File and data analysis

File and data analysis




Advanced Prefetch Analyser Allan Hay Reads Windows XP,Vista and Windows 7 prefetch files
analyzeMFT David Kovar Parses the MFT from an NTFS file system allowing results to be analysed with other tools
CapAnalysis Evolka PCAP viewer
CrowdResponse CrowdStrike Directory enumeration, file hashes, certificate details, detailed process listing and YARA module to scan process memory & associated binaries.
CrowdInspect CrowdStrike Details network processes, listing binaries associated with each process. Queries VirusTotal, other malware repositories & reputation services to produce “at-a-glance” state of the system
Defraser Various Detects full and partial multimedia files in unallocated space
eCryptfs Parser Ted Technology Recursively parses headers of every eCryptfs file in selected directory. Outputs encryption algorithm used, original file size, signature used, etc.
Encryption Analyzer Passware Scans a computer for password-protected & encrypted files, reports encryption complexity and decryption options for each file
ExifTool Phil Harvey Read, write and edit Exif data in a large number of file types
Forensic Image Viewer Sanderson Forensics View various picture formats, image enhancer, extraction of embedded Exif, GPS data
Ghiro Alessandro Tanasi In-depth analysis of image (picture) files
Highlighter Mandiant Examine log files using text, graphic or histogram views
Link Parser 4Discovery Recursively parses folders extracting 30+ attributes from Windows .lnk (shortcut) files
LiveContactsView Nirsoft View and export Windows Live Messenger contact details
PlatformAuditProbe* AppliedAlgo Command Line Windows forensic/ incident response tool that collects many artefacts. Manual
RSA Netwitness Investigator* EMC Network packet capture and analysis
Memoryze Mandiant Acquire and/or analyse RAM images, including the page file on live systems
MetaExtractor 4Discovery Recursively parses folders to extract meta data from MS Office, OpenOffice and PDF files
MFTview Sanderson Forensics Displays and decodes contents of an extracted MFT file
NetSleuth NetGrab Network monitoring tool, with covert “silent port scanning”
PictureBox Mike’s Forensic Tools Lists EXIF, and where available, GPS data for all photographs present in a directory. Export data to .xls or Google Earth KML format
PsTools Microsoft Suite of command-line Windows utilities
Shadow Explorer Shadow Explorer Browse and extract files from shadow copies
Simple File Parser Chris Mayhew GUI tool for parsing .lnk files, prefetch and jump list artefacts
SQLite Manager Mrinal Kant, Tarakant Tripathy Firefox add-on enabling viewing of any SQLite database
Strings Microsoft Command-line tool for text searches
Structured Storage Viewer MiTec View and manage MS OLE Structured Storage based files
Switch-a-Roo Mike’s Forensic Tools Text replacement/converter/decoder for when dealing with URL encoding, etc
Windows File Analyzer MiTeC Analyse thumbs.db, Prefetch, INFO2 and .lnk files
Xplico Gianluca Costa & Andrea De Franceschi Network forensics analysis tool

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.