Definition of Forensic Tools
Forensic tools are tools used in the process of investigating data processing equipment-- typically a home computer, laptop, server, or office workstation-- to determine if the equipment has been used for illegal, unauthorized, or unusual activities.
|
|
Forensic Tools
|
|
FileMon
FileMon monitors and displays file system activity on a system in real-time. Its advanced capabilities make it a powerful tool for exploring the way Windows works, seeing how applications use the files and DLLs, or tracking down problems in system or application file configurations. Filemon's timestamping feature will show you precisely when every open, read, write or delete, happens, and its status column tells you the outcome. FileMon is so easy to use that you'll be an expert within minutes. It begins monitoring when you start it, and its output window can be saved to a file for off-line viewing. It has full search capability, and if you find that you're getting information overload, simply set up one or more filters.
Read the Article
|
Fire
FIRE is a portable bootable cdrom based distribution with the goal of providing an immediate environment to perform forensic analysis, incident response, data recovery, virus scanning and vulnerability assessment. Also provides necessary tools for live forensics/analysis on win32, sparc solaris and x86 linux hosts just by mounting the cdrom and using trusted static binaries available in /statbins.
Read the Article
|
Forensic and Log Analysis GUI - Default branch
FLAG was designed to simplify the process of log file analysis and forensic investigations. It uses a database as a backend to assist in managing the large volumes of data. This allows it to remain responsive and expedite data manipulation operations. It features compatibility with encase images, Windows registry support, and network dump analysis.
Read the Article
|
Forensic Server Project
The Forensic Server Project (FSP) is a proof of concept tool for retrieving volatile (and some non-volatile) data from potentially compromised systems. The FSP consists of several Perl scripts and third-party utilities. The server component of the FSP is run on an investigator or administrator's system, and handles all data storage and activity logging. The client components (i.e., FRU.pl and supporting Perl scripts and tools) of the FSP are burned to a CD, and run from the CD drive of the potentially compromised system. Data is copied to the server component via TCP/IP.
Read the Article
|
FTimes
FTimes is a system baselining and evidence collection tool. The primary purpose of FTimes is to gather and/or develop information about specified directories and files in a manner conducive to intrusion analysis. FTimes is a lightweight tool in the sense that it doesn't need to be "installed" on a given system to work on that system, it is small enough to fit on a single floppy, and it provides only a command line interface.
Read the Article
|
IDA Pro Disassembler and Debugger
The IDA Pro Disassembler and Debugger is an interactive, programmable, extendible, muti-processor disassembler hosted on Windows or on Linux. IDA Pro has become the de-facto standard for the analysis of hostile code, vulnerability research and COTS validation.
Read the Article
|
InstallWatch
InstallWatch records modifications made to your PC during the installation of software, hardware, or configuration changes.
Read the Article
|
Operator
Operator is a complete Linux (Debian) distribution that runs from a single bootable CD and runs entirely in RAM. The Operator contains an extensive set of Open Source network security tools that can be used for monitoring and discovering networks. This virtually can turn any PC into a network security pen-testing device without having to install any software. Operator also contains a set of computer forensic and data recovery tools that can be used to assist you in data retrieval on the local system.
Read the Article
|
Port Reporter
Port Reporter logs TCP and UDP port activity on a local Windows system. Port Reporter is a small application that runs as a service on Windows 2000, Windows XP, and Windows Server 2003.
Read the Article
|
PortQry Command Line Port Scanner
PortQryV2.exe is a command-line utility that you can use to help troubleshoot TCP/IP connectivity issues. Portqry.exe runs on Windows 2000-based computers.The utility reports the port status of TCP and UDP ports on a computer you choose. For details, see Knowledge Base Article Knowledge Base Article 310099.
Read the Article
|
|
|
Page: 1 2 3 4 5
Members currently browsing this category:
|
|
