智慧物流>> forensics-experience>> 返回
项目作者： githubfoam

项目描述 ：
computer forensics
高级语言： C
项目地址: git://github.com/githubfoam/forensics-experience.git
创建时间： 2019-09-18T16:47:32Z
项目社区：https://github.com/githubfoam/forensics-experience
开源协议：GNU General Public License v3.0
下载


forensics-experience

process accounting CI workflow

UAV - Unmanned aerial vehicle forensics

  1. DatCon 
  2. case study: flight logs, motor speeds, battery usage, a tool designed to interpret .DAT files specifically from DJI UAV
  4. CsvView and DatCon are free offline apps that provide the means to analyze log files produced by the Phantom 3, Phantom 4, Phantom 4 Pro, Inspire 1, Spark, and Mavic Pro drones. To use one, or both, of these apps just download and install on your PC, Mac or Linux machine.
  5. https://datfile.net/
  1. DJIFix 
  2. carves  images  and videos  through  the commandline
  4. Repairing Corrupt DJI Video Files
  5. if you accidentally power off your DJI quadcopter (Phantom, Mavic, Spark, or Inspire) before stopping video recording, you'll be left with a file that's corrupt, and cannot be played. 
  6. http://djifix.live555.com/
  1. ST2Dash der Flightlog Konverter für die  ST10+/Q500.
  3. https://www.drohnen-forum.de/index.php/Thread/12303-ST2Dash-der-Flightlog-Konverter-f%C3%BCr-die-ST10-Q500/
  1. DroneLogbook
  2. STANDARD Free
  3. Perfect for the hobbyist and individual user who wants to track key flight 
  5. Log your flights with detail
  6. Import your flight log to fill info automatically, view GPS trace and replay it in 3D.
  7. https://www.dronelogbook.com/hp/1/index.html
  1. Gryphon Drone Forensics Tool
  3.  this tool aims to extract critical events happened during the flight of an Unmanned Aerial System/Vehicle, running Ardupilot flight stack. This tool is part of the research paper Gryphon: Forensics on Dataflash and Telemetry Logs.
  4. https://github.com/emantas/gryphon_dft
  1. process accounting on Linux
  2. RHEL :  yum install psacct
  3. Ubuntu : sudo apt-get install acct
  4. https://man7.org/linux/man-pages/man5/acct.5.html

Anti-Forensics

  2. Timestamps
  4. TimeStomp
  6. parse MFT files
  7. https://github.com/dkovar/analyzeMFT
  9. Extract $MFT record info and log it to a csv file. 
  10. https://github.com/jschicht/Mft2Csv
  12. collect MFT files
  13. https://github.com/orlikoski/CyLR
  15. Parser for $UsnJrnl on NTFS 
  16. https://github.com/jschicht/UsnJrnl2Csv
  18. Parser for $LogFile on NTFS 
  19. https://github.com/jschicht/LogFileParser
  21. https://github.com/jschicht/SetMace
  23. Hiding Data in Slack Space using bmap
  24. http://dl.packetstormsecurity.net/linux/security/bmap-1.0.17.tar.gz
  26. slacker.exe
  28. Finding Data in Slack Space
  29. sleuthkit/autopsy
  31. Disable Timestamps - UserAssist
  32. registry key that maintains dates and hours when each executable was run by the user
  34. Disabling UserAssist
  35. Set two registry keys both to zero
  37. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
  38. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackEnabled
  40. Disable Timestamps - Prefetch
  41. information about the applications executed with the goal of improving the performance of the Windows system
  43. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\PrefetchParameters
  45. Set two registry keys both to zero
  46. EnablePrefetcher and EnableSuperfetch
  48. Disable Timestamps - Last Access Time
  49. Whenever a folder is opened from an NTFS volume on a Windows NT server, the system takes the time to update a timestamp field on each listed folder, called the last access tim
  51. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
  52. set value to 1
  53. NtfsDisableLastAccessUpdate
  55. Delete USB History
  56. USBSTOR registry key that contains sub keys which are created whenever you plug a USB Device 
  58. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
  59. saves information about the USBs
  60. C:\Windows\INF\setupapi.dev.log
  62. https://www.nirsoft.net/utils/usb_devices_view.html
  65. Disable Shadow Copies
  67. #List shadow copies
  68. vssadmin list shadowstorage
  69. #Delete  shadow copies
  70. vssadmin delete shadow
  72. disable shadow copies
  73. services-Volume Shadow Copy-Properties-Startup type-Disabled
  75. Overwrite deleted files
  77. Delete Windows event logs
  79. eventvwr.msc-Windows Logs-Clear Log
  80. Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }
  82. Disable Windows event logs
  84. services-Windows Event Log-Properties-Startup type-Disabled
  86. reg add 'HKLM\SYSTEM\CurrentControlSet\Services\eventlog' /v Start /t REG_DWORD /d 4 /f
  88. Disable $UsnJrnl
  90. fsutil usn deletejournal /d c