pcapfex Logo

pcapfex

0
Free
Visit Website

Packet CAPture Forensic Evidence eXtractor (pcapfex) is a tool developed by Viktor Winkelmann as part of a bachelor thesis, designed to find and extract files from packet capture files. The tool's ease of use allows users to provide a pcap-file and receive a structured export of all files found in it, even if non-standard protocols were used. pcapfex offers a plugin-system for Python developers to easily add more file-types, encodings, or complex protocols. It is developed and tested for Linux environments, depends on Python 2.7 and the dpkt package, and optionally benefits from the regex package for better performance in multithreaded search for file objects.

FEATURES

ALTERNATIVES

A collaborative forensic timeline analysis tool for organizing and analyzing data with rich annotations and comments.

A forensic tool to find hidden processes and TCP/UDP ports by rootkits or other hidden techniques.

A Mac OS X computer forensics tool for analyzing system artifacts, user files, and logs with reputation verification and log aggregation capabilities.

Stegextract is a Bash script that extracts hidden files and strings from images, supporting PNG, JPG, and GIF formats.

A portable volatile memory acquisition tool for Linux.

A powerful reverse engineering framework

A digital forensics tool that provides read-only access to file-system objects from various storage media types and file formats.

Dump iOS Frequent Locations from StateModel#.archive files.