plaso

Plaso Plaso Langar Að Safna Öllu - 超级时间线，收集一切 Plaso（Plaso Langar Að Safna Öllu），即 超级时间线，收集一切 ，是一个基于 Python 的引擎，被多个工具用于自动创建时间线。Plaso 的默认行为是创建超级时间线，但它也支持创建更具针对性的时间线。 这些时间线可帮助数字取证调查人员/分析师关联在普通计算机的日志和其他文件中发现的大量信息。 详细介绍 Plaso 最初的目标是收集计算机系统上所有感兴趣且带有时间戳的事件，并将其聚合到单一位置以供计算机取证分析之用（又称超级时间线）。 然而，Plaso...

hashr

HashR：生成你自己的哈希集合 目录 HashR：生成你自己的哈希集合 目录 关于 要求 构建 HashR 二进制并运行测试 设置 HashR 使用 docker 运行 HashR 操作系统配置与所需第三方工具 为处理任务设置存储 设置 PostgreSQL 存储 设置 Cloud Spanner 设置导入器 GCP（谷歌云平台） AWS（亚马逊云服务） GCR（谷歌容器镜像仓库） Windows WSUS TarGz Deb RPM Zip（以及类似 zip 的格式） ISO 9660 设置导出器 设置 Postgres 导出器 设置 GCP 导出器 附加标志 关于 HashR...

Cold Disk Quick Response: CDQR

Cold Disk Quick Response tool The CDQR tool uses Plaso to parse disk images with specific parsers and create easy to analyze custom reports. The parsers were chosen based on my experience and triaging best practices and the custom reports group like items together to make analysis easier. The...

Parse Various Log Files: Plaso

Plaso is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline and thus plaso is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network...

CAINE 6.0 "Dark Matter" - Distribution with a complete forensic environment

CAINE Computer Aided INvestigative Environment is an Italian GNU/Linux live distribution created as a project of Digital Forensics. Currently the project manager is Nanni Bassetti. CAINE offers a complete forensic environment that is organized to integrate existing software tools as software...