<li> Secure file archive using hashing
</li>
<li> Export items to popular spreadsheet programs
</li>
<li> Supports international charsets
</li>
<li> Contains a "content" view for plain text viewing of data, as well as a hexadecimal view for more specific analysis.
</li>
</ul>
<h3 style="text-align: justify;">
 <span class="mw-headline" id="Data_Acquisition"> Data Acquisition :: </span></h3>
<div style="text-align: justify;">
SIMCon is also capable of aquiring the following data from a SIM Card:
</div>
<ul style="text-align: justify;">
<li> Abbreviated Dialing Numbers (ADN), 
</li>
<li> Last Dialed Numbers (LDN)
</li>
<li> Short Message Service (SMS)
</li>
<li> Public Land Mobile Network (PLMN) selector
</li>
<li> Forbidden PLMNs, Location Information (LOCI)
</li>
<li> General Packet Radio Service (GPRS) location
</li>
<li> International Mobile Subscriber Identity (IMSI)
</li>
<li> Integrated Circuit Card Identifier (ICCID)
</li>
<li> Mobile Subscriber ISDN (MSISDN)
</li>
<li> Service Provider Name (SPN)
</li>
<li> Phase Identification
</li>
<li> SIM Service Table (SST)
</li>
<li> Language Preference (LP)
</li>
<li> Card Holder Verification (CHV1) and (CHV2)
</li>
<li> Broadcast Control Channels (BCCH)
</li>
<li> Ciphering Key (Kc)
</li>
<li> Ciphering Key Sequence Number
</li>
<li> Emergency Call Code
</li>
<li> Fixed Dialing Numbers (FDN)
</li>
<li> Forbidden PLMNs
</li>
<li> Local Area Identitity (LAI)
</li>
<li> Own Dialing Number
</li>
<li> Temporary Mobile Subscriber Identity (TMSI)
</li>
<li> Routing Area Identifier (RIA) netowrk code
</li>
<li> Service Dialing Numbers (SDNs)
</li>
<li> Service Provider Name
</li>
<li> Depersonalizatoin Keys </li>
</ul>
Tutorials ::<br /><b>Buy :: </b><a href="http://www.simcon.no/buy/index.html" target="_blank">SIMCon  $79.95</a><br />
<b>Official Website :: </b><a href="http://www.simcon.no/index.html">http://www.simcon.no/index.html</a>

SIMCon (SIM Card Forensics) :: Tools

SIMCon is a program that securely images all files on a GSM SIM Card with a standard PC-SC smart card reader, either serial or USB . Af...

CD/DVD Inspector (CD/DVD Forensics) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="CD/DVD Inspector" border="0" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8t5ku03fzM66A_D-zGNtFxTSIjD8cNRhTQ49guzYkRb5UYgQxwPknB-Uau7TUenSzPl680Vn6g7c4O2r1LbbS6JEO3jDFJY1tkhvqEfzk27-4WiBBtCc9D38NquQt9ntGyY0A7BNNWROd/s1600/CD-DVD+Inspector.jpg" title="CD/DVD Inspector" width="640" /></div>
<div style="text-align: justify;">
<b>CD/DVD Inspector</b> for intensive <b>analysis and extraction</b> of data from CD-R, CD-RW and all types of DVD media - including HD DVD and Blu-Ray.. Tailored for professionals in <b>data recovery, <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a>, and law enforcement.</b>  Building on the <a href="http://www.toolwar.com/search/label/Recovery" target="_blank">data recovery</a> technology in CD/DVD Diagnostic™, it adds detailed displays and enhanced media search abilities, improving performance and usability.  With the release of the 4.1 version, this is now the forensic tool you should be using.  For information about the changes in each version see the release information page.<br /><br /><b>CD/DVD Inspector</b> reads all major CD and DVD filesystem formats including ISO-9660, Joliet, UDF, HSG, HFS and HFS+.  When the disc being examined contains more than a single filesystem, all filesystems found are displayed.  Multiple filesystems are present for hybrid Macintosh/PC discs as well as for discs that are produced by DirectCD and other packet-writing software. DVD Video discs include both the UDF and ISO-9660 filesystem as well.<br /><br /><b>CD/DVD Inspector </b>now includes a flexible report generator which can be tailored to your specific requirements.  Over 50 separate data items can be selected for reports with output in direct to print, HTML, text file or CSV.  With printed and HTML reports thumbnails can be included for pictures.  Reports can be sorted by any data item included in the report.<br /><br />Now available - Robotic Loader Extension.  This is the tool to automate your handling of the massive quantities of CD and DVD evidence that is being collected.  Includes support for photographing and tracking discs!  InfinaDyne now supports TEAC disc publishing systems for automated collection of CD and DVD evidence.</div>
<h3 style="text-align: justify;">
Features ::</h3>
<div style="text-align: justify;">
<b>Flexible Report Generator ::</b><br />Reports can be produced for print, HTML, text file or CSV output with over 50 different data items selectable.  An unlimited number of user-defined reports can be created.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Automated Media Collection ::</b><br />Put up to 300 discs at once in one of the supported Robotic Loader systems and it will automatically collect all content from every disc.  Flexible reporting for each disc processed.  Import the results directly into EnCase or FTK.  Optionally photograph each disc as it is processed.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Complete CD Imaging :: </b><br />Now CD/DVD Inspector can create an image file containing all of the information required to completely process any disc in a set of two files.  The first file contains the complete "raw" track data with all subchannels from a CD and all of the user sector data from all sessions on a DVD.  The second file is in XML format and contains all of the information that CD/DVD Inspector has extracted from the various control structures on the disc and the file systems.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Transfer data collected to EnCase, FTK, etc. ::</b><br />Captures all files, even those not part of the directory structure (deleted or damaged) One-step image collection from otherwise inaccessible CD or DVD discs.Use of 'hard links" minimizes size of the image file while retaining complete content of the disc. Drag-and-drop a single file per disc<br /><br /><b>File scanning ::</b><br />“Inaccessible” discs files can be searched using scan specification syntax, including regular expressions.</div>
<div style="text-align: justify;">
<br /><b>Built-in Image Viewer :: </b><br />This tool identifies files containing graphic content (ART, BMP, GIF, JPEG, TIFF, etc.) independent of the file extension. Supports RAW images from over 125 different digital cameras.<br /><br /><b>Low-level sector examination and scanning ::</b></div>
<div style="text-align: justify;">
Displays sectors in hexadecimal and character. It  also scans all sectors of a disc for particular data   For example, it  locates an email address on a disc regardless of what file the mail  may be in.  This searches the complete disc, not just areas identified as belonging to files.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Data pane ::</b></div>
<div style="text-align: justify;">
Allows direct examination of the contents of files on the disc from the main window.  The information can be displayed in either character or hexadecimal/character form.  The data pane can be resized and scrolled as needed.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Disc Memory and Checkpoint ::</b><br />This feature eliminates lengthy re-discovery of the disc’s contents.  Additionally, it allows for interruption of a disc examination and then resumption of that same examination at a later time.  This is useful as some disc examinations can be lengthy, often taking more than 12 hours.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Intensive Disc Examination ::</b><br />Locates data on discs that has been dropped from the file system, either because of software glitches, deletion or user action.  This is now done for all format discs.<br /><b> </b></div>
<div style="text-align: justify;">
<b>Expanded Retry Capabilities ::</b><br />Permits users to select the level of automatic retries performed whenever a data error is encountered.  This can make otherwise unreadable data sectors readable again.  This allows the user to balance examination speed with thoroughness.<br /><b> </b></div>
<div style="text-align: justify;">
<b>CD Text, ISRC and RID Audio Disc Display ::</b></div>
<ul style="text-align: justify;">
<li>CD Text contains album, track and artist names on Sony and home-produced music CDs.</li>
</ul>
<ul style="text-align: justify;">
<li>ISRC is the acronym for International Standard Recording Code.  It is a code used to identify the recording studio and publisher of a music track. </li>
</ul>
<ul style="text-align: justify;">
<li>RID is the acronym for Recorder Identification.  It is written to music CDs recorded on standalone CD recorders used with audio systems. </li>
</ul>
<h3 style="text-align: justify;">
Download ::</h3>
<div style="text-align: justify;">
<b>Buy :: </b>$699 - <a href="http://www.infinadyne.com/cddvd_inspector.html" target="_blank">Click Here for Purchase</a></div>
<div style="text-align: justify;">
<b>Official Website ::</b> <a href="http://www.infinadyne.com/cddvd_inspector.html">http://www.infinadyne.com/cddvd_inspector.html</a></div>

CD/DVD Inspector (CD/DVD Forensics) :: Tools

CD/DVD Inspector for intensive analysis and extraction of data from CD-R, CD-RW and all types of DVD media - including HD DVD and Blu-R...

UFED Physical Analyzer (Mobile Forensics & Analysis) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrrfb3Vu39jG8zllB6pBzdPUOl7XnIjnKiOGJ5Fkxd-XaLP2XL1vQjPm3haFOBuClpRNQQSOPDsvnWSqf8nzx5BTRdsMPscgUQL_tvrz0MbYFvVmw2RiiPr9oSCLYKtIaVjhWf61xVy-_x/s1600/Cellebrite+Physical+Analyzer+Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Cellebrite Physical Analyzer Screenshot" border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrrfb3Vu39jG8zllB6pBzdPUOl7XnIjnKiOGJ5Fkxd-XaLP2XL1vQjPm3haFOBuClpRNQQSOPDsvnWSqf8nzx5BTRdsMPscgUQL_tvrz0MbYFvVmw2RiiPr9oSCLYKtIaVjhWf61xVy-_x/s1600/Cellebrite+Physical+Analyzer+Screenshot.png" title="Cellebrite Physical Analyzer Screenshot" width="400" /></a></div>
<b>UFED Physical Analyzer</b> is the most <b>advanced analysis, decoding and reporting</b> application in the <a href="http://www.toolwar.com/search/label/Phone" target="_blank">mobile forensic</a> industry. It includes <a href="http://www.toolwar.com/search/label/Malware" target="_blank">malware detection</a>, enhanced decoding and reporting functions, project analytics, timeline graph, exporting data capabilities and much more.<span id="copylink" style="left: -9999px; position: absolute;"><br />
Source: http://www.cellebrite.com/mobile-forensics/products/applications/ufed-physical-analyzer</span><span id="copylink" style="left: -9999px; position: absolute;"> </span> </div>
<div style="text-align: justify;">
The <b>Cellebrite 'Universal Forensic Extraction Device' (UFED)</b>  is a <a href="http://www.toolwar.com/search/label/Phone" target="_blank">tool for mobile phone</a>, smartphone, and PDA <a href="http://www.toolwar.com/search/label/Forensics" target="_blank">forensics</a>. As of  September 2010 the UFED was compatible with over 2,500 mobile phones  (including GSM, TDMA, CDMA, iDEN). The standard package containing  several dozen phone cables. The <b>UFED</b> had an intergrated SIM reader, with  Wireless connection options also being integrated, such as IR and  Bluetooth.   </div>
<div style="text-align: justify;">
The <b>UFED</b> also supports native Apple iPOD Touch, and Apple iPHONE  extraction on both 2G and 3G versions, as well as iOS4. This is  clientless, and via a physical cable, and works on <a href="http://www.toolwar.com/search/label/Jailbreak" target="_blank">jailbroken</a> and  non-jailbroken devices.  </div>
<div style="text-align: justify;">
Subject data can be retrieved via logical extraction or via  physical extraction (ie: hex dump). Moreover, all cable connectors from  subject (source) side act as a write-blocker, being read only via the  onboard hardware chipset. Extracted data includes basic handset data,  the phonebook, SMS and MMS messages, SIM data, multimedia (e.g. images  and videos stored on the phone), and time and date stamps. </div>
<div style="text-align: justify;">
<b>Supported Devices :: </b><a href="http://www.cellebrite.com/mobile-forensics/support/ufed-supported-devices" target="_blank">Click Here</a></div>
<h3 style="text-align: justify;">
Advanced capabilities for:</h3>
<div style="text-align: justify;">
<b>iOS :: </b> </div>
<ul style="text-align: justify;">
<li>Bypassing <b>simple and complex passcode</b> while performing physical and file system extraction on selected devices running iOS 3.0 or higher including iOS 6.</li>
<li>Real-time decryption and decoding of data, applications, and keychain real-time decryption while revealing user passwords.</li>
<li>Advanced decoding of applications.</li>
</ul>
<div style="text-align: justify;">
<b>BlackBerry :: </b> </div>
<ul style="text-align: justify;">
<li>Advanced decoding of BlackBerry Messenger (BBM), emails, locations, applications and more.</li>
<li>Real-time decryption of protected content from selected BlackBerry devices running OS 4+ using a given password.</li>
</ul>
<div style="text-align: justify;">
<b>Android ::</b> </div>
<ul style="text-align: justify;">
<li>Advanced decoding of all physical extractions performed on devices running any Android versions.</li>
<li>Advanced decoding of applications and application files.</li>
</ul>
<div style="text-align: justify;">
<b>GPS :: </b> </div>
<ul style="text-align: justify;">
<li>Portable GPS devices extraction and decoding.</li>
<li>Exclusive – Physical extraction of Tom Tom trip-log files.</li>
</ul>
<h3>
Tutorials :: </h3>
<div style="text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/OTa6JWwFUms?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/V-x-uJ5TRuM?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download :: <b> </b></h3>
<b>Trial (30 Days) ::</b> <a href="http://go.cellebrite.com/30DayPhysicalAnalyzerTrial" target="_blank">Click Here</a> <b> </b><br />
<b>Buy :: </b><a href="https://my.cellebrite.com/" target="_blank">Click Here</a><b><br /></b><br />
<b>Official Website :: </b><a href="http://www.cellebrite.com/">http://www.cellebrite.com/</a>

UFED Physical Analyzer (Mobile Forensics & Analysis) :: Tools

UFED Physical Analyzer is the most advanced analysis, decoding and reporting application in the mobile forensic industry. It includes ...

Subscribe to: Posts ( Atom )