SANS Digital Forensics and Incident Response Blog: Tag - forensic tools

DensityScout can handle multi-byte characters, now!

Due to a bug-report regarding issues when using DensityScout with filenames/paths including multi-byte characters I compiled and uploaded a new build which is now capable of handling this cases correctly. I strongly recommend switching to this new build as soon as possible. Get it from: https://cert.at/downloads/software/densityscout_en.html Cheers, Christian Continue reading DensityScout can handle multi-byte characters, now!


Running Malware Analysis Apps as Docker Containers

A new REMnux project initiative provides Docker images of Linux applications useful for malware analysis to offer investigators easier access to malware forensics tools. Docker is a platform for packaging, running and managing applications as "containers," as a lightweight alternative to full virtualization. Several application images are available as of this writing, and you can contribute your own as a way of experimenting with Docker and sharing with the community. Continue reading Running Malware Analysis Apps as Docker Containers


Automating Static Malware Analysis With MASTIFF

MASTIFF is an open source framework for automating static malware analysis. This tool, created by Tyler Hudak, determines the type of file that is being analyzed and then applies only the static analysis techniques that are appropriate for that file type. MASTIFF offers a useful way for performing triage on a large set of suspicious files. Continue reading Automating Static Malware Analysis With MASTIFF


Installing the REMnux Virtual Appliance for Malware Analysis

REMnux is a lightweight Linux distribution for assisting malware analysts with reverse-engineering malicious software. Here is how to install the REMnux virtual appliance using common virtualization tools, such as VMware and VirtualBox, thanks to the Open Virtualization Format (OVF/OVA). Continue reading Installing the REMnux Virtual Appliance for Malware Analysis


Log2timeline Plugin Creation

About a year ago, I needed to add an Apache log to a supertimeline I was working on. I wrote a bash script to do this, as I was not familiar with perl at the time. I later went back and learned some basics of perl and converted it to my first log2tlimeline plugin. Since … Continue reading Log2timeline Plugin Creation