Forensics

MessenPass

Description
MessenPass is a password recovery tool that reveals the passwords of the following instant messenger applications:

* MSN Messenger
* Windows Messenger (In Windows XP)
* Windows Live Messenger (In Windows XP And Vista)
* Yahoo Messenger (Versions 5.x and 6.x)
* Google Talk
* ICQ Lite 4.x/5.x/2003
* AOL Instant Messenger v4.6 or below, AIM 6.x, and AIM Pro.
* Trillian
* Miranda
* GAIM/Pidgin
* MySpace IM
* PaltalkScene
* Digsby

IE PassView

Description
IE PassView is a small utility that reveals the passwords stored by Internet Explorer browser. It supports the new version of Internet Explorer 7.0, the Beta version of Internet Explorer 8.0, as well as older versions of Internet Explorer, v4.0 - v6.0

Using IE PassView

Dialupass

Description
When you use the "Dial-Up Networking" module for connecting to the internet or to other networks, the operating system give you the option to store the password and use it when it needed. Although the password is constantly stored in your computer, the operating system doesn't allow you to watch it. if you forget your password and you want to extract it from your computer, you can use the Dialupass utility for viewing the password.
This utility enumerates all Dial-Up entries on your computer and reveals their logon details: User Name, Password and Domain.

PasswordFox

Description
PasswordFox is a small password recovery tool that allows you to view the user names and passwords stored by Mozilla Firefox Web browser. By default, PasswordFox displays the passwords stored in your current profile, but you can easily select to watch the passwords of any other Firefox profile. For each password entry, the following information is displayed: Record Index, Web Site, User Name, Password, User Name Field, Password Field, and the Signons filename.

System Requirements
This utility works under Windows 2000, Windows XP, Windows Server 2003, and Windows Vista. Firefox should also be installed on your system in order to use this utility.

MozillaHistoryView

Description
MozillaHistoryView is a small utility that reads the history data file (history.dat) of Firefox/Mozilla/Netscape Web browsers, and displays the list of all visited Web pages in the last days. For each visited Web page, the following information is displayed: URL, First visit date, Last visit date, Visit counter, Referrer, Title, and Host name.
You can also easily export the history data to text/HTML/Xml file.

System Requirements
This utility works on any version of Windows, From Windows 98 to Windows Vista. For all Firefox/Mozilla versions except of Firefox 3, you can use this utility even if Firefox/Mozilla is not installed on your system, as long as you have the history file (history.dat) that you want to inspect. If you want to read the history file of Firefox 3 (places.sqlite file), Firefox 3 must be installed on your system.

SkypeLogView

Description
SkypeLogView reads the log files created by Skype application, and displays the details of incoming/outgoing calls, chat messages, and file transfers made by the specified Skype account. You can select one or more items from the logs list, and then copy them to the clipboard, or export them into text/html/csv/xml file.

System Requirements

IE HistoryView

Each time that you type a URL in the address bar or click on a link in Internet Explorer browser, the URL address is automatically added to the history index file. When you type a sequence of characters in the address bar, Internet Explorer automatically suggests you all URLs that begins with characters sequence that you typed (unless AutoComplete feature for Web addresses is turned off). However, Internet Explorer doesn't allow you to view and edit the entire URL list that it stores inside the history file.

Helix

Helix is a bootable live CD. You can still boot into a customized Linux environment that includes customized linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics.

Helix has been modified very carefully to NOT touch the host computer in any way and it is forensically sound. Helix wil not auto mount swap space, or auto mount any attached devices. Helix also has a special Windows autorun side for Incident Response and Forensics.

Helix focuses on Incident Response & Forensics tools. It is meant to be used by individuals who have a sound understanding of Incident Response and Forensic techniques.

http://www.e-fense.com/helix/downloads.php

IDA Pro

Interactive Disassembler Pro. Supports 80x86 binaries and FLIRT, a unique Fast Library Identification and Recognition Technology that automagically recognizes standard compiler library calls. Widely used in COTS validation and hostile code analysis.
In short it's what we like to call the "Reverse Engineer's Wet Dream".

Winhex

WinHex is a hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. Also a advanced tool for everyday and emergency use.

http://www.x-ways.net/winhex/

Syndicate content