달력

12

« 2019/12 »

  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  •  
  •  
  •  
  •  

   

경찰수사연수원 디지털포렌식 챌린지

http://digital-forensic.kpia.go.kr/Digital_Forensic_Challenge.html

   

   

   

   

직접 다운받기

 

challenge.zip.001


challenge.zip.002


challenge.zip.003


challenge.zip.004


challenge.zip.005


challenge.zip.006


challenge.zip.007


challenge.zip.008


challenge.zip.009


challenge.zip.010


challenge.zip.011


challenge.zip.012


challenge.zip.013


challenge.zip.014


challenge.zip.015


challenge.zip.016


challenge.zip.017


challenge.zip.018


challenge.zip.019


challenge.zip.020


challenge.zip.021


challenge.zip.022


challenge.zip.023


challenge.zip.024


challenge.zip.025


challenge.zip.026


challenge.zip.027


challenge.zip.028


challenge.zip.029


challenge.zip.030


challenge.zip.031


challenge.zip.032


challenge.zip.033


challenge.zip.034


challenge.zip.035


challenge.zip.036


challenge.zip.037


challenge.zip.038


challenge.zip.039


challenge.zip.040


challenge.zip.041


challenge.zip.042


challenge.zip.043


challenge.zip.044


challenge.zip.045


challenge.zip.046


challenge.zip.047


challenge.zip.048


challenge.zip.049


challenge.zip.050


challenge.zip.051


challenge.zip.052


challenge.zip.053


challenge.zip.054


challenge.zip.055


challenge.zip.056


challenge.zip.057


challenge.zip.058


challenge.zip.059


challenge.zip.060


challenge.zip.061


challenge.zip.062


challenge.zip.063


challenge.zip.064


challenge.zip.065


challenge.zip.066


challenge.zip.067


challenge.zip.068


challenge.zip.069


challenge.zip.070


challenge.zip.071


challenge.zip.072


challenge.zip.073


challenge.zip.074


challenge.zip.075


challenge.zip.076


challenge.zip.077


challenge.zip.078


challenge.zip.079


challenge.zip.080


challenge.zip.081


challenge.zip.082

 

Posted by codedragon codedragon

댓글을 달아 주세요

   

   

ZeroAccess rootkit kills security software



Posted by codedragon codedragon

댓글을 달아 주세요

   

   

ZeroAccess – an advanced kernel mode rootkit

   

   

   

직접다운받기

zeroaccess_analysis.pdf


Posted by codedragon codedragon

댓글을 달아 주세요

   

   

DCode

다양한 타임스탬프에서 날짜/시간값 계산하는 도구

   

http://www.digital-detective.net/digital-forensic-software/free-tools/

   

다운로드

하단의 회색 Download버튼 클릭

   

   

실행화면

   

   

직접다운로드

DCode-v4.02a-build-4.02.0.9306.zip


Posted by codedragon codedragon

댓글을 달아 주세요

   

   

openports.exe

시스템 프로세스와 함께 모든 오픈된 TCP와 UDP 포드 정보 출력

   

   

C:\forensics\ToolSuite>openports.exe /?

OpenPorts - DiamondCS Console Tools (www.diamondcs.com.au)

---

PURPOSE: Displays information about all TCP/UDP ports.

USAGE: openports.exe [-lines] [-path] [-netstat / -fport / -csv]

FLAGS:

[no flags] Standard display (default options used)

-lines Adds lines between processes for easier viewing

-path Processes are displayed with full path

The above flags have no effect if one of these options is used:

-netstat Results are displayed similar to Window XP's netstat

-fport Results are displayed similar to FPort

-csv Results are displayed as comma separated values

    

 

   

 

 

직접 다운로드


Posted by codedragon codedragon

댓글을 달아 주세요

   

   

Hunt

   

   

version

2.0

   

   

   

 

직접 다운로드


Posted by codedragon codedragon

댓글을 달아 주세요

   

   

Running FTK Imager from a Thumb drive or CD

At times you may be required to image a system that cannot be powered down for

the acquisition. This might be a server running vital applications or a workstation

from which you need certain files for preliminary investigation. You can run FTK

Imager from a thumb drive or a CD to create a disk image or to image certain

folders of a live system.

You can do this by either copying certain files from the installation of FTK Imager on

your computer, or by downloading FTK Imager Lite.

   

NOTE: It is possible to image a live system, but please use this option with caution. A

live system is constantly changing and the image you acquire will not be replicable.

FTK Imager will write to the system RAM and perhaps the hard drive page file during

the imaging process. In some cases this may keep evidence from being admissible in

court. Be aware of the risks of imaging a live system and make the decision carefully.

   

Using files from a previous installation of FTK Imager

   

If you already have FTK Imager installed on your computer you can copy certain files

from that installation to a thumb drive or burn them to a CD. The files are found at:

C:\Program Files\AccessData\AccessData FTK Imager

   

From this folder, copy the following files to your thumb drive or CD:

   

FTK Imager.exe

cximage.dll

IsoBuster.dll

libxml2.dll (for any version of Imager higher than 2.4)

   

There are two dll's that are not required to run FTK Imager; however you will need

them for the LogiCube support.

   

msvcr71.dll

MD5Remote.dll

   

Once you have copied the files you need, take the thumb drive or CD to the system

you need to image and run the FTK Imager.exe file to launch the program.

   

Using FTK Imager Lite

We also have a new installation of FTK Imager available on our website called FTK

Imager Lite. FTK Imager Lite contains the minimum files necessary to run FTK

Imager without installing it on your computer. Simply download the self-executable

file and unzip it to your thumb drive or the CD you are burning. Bring the thumb

drive or CD to the system you need to image and run the FTK Imager.exe file to

launch the program.

   

   

   

   

   

techdoc.Running_FTK_Imager_from_a_thumb_drive_or_CD.en_us.pdf


 

Posted by codedragon codedragon

댓글을 달아 주세요

   

   

   

USBDeview

USB 정보를 분석할 수 있는 도구

   

http://www.nirsoft.net/utils/usb_devices_view.html

   

   

다운로드하기

페이지 하단부분에서 Download 링크 클릭

   

   

   

직접다운로드

usbdeview-x64.zip

usbdeview.zip


'Security > DigitalForensics' 카테고리의 다른 글

Running FTK Imager from a Thumb drive or CD  (0) 2016.07.23
Registry Quick Find Chart, pdf  (0) 2016.06.02
USBDeview  (0) 2016.05.21
[Windows Forensic] FAT: General Overview of On-Disk Format  (0) 2016.05.08
HxD-Hex Editor and Disk Editor  (0) 2016.03.24
FORENSIC CHALLENGES  (0) 2016.03.11
Posted by codedragon codedragon

댓글을 달아 주세요

   

   

   

Mitec Windows Registry Recovery

Portable

   

http://www.mitec.cz/wrr.html

   

   

실행화면

   

   

   

   

직접다운로드

WRR_v1.5.3.0.zip


Posted by codedragon codedragon

댓글을 달아 주세요

   

RegRipper

http://regripper.org/

http://regripper.org/regripper-blog/

   

   

다운로드

홈페이지에서 상단의 Download 메뉴 클릭 후 >

중간쯤에 있는 RegRipper 내용 부분에서 zip파일 링크 클릭

※다운로드가 안될 경우 아래의 GitHub 사이트에서 다운로드

   

   

RegRipper site

http://regripper.wordpress.com/

   

   

RegRipper-Github

https://github.com/keydet89

https://github.com/keydet89/RegRipper2.8

   

   

직접다운받기

RegRipper2.8-master.zip


Posted by codedragon codedragon

댓글을 달아 주세요