# data[].attributes.attachment_link.keywords[]
"13 cubed" 13cubed dfir "digital forensics" "penetration testing" "malware analysis"

# data[].attributes.attachment_link.description
13Cubed is a side project maintained by me, Richard Davis. This channel will mostly cover security-related topics including Digital Forensics and Incident Re...

# data[].attributes.attachment_link.description
As a continuation of the "Introduction to Windows Forensics" series, this video introduces Plaso and Log2Timeline. Log2Timeline is designed to extract forensic data from a computer system and aggregate it for analysis, and Plaso is the Python-based backend engine that powers the tool.

# data[].attributes.attachment_link.readable_text
The Plaso development team has announced the new version of the tool - Heimdall. Here is the list of new features:

DC3 contributed SQLite database schema matching in SQLite plugins, to highlight situations where an application's SQLite schema may have changed.

B3n7s added support for shield authentication in the ElasticSearch output module.

The EventData changed made it possible to implement merged MACB output in the l2tcsv output module. This reduces the noise from file timestamp updates significantly, and resolves a longstanding issue.

Psteal.py is a new Plaso frontend that simplifies the most common Plaso use case of processing an image, and producing a human-readable output. Essentially, psteal runs log2timeline, then psort immediately afterwards.

You can read more about the release here and download it here.

# data[].attributes.attachment_link.description
The Plaso development team has announced the new version of the tool - Heimdall. Here is the list of new features: DC3 contributed SQLite database schema matching in SQLite plugins, to highlight situations where an application's SQLite schema may have changed. B3n7s added support for shield authentication in the ElasticSearch output module.

# data[].attributes.attachment_link.title
Getting to know your NTFS INDX Records - Willi Ballenthin

# data[].attributes.attachment_link.description
This was the first special request presentation, Willi originally presented this at NYC4SEC, it received lots of positive response and he kindly offered to come and give it again for a special DFIROnline session. Willi is a great presenter and this is a good reminder of how important it is to look beyond the MFT.

# data[].attributes.attachment_link.title
Getting to know your NTFS INDX Records - Willi Ballenthin

# data[].attributes.attachment_link.description
This was the first special request presentation, Willi originally presented this at NYC4SEC, it received lots of positive response and he kindly offered to come and give it again for a special DFIROnline session. Willi is a great presenter and this is a good reminder of how important it is to look beyond the MFT.

# data[].attributes.attachment_link.keywords[]
you must know 20 important linux commands

# data[].attributes.attachment_link.description
list of linux commands linux basic commands with examples commands of linux unix basic commands introduction to linux basic linux commands with examples linux unix basic commands linux terminal commands shell commands linux gui common linux commands linux networking commands linux operating system commands basic linux commands for beginners useful

# data[].attributes.attachment_link.description
An introduction to the basic Linux file system and how to get around in it. If you'd like to know more about how I can help you get started with Linux then please check out http://www.ezeelinux.com

# data[].attributes.attachment_link.readable_text
Forensic investigations are always challenging as you may gather all the information you could for the evidence and mitigation plan. Here are some of the computer forensic investigator tools you would need. Most of them are free!

Whether it's for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites and utilities will help you conduct memory forensic analysis, hard drive forensic analysis, forensic image exploration, forensic imaging and mobile forensics. As such, they all provide the ability to bring back in-depth information about what's "under the hood" of a system.

Autopsy is a GUI-based open source digital forensic program to analyze hard drives and smart phones effectively. Autospy is used by thousands of users worldwide to investigate what actually happened in the computer.

2. Encrypted Disk Detector

Encrypted Disk Detector can be helpful to check encrypted physical drives. It supports TrueCrypt, PGP, Bitlocker, Safeboot encrypted volumes.

3. Wireshark

Wireshark is a network capture and analyzer tool to see what's happening in your network. Wireshark will be handy to investigate network related incident.

4. Magnet RAM Capture

You can use Magnet RAM capture to capture the physical memory of a computer and analyze artifacts in memory.

It supports Windows operating system.

5. Network Miner

An interesting network forensic analyzer for Windows, Linux & MAC OS X to detect OS, hostname, sessions and open ports through packet sniffing or by PCAP file. Network Miner provide extracted artifacts in an intuitive user interface.

NMAP (Network Mapper) is one of the most popular networks and security auditing tools. NMAP is supported on most of the operating systems including Windows, Linux, Solaris, MAC OS, HP-UX etc. It's open source so free.

7. RAM Capturer

RAM Capturer by Belkasoft is a free tool to dump the data from computer's volatile memory. It's compatible with Windows OS. Memory dumps may contain encrypted volume's password and login credentials for webmails and social network services.

8. Forensic Investigator

If you are using Splunk then Forensic Investigator will be a very handy tool. It's Splunk app and has many tools combined.

FAW (Forensics Acquisition of Websites) is to acquire web pages for forensic investigation which has the following features.

Capture the entire or partial page

Capture all types of image

Capture HTML source code of the web page

Integrate with Wireshark

10. HashMyFiles

HashMyFiles will help you to calculate the MD5 and SHA1 hashes. It works on almost all latest Windows OS.

11. USB Write Blocker

View the USB drives content without leaving the fingerprint, changes to metadata and timestamps. USB Write Blocker use Windows registry to write-block USB devices.

12. Crowd Response

Response by Crowd Strike is a windows application to gather system information for incident response and security engagements. You can view the results in XML, CSV, TSV or HTML with help of CRConvert. It runs on 32 or 64 bit of Windows XP above.

Crowd Strike has some other nice tools for investigation.

Totrtilla - anonymously route TCP/IP and DNS traffic through TOR.

Shellshock Scanner - scan your network for shellshock vulnerability

Heartbleed scanner - scan your network for OpenSSL heart bleed vulnerability

13. NFI Defraser

Defraser forensic tool may help you to detect full and partial multimedia files in the data streams.

14. ExifTool

ExifTool helps you to read, write and edit meta information for a number of file types. It can read EXIF, GPS, IPTC, XMP, JFIF, GeoTIFF, Photoshop IRB, FlashPix, etc.

15. Toolsley

Toolsley got more than 10 useful tools for investigation.

File signature verifier

File identifier

Hash & Validate

Binary inspector

Encode text

Data URI generator

Password generator

SIFT (SANS investigative forensic toolkit) workstation is freely available as Ubuntu 14.04. SIFT is a suite of forensic tools you need and one of the most popular open source incident response platform.

17. Dumpzilla

Extract all interesting information from Firefox, Iceweasel and Seamonkey browser to be analyzed with Dumpzilla.

18. Browser History

Foxton has two free interesting tools.

1. Browser history capturer - capture web browser (chrome, firefox, IE & edge) history on Windows OS.

2. Browser history viewer - extract ana analyze internet activity history from most of the modern browsers. Results are shown in the interactive graph and historical data can be filtered.

19. ForensicUserInfo

Extract the following information with ForensicUserInfo.

RID

LM/NT Hash

Password reset/Account expiry date

Login count/fail date

Groups

Profile path

20. Kali Linux

Kali Linux is one of the most popular platforms for penetration testing but it has forensic capability too.

PALADIN forensic suite - the world's most popular Linux forensic suite is a modified Linux distro based on Ubuntu available in 32 and 64 bit.

22. Sleuth Kit

The Sleuth Kit is a collection of command line tools to investigate and analyze volume and file systems to find the evidence.

CAINE ( Computer Aided Investigate E nvironment) is Linux distro that offers the complete forensic platform which has more than 80 tools for you to analyze, investigate and create an actionable report.

24. Volatility

Volatility is the memory forensics framework. It used for incident response and malware analysis. With this tool, you can extract information from running processes, network sockets, network connection, DLLs and registry hives. It also has support for extracting information from Windows crash dump files and hibernation files. This tool is available for free under GPL license.

25. WindowSCOPE

WindowsSCOPE is another memory forensics and reverse engineering tool used for analyzing volatile memory. It is basically used for reverse engineering of malwares. It provides the capability of analyzing the Windows kernel, drivers, DLLs, virtual and physical memory.

26. The Coroner's Toolkit

The Coroner's Toolkit or TCT is also a good digital forensic analysis tool. It runs under several Unix-related operating systems. It can be used to aid analysis of computer disasters and data recovery.

27. Bulk Extractor

Bulk Extractor is also an important and popular digital forensics tool. It scans the disk images, file or directory of files to extract useful information. In this process, it ignores the file system structure, so it is faster than other available similar kinds of tools. It is basically used by intelligence and law enforcement agencies in solving cyber crimes.

28. Oxygen Forensic Suite

If you are investigating a case that requires you to gather evidence from a mobile phone to support your case, Oxygen Forensics Suite (Standard Edition) is a tool that will help you achieve this.

29. Free Hex Editor Neo

Free Hex Editor Neo is a basic hex editor that was designed to handle very large files. While a lot of the additional features are found in the commercial versions of Hex Editor Neo, I find this tool useful for loading large files (e.g. database files or forensic images) and performing actions such as manual data carving, low-level file editing, information gathering, or searching for hidden data.

Xplico is an open source Network Forensic Analysis Tool (NFAT) that aims to extract applications data from internet traffic (e.g. Xplico can extract an e-mail message from POP, IMAP or SMTP traffic). Features include support for a multitude of protocols (e.g. HTTP, SIP, IMAP, TCP, UDP), TCP reassembly, and the ability to output data to a MySQL or SQLite database, amongst others.

# data[].attributes.attachment_link.title
The Best Open Source Digital Forensic Tools

# data[].attributes.attachment_link.description
Forensic investigations are always challenging as you may gather all the information you could for the evidence and mitigation plan. Here are some of the computer forensic investigator tools you would need. Most of them are free!

# data[].attributes.attachment_link.description
Thank you for requesting your KnowBe4 RanSim Tool.

# data[].attributes.attachment_link.readable_text
Threats are constantly evolving and, just like everything else, tend to follow certain trends. Whenever a new type of threat is especially successful or profitable, many others of the same type will inevitably follow. The best defenses need to mirror those trends so users get the most robust protection against the newest wave of threats. Along those lines, Gartner has identified the most important categories in cybersecurity technology for the immediate future.

We wanted to dive into the newest cybersecurity products and services from those hot categories that Gartner identified, reviewing some of the most innovative and useful from each group. Our goal is to discover how cutting-edge cybersecurity software fares against the latest threats, hopefully helping you to make good technology purchasing decisions.

Each product reviewed here was tested in a local testbed or, depending on the product or service, within a production environment provided by the vendor. Where appropriate, each was pitted against the most dangerous threats out there today as we unleashed the motley crew from our ever-expanding malware zoo.

With each review, listed in alphabetical order, we will endeavor to show how these new and trending cybersecurity tools work, where they fit into a security architecture, and how they defend against the latest types of threats and attacks.

Best security software, 2018

Best security software, 2017

- Category: Network security
Because most email gateway appliances only scan for known bad domains or the presence of malware, "please hand me the cash"-type social engineering phishing attacks normally breeze through security. GreatHorn was designed to close that security gap, as well as lock down the rest of the mail stream. Read the full review...

- Category: Network security
When CSO's sister site Network World conducted its firewall manager review, the original plan was to invite RedSeal to participate. The problem was that while RedSeal originally did manage firewalls, their product has now evolved into something else. RedSeal shares some similarities to firewall managers, but is now in a separate, unique product group. Read the full review...

Read more security software reviews:

# data[].attributes.attachment_link.title
Best security software, 2018: How 5 cutting-edge tools tackle threats

# data[].attributes.attachment_link.description
Threats are constantly evolving and, just like everything else, tend to follow certain trends. Whenever a new type of threat is especially successful or profitable, many others of the same type will inevitably follow. The best defenses need to mirror those trends so users get the most robust protection against the newest wave of threats.

# data[].attributes.attachment_link.title
List of digital forensics tools - Wikipedia

# data[].attributes.attachment_link.description
During the 1980s, most digital forensic investigations consisted of "live analysis", examining digital media directly using non-specialist tools. In the 1990s, several freeware and other proprietary tools (both hardware and software) were created to allow investigations to take place without modifying media.

# data[].attributes.attachment_link.description
BEC allows an investigator to perform all investigation steps: acquisition (aquire hard and removable drives, image smartphones and download cloud data), extraction of evidence (searches and carves more than 700 formats of various files and applications data), analysis (hex viewer, SQLite viewer, social graph building with communities detection etc) and reporting.

# data[].attributes.attachment_link.readable_text
Test your browser to see how well you are protected from tracking and fingerprinting:
Test Your Browser Test with a real tracking company

How does tracking technology follow your trail around the web, even if you've taken protective measures? Cover Your Tracks shows you how trackers see your browser. It provides you with an overview of your browser's most unique and identifying characteristics.

Only anonymous data will be collected through this site.

Want to learn more about tracking? Read how it works with our guide:
Learn More About Fingerprinting
stop animation

# data[].attributes.attachment_link.description
Test your browser to see how well you are protected from tracking and fingerprinting: Test Your Browser Test with a real tracking company How does tracking technology follow your trail around the web, even if you've taken protective measures? Cover Your Tracks shows you how trackers see your browser.