Tools to help examine NTFS for unauthorized activity.
The Forensic ToolKit™ contains several Win32 Command line tools that can help you examine the files on a NTFS disk partition for unauthorized activity. We built these tools to help us do our job, we hope they can help you as well.
AFind is the only tool that lists files by their last access time without tampering the data the way that right-clicking on file properties in Explorer will. AFind allows you to search for access times between certain time frames, coordinating this with logon info provided from ntlast, you can to begin determine user activity even if file logging has not been enabled.
HFind scans the disk for hidden files. It will find files that have either the hidden attribute set, or NT's unique and painful way of hiding things by using the directory/system attribute combination. This is the method that IE uses to hide data. HFind lists the last access times.
SFind scans the disk for hidden data streams and lists the last access times.
FileStat is a quick dump of all file and security attributes. It works on only one file at a time but this is usually sufficient.
Hunt is a quick way to see if a server reveals too much info via NULL sessions.
Command Line Switches
afind [dir] /f [filename] /ns=no subs /a after /b before /m between
time format =
hfind [dir] /hd=find dir/system attribs /ns=no subs
sfind [dir] /ns=no subs
Windows NT 4.0 SP3
Audit log enabled with searchable records
Set NT command line buffer to 500 or more lines. 1200 or more lines works well
'Security > DigitalForensics' 카테고리의 다른 글
|rhdtool-숨겨진 데이터 제거 (0)||2014.12.24|
|McAfee Forensic Toolkit-download (0)||2014.12.22|
|McAfee Forensic Toolkit (0)||2014.12.22|
|Forensic 회사(국외)-AccessData, Intelligent Computer Solutions, Logicube (0)||2014.12.21|
|Forensic 회사(국내)-더존 정보보호서비스, 레드아이 포렌식, KDL 컴퓨터포렌식, Dr.Mobile 휴대폰감정&데이터복구 (0)||2014.12.20|
|독수독과 이론(fruit of the poisonous tree theory) (0)||2014.12.19|