FTK Imager – FTK Imager is a data preview and imaging tool that allows you to examine files and folders on local hard drives, network drives, CDs/DVDs, and review the content of forensic images or memory dumps.It comes with features like Timeline Analysis, Hash Filtering, File System Analysis and Keyword Searching out of the box, with the ability to add other modules for extended functionality. Autopsy is essentially a GUI that sits on top of The Sleuth Kit. The Sleuth Kit (+Autopsy) – The Sleuth Kit is an open source digital forensics toolkit that can be used to perform in-depth analysis of various file systems.
Using Volatility you can extract information about running processes, open network sockets and network connections, DLLs loaded for each process, cached registry hives, process IDs, and more. Volatility – Volatility is a memory forensics framework for incident response and malware analysis that allows you to extract digital artefacts from volatile memory (RAM) dumps.
You can also search for data using the Search node based on the criteria you specify. Once you add a forensic image you can view the data by content or by looking at the clusters that hold the data.
0 kommentar(er)
