forensics | Penetration Testing Tools

Cuckoo

February 19, 2014portsForensicsforensics

Cuckoo Sandbox is a malware analysis system. You can throw any suspicious file at it and in a matter of seconds Cuckoo will provide you back some detailed results outlining what such file did when executed inside an isolated environment.

Capstone

February 19, 2014portsForensicsforensics, reversing

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community.

dc3dd

February 18, 2014portsForensicsforensics, imaging

dc3dd is a patched version of GNU dd with added features for computer forensics:. * on the fly hashing (md5, sha-1, sha-256, and sha-512) * possibility to write errors to a file * group errors in the error log * pattern wiping * progress report * possiblity to split output

ddrescue

February 18, 2014portsForensicsforensics, imaging

Like dd, dd_rescue does copy data from one file or block device to another. You can specify file positions (called seek and Skip in dd).

dex2jar

February 18, 2014portsHardware Hacking, Reverse Engineeringforensics, reversing

dex2jar contains multiple components to work with .dex files.

DFF

February 18, 2014portsForensicsforensics, gui, imaging

DFF (Digital Forensics Framework) is a free and Open Source computer forensics software built on top of a dedicated Application Programming Interface (API).

diStorm3

February 18, 2014portsForensics, Reverse Engineeringforensics, reversing

diStorm is a lightweight, easy-to-use and fast decomposer library. diStorm disassembles instructions in 16, 32 and 64 bit modes. Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD’s SVM and AVX!

Dumpzilla

February 18, 2014portsForensicsforensics

Dumpzilla application is developed in Python 3.x and has as purpose extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers to be analyzed. Due to its Python 3.x developement, might not work properly in old Python versions, mainly with certain characters.

extundelete

February 18, 2014portsForensicsforensics

extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu.

Foremost

February 18, 2014portsForensicsforensics

Foremost is a forensic program to recover lost files based on their headers, footers, and internal data structures. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive.

Tag: forensics