Forensics - Revision history

Jeremy: /* Disk */

2015-09-12T22:02:45Z

Disk

← Older revision		Revision as of 22:02, 12 September 2015
Line 2:		Line 2:

	== Disk ==		== Disk ==

			Tools to test disks:
			* [https://www.smartmontools.org/ smartmontools] (GNU GPL 2)<br>The smartmontools package contains two utility programs (smartctl and smartd) to control and monitor storage systems using the Self-Monitoring, Analysis and Reporting Technology System (SMART) built into most modern ATA and SCSI harddisks. In many cases, these utilities will provide advanced warning of disk degradation and failure.

	Tools to recover disk images from disks with errors:		Tools to recover disk images from disks with errors:
Line 8:		Line 11:
	* [https://www.grc.com/sr/spinrite.htm SpinRite] (Commercial)<br>SpinRite is a computer software program for scanning magnetic data storage devices such as hard disks, recovering data from them and refreshing their surfaces.		* [https://www.grc.com/sr/spinrite.htm SpinRite] (Commercial)<br>SpinRite is a computer software program for scanning magnetic data storage devices such as hard disks, recovering data from them and refreshing their surfaces.
	Tools to recover files from a disk image:		Tools to recover files from a disk image:
	* [http://www.cgsecurity.org/wiki/PhotoRec PhotoRec]<br>PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted.		* [http://www.cgsecurity.org/wiki/PhotoRec PhotoRec]<br>PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted.

	== Linux ==		== Linux ==

Jeremy at 21:58, 12 September 2015

2015-09-12T21:58:21Z

← Older revision		Revision as of 21:58, 12 September 2015
Line 1:		Line 1:
	= Forensics =		= Forensics =

			== Disk ==

			Tools to recover disk images from disks with errors:
			* [http://www.garloff.de/kurt/linux/ddrescue/ dd_rescue] (GNU GPL 2 or 3)<br>Like dd, dd_rescue does copy data from one file or block device to another. You can specify file positions (called seek and Skip in dd).
			* [https://www.gnu.org/software/ddrescue/ ddrescue] (GPL 2 or later)<br>GNU ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying to rescue the good parts first in case of read errors.
			* [https://www.grc.com/sr/spinrite.htm SpinRite] (Commercial)<br>SpinRite is a computer software program for scanning magnetic data storage devices such as hard disks, recovering data from them and refreshing their surfaces.
			Tools to recover files from a disk image:
			* [http://www.cgsecurity.org/wiki/PhotoRec PhotoRec]<br>PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted.
	== Linux ==		== Linux ==

			=== Memory ===
	Tools to extract entire system RAM to a file		Tools to extract entire system RAM to a file
	* [https://github.com/504ensicslabs/lime LiME] (Linux Memory Extractor)<br>A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.		* [https://github.com/504ensicslabs/lime LiME] (Linux Memory Extractor)<br>A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
	** Works as a kernel module		** Works as a kernel module
	** Compiles on Linux and Android		** Compiles on Linux and Android

Jeremy: Created page with "= Forensics = == Linux == Tools to extract entire system RAM to a file * [https://github.com/504ensicslabs/lime LiME] (Linux Memory Extractor)
A Loadable Kernel Module (L..."

2015-09-12T21:49:28Z

Created page with "= Forensics = == Linux == Tools to extract entire system RAM to a file * [https://github.com/504ensicslabs/lime LiME] (Linux Memory Extractor)<br>A Loadable Kernel Module (L..."

New page

= Forensics =

== Linux ==

Tools to extract entire system RAM to a file
* [https://github.com/504ensicslabs/lime LiME] (Linux Memory Extractor)<br>A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
** Works as a kernel module
** Compiles on Linux and Android

Forensics - Revision history

Jeremy: /* Disk */

Jeremy at 21:58, 12 September 2015

Jeremy: Created page with "= Forensics = == Linux == Tools to extract entire system RAM to a file * [https://github.com/504ensicslabs/lime LiME] (Linux Memory Extractor)A Loadable Kernel Module (L..."

Jeremy: Created page with "= Forensics = == Linux == Tools to extract entire system RAM to a file * [https://github.com/504ensicslabs/lime LiME] (Linux Memory Extractor)
A Loadable Kernel Module (L..."