Free Computer Forensic Tools

This is a handy list for forensic and IR work. Any update of the list will be announced on twitter.com/jonathankrause

Currently the list is divided into the following categories:

• Disk Tools
• Email Analysis
• General
• File & Data Analysis
• Data Analysis Suite
• File Viewers
• Internet History Analysis
• Registry Analysis
• Web Application Analysis

The full list can be obtains at http://forensiccontrol.com/fcresources.php

Introduction to Java Examination

There is an article posted by Corey Harrell, (Almost) Cooked Up Some Java. It introduces the steps he took to examine the java. This article includes:

• Understand the Java cache folder.
• Examine the IDX file.
• Examine the JAR file.
• Extract Java source from the JAR file.
• Examine the Java source code.

Arduino Tutorial

OK, I admit this. I'm only manage to complete up to "Lesson 2". But there are all together 7 lessons in this great tutorial at http://www.ladyada.net/learn/arduino/index.html

And there more more other stuffs there for any beginner who wish to learn Arduino or electronics.

Secure Erase

This summarize the article from Craig Wright. He is a Director with Information Defense in Australia.

In the article, Erasing drives should be quick and easy, he shows us a way to perform secure erase. Also he stated a few FUD on data recovering like:

• X-Ray machines and scanners will erase a drive;
• SEM or AFM (electron microscopy will do) could be used to recover data;
• Government or NSA can read your wiped drives;

The simplest manner to wipe hard disk is using the the firmware Secure Erase command on an ATA, SATA, PATA, etc drives. A full erase using SE takes 30 min to 1 hour to complete. Basically it is quick. It is non-recoverable. It saves all the BS. It removes the need for the FUD that still surrounds us.

Here's the steps to wipe a drive using hdparm utility:

1. Login as root.
2. Ensure the drive isn't security frozen (result shows "not frozen"): hdparm -I /dev/sda
3. Issue command by set user password, Security =Maximum (Master Password = Blank): hdparm --user-master u --security-set-pass Eins /dev/sda
4. Issue command to confirm the process with the the word "enabled" in the output: hdparm -I /dev/sda
5. Issue the AT SE command: hdparm --user-master u --security-erase Eins /dev/sda
6. Issue command to ensure output verification return "not enabled": hdparm -I /dev/sda

References:

• http://sourceforge.net/projects/hdparm/
• http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml
• https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase

Multiple IP Addresses with Windows OS

Here's the batch script to help configure multiple IPv4 addresses on a Windows 7 or Windows 2008. Create a batch file like the below:

netsh in ip add address "eth0" 10.0.0.2 255.0.0.0
netsh in ip add address "eth0" 10.0.0.3 255.0.0.0
netsh in ip add address "eth0" 10.0.0.4 255.0.0.0
netsh in ip add address "eth0" 10.0.0.5 255.0.0.0
netsh in ip add address "eth0" 10.0.0.6 255.0.0.0
[...]
netsh in ip add address "eth0" 10.0.0.226 255.0.0.0

Or just do a command like:

for  /L %a in (1,1,254) do netsh in ip add address "eth0" 10.0.0.%a 255.255.255.0