Digital Forensic Analysis, EnCase

Good to be back! After a decade

2024-10-11T07:41:00.001+05:30

EnCase Forensic version 24 excites me!

TeamViewer Log File | EnScript

2013-05-22T04:30:00.000+05:30

You don't need any specialized software to parse the TeamViewer Log File. It's just an text file, "notepad.exe" and human interpret is far enough to analyze .

If you like to know more about TeamViewer Artifacts, here is the best link. Click here. Its speaks more about the understanding of log file, and data in Registry hives.

If you are an EnCase user , and your not interested in exporting log file in old way, you can use my EnScript which is exactly an click away. Download Here

RegRipper Supporting Files | EnScript

2013-05-22T01:30:00.000+05:30

This is how it starting, RegRipper is not registry hive viewer.

Registry Analysis with RegRipper was always good for me. Apart from waiting for the end of status bar in EnCase, RegRipper does so fast - some forensicator use RegRipper for the cross check purpose.

This is just like the previous post of mine, this script export the RegRipper supporting files which can be useful for Clickers.

And here is the EnScript., Download Here.

After the export is over you can use RegRipper to parse the data. Download Here

Volume Shadow Copies EnScript

2013-05-21T12:30:00.001+05:30

Its been a long time after my previous post.

Today I was following #ceic @ twitter for things happening around there. Something interesting got into , that's "Volume Shadow".

As most of us know it available in NTFS filesystem,only. If you were interested in knowing the basic of Volume Shadow, click here.

LibShadow can be use to parse the Volume Shadow supporting files. You can download the beta version click here

How to use LibShadow?

youtube is the best player for most of us.

To get all the supporting files, I have written an small EnScript which can help you to get copy from the E01 or RAW from EnCase software.

Download EnScript

Hash value is computed for each supporting file as addon forensic feature, hahahah...!

Save Energy | Monitor

2012-08-27T08:41:00.002+05:30

That was really a long time, I have posted something useful[hope you don’t mind].

I was using an CRT Monitor for the past 5 Years , which consumed an energy which emitted heat on my face. Which took ample amount of electric power for its usage, and most of the time I don’t off my monitor when I have an break – so technology took more energy[Indirectly I wasted].I was having mind of that for long time, where I can’t help. On the other hand, my PC also taking more electric power compared to laptop. Somewhere in my Mind it was registered that no to PC and CRT.

So, now I got laptop and an LCD Monitor, which takes 1/3 power compared to older technology and I don’t need to invest in UPS, for backup. And I was haunting Google for Monitor optimiser of human error, to my surprise I got this, MonitorES - Monitor Energy Saver v1.0.1b , it do’s magic in saving electric energy. I’m trying my best to save energy and trying to go green and recycle, and making surrounding plastic free.

Data Seg & Tally Export

2012-07-11T09:11:00.000+05:30

Greeting to visitors,

Today I gonna upload you two updated EnScript which I used to call them as (a)Data Seg and (b)Tally Export. The GUI of both resembles the same, but the background work was much sophisticated and differ from each other in more area, and the end result will be pakka[super correct].

You can download both from here..

1. Data Seg
2. Tally Export - email me for more info

If you got any query email me

EnCase v6 Condition for EnCase v7

2011-10-11T16:42:00.001+05:30

Greeting to all,

EnCase v6 was History , EnCase v7 now changes the digital investigation GUI i.e., browser like Graphical Interface.. and that's really awesome.

But I have no idea, why EnCase v7 developer's dropped v6 Conditions.For that positive note EnCase v7 developer's made options to create their own Condition, called EnCondition.No problem, you can download "EnCase v6 Condition for v7" and use, investigate, filter the needed files for investigation and more

Download the attached file, decompress it with 7zip. Please paste the decompressed folders to C:\Users\<UserName>\Documents\EnCase\Condition , if you made default installation...

How to EnCase v6 Condition for EnCase v7

Download Here

Steve Jobs - Apple's Visionary, Dies At 56

2011-10-06T09:29:00.001+05:30

Steve Jobs — the man who brought us the iPhone, the iPod and the iMac — has died. The co-founder of Apple was 56 years old. Jobs had been battling a rare form of pancreatic cancer for years.

"It boggles the mind to think of all the things that Steve Jobs did," says Silicon Valley venture capitalist Roger McNamee, who worked with Jobs.

McNamee says that in addition to introducing us to desktop publishing and computer animated movies, Jobs should be credited with creating the first commercially successful computer.

"Any one of those would have qualified him as one of the great executives in American history," McNamee says, "the sum of which put him in a place where no one else has ever been before. To me he is of his era what Thomas Edison was to the beginning of the 20th century."

Jobs was just 21 when he co-founded Apple Computer in his garage in Cupertino, Calif., in 1976. The following year, when Jobs and his partner, Steve Wozniak, released the compact Apple II, most computers were big enough to fill a university basement or came from do-it-yourself kits for hobbyists with soldering irons.

With sound and cutting-edge color graphics, Apple II was the first blockbuster desktop computer. Users could hook it up to their TV sets to play games, and its spreadsheet program made it popular with small businesses.

"It made Apple the biggest computer manufacturer in the nascent computer industry," says Leander Kahney, author of Inside Steve's Brain.

But in 1981, Apple got its first taste of serious competition, when IBM released its own personal computer. IBM had the advantage of a well-known, trusted name, and Jobs — a California boy — loathed the kind of conformist East Coast culture it represented.

So he countered with the Macintosh, the first computer to feature a mouse, pull-down menus and icons — thus eliminating the command-line interface.

"Jobs' idea was that we'll make it easy enough that anybody can do it ... a grandmother, a kid, people who don't have any experience," Kahney says. The Mac was an example of the kind of product that would come to define Jobs' entire career: easy-to-use computers.

That's the message Jobs sent to millions when he released the Mac in 1984. In an ad that aired once during the Super Bowl, a woman dressed in brightly colored shorts runs into a room of gray-looking people and throws a sledgehammer at a screen where Big Brother — read IBM — is talking. The minute-long reference to George Orwell's 1984 became one of the most famous television commercials of all time.

It also illustrated Jobs' belief that computers were tools to unleash human creativity. In an interview for the 1996 PBS documentary Triumph of the Nerds, Jobs said, "Part of what made the Macintosh great was that the people working on it were musicians and poets and artists and zoologists and historians who also happened to be the best computer scientists in the world."

In many ways Jobs was the poet of the computer world. He'd gone to India and become a Buddhist. He took LSD and believed it had opened his mind to new ways of thinking.

But Jobs' iconoclastic ideals did not always make him easy to work with.

"He was just a terrible manager and a terrible executive," says Trip Hawkins, the marketing director of Apple until 1982. "At that point in time I never really thought that he could be a CEO."

Jobs was eventually fired in a 1985 boardroom coup led by John Sculley — the man Jobs himself had hired to be CEO of Apple. But Jobs was driven to make computers vehicles for creativity, and after he left Apple, he purchased a little-known division of Lucas film and renamed it Pixar.

In 1995, Pixar released the first animated feature to be done entirely on computers. That film, Toy Story, was a huge success, and Pixar followed it with other big hits including Monsters, Inc., The Incredibles and Finding Nemo.

But Apple didn't exactly thrive in the years after Jobs' departure. With less than 5 percent of the computer market in its possession and analysts predicting the company's demise, the board invited Jobs to come back and run his old business.

In 1998, as interim CEO of Apple, Jobs introduced the iMac and once again helped remake the computer industry. According to venture capitalist McNamee, the iMac was the first computer made to harness the creative potential of the Internet.

"The iMac reflected the transition of consumers from passive consumption of content to active creation of entertainment," McNamee says. "People could write their own blogs, make their own digital photographs and make their own movies. Apple made all the tools to make that easy and they did at a time when Microsoft just wasn't paying attention."

Three years after the iMac, Jobs announced Apple's expansion into the music industry with a breakthrough MP3 player — the iPod.

"This is not a speculative market," he said as he introduced the iPod in 2001. "It's a part of everyone's life. It's a very large target market all around the world."

The iPod was a classic Jobs product — easy to use and nice to look at. Apple sold tens of millions of iPods, and the iTunes store became the No. 1 music retailer.

Six years later, Apple released the iPhone — a device whose elegance and user friendliness blew other phone/music players out of the water.

In 2010, Apple created yet another groundbreaking device with the introduction of the iPad. With its color touch-screen, the tablet gave users the ability to surf the Web, send e-mail, watch videos and read e-books.

Book publishers weren't the only ones to embrace the new tablet. A host of magazines, newspapers and broadcast news organizations, including The New Yorker, The Wall Street Journal and NPR, created iPad-specific apps that helped showcase stories — and images — in a tabloid-style layout.

And in January 2011, Apple reached a milestone by surpassing 10 billion downloads from its App Store — a sign of just how popular the company's devices have become with consumers.

"Simplifying complexity is not simple," says Susan Rockrise, a creative director who worked with Jobs. "It is the greatest, greatest gift to have someone who has Steve's capabilities as an editor and a product designer edit the crap away so that you can focus on what you want to do."

Rockrise believes Jobs touched pretty much anyone who has ever clicked a mouse, sent a photo over the Internet, published a book from a home computer or enjoyed portable music or a computer-animated movie.

She says they all have Jobs to thank for making it happen.

LINK to original story by Laura Sydell @ www.npr.org

Year Segregation 2005 - 2011

2011-09-11T11:04:00.001+05:30

Greeting to all after some long time...

Because of So and So...

This Small Script came to life, coz of client direct requirement..

This EnScript helps you to segregate depending on the year vice... From 2005 to 2011...

File Types supported are Documents, Excel, PDF, Compound File, DataBase File .......

Hope you all Enjoy via Automation on day to day life...

If you have any probe let me know and help you...

Download Here

Digital Forensic Search

2011-08-06T10:28:00.001+05:30

The following is the listing of sites indexed by the Digital Forensic:

Its worth of sharing...

Blogs

A Fistful of Dongles http://ericjhuber.blogspot.com/

A Geek Raised by Wolves http://jessekornblum.livejournal.com/

A Renaissance Security Professional http://renaissancesecurity.blogspot.com/
An Eye on Forensics http://eyeonforensics.blogspot.com/

American Destroyer http://megadeus.com/
appointments-uk http://appointments-uk.blogspot.com/

Blog Matt Churchill http://mattchurchill.net/blog/
Bradley Schatz on the intersection of technology and the law http://blog.schatzforensic.com.au/
cci http://cci.cocolog-nifty.com/blog/

Cellular.Sherlock - Mobile Forensics from the front lines  http://blog.csvance.com/
CnW Recovery  http://cnwrecovery.blogspot.com/
Codeslack  http://codeslack.blogspot.com/

Computer Forensic Blog http://computer.forensikblog.de/en/

Computer Forensic Source http://forensicsource.blogspot.com/

Computer Forensics and IR - What's New http://newinforensics.blogspot.com/

Computer Forensics Forums - Recent Blogs Posts - Blogs http://www.computer-forensics.co.uk/computer-forensics-forums/blog.php?s=88da0ba9705c1f3b0a6e0ff5168ac75b

Computer Forensics, Malware Analysis & Digital Investigations http://www.forensickb.com/

Computer Forensics-E-Discovery Tips-Tricks and Information http://cfed-ttf.blogspot.com/

ComputerForensicSource.com http://www.computerforensicsource.com/

contagio http://contagiodump.blogspot.com/

copgeek018 http://copgeek018.wordpress.com/
Crucial Security Forensics Blog http://crucialsecurityblog.harris.com/
CSITech - Computer Forensics http://nickfurneaux.blogspot.com/

CYB3RCRIM3 http://cyb3rcrim3.blogspot.com/

Cyber Crime 101 http://www.cybercrime101.com/

CyberSpeak's Podcast http://cyberspeak.libsyn.com/

Dancho Danchev's Blog - Mind Streams of Information Security Knowledge http://ddanchev.blogspot.com/

Derek Newton « Information Security Insights http://dereknewton.com/

digfor http://digfor.blogspot.com/

Didier Stevens http://blog.didierstevens.com/

Digital Detective http://blog.digital-detective.co.uk/

Digital Forensic Source http://www.digitalforensicsource.com/

Digital Forensics Blog http://digiforensics.blogspot.com/

Digital Forensics Solutions http://dfsforensics.blogspot.com/

EDD and Forensics http://eddandforensics.blogspot.com/

Ex Forensis  http://exforensis.blogspot.com/
FireEye Malware Intelligence Lab  http://blog.fireeye.com/research/
Forensic 4cast  http://www.forensic4cast.com/

forensic . seccure . net http://seccure.blogspot.com/

Forensic Artifacts http://forensicartifacts.com/

Forensic Computing — Digital forensics from the view of a computer scientist http://www.forensicblog.org/

Forensic Incident Response http://forensicir.blogspot.com/

Forensic Photoshop  http://forensicphotoshop.blogspot.com/
Forensicaliente - because digital forensics is "hot"  http://forensicaliente.blogspot.com/
Forensics from London  http://forensiccontrol.blogspot.com/
Forensics from the sausage factory  http://forensicsfromthesausagefactory.blogspot.com/

ForensicZone http://forensiczone.blogspot.com/

Geoff Black's Forensic Gremlins - Everything that gives you fits in Digital
Girl, Unallocated http://girlunallocated.blogspot.com/
GPS Evidence Tracking Issues http://gpsevidence.blogspot.com/
Forensics and E-Discovery http://www.geoffblack.com/

Hacking Exposed Computer Forensics blog http://hackingexposedcomputerforensicsblog.blogspot.com/

Happy As A Monkey http://happyasamonkey.wordpress.com/
integriography A Journal of Broken Locks, Ethics, and Computer Forensics http://integriography.wordpress.com/

Internet Storm Center Diary http://isc.sans.edu/

IR and forensic talk http://blog.kiddaland.net/

JL's stuff http://gleeda.blogspot.com/

Journey into Incident Response http://journeyintoir.blogspot.com/

Linux Sleuthing http://linuxsleuthing.blogspot.com/
Lowmanio (digital forensic category) http://www.lowmanio.co.uk/blog/categories/digital-forensics/
Macaroni Forensics http://macaroniforensics.blogspot.com/

Mark Morgan http://markmorgan47.wordpress.com/
Matthieu Suiche’s blog ! - Happiness only real when shared. http://www.msuiche.net/

McGrew Security Blog http://www.mcgrewsecurity.com/

MNIN Security Blog http://mnin.blogspot.com/
Mobile Device Forensics http://mobileforensics.wordpress.com/

Mobile Forensics Inc Blogger http://blog.mobileforensicsinc.com/

Mobile Telephone Evidence http://trewmte.blogspot.com/

Multimedia Forensics http://multimediaforensics.com/
M-unition  http://blog.mandiant.com/
Nibble on DAV NADS  http://www.davnads.blogspot.com/
OS X Forensics Blog  http://osxforensics.wordpress.com/

Post Humorous http://www.posthumorous.com/
Push the Red Button http://moyix.blogspot.com/

RAM Slack – Random Thoughts from a Computer Forensic Examiner http://ramslack.wordpress.com/

Reversing Malware http://internetopenurla.blogspot.com/

Security Ripcord  http://www.cutawaysecurity.com/blog/
Sempersecurus http://sempersecurus.blogspot.com/
Seculert  http://blog.seculert.com/
Secureartisan http://secureartisan.wordpress.com/
Security Braindump  http://securitybraindump.blogspot.com/
TaoSecurity  http://taosecurity.blogspot.com/

The Cave  http://cyb3rdaw6.harpermountain.net/
The Digital Standard  http://thedigitalstandard.blogspot.com/
The Last Line of Defense  http://blog.tllod.com/
trustedsignal -- blog  http://trustedsignal.blogspot.com/
Unmask Parisites blog  http://blog.unmaskparasites.com/
volatility Advanced Memory Forensics  http://volatility.tumblr.com/

Websense Security Labs http://community.websense.com/blogs/securitylabs/
Windows Forensic Environment http://winfe.wordpress.com/

Windows Incident Response http://windowsir.blogspot.com/
Zscaler http://research.zscaler.com/

Websites

Brian Carrier Digital Investigation - Forensics and Evidence Research http://www.digital-evidence.org/

CERIAS Reports and Papers Archive https://www.cerias.purdue.edu/apps/reports_and_papers/

Cert http://www.cert.org/

Computer Crime & Intellectual Property Section US DOJ http://www.justice.gov/criminal/cybercrime/

Computer Forensics Miscellany http://computerforensics.parsonage.co.uk/

Craig Gall Helping Lawyers Master Technology http://www.craigball.com/

DFI News http://www.dfinews.com/

DFRWS (Digital Forensics Research Conference)  http://www.dfrws.org/
Digital Forensics Magazine supporting the professional computer security industry http://www.digitalforensicsmagazine.com/
ENSIA CERT  http://www.enisa.europa.eu/act/cert/
E-Evidence Information Center - Home  http://www.e-evidence.info/
FIRST - Improving security together  http://www.first.org/
Forensic Focus  www.forensicfocus.com/
Forensic Magazine Issues  http://www.forensicmag.com/current-issue/
Forensics Wiki  http://www.forensicswiki.org/
Inside the registry  http://www.insidetheregistry.com/regdatabase/
International Journal of Digital Evidence on Utica College http://www.utica.edu/academic/institutes/ecii/ijde/
Into The Boxes  http://intotheboxes.wordpress.com/
Lenny Zeltser  http://zeltser.com/
log2timeline  http://log2timeline.net/
Mobile Forensics Central  http://www.mobileforensicscentral.com/
National White Collar Crime Center  http://www.nw3c.org/
Network Forensics Puzzle Contest  http://forensicscontest.com/
NIST Computer Security Division Special Publications  http://csrc.nist.gov/publications/nistpubs/
Open Source Digital Forensics  http://www2.opensourceforensics.org/
SANs Computer Forensics  http://computer-forensics.sans.org/
SANS InfoSec Reading Room - Forensics http://www.sans.org/reading_room/whitepapers/forensics/
SANS InfoSec Reading Room - Incident Handling http://www.sans.org/reading_room/whitepapers/incident/
SANS InfoSec Reading Room - Malicious Code http://www.sans.org/reading_room/whitepapers/malicious/
SANS InfoSec Reading Room - Steganography http://www.sans.org/reading_room/whitepapers/stenganography/
Small Scale Digital Device Forensics Journal  http://www.ssddfj.org/
SWGDE  http://www.swgde.org/
The Honeynet Project Challenges  https://www.honeynet.org/challenges/
Welcome AppleExaminer  http://www.appleexaminer.com/

Webpages

AuSCERT Forming an Incident Response Team  http://www.auscert.org.au/render.html?it=2252&cid=1938
Cybercrime.gov searching and seizing manual http://www.cybercrime.gov/ssmanual/index.html
Daubert v. Merrell Dow Pharmaceuticals  http://www.law.cornell.edu/supct/html/92-102.ZS.html
Default Processes in Windows 2000  http://support.microsoft.com/kb/263201
Digital Evidence: Standards and Principles http://www2.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm
Digitalcorpora Disk Images  http://digitalcorpora.org/corpora/disk-images/
FileSignatures Table  http://www.garykessler.net/library/file_sigs.html
Forensically interesting spots in the Windows 7, Vista and XP file system and registry (and anti-forensics)  http://www.irongeek.com/i.php?page=security/windows-forensics-registry-and-file-system-spots
Microsoft Windows XP - Default settings for services http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sys_srv_default_settings.mspx?mfr=true
QQIS Whitepapers  http://www.qccis.com/resources/whitepapers
RFC 3227 - Guidelines for Evidence Collection and Archiving  http://www.rfc-archive.org/getrfc.php?rfc=3227
SEI Handbook for Incident Response Teams http://www.sei.cmu.edu/library/abstracts/reports/03hb002.cfm
Windows 7 Default Services and Suggested Startup Mode http://www.windowsnetworking.com/articles_tutorials/Windows-7-Default-Services-Suggested-Startup-Mode.html

Groups

Yahoo Win4n6 Group  http://tech.groups.yahoo.com/group/win4n6/
Yahoo Linux Forensics Group  http://tech.groups.yahoo.com/group/linux_forensics/

Export Tally

2011-08-05T14:32:00.000+05:30

Greeting to all,

The attached EnScript is used to extract all Tally related files to the desired path, (Folder Option).

Tally is the Accounting software which is used in India and South Asia Regions alot.

Initially I have struggled a lot on Extracting Tally related file on the structural basis, still I extracted unwanted file.

Tally Related File incense : Tally data of all versions and Tally Backup of all version

After the lesson learned from my experience, I have made this EnScript.

This is really easy to use, If you come to know the power of ExportTally EnScript you will spread and share with others.

If you were n00b to EnCase make use of it.

Be Updated and Be accurate...
Email me

Nirmal Jose
Computer Forensic Analyst

Exporting Password Protected Files v2.1, EnScript

2011-07-07T13:08:00.001+05:30

Greeting to Everyone,

Recently there was a request from Anonymous, who wanted to automate Forensically Analysis task, which he does day to day of Filtering Password Protected file, and Keeping track of exported Password Protected file in Excel for future purpose like its File Name, Path and Where it is exported, desired path.

I made an Pre-Compiled EnScript to help him and others like him... Hope you like this.

Download

Open Source Tools

2011-07-06T22:17:00.007+05:30

dc3dd -http://dc3dd.sourceforge.net/ – Patched version of GNU dd to include a number of features useful for computer forensics. Many of these features were inspired by dcfldd, but were rewritten for dc3dd.

dcfldd – http://dcfldd.sourceforge.net/ – Enhanced version of GNU dd with features useful for forensics and security. Based on the dd program found in the GNU Coreutils package, dcfldd has additional features.

dd_rescue – http://www.garloff.de/kurt/linux/ddrescue/ – Suitable for rescuing data from a medium with errors, i.e. a hard disk with some bad sectors.
-
TheSleuthKit – http://www.sleuthkit.org/ – The Sleuth Kit (TSK) is a collection of UNIX-based command line tools that allow you to investigate a computer.

Autopsy – http://www.sleuthkit.org/autopsy/ – The Autopsy Forensic Browser is a graphical interface to the command line digital investigation tools in The Sleuth Kit.

Foremost – http://foremost.sourceforge.net/- Foremost is a console program to recover files based on their headers, footers, and internal data structures. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive.

Scalpel – http://www.digitalforensicssolutions.com/Scalpel/ – Scalpel is a file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions.
-
Volatility – https://www.volatilesystems.com/VolatileWeb/volatility.gsp – The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
-
HxD – http://mh-nexus.de/en/hxd/ – HxD is a carefully designed and fast hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size (Windows) (Run as administrator to use the disk editor).

Ghex – http://live.gnome.org/Ghex – Hex Editor (Linux)
-
Notepad ++ – http://notepad-plus-plus.org/ – Great Text Editor (Windows)
-
Stegbreak – http://www.outguess.org/download.php – Steganalysis Program

Steganography Programs – http://www.jjtc.com/Steganography/tools.html
-
Wireshark – http://www.wireshark.org/ – Network protocol analyzer.
-
Open Source Digital Forensics – http://www2.opensourceforensics.org/tools – # Open Source tools for: Bootable Environments, Data Acquisition, Volume System, File System, Application, Network, Memory, Frameworks.
-
Knoppix std 0.1 – http://s-t-d.org/ – STD is a Linux-based Security Tool. Full of very useful open source security tools. It’s a Live Distro / Live CD (Linux), so bootable and can be run in memory only.

DEFT 6.0 – http://www.deftlinux.net/ – Network and Computer Forensic Live Distro / Live CD, contains open source tools specific to forensic use and application.

CAINE 2.0 – http://www.caine-live.net – GNU/Linux live distro that is organized to integrate existing software tools as software modules and to provide a friendly graphical interface.

HELIX 3 (2009R1) – https://www.e-fense.com/store/index.php?_a=viewProd&productId=11 – Free version of the Helix 3 ISO version 2009R1, (note: not Helix3 Pro version 2009 R2).

Raptor 2.0 – http://forwarddiscovery.com/Raptor – Raptor 2.0 is a modified Live Linux distribution based on Ubuntu, you can register and download an ISO for FREE, to create your own bootable CD or USB. It is also available for sale as a pre-installed USB device.
Note: Raptor USB is not able to boot Intel-based MAC computers, this capability is available when using the Raptor CD.

Penguin Sleuth Kit – http://penguinsleuth.org/index.php?option=com_wrapper&Itemid=39 – Live disto / CD, geared towards the live previewing of computer systems out in the field. Also includeded several forensic, security auditing and sys admin tools.

Lnx4n6 – http://www.lnx4n6.be/index.php?sec=Downloads&page=bootcd – FCCU GNU/Linux Forensic Live Distro Boot CD.

PALADIN – http://www.sumuri.com/ – PALADIN is a modified Live Linux distribution based on Ubuntu that simplifies the process of creating forensic images in a forensically sound manner, for those not comfortable with using the command-line but still want to utilize the power of Linux.

The Dropbox - Changes to policies (updated)

2011-07-04T18:49:00.002+05:30

If you are one of the Cloud user of non-commercial use. I can suggest you all to use DropBox, they have changed some policy coz of the recent query's on their security issues and privacy.

If you are interested you can click the below link and look through it ....z

The Dropbox Blog » Blog Archive » Changes to our policies (updated)

Custom Keyword search, EnScript

2011-06-28T12:46:00.000+05:30

Greeting to Everyone,

Most of the Computer Forensic software, have built-in keyword search option. They rely on it, coz it do's awesome job in finding the information for the investigators.

So, I thought why can't I contribute some add-on features to the keyword search. You can find the result, by downloading the EnScript.

What it does ?

1.Search for the Keyword.
2.Once found, bookmark the keyword
3.This might be interesting, Console says How many hits found on each and every individual file.
4.Finally Total number of hit found.

Screenshot of the Result:

I feel, it's pretty cool...!

Just A Click, EnScript Does Rest

You can download the EnScript.

Download

Exporting Password Protected Files, EnScript

2011-06-27T19:25:00.003+05:30

I got couple of e-mail after this post.

They were much happy about the automation done to find the protected file. But, they wanted me not only to find the protected file, but also to export the password protected file. So, after couple of my regular work, I made some extra spare time to help them. The result is below, download and make use of it.

This EnScript works only on Microsoft office and PDF files,because most of the users stores data down here. When they feel, its classified information or secret.

How to Protect file ?

There are 'n' number of video than this.

With the help of this EnScript , Investigator can export protected file and decrypt with the help of third party password cracker.

To make use of this EnScript, Copy the files to the respective folder.

Where,

EnScript to c:\Program Files\EnCase6\EnScript
EnLicense to c:\Program Files\EnCase6\License

If you got any problem using this particular EnScript, feel free to e-mail me....

"Just A Click, EnScript Does The Rest"

Download here : EnScript, Licence

Polishing Dixon Box

2011-06-25T10:52:00.001+05:30

I have heard 'n' number of stories behind the need of Dixon Box, when Dixon pin pointed it. I made polish of his requirement.

This EnScript is somewhat similar to my previous post.

Still what is the need ?

1.New Code's are used.
2.EnScript is Clean and simple.
3.Avoiding the Size of selection.

I made this without license, and restriction.

Suggestion are welcome.

Download here

"Just a Click, EnScript Does The Rest"

Finding Encrypted Files Using EnCase

2011-06-24T12:45:00.000+05:30

There was 'n' number of situation, where Me/You would have stuck with finding Encrypted or Password protected files among the other normal files. So, I have worked on EnScript which Run on EnCase to solve the problem for me and you. The job of EnScript is to scan all files in the forensically driven image, and see through them whether its password protected/Encrypted. I feel its real cool, but still its in the developing stage. Why its in developing stage, the one only reason , its sucks more time on scanning all files, I'm working on it.

The only Inspiration behind this EnScript is coz of this link

If you need to use this EnScript, you need two thinks Genuine EnCase and License to Run the Script.

If you are interested twit me ,or mail me for the License to Run the EnScript.

"Suggestion and Comments are Welcome"

Download

"Just a click, EnScript Does the Rest"

Export Tally

2011-06-01T15:19:00.000+05:30

The entry in this blog is to say and share an Brand New and Final version of ExportTally EnScript. Use it, post your comments and suggestion

Peace and Cheers

Download here

Tally Data Export

2011-06-01T14:06:00.000+05:30

The Purpose of the blog entry is to help EnCase user's who are struggling in Exporting Tally data files.
Data's are Exported to S:\
Just a Click, Script do's the rest

Peace and Cheers

Download Here

Tally Backup Export v 1.1

2011-06-01T13:57:00.001+05:30

The Purpose of this EnScript is to Export only Tally Backup to S:\ as like in Suspects harddisk , their is the need to do this because Every file got the same name, and this also will be helpful for tracing back.....

Cheer and Peace.

You can find EnScript down here

Download here

BackTrack 5 Download

2011-05-15T10:16:00.000+05:30

I always have the love with BackTrack Linux distro. I tried and worked from its Version 4. Hope you can all can have this Download.

More on EnCase v7 and BackTrack 5...

Mobile Digital Forensic Solution from Dell

2011-04-07T19:46:00.000+05:30

Dell is the most innovative for Digital Forensic, according to my mind set.

Because, apart from marketing their products they have keen interest in Digital forensic from the top.
They came up with a new products which has all capabilities of connector for todays high-tech world. We need to truly thank them for all their update is hardware world. Without them, it will be Thorn on Digital forensic. Because most digital investigator use's Dell, all have their own reasons to use it.

Dell came with a new product where called Latitude E6400 XFR. It works on any hard conditions like heat, in water, and of high air too.

Its cases are too strong and unbelievable.

Sorry for the typo and grammer

Jose Console Vs Dixon Box

2011-03-21T20:27:00.000+05:30

Dixon Box which is enabled in EnCase show selected items, among the total items.

And My Console, ie., "Jose Console" Shows number of selected items, which differentiate file and folders selected among them.

Among that, it will show total size of selected items in bytes, KB,MB,GB. ( It not so accurate, coz thinking of two decimal or more)

New version of this EnScript will replace the existing, which overcome the issues in KB,MB,GB .

Tested in EnCase v 6.18.59

Waiting for your comments

Download Here

Finding Number of Encrypted File

2011-03-18T11:51:00.000+05:30

Hello Everyone,

My First EnScript on Web.
This Script is the beta version, changed depending upon your suggestion.

What this Script do's ?
1.Search's for the Encrypted File.
2.Once Found
   a. Prints the File Name ,
   b.Prints Full path,
   c.Prints Size of File
   d.Prints MAC time.
in the Console.

Waiting for your Suggestion.

Download Here