数字取证
本篇翻译整合数字取证相关资源和工具（偏向于免费、开源软件），感谢原作者们:-)
- Awesome Forensics
- Collections
- Tools
- Distributions
- Frameworks
- Live Forensics
- IOC Scanner
- Acquisition
- Imageing
- Carving
- Memory Forensics
- Network Forensics
- Windows Artifacts
- OS X Forensics
- Mobile Forensics
- Docker Forensics
- Internet Artifacts
- Timeline Analysis
- Disk image handling
- Decryption
- Management
- Picture Analysis
- Learn Forensics
- CTFs and Challenges
- Resources
- Books
- File System Corpora
- Blogs
- Other
- Related Awesome Lists
- Contributing
合集
- AboutDFIR – The Definitive Compendium Project
- 用于学习和研究的取证资源集合，提供认证、书籍、博客、挑战等列表
- DFIR.Training
- 专注于事件、工具等的取证资源数据库
- :star:ForensicArtifacts.com Artifact Repository
- 机器可读的取证组件知识库
工具
- Forensics tools on Wikipedia
- 维基百科上的取证工具整理
- Eric Zimmerman’s Tools
- EricZimmerman整理的取证工具大全，附带.ps1文件帮助一键安装
取证系统发行版
- bitscout
- 用于远程取证和分析的 LiveCD/LiveUSB
- Remnux
- 用于逆向工程和分析恶意软件的Linux发行版
- SANS Investigative Forensics Toolkit (sift)
- 用于取证分析的 Linux 发行版
- Tsurugi Linux
- 用于取证分析的 Linux 发行版
- WinFE
- Windows 取证环境
取证框架
- :star:Autopsy
- 图形化的数字取证工具/平台
- dff
- 一个开源计算机取证平台，建立在API之上，为简单使用和自动化而设计
- dexter
- Dexter 是一个取证采集框架，旨在实现可扩展性和安全性
- 🌟IntelMQ
- 使用消息队列协议收集和处理安全源的解决方案，可用于：自动事件处理、态势感知、自动通知以及作为其他工具的数据收集等
- Kuiper
- 一个数字调查平台，为调查团队和个人提供解析、搜索、可视化取证的能力
- Laika BOSS
- 一个对象扫描器和入侵检测系统
- 🐞注：对象扫描器（object scanner）？
- PowerForensics
- 一个用于实时磁盘取证分析的框架
- :star: The Sleuth Kit
- 用于分析 Microsoft 和 UNIX 文件系统和磁盘，能从事件响应期间或实时系统中获取的图像中识别和恢复证据
- turbinia
- 一个开源框架，用于在云平台上部署、管理和运行取证工作负载
- IPED – Indexador e Processador de Evidências Digitais
- 巴西联邦警察的数字取证调查工具
- Wombat Forensics
- 使用C/C++构建的可视化取证工具
实时取证
- grr
- 一个Python编写的客户端，用于事件响应时的远程实时取证
- Linux Expl0rer
- 一个易于使用的实时取证工具箱，适用于Linux终端节点，使用Python&Flask编写
- mig
- 云上的分布式、实时数字取证平台，属于Mozilla维护，现已弃用
- osquery
- 一个SQL驱动的操作系统检测、监控和分析框架
- UAC
- UAC（类Unix组件收集器）是事件响应的实时响应收集工具，它利用内置工具自动收集类 Unix 系统工件。支持的系统包括：AIX、FreeBSD、Linux、macOS、NetBSD、Netscaler、OpenBSD 和 Solaris
IOC扫描器
- Fenrir
- 一个简单的 IOC 扫描器（Bash脚本），支持扫描 Linux/Unix/macOS系统
- Loki
- IOC/YARA扫描器，支持四种检测方法：文件名检测、YARA规则检测、哈希值检测、C2反向连接检测
- Redline
- FireEye提供的免费终端安全工具，通过内存和文件分析以及威胁评估配置文件的开发来查找恶意活动的迹象
- THOR Lite
- 免费但不开源的IOC/YARA扫描器，与Loki一家，使用Golang编写，相当于开源Loki的增强版
采集器
- artifactcollector – A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
- 一个可定制的代理，可用于在任何
- ArtifactExtractor – Extract common Windows artifacts from source images and VSCs
- AVML – A portable volatile memory acquisition tool for Linux
- Belkasoft RAM Capturer – Volatile Memory Acquisition Tool
- CrowdResponse – A static host data collection tool by CrowdStrike
- DFIR ORC – Forensics artefact collection tool for systems running Microsoft Windows
- FastIR Collector – Collect artifacts on windows
- FireEye Memoryze – A free memory forensic software
- LiME – Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
- Magnet RAM Capture – A free imaging tool designed to capture the physical memory
- Velociraptor – Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
- WinTriage – Wintriage is a live response tool that extracts Windows artifacts. It must be executed with local or domain administrator privileges and recommended to be done from an external drive.
- artifactcollector – 一个可定制的代理，用于在任何 Windows、macOS 或 Linux 系统上收集取证工件
- ArtifactExtractor – 从源图像和 VSC 中提取常见的 Windows 工件
- AVML – 适用于 Linux 的便携式易失性内存获取工具
- Belkasoft RAM Capturer – 易失性内存采集工具
- CrowdResponse – CrowdStrike 的静态主机数据收集工具
- DFIR ORC – 用于运行 Microsoft Windows 的系统的取证人工制品收集工具
- FastIR 收集器– 在 Windows 上收集工件
- FireEye Memoryze – 免费的内存取证软件
- LiME – 可加载内核模块 (LKM)，允许从 Linux 和基于 Linux 的设备（以前称为 DMD）获取易失性内存
- Magnet RAM Capture – 一种免费的映像工具，旨在捕获物理内存
- Velociraptor – Velociraptor 是一种使用 Velocidex 查询语言 (VQL) 查询收集基于主机的状态信息的工具
- WinTriage – Wintriage 是一种实时响应工具，可提取 Windows 工件。它必须以本地或域管理员权限执行，并建议从外部驱动器执行。
Imaging
- dc3dd – Improved version of dd
- dcfldd – Different improved version of dd (this version has some bugs!, another version is on github adulau/dcfldd)
- FTK Imager – Free imageing tool for windows
- :star: Guymager – Open source version for disk imageing on linux systems
Carving
- bstrings – Improved strings utility
- bulk_extractor – Extracts information such as email addresses, creditcard numbers and histrograms from disk images
- floss – Static analysis tool to automatically deobfuscate strings from malware binaries
- :star: photorec – File carving tool
- swap_digger – A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.
Memory Forensics
- inVtero.net – High speed memory analysis framework
developed in .NET supports all Windows x64, includes code integrity and write support - KeeFarce – Extract KeePass passwords from memory
- MemProcFS – An easy and convenient way of accessing physical memory as files a virtual file system.
- Rekall – Memory Forensic Framework
- volatility – The memory forensic framework
- VolUtility – Web App for Volatility framework
Network Forensics
- Kismet – A passive wireless sniffer
- NetworkMiner – Network Forensic Analysis Tool
- :star: WireShark – A network protocol analyzer
Windows Artifacts
- Beagle – Transform data sources and logs into graphs
- FRED – Cross-platform microsoft registry hive editor
- LastActivityView – LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer.
- LogonTracer – Investigate malicious Windows logon by visualizing and analyzing Windows event log
- python-evt – Pure Python parser for classic Windows Event Log files (.evt)
- RegRipper3.0 – RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis
- RegRippy – A framework for reading and extracting useful forensics data from Windows registry hives
NTFS/MFT Processing
- MFT-Parsers – Comparison of MFT-Parsers
- MFTEcmd – MFT Parser by Eric Zimmerman
- MFTExtractor – MFT-Parser
- NTFS journal parser
- NTFS USN Journal parser
- RecuperaBit – Reconstruct and recover NTFS data
- python-ntfs – NTFS analysis
OS X Forensics
- APFS Fuse – A read-only FUSE driver for the new Apple File System
- mac_apt (macOS Artifact Parsing Tool) – Extracts forensic artifacts from disk images or live machines
- MacLocationsScraper – Dump the contents of the location database files on iOS and macOS
- macMRUParser – Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format
- OSXAuditor
- OSX Collect
Mobile Forensics
- Andriller – A software utility with a collection of forensic tools for smartphones
- ALEAPP – An Android Logs Events and Protobuf Parser
- ArtEx – Artifact Examiner for iOS Full File System extractions
- iLEAPP – An iOS Logs, Events, And Plists Parser
- iOS Frequent Locations Dumper – Dump the contents of the StateModel#.archive files located in /private/var/mobile/Library/Caches/com.apple.routined/
- MEAT – Perform different kinds of acquisitions on iOS devices
- MobSF – An automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- OpenBackupExtractor – An app for extracting data from iPhone and iPad backups.
Docker Forensics
- dof (Docker Forensics Toolkit) – Extracts and interprets forensic artifacts from disk images of Docker Host systems
- Docker Explorer Extracts and interprets forensic artifacts from disk images of Docker Host systems
Internet Artifacts
- ChromeCacheView – A small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
- chrome-url-dumper – Dump all local stored infromation collected by Chrome
- hindsight – Internet history forensics for Google Chrome/Chromium
- unfurl – Extract and visualize data from URLs
Timeline Analysis
- DFTimewolf – Framework for orchestrating forensic collection, processing and data export using GRR and Rekall
- :star: plaso – Extract timestamps from various files and aggregate them
- Timeline Explorer – Timeline Analysis tool for CSV and Excel files. Built for SANS FOR508 students
- timeliner – A rewrite of mactime, a bodyfile reader
- timesketch – Collaborative forensic timeline analysis
Disk image handling
- Disk Arbitrator – A Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
- imagemounter – Command line utility and Python package to ease the (un)mounting of forensic disk images
- libewf – Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
- PancakeViewer – Disk image viewer based in dfvfs, similar to the FTK Imager viewer
- xmount – Convert between different disk image formats
Decryption
- hashcat – Fast password cracker with GPU support
- John the Ripper – Password cracker
Management
- dfirtrack – Digital Forensics and Incident Response Tracking application, track systems
- Incidents – Web application for organizing non-trivial security investigations. Built on the idea that incidents are trees of tickets, where some tickets are leads
Picture Analysis
- Ghiro – A fully automated tool designed to run forensics analysis over a massive amount of images
- sherloq – An open-source digital photographic image forensic toolset
Metadata Forensics
- ExifTool by Phil Harvey
- FOCA – FOCA is a tool used mainly to find metadata and hidden information in the documents
Steganography
- Sonicvisualizer
- Steghide – is a steganography program that hides data in various kinds of image and audio files
- Wavsteg – is a steganography program that hides data in various kinds of image and audio files
- Zsteg – A steganographic coder for WAV files
Learn Forensics
- Forensic challenges – Mindmap of forensic challenges
- OpenLearn – Digital forensic course
- Training material – Online training material by European Union Agency for Network and Information Security for different topics (e.g. Digital forensics, Network forensics)
CTFs and Challenges
- Champlain College DFIR CTF
- CyberDefenders
- DefCon CTFs – archive of DEF CON CTF challenges.
- Forensics CTFs
- MagnetForensics CTF Challenge
- MalwareTech Challenges
- MalwareTraffic Analysis
- MemLabs
- NW3C Chanllenges
- Precision Widgets of North Dakota Intrusion
- ReverseEngineering Challenges
Resources
Web
Blogs
- FlashbackData
- Netresec
- roDigitalForensics
- SANS Forensics Blog
- SecurityAffairs – blog by Pierluigi Paganini
- thisweekin4n6.wordpress.com – Weekly updates for forensics
- Zena Forensics
Books
more at Recommended Readings by Andrew Case
- Network Forensics: Tracking Hackers through Cyberspace – Learn to recognize hackers’ tracks and uncover network-based evidence
- The Art of Memory Forensics – Detecting Malware and Threats in Windows, Linux, and Mac Memory
- The Practice of Network Security Monitoring – Understanding Incident Detection and Response
File System Corpora
- Digital Forensic Challenge Images – Two DFIR challenges with images
- Digital Forensics Tool Testing Images
- The CFReDS Project
- Hacking Case (4.5 GB NTFS Image)
- @4n6ist
- @aheadless
- @AppleExaminer – Apple OS X & iOS Digital Forensics
- @carrier4n6 – Brian Carrier, author of Autopsy and the Sleuth Kit
- @CindyMurph – Detective & Digital Forensic Examiner
- @forensikblog – Computer forensic geek
- @HECFBlog – SANS Certified Instructor
- @Hexacorn – DFIR+Malware
- @hiddenillusion
- @iamevltwin – Mac Nerd, Forensic Analyst, Author & Instructor of SANS FOR518
- @jaredcatkinson – PowerShell Forensics
- @maridegrazia – Computer Forensics Examiner
- @sleuthkit
- @williballenthin
- @XWaysGuide
- @inginformatico – DFIR analyst and enthusiast
Vendors:
Other
- /r/computerforensics/ – Subreddit for computer forensics
- /r/LearnDigitalForensics – Subreddit for learning Digital Forensics
- ForensicPosters – Posters of file system structures
- SANS Posters – Free posters provided by SANS
Related Awesome Lists
© 版权声明
文章版权归作者所有，转载请标明出处。
THE END
暂无评论内容