Forensics

Geoedge

This little tools is designed to get geolocalization information of a host, it get the information from two sources (maxmind and geoiptool). It's useful when doing forensics, log analisis, or just plain curiosity.

LTrace

ltrace intercepts and records dynamic library calls which are called by an executed process and the signals received by that process. It can also intercept and print the system calls executed by the program.

Creepy

creepy is an application that allows you to gather geolocation related information about users from social networking platforms and image hosting services. The information is presented in a map inside the application where all the retrieved data is shown accompanied with relevant information (i.e. what was posted from that specific location) to provide context to the presentation.

RStudio

R-STUDIO is a family of powerful, cost-effective disk recovery software. Originally developed by R-Tools Technology, Inc. for experienced data recovery professionals, R-Studio has been redesigned as a scalable, user-friendly all-in-one data recovery tool. By coupling our most advanced file recovery and disk repair technology with an intuitive user-interface, R-Studio provides enterprise and professional-level data recovery specialists the tools they need without hindering the experience of entry-level users.

EnCase

Guidance Software is recognized globally as a world leader in Digital Forensics, Cyber Security, and E-Discovery solutions. Their services include incident response, computer forensics, and litigation support, provided by experts with hands-on experience in digital investigation. Each year we also train over 6,000 corporate, law enforcement, and government professionals in digital forensics, e-discovery, security, and incident response.

WinDBG

Use Debugging Tools for Windows to debug drivers, applications, and services on Windows systems. Debugging Tools for Windows includes a core debugging engine and several tools that provide interfaces to the debugging engine. A Visual Studio extension provides a graphical user interface, as does Windows Debugger (WinDbg). Console Debugger (CDB), NT Symbolic Debugger (NTSD), and Kernel Debugger (KD) provide command line user interfaces.

The Sleuth Kit

The Sleuth Kit (TSK) is a C library and a collection of command line tools. Autopsy is a graphical interface to TSK. TSK can be integrated into automated forensics systems in many ways, including as a C library and by using the SQLite database that it can can create. The Sleuth Kit Hadoop Framework is a framework that incorporates TSK into cloud computing for large scale data analysis.

Vomit

The vomit utility converts a Cisco IP phone conversation into a wave file that can be played with ordinary sound players. Vomit requires a tcpdump output file. Vomit is not a VoIP sniffer also it could be but the naming is probably related to H.323.

EliteWrap

EliteWrap is a binder that is used to bind a file inside of another. This tool is a bit older, but it works well. There are many options, and I would suggest using them so the files don't get deleted upon opening by av software.

FU Rootkit

The fu rootkit is another tool used to hide running processes and many other things on the target system after exploitation

*PASSWORD* test123

Syndicate content