Windows Memory Forensics Tools [update]
SANS recently published a good summary of Windows memory forensics acquisition and analysis tools. It’s a good compilation
Kategorie: Tools
new linux incident response script
We updated the ForensiX Linux Incident Response Script. You can find the new version at
The Sleuthkit 2.10
A new version of The sleuthkit (TSK) is out now. There are some minor bug fixes included. Changelog
New Forensics Live Response CD published
I’m proud to announce, that my team published yesterday a very cool Live Response CD for Linux and Windows in cooperation with the german journal iX. It contains a brand new Linux Live Response script and a build script for your own static binaries. This Live Response Script contains also an
Booting EnCase Images
GetData now bundles their forensics tool MountImage Pro v2 with Virtual Forensic Computing (VFC) from MD5 Ltd. You can now mount a forensic image
Sector Inspector (SecInspect.exe)
Microsoft published a tool called Sector Inspector (SecInspect.exe) with the Windows 2003 Server Resource Kit. This is a command-line diagnostics tool that allows administrators to view the contents of master boot records, boot sectors, and IA64 GUID partition tables. Additional features
The Sleuthkit 2.08
The Sleuthkit (TSK) 2.08 is out now. The new version contains
DFRWS 2007 File Carving Challenge
The new DFRWS File Carving Challenge for the year 2007 has been released. The say: „The goal of this challenge is to design and develop AUTOMATED file carving algorithms that have high true positive and low false positive rates.“
The Sleuthkit 2.07
Brian Carrierr released version 2.07 of his file system analysis tool The Sleuthkit: There are a lot of updates and bug fixes. The summarized list is below. The executive summary is that there are new flags for ils to find orphan files and new flags for dls to specify allocation status.There were a lot of Read More …
New Helix version released
There is a new Helix (Incident Response & Computer Forensics Live CD based on Knoppix) version released. Version 1.8 has a now Andreas Schuster’s PTFinder included an will no longer change JFS information. You can donwload Helix here. All new features at a glance: