CrossPost from Windows Incident Response blog:
Keydet89 has listed a number of forensic and IR and RE tools.
Memory Analysis
There have been a number of changes recently on the memory analysis front. For example, Mandiant recently released their
RedLine tool, and HBGary released the
Community Edition of their Responder product.
While on the topic of memory analysis tools, let's not forget the erstwhile and formidable
Volatility.
Also, if you're performing memory dumps from live systems, be sure to take a look at the
MoonSol Windows Memory Toolkit.
SQLite Tools
CCL-Forensics has a trial version of
epilog available download, for working with SQLite databases (found on smartphones, etc.). One of the most noticeable benefits of epilog is that it allows you to recover deleted records, which can be very beneficial for analysts and investigators.
I'm familiar with the
SQLite Database Browser...epilog would be interesting to try.
MFT Tools
Sometimes you need a tool to parse the NTFS $MFT file, for a variety of reasons. A version of my own
mft.pl is available online, and Dave Kovar provided his
analyzemft.pl tool online, as well. Mark McKinnon has chimed in and provided MFT parsing tools for
Windows,
Linux, and
MacOSX.
Other Tools
HBGary also made their
AcroScrub tool available, which uses WMI to reach across the enterprise and scan for older versions of Adobe Reader.
A very interesting tool that I ran across is
Flash Dissector. If you deal with or even run across SWF files, you might want to take a look at this tool, as well as the companion tools in the SWFRETools set.
The
read_open_xml.pl Perl script is still available for parsing metadata from Office 2007 documents.
From the same site as the SWFRETools are some malware write-ups including
NiteAim, and
Downloader-IstBar. As a complete aside, here's a very interesting
Gh0stNet writeup that
Chris pointed me to recently (fans of Ron White refer to him as 'Tater Salad'...fans of
Chris Pogue should refer to him as 'Beefcake' or 'Bread Puddin''...).
ADSs
Alternate data streams isn't something that you see discussed much these days. I recently received a question about a specific ADS, and thought I'd include some tools in this list. I've used Frank's
LADS, as well as Mark's
streams.exe. Scanning for ADSs is part of my malware detection process checklist, particularly when the goal of the analysis is to determine if there's any malware on the system.
Also, I ran across this listing at MS of
Known Alternate Stream Names. This is some very useful information when processing the output of the above tools, because what often happens is that someone uses one of the above tools and finds one of the listed ADSs, and after the panic that ensues, their attitude switches back to the other side of the spectrum, to apathy...and that's when they're most likely to get hit.
Here are some additional resources from
Symantec,
IronGeek, and
MS. Also, be sure to check out what I've written about these in
WFA 2/e.
Scanners
Microsoft recently released their
Safety Scanner, which is a one-shot micro-scanner...download it, run it, and it expires after 10 days, and then you have to download it again. This shouldn't replace the use of
Security Essentials or other AV tools, but I'm pointing this out because it could be very useful when included as part of your malware detection process. For example, you could mount an acquired image via FTK Imager or ImDisk and scan the image. Also, the folks at
ForensicArtifacts recently posted on accessing VSCs (their first research link actually goes back to
my post by the same title...thanks to AntiForensics for reposting the entire thing...)...without having to have EnCase or PDE, you could easily scan the mounted VSC, as well.
Frameworks
The
Digital Forensics Framework (DFF) is open source, and was recently updated to include support for the AFF format, as well as mailbox reconstruction via Joachim Metz's
libpff.
Christopher Brown, of TechPathways, has made
ProDiscover Basic Edition v6.10.0.2 available, as well. As a side note, Chris recently tweeted that he's just finished the beta of the full version of ProDiscover, adding the ability to image and diff VSCs. Wowzers!
Sites
TZWorks - free "prototypes" tools, including the Windows Shellbags parser, an EVTX file parser, and others. Definitely worth checking out.
WoanWare - several free forensics tools including a couple for browser forensics, and (like TZWorks) a 'USBStor parser'.
NirSoft - the link to the site goes to the forensics tools, but there are a lot of free tools available at the NirSoft site...too many to list.
The
Open Source Digital Forensics site is a good source of tools, as well.
OSDFC
Speaking of tools, let's not forget that the
OSDFC is right around the corner...
Addendum
Check out Phil Harvey's
EXIFTool (comes with a standalone Windows EXE)...there's a long list of supported file types at the tool page.
Additional lists of tools include
Mike's Forensic Tools, as well as the tools at
MiTeC (thanks to Anonymous' comment). Also, Mark McKinnon has
posted some freely available tools, as well.
"
