# data[].attributes.attachment_link.description
Welcome to the NDG Online Portal If you have not created an account yet, then please sign up first.

# data[].attributes.attachment_link.readable_text
Here are 20 of the best free tools that will help you conduct a digital forensic investigation. Whether it's for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites and utilities will help you conduct memory forensic analysis, hard drive forensic analysis, forensic image exploration, forensic imaging and mobile forensics. As such, they all provide the ability to bring back in-depth information about what's "under the hood" of a system.

This is by no means an extensive list and may not cover everything you need for your investigation. You might also need additional utilities such a file viewers, hash generators, and text editors - checkout 101 Free Admin Tools for some of these.

My articles on Top 10 Free Troubleshooting Tools for SysAdmins, Top 20 Free Network Monitoring and Analysis Tools for Sys Admins and Top 20 Free File Management Tools for Sys Admins might also come in handy since they contain a bunch of tools that can be used for Digital Forensic Investigations (e.g. BackTrack and the SysInternals Suite or the NirSoft Suite of tools).

Even if you may have heard of some of these tools before, I'm confident that you'll find a gem or two amongst this list.

The SANS Investigative Forensic Toolkit (SIFT) is an Ubuntu based Live CD which includes all the tools you need to conduct an in-depth forensic or incident response investigation. It supports analysis of Expert Witness Format (E01), Advanced Forensic Format (AFF), and RAW (dd) evidence formats. SIFT includes tools such as log2timeline for generating a timeline from system logs, Scalpel for data file carving, Rifiuti for examining the recycle bin, and lots more.

When you first boot into the SIFT environment, I suggest you explore the documentation on the desktop to help you become accustomed to what tools are available and how to use them. There is also a good explanation of where to find evidence on a system. Use the top menu bar to open a tool, or launch it manually from a terminal window.

ProDiscover Basic is a simple digital forensic investigation tool that allows you to image, analyse and report on evidence found on a drive. Once you add a forensic image you can view the data by content or by looking at the clusters that hold the data. You can also search for data using the Search node based on the criteria you specify.

When you launch ProDiscover Basic you first need to create or load a project and add evidence from the 'Add' node. You can then use the 'Content View' or 'Cluster View' nodes to analyse the data and the Tools menu to perform actions against the data. Click the 'Report' node to view important information about the project.

Volatility is a memory forensics framework for incident response and malware analysis that allows you to extract digital artefacts from volatile memory (RAM) dumps. Using Volatility you can extract information about running processes, open network sockets and network connections, DLLs loaded for each process, cached registry hives, process IDs, and more.

If you are using the standalone Windows executable version of Volatility, simply place volatility-2.1.standalone.exe into a folder and open a command prompt window. From the command prompt, navigate to the location of the executable file and type "volatility-2.1.standalone.exe -f <FILENAME> -profile=<PROFILENAME> <PLUGINNAME>" without quotes - FILENAME would be the name of the memory dump file you wish to analyse, PROFILENAME would be the machine the memory dump was taken on and PLUGINNAME would be the name of the plugin you wish to use to extract information.

Note: In the example above I am using the 'connscan' plugin to search the physical memory dump for TCP connection information.

The Sleuth Kit is an open source digital forensics toolkit that can be used to perform in-depth analysis of various file systems. Autopsy is essentially a GUI that sits on top of The Sleuth Kit. It comes with features like Timeline Analysis, Hash Filtering, File System Analysis and Keyword Searching out of the box, with the ability to add other modules for extended functionality.

Note: You can use The Sleuth Kit if you are running a Linux box and Autopsy if you are running a Windows box.

When you launch Autopsy, you can choose to create a new case or load an existing one. If you choose to create a new case you will need to load a forensic image or a local disk to start your analysis. Once the analysis process is complete, use the nodes on the left hand pane to choose which results to view.

FTK Imager is a data preview and imaging tool that allows you to examine files and folders on local hard drives, network drives, CDs/DVDs, and review the content of forensic images or memory dumps. Using FTK Imager you can also create SHA1 or MD5 hashes of files, export files and folders from forensic images to disk, review and recover files that were deleted from the Recycle Bin (providing that their data blocks haven't been overwritten), and mount a forensic image to view its contents in Windows Explorer.

Note: There is a portable version of FTK Imager that will allow you to run it from a USB disk.

When you launch FTK Imager, go to 'File > Add Evidence Item...' to load a piece of evidence for review. To create a forensic image, go to 'File > Create Disk Image...' and choose which source you wish to forensically image.

06 Linux 'dd'

dd comes by default on the majority of Linux distributions available today (e.g. Ubuntu, Fedora). This tool can be used for various digital forensic tasks such as forensically wiping a drive (zero-ing out a drive) and creating a raw image of a drive.

Note: dd is a very powerful tool that can have devastating effects if not used with care. It is recommended that you experiment in a safe environment before using this tool in the real world.

Tip: A modified version of dd is available from http://sourceforge.net/projects/dc3dd/ - dc3dd includes additional features that were added specifically for digital forensic acquisition tasks.

To use dd, simply open a terminal window and type dd followed by a set of command parameters (which command parameters will obviously depend on what you want to do). The basic dd syntax for forensically wiping a drive is:

dd if=/dev/zero of=/dev/sdb1 bs=1024
where if = input file, of = output file, bs = byte size

Note: Replace /dev/sdb1 with the drive name of the drive you want to forensically wipe and 1024 with the size of the byte blocks you want to write out.

The basic dd syntax for creating a forensic image of a drive is:

dd if=/dev/sdb1 of=/home/andrew/newimage.dd bs=512 conv=noerror,sync

where if = input file (or in this case drive), of = output file, bs = byte size, conv = conversion options

Tip: For additional usage info, from a terminal window, type "man dd" without quotes to bring up the help manual for the dd command.

CAINE (Computer Aided INvestigative Environment) is Linux Live CD that contains a wealth of digital forensic tools. Features include a user-friendly GUI, semi-automated report creation and tools for Mobile Forensics, Network Forensics, Data Recovery and more.

When you boot into the CAINE Linux environment, you can launch the digital forensic tools from the CAINE interface (shortcut on the desktop) or from each tool's shortcut in the 'Forensic Tools' folder on the applications menu bar.

If you are investigating a case that requires you to gather evidence from a mobile phone to support your case, Oxygen Forensics Suite (Standard Edition) is a tool that will help you achieve this. Features include the ability to gather Device Information (Manufacturer, OS Platform, IMEI, Serial Number, etc.), Contacts, Messages (Emails, SMS, MMS, etc.) and recovery of deleted messages, Call Logs, and Calendar and Task information. It also comes with a file browser which allows you to access and analyse user photos, videos, documents and device databases.

When you launch Oxygen Forensic Suite, hit the 'Connect new device' button on the top menu bar to launch the Oxygen Forensic Extractor wizard that guides you through selecting the device and type of information you wish to extract.

Free Hex Editor Neo is a basic hex editor that was designed to handle very large files. While a lot of the additional features are found in the commercial versions of Hex Editor Neo, I find this tool useful for loading large files (e.g. database files or forensic images) and performing actions such as manual data carving, low-level file editing, information gathering, or searching for hidden data.

Use 'File > Open' to load a file into Hex Editor Neo. The data will appear in the middle window where you can begin to navigate through the hex manually or press CTRL + F to run a search.

bulk_extractor is a computer forensics tool that scans a disk image, file, or directory of files and extracts information such as credit card numbers, domains, e-mail addresses, URLs, and ZIP files. The extracted information is output to a series of text files (which can be reviewed manually or analysed using other forensics tools or scripts).

Tip: Within the output text files you will find entries for data that resemble a credit card number, e-mail address, domain name, etc. You will also see a decimal value in the first column of the text file that, when converted to hex, can be used as the pointer on disk where the entry was found (i.e. if you were analysing the disk manually using a hex editor for example, you would jump to this hexadecimal value to view the data).

Bulk_extractor comes as a command-line tool or a GUI tool. In the example above I set the bulk extractor tool to extract information from a forensics image I took earlier and output the results to a folder called "BE_Output". The results can then be viewed in the Bulk Extractor Viewer and the output text files mentioned above.

DEFT is another Linux Live CD which bundles some of the most popular free and open source computer forensic tools available. It aims to help with Incident Response, Cyber Intelligence and Computer Forensics scenarios. Amongst others, it contains tools for Mobile Forensics, Network Forensics, Data Recovery, and Hashing.

When you boot using DEFT, you are asked whether you wish to load the live environment or install DEFT to disk. If you load the live environment you can use the shortcuts on the application menu bar to launch the required tools.

Xplico is an open source Network Forensic Analysis Tool (NFAT) that aims to extract applications data from internet traffic (e.g. Xplico can extract an e-mail message from POP, IMAP or SMTP traffic). Features include support for a multitude of protocols (e.g. HTTP, SIP, IMAP, TCP, UDP), TCP reassembly, and the ability to output data to a MySQL or SQLite database, amongst others.

Once you've installed Xplico, access the web interface by navigating to http://<IPADDRESS>:9876 and logging in with a normal user account. The first thing you need to do is create a case and add a new session. When you create a new session you can either load a PCAP file (acquired from Wireshark for example) or start a live capture. Once the session has finished decoding, use the navigation menu on the left hand side to view the results.

I briefly touched on LastActivityView when pointing out the NirSoft suite of tools in my Top 10 Free System Troubleshooting Tools for SysAdmins article. LastActivityView allows you to view what actions were taken by a user and what events occurred on the machine. Any activities such as running an executable file, opening a file/folder from Explorer, an application or system crash or a user performing a software installation will be logged. The information can be exported to a CSV / XML / HTML file. This tool is useful when you need to prove that a user (or account) performed an action he or she said they didn't.

When you launch LastActivityView, it will immediately start displaying a list of actions taken on the machine it is being run on. Sort by action time or use the search button to start investigating what actions were taken on the machine.

DSi USB Write Blocker is a software-based write blocker that prevents write access to USB devices. This is important in an investigation to prevent modifying the metadata or timestamps and invalidating the evidence.

When you run DSi USB Write Blocker, it brings up a window that allows you to enable or disable the USB Write Blocker. Once you make changes and exit the application, you can keep an eye on the status from the padlock icon in the taskbar. When performing an analysis of a USB drive, enable the USB Write Blocker first and then plug the USB drive in.

Note: If you are looking for a command line alternative USB Write Blocker, check out 'USB Write Blocker for ALL Windows': http://sourceforge.net/projects/usbwriteblockerforwindows8/

RedLine offers the ability to perform memory and file analysis of a specific host. It collects information about running processes and drivers from memory, and gathers file system metadata, registry data, event logs, network information, services, tasks, and Internet history to help build an overall threat assessment profile.

When you launch RedLine, you will be given a choice to Collect Data or Analyze Data. Unless you already have a memory dump file available, you'll need to create a collector to gather data from the machine and let that process run through to completion. Once you have a memory dump file to hand you can begin your analysis.

PlainSight is a Live CD based on Knoppix (a Linux distribution) that allows you to perform digital forensic tasks such as viewing internet histories, data carving, USB device usage information gathering, examining physical memory dumps, extracting password hashes, and more.

When you boot into PlainSight, a window pops up asking you to select whether you want to perform a scan, load a file or run the wizard. Enter a selection to begin the data extraction and analysis process.

HxD is one of my personal favourites. It is a user-friendly hex editor that allows you to perform low-level editing and modifying of a raw disk or main memory (RAM). HxD was designed with easy-of-use and performance in mind and can handle large files without issue. Features include searching and replacing, exporting, checksums/digests, an in-built file shredder, concatenation or splitting of files, generation of statistics and more.

From the HxD interface start your analysis by opening a file from 'File > Open', loading a disk from 'Extras > Open disk...' or loading a RAM process from 'Extras > Open RAM...'

HELIX3 is a Live CD based on Linux that was built to be used in Incident Response, Computer Forensics and E-Discovery scenarios. It is packed with a bunch of open source tools ranging from hex editors to data carving software to password cracking utilities, and more.

Note: The HELIX3 version you need is 2009R1. This version was the last free version available before HELIX was taken over by a commercial vendor. HELIX3 2009R1 is still valid today and makes for a useful addition to your digital forensics toolkit.

When you boot using HELIX3, you are asked whether you want to load the GUI environment or install HELIX3 to disk. If you choose to load the GUI environment directly (recommended), a Linux-based screen will appear giving you the option to run the graphical version of the bundled tools.

Paladin Forensic Suite is a Live CD based on Ubuntu that is packed with wealth of open source forensic tools. The 80+ tools found on this Live CD are organized into over 25 categories including Imaging Tools, Malware Analysis, Social Media Analysis, Hashing Tools, etc.

After you boot Paladin Forensic Suite, navigate to the App Menu or click on one of the icons in the taskbar to get started.

Note: A handy Quick Start Guide for Paladin Forensic Suite is available to view or download from the Paladin website as well as the taskbar within Paladin itself.

USB Historian parses USB information, primarily from the Windows registry, to give you a list of all USB drives that were plugged into the machine. It displays information such as the name of the USB drive, the serial number, when it was mounted and by which user account. This information can be very useful when you're dealing with an investigation whereby you need to understand if data was stolen, moved or accessed.

When you launch USB Historian, click the '+' icon on the top menu to launch the data parse wizard. Select which method you want to parse data from (Drive Letter, Windows and Users Folder, or Individual Hives/Files) and then select the respective data to parse. Once complete you will see information similar to that shown in the above image.

# data[].attributes.attachment_link.title
Top 20 Free Digital Forensic Investigation Tools for SysAdmins

# data[].attributes.attachment_link.description
Here are 20 of the best free tools that will help you conduct a digital forensic investigation. Whether it's for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites a perfect place to start.

# data[].attributes.attachment_link.readable_text
You will receive £37,305 the band minimum. Progress to the band maximum of £41,811 will be via incremental progression.

LOCATION - London, SE1

The Digital, Cyber and Communications (DCC) department is undergoing significant changes. It's all to improve the way we deliver digital forensics services to the MPS and the Criminal Justice System. We're aiming to offer three different levels of service. As part of this, we're introducing digital forensic kiosks into custody suites and opening small labs across London. This is a rare chance to be part of the Central Digital Forensics laboratory and help bring criminals to justice - all while developing a unique skill-set.

You'll be crucial to our vision, as you'll help us to enable complex investigations, and develop new tools to meet the needs of future technologies. An expert in your field, you'll be a valuable member of the Forensic Video department, able to interpret digital forensic submissions and provide detailed reports. Confident in the recovery of deleted or corrupted video material, you'll reverse engineer everything from CCTV recorders to phones - creating compilations for court presentation. With outstanding communication skills, you'll also oversee a small team and provide peer reviews against ISO 17025 standards.

To join us, you need to be confident with all types of video technology and forensics techniques. With second-to-none expertise, you'll have proven experience in presenting evidence, working on criminal investigations and attending court. And committed to constantly improving technical practices and procedures, you'll be dedicated to keeping track of emerging trends.
To apply, please visit our website to download a role specific information pack and application form. Completed applications must be returned by 17 March 2017.
Please note we are only able to review the first 50 applications received.

We view diversity as fundamental to our success. To tackle today's complex policing challenges, we need a workforce made up from all of London's communities. Applications from across the community are therefore essential.

www.metpolicecareers.co.uk

(53)

# data[].attributes.attachment_link.description
You will receive £37,305 the band minimum. Progress to the band maximum of £41,811 will be via incremental progression. LOCATION - London, SE1 The Digital, Cyber and Communications (DCC) department is undergoing significant changes. It's all to improve the way we deliver digital forensics services to the MPS and the Criminal Justice System.

# data[].attributes.attachment_link.title
Computer Forensics Fundamentals - 01 Understanding what computer forensics is

# data[].attributes.attachment_link.description
Computer Forensics Fundamentals will provide: Foundational concepts about the computer forensics field Understanding of hexadecimal and hashing in relations to computer forensics An introductory understanding of what computer forensics is The process of collecting digital evidence How do create, mount and explore forensic digital images Considerations for first responders to a computer crime scene The course will consist of presentations to explain the concepts of computer forensics as well as demonstrations of proper collections of digital evidence.

# data[].attributes.attachment_link.readable_text
The AXIOM Wordlist Generator is part of a repeatable process for determining and retrieving user passwords based on keywords from a Magnet AXIOM case file.

Dropbox® Decryptor from Magnet Forensics is a free tool that will decrypt the Dropbox filecache.dbx and config.dbx files which are encrypted SQLite databases.

Encrypted Disk Detector (EDD) is a command-line tool that checks the local physical drives on a system for encrypted volumes created by TrueCrypt, PGP®, Bitlocker®, and other full disk encryption products.

Google Maps Tile Investigator (GMTI) assists in putting more meaning around the Google Maps tile files left behind when viewing maps or getting directions on the Google Maps website.

Magnet RAM Capture is a free imaging tool designed to capture the physical memory of a suspect's computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.

The TSV to TLN Converter is a free tool from Magnet Forensics that converts the X-Ways generated TSV file into the TLN file format which can be loaded into the IEF Timeline View for visual analysis.

Web Page Saver (WPS) is a program that takes a list of URLs and saves scrolling captures ("snapshots") of each page.

# data[].attributes.attachment_link.description
The AXIOM Wordlist Generator is part of a repeatable process for determining and retrieving user passwords based on keywords from a Magnet AXIOM case file. Dropbox® Decryptor from Magnet Forensics is a free tool that will decrypt the Dropbox filecache.dbx and config.dbx files which are encrypted SQLite databases.

# data[].attributes.body
January 19, 2018

# data[].attributes.attachment_link.description
List of free computer forensic tools created & maintained by Forensic Control. With disk capture, file viewers, Mac OS tools, email analysis & many others.

# data[].attributes.body
January 19, 201

# data[].attributes.attachment_link.readable_text
Guys from Forensic Control have updated their list of free digital forensic tools. The list was last reviewed on 30 August 2017. Forensic Control is a cyber security and computer forensic company based in London.

# data[].attributes.attachment_link.description
Guys from Forensic Control have updated their list of free digital forensic tools. The list was last reviewed on 30 August 2017. Forensic Control is a cyber security and computer forensic company based in London.

# data[].attributes.body
https://www.sleuthkit.org/

# data[].attributes.body
January 24, 2018

# data[].attributes.body
https://sumuri.com/software/paladin/

# data[].attributes.body
Andriller

# data[].attributes.body
X-Ways Forensics

# data[].attributes.body
SIFT

# data[].attributes.body
LastActivityView
http://www.nirsoft.net/utils/computer_activity_view.html

# data[].attributes.body
SIW

# data[].attributes.body
USB Write Blocker
http://sourceforge.net/projects/usbwriteblockerforwindows8/

# data[].attributes.body
March 9, 2018

# data[].attributes.attachment_link.readable_text
Forensic investigations are always challenging as you may gather all the information you could for the evidence and mitigation plan. Here are some of the computer forensic investigator tools you would need. Most of them are free!

Whether it's for an internal human resources case, an investigation into unauthorized access to a server, or if you just want to learn a new skill, these suites and utilities will help you conduct memory forensic analysis, hard drive forensic analysis, forensic image exploration, forensic imaging and mobile forensics. As such, they all provide the ability to bring back in-depth information about what's "under the hood" of a system.

Autopsy is a GUI-based open source digital forensic program to analyze hard drives and smart phones effectively. Autospy is used by thousands of users worldwide to investigate what actually happened in the computer.

2. Encrypted Disk Detector

Encrypted Disk Detector can be helpful to check encrypted physical drives. It supports TrueCrypt, PGP, Bitlocker, Safeboot encrypted volumes.

3. Wireshark

Wireshark is a network capture and analyzer tool to see what's happening in your network. Wireshark will be handy to investigate network related incident.

4. Magnet RAM Capture

You can use Magnet RAM capture to capture the physical memory of a computer and analyze artifacts in memory.

It supports Windows operating system.

5. Network Miner

An interesting network forensic analyzer for Windows, Linux & MAC OS X to detect OS, hostname, sessions and open ports through packet sniffing or by PCAP file. Network Miner provide extracted artifacts in an intuitive user interface.

NMAP (Network Mapper) is one of the most popular networks and security auditing tools. NMAP is supported on most of the operating systems including Windows, Linux, Solaris, MAC OS, HP-UX etc. It's open source so free.

7. RAM Capturer

RAM Capturer by Belkasoft is a free tool to dump the data from computer's volatile memory. It's compatible with Windows OS. Memory dumps may contain encrypted volume's password and login credentials for webmails and social network services.

8. Forensic Investigator

If you are using Splunk then Forensic Investigator will be a very handy tool. It's Splunk app and has many tools combined.

FAW (Forensics Acquisition of Websites) is to acquire web pages for forensic investigation which has the following features.

Capture the entire or partial page

Capture all types of image

Capture HTML source code of the web page

Integrate with Wireshark

10. HashMyFiles

HashMyFiles will help you to calculate the MD5 and SHA1 hashes. It works on almost all latest Windows OS.

11. USB Write Blocker

View the USB drives content without leaving the fingerprint, changes to metadata and timestamps. USB Write Blocker use Windows registry to write-block USB devices.

12. Crowd Response

Response by Crowd Strike is a windows application to gather system information for incident response and security engagements. You can view the results in XML, CSV, TSV or HTML with help of CRConvert. It runs on 32 or 64 bit of Windows XP above.

Crowd Strike has some other nice tools for investigation.

Totrtilla - anonymously route TCP/IP and DNS traffic through TOR.

Shellshock Scanner - scan your network for shellshock vulnerability

Heartbleed scanner - scan your network for OpenSSL heart bleed vulnerability

13. NFI Defraser

Defraser forensic tool may help you to detect full and partial multimedia files in the data streams.

14. ExifTool

ExifTool helps you to read, write and edit meta information for a number of file types. It can read EXIF, GPS, IPTC, XMP, JFIF, GeoTIFF, Photoshop IRB, FlashPix, etc.

15. Toolsley

Toolsley got more than 10 useful tools for investigation.

File signature verifier

File identifier

Hash & Validate

Binary inspector

Encode text

Data URI generator

Password generator

SIFT (SANS investigative forensic toolkit) workstation is freely available as Ubuntu 14.04. SIFT is a suite of forensic tools you need and one of the most popular open source incident response platform.

17. Dumpzilla

Extract all interesting information from Firefox, Iceweasel and Seamonkey browser to be analyzed with Dumpzilla.

18. Browser History

Foxton has two free interesting tools.

1. Browser history capturer - capture web browser (chrome, firefox, IE & edge) history on Windows OS.

2. Browser history viewer - extract ana analyze internet activity history from most of the modern browsers. Results are shown in the interactive graph and historical data can be filtered.

19. ForensicUserInfo

Extract the following information with ForensicUserInfo.

RID

LM/NT Hash

Password reset/Account expiry date

Login count/fail date

Groups

Profile path

20. Kali Linux

Kali Linux is one of the most popular platforms for penetration testing but it has forensic capability too.

PALADIN forensic suite - the world's most popular Linux forensic suite is a modified Linux distro based on Ubuntu available in 32 and 64 bit.

22. Sleuth Kit

The Sleuth Kit is a collection of command line tools to investigate and analyze volume and file systems to find the evidence.

CAINE ( Computer Aided Investigate E nvironment) is Linux distro that offers the complete forensic platform which has more than 80 tools for you to analyze, investigate and create an actionable report.

24. Volatility

Volatility is the memory forensics framework. It used for incident response and malware analysis. With this tool, you can extract information from running processes, network sockets, network connection, DLLs and registry hives. It also has support for extracting information from Windows crash dump files and hibernation files. This tool is available for free under GPL license.

25. WindowSCOPE

WindowsSCOPE is another memory forensics and reverse engineering tool used for analyzing volatile memory. It is basically used for reverse engineering of malwares. It provides the capability of analyzing the Windows kernel, drivers, DLLs, virtual and physical memory.

26. The Coroner's Toolkit

The Coroner's Toolkit or TCT is also a good digital forensic analysis tool. It runs under several Unix-related operating systems. It can be used to aid analysis of computer disasters and data recovery.

27. Bulk Extractor

Bulk Extractor is also an important and popular digital forensics tool. It scans the disk images, file or directory of files to extract useful information. In this process, it ignores the file system structure, so it is faster than other available similar kinds of tools. It is basically used by intelligence and law enforcement agencies in solving cyber crimes.

28. Oxygen Forensic Suite

If you are investigating a case that requires you to gather evidence from a mobile phone to support your case, Oxygen Forensics Suite (Standard Edition) is a tool that will help you achieve this.

29. Free Hex Editor Neo

Free Hex Editor Neo is a basic hex editor that was designed to handle very large files. While a lot of the additional features are found in the commercial versions of Hex Editor Neo, I find this tool useful for loading large files (e.g. database files or forensic images) and performing actions such as manual data carving, low-level file editing, information gathering, or searching for hidden data.

Xplico is an open source Network Forensic Analysis Tool (NFAT) that aims to extract applications data from internet traffic (e.g. Xplico can extract an e-mail message from POP, IMAP or SMTP traffic). Features include support for a multitude of protocols (e.g. HTTP, SIP, IMAP, TCP, UDP), TCP reassembly, and the ability to output data to a MySQL or SQLite database, amongst others.

# data[].attributes.attachment_link.title
The Best Open Source Digital Forensic Tools

# data[].attributes.attachment_link.description
Forensic investigations are always challenging as you may gather all the information you could for the evidence and mitigation plan. Here are some of the computer forensic investigator tools you would need. Most of them are free!

# data[].attributes.body
Puran File Recovery
http://www.puransoftware.com/File-Recovery.html

# data[].attributes.body
https://github.com/The-Art-of-Hacking/art-of-hacking/tree/master/cheat_sheets
Links to cheat sheets for a variety of tools for ethical hacking, digital forensics, etc.

# data[].attributes.body
April 16, 208

# data[].attributes.attachment_link.title
Sysinternals Suite - Windows Sysinternals

# data[].attributes.attachment_link.description
The Windows Sysinternals troubleshooting Utilities have been rolled up into a single suite of tools.

# data[].attributes.body
April 16, 2018

# data[].attributes.attachment_link.title
CyberOps v1 Student Lab Source Files.zip

# data[].attributes.attachment_link.title
Computer Security Student | Cyber Security Lessons, Tutorials, and Training

# data[].attributes.attachment_link.description
Computer Security Student LLC provides Cyber Security Hac-King-Do Training, Lessons, and Tutorials in Penetration Testing, Vulnerability Assessment, Ethical Exploitation, Malware Analysis, and Forensic Investigation.

# data[].attributes.attachment_link.readable_text
Lance Spitzner said:

1. Eat breakfast, it may be the last meal you get that day.

2. Schedule the most important meetings in the morning.

3. RSA gives you a back-pack. Don't use it at the con, there will be..

Read More

# data[].attributes.attachment_link.description
Lance Spitzner said: Eat breakfast, it may be the last meal you get that day. Schedule the most important meetings in the morning. RSA gives you a back-pack. Don't use it at the con, there will be.. Read More

# data[].attributes.attachment_link.readable_text
Creating a digital forensic laboratory is a responsible step. The effectiveness of the laboratory depends on what software, hardware and equipment will be purchased.

DFC specialists took part in the creation and upgrade of several digital forensic laboratories owned by state organizations and private entities and today they will share their tips and tricks.

Choosing a workstation configuration is an important step. The effectiveness of digital examiners depends on the way the workstation is configured.

However, we want to pay special attention to one point: the workstation should work as quietly as possible. Imagine an open space where several powerful computers are installed, each of which makes a noise like a server. The employees' headache and poor health are guaranteed. Silent workstation performance is achieved by using low-noise fans and passive cooling systems.

Do not use top hardware. The idea to buy the most expensive processor, memory, motherboard for your new workstation is not the best one. We had many problems with the workstation in which similar components were used.

In our opinion, this configuration is optimal today:

OS: Windows 10 Pro 64-bit

CPU (2): E5-2660 v4 (14 core)

RAM: 64 GB DDR-42133 ECC

OS Drive: 1 TB SSD

Temp/Cache/DB Drive: 256 GB SSD

Data Drive: 8 TB 7200rpm

RAID Drives: 5×4 TB 7200rpm

Video Card: GeForce GTX 1080

We recommend to use two or more monitors for each workstation.

The most effective work is achieved when a digital examiner uses two workstations in its work.

Use NET Storages to store cases, forensic images, etc. NET Storages with a volume of 100-150 TB proved to be quite effective.

Use 10Gbit Net Cards. They will allow you to transfer data from the workstation to NET Storages quickly.

A Tableau Write Blockers Kit

It's a good idea to have as more different forensic software in the digital laboratory. This will allow a forensic examiner to make cases as quickly and efficiently as possible. Also, this makes it possible to recheck the results of the research effectively.

However, if you have a limited budget, we recommend buying this software:

Windows 10 Pro

Office 365

Antivirus software

X-ways Forensic

AXIOM (Magnet Forensics)

The rest of the tools can be purchased as the laboratory develops.

Also, a lot of research can be done using freeware tools. Sometimes these tools outperform functionality of commercial tools.

If you create a digital forensic laboratory in a government organization, for example in the police department, then most likely they have their own case management software and then your task is just to add a new laboratory to the network of existing ones.

In other cases, you can use free and chargeable CRM systems. Besides, some CRM systems can be adapted to your management needs.

We recommend Kirjuri (Kirjuri is a web application for managing cases and physical forensic evidence items.) and Lima Forensic Case Management of all the specialized tools.

We recommend using a separate workstation for the production of video forensics cases. We recommend using the following forensic tools:

DVR Examiner

Amped FIVE

Elecard

Very good results of recovering deleted videos can be obtained using X-ways Forensic. We have written about this tool above.

We recommend using a separate workstation to carry out mobile forensics research.

There are a lot of tools for mobile forensics. That is why it is difficult for a beginner to understand what they need to carry out this research effectively. We recommend using the following mobile forensic tools:

UFED 4PC (with CHINEX, UFED Camera Kit)

Cellebrute UFED Touch

Cellebryte cables and adapters

Oxygen Forensics DETECTIVE

XRY

Elcomsoft Mobile Forensic Bundle

We recommend using SР Flash tool to retrieve data from MTK based phones.

A Faraday Box (Ramsey)

We recommend using the following tools for Cloud forensics:

UFED Cloud Analyzer

Oxygen Forensics DETECTIVE

Elcomsoft Cloud eXplorer

We recommend using flashers for JTAG research:

Easy Z3x JTAG BOX

Octoplus Box

Samsung anyway S101

For Chip-off we recommend using:

VISUAL NAND RECONSTRUCTOR (STARTER KIT, Rusolut)

SMARTPHONE KIT (Rusolut)

CHINESE SMARTPHONE KIT (Rusolut)

NuProg-E UFS/EMMC Programmer

IN-UFS-Socket BGA Opentop

N-UFS-065-BGA095-115130-02O BGA Opentop

N-UFS-050-FBGA153-115130-02O BGA Opentop

We recommend using Weller WHA 300 Hot Air Reworking Station or Ersa HR100 Hybrid Rework system for disordering chips.

We recommend using a separate workstation for the production of Data recovery. You will need special hardware and tools for data recovery:

PC-3000 Express Professional System (Acelab)

Data Extractor Express (Acelab)

PC-3000 Flash (Acelab)

Many people believe that it is enough to buy ordinary office desks and chairs to equip a digital forensic lab. However, it is not so. Tables must have abrasion resistant coatings. We recommend the use of special laboratory tables.

Office chairs should be as convenient as possible. We recommend using not ordinary office chairs but gaming chairs.

The table where the electronic equipment is assembled and disassembled should be equipped with an antistatic mat and an antistatic bracelet.

Happy forensicating!

About the authors
Oleg Skulkin, GCFA, MCFE, ACE, is a DFIR enthusional (enthusiast + professional), Windows Forensics Cookbook and Practical Mobile Forensics co-author.

Igor Mikhaylov, MCFE, EnCE, ACE, OSFCE, is a digital forensic examiner with more than 20 years of experience and Mobile Forensics Cookbook author.

# data[].attributes.attachment_link.title
Creating a digital forensic laboratory: Tips and Tricks

# data[].attributes.attachment_link.description
Creating a digital forensic laboratory is a responsible step. The effectiveness of the laboratory depends on what software, hardware and equipment will be purchased. DFC specialists took part in the creation and upgrade of several digital forensic laboratories owned by state organizations and private entities and today they will share their tips and tricks.

# data[].attributes.attachment_link.title
Autopsy: Lesson 1: Analyzing Deleted JPEGs

# data[].attributes.attachment_link.description
Computer Security Student LLC provides Cyber Security Hac-King-Do Training, Lessons, and Tutorials in Penetration Testing, Vulnerability Assessment, Ethical Exploitation, Malware Analysis, and Forensic Investigation.

# data[].attributes.attachment_link.title
Evidence Technology Magazine - Digital Edition