DFIR ORC
0 (0)
DFIR ORC Documentation provides detailed instructions for setting up the build environment and deploying the tool.
Recover event log entries from an image by heuristically looking for record structures. Dependencies: argparse (http://pypi.python.org/pypi/argparse available via easy_install/pip). Usage: Use this tool to extract event log messages from an image file by looking for things that appear to be records. Then, feed the resulting file into an event log viewer, such as Event Log Explorer (http://www.eventlogxp.com/, use 'direct' mode when opening). Sample Output: evt/LfLe - [master●] » python lfle.py '/media/truecrypt2/VM/Windows XP Professional - Service Pack 3 - TEMPLATE/Windows XP Professional - Service Pack 3-cl1.vmdk' recovered.evt 100% complete% done. Wrote 5413 records. Skipped 48 records with length greater than 0x10000. Skipped 12.
DFIR ORC Documentation provides detailed instructions for setting up the build environment and deploying the tool.
An anti-forensic Linux Kernel Module kill-switch for USB ports.
Review of various MFT parsers used in digital forensics for analyzing NTFS file systems.
A Windows Registry hive extraction library that reads and writes Windows Registry 'hive' binary files.
WinSearchDBAnalyzer can parse and recover records in Windows.edb, providing detailed insights into various data types.
Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.