The word “Forensics” refers to the techniques used by the investigators to solve a crime. Every invention has its pros and cons. Computers and electronic devices have evolved much faster, and are being used in modern crimes.
- EnCase has maintained its reputation as the gold standard in criminal investigations and was named the Best Computer Forensic Solution for eight consecutive years by SC Magazine. No other solution offers the same level of functionality, flexibility, and has the track record of court-acceptance as EnCase Forensic.
- 10+ Best Computer Forensics Tools Reviews There are instances when an individual or a propriety encounters legal cases for digital data. It can be a case of plagiarism, online fraud, and other related incidents.
- The primary goal of the Tool Catalog is to provide an easily searchable catalog of forensic tools. This enables practitioners to find tools that meet their specific technical needs. The Catalog provides the ability to search by technical parameters based on specific digital forensics functions, such as disk imaging or deleted file recovery.
Autopsy
I consider Autopsy, which comes by default on CAINE and Kali Linux, the first tool to get introduced to forensics due it’s graphical and intuitive interface to manage computer forensic tools. Autopsy optimizes the process by using multiple processor cores while running in the background and can tell you in advance if the process will lead to a positive result. Autopsy can also be used as graphical interface for different command line tools, supports extensions for integration with third party tools such as PhotoRec already featured on LinuxHint to improve and add functions.
As said, it comes by default on Kali, Debian and Ubuntu users can get Autopsy by running:
Official website: https://www.sleuthkit.org/autopsy/
CAINE (Computer Aided Investigative Environment)
CAINE is an Ubuntu Linux based distribution specifically designed for computer forensics, it comes with Autopsy by default creating a very friendly environment for the user. CAINE is a great assistant, as an OS, since it applies by default common forensics practices like protecting the storage devices from getting corrupted or overwritten during the forensic process.
CAINE is an up to date Linux distribution highly recommended to get started with computer forensics.
Official website: https://www.caine-live.net/
P0f
P0f is an analyzer for the interaction between different devices through networking. P0f is capable to identify the OS and software used by different devices connected in passive mode, rather than sending packets to analyze the reply P0f only captures packets for later analysis, that’s why it can lead to better results than Nmap when fingerprinting. Practical uses of P0f may include detecting an attacker during an ongoing pentesting session, network surveillance and additional information on connections to setup proper security measures. P0f wasn’t updated for a long time and has come back as P03 with support for modern OS and software. In a future article we’ll trace attackers using different tools including P0f.
Debian and Ubuntu users can install P0f by running:
Official website: http://lcamtuf.coredump.cx/p0f3/
Dumpzilla
During a criminal investigation analysis of browsing activity is among the first protocol steps. As said above, Autopsy allows us to enable extensions to research the browsing activity of the user. Dumpzilla is a tool focused specifically on recovering browsing data from Mozilla Firefox browsers or derivatives like Iceweasel or Seamonkey. Dumpzilla can grant us a lot of valuable information like usernames, passwords, browsing history and any information stored in cookies or user preferences. Despite the fact that it is very specific running Dumpzilla against a target with Firefox is recommended, in spite of the fact that it wasn’t updated for the last two years.
Dumpzilla isn’t included in default repositories, you can get it from: https://github.com/Busindre/dumpzilla
Best Computer Forensic Software
Official website: https://www.dumpzilla.org
Volatility
Best Computer Forensics Software
Volatility allows us to investigate the live RAM of a device, which means information which wasn’t stored on the hard drive, but left artifacts or traces on the live RAM. This tool, which comes by default both on CAINE and Kali Linux, can lead us to useful information after an incident on a device, like what processes were running, or are running, during an event. To install volatility on Debian you can run
Best Free Computer Forensic Software
Official website: https://www.volatilityfoundation.org/
Chkrootkit
A RootKit is malicious software installed locally or remotely on a device to grant illegitimate access to an attacker, we can do a grotesque comparison between rootKits and trojan servers despite small differences (RootKIts include additional functions). RootKits can modify the system files and remove traces of illegitimate intrusions. Here is where ChkRooKit comes analyzing binaries for modifications, logs and other traces which could get removed by an intruder. On Debian you can get chkrootkit by running:
Official website: http://www.chkrootkit.org/
I hope you found this article useful to realize computer forensics are not restricted to IT gurus, anyone can carry out computer forensics easily with the tools mentioned above. Keep following LinuxHint for more tips and updates on Linux.