810 lines
20 KiB
YAML
810 lines
20 KiB
YAML
tools:
|
|
# Disk & File System Analysis Tools
|
|
- name: Autopsy
|
|
description: >-
|
|
Open-Source digitale Forensik-Anwendung mit grafischer Benutzeroberfläche
|
|
für Festplatten- und Dateisystemanalyse. Besonders geeignet für die
|
|
Auswertungs- und Analyse-Phase mit umfangreichen Carving- und Timeline-Funktionen.
|
|
DIE Alternative für kommerzielle Software im Bereich, wenn es um die
|
|
kriminalistische Untersuchung von Images geht.
|
|
domains:
|
|
- incident-response
|
|
- law-enforcement
|
|
- malware-analysis
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
- analysis
|
|
- reporting
|
|
platforms:
|
|
- Windows
|
|
- Linux (Snap-Paket)
|
|
skillLevel: intermediate
|
|
accessType: download
|
|
url: https://www.autopsy.com/
|
|
projectUrl: ''
|
|
license: Apache 2.0
|
|
knowledgebase:
|
|
tags:
|
|
- disk-imaging
|
|
- file-carving
|
|
- timeline-analysis
|
|
- registry-analysis
|
|
- windows-artifacts
|
|
- linux-artifacts
|
|
- hash-verification
|
|
- dead-box-forensics
|
|
- plugin-architecture
|
|
- csv-export
|
|
|
|
# Memory Analysis Tools
|
|
- name: Volatility 3
|
|
description: >-
|
|
Fortgeschrittenes Memory-Forensik-Framework für Incident Response und
|
|
Malware-Analyse mit Plugin-Architektur. Hauptsächlich für die
|
|
Auswertungs- und Analysephase von RAM-Dumps geeignet.
|
|
domains:
|
|
- incident-response
|
|
- malware-analysis
|
|
- law-enforcement
|
|
phases:
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Windows
|
|
- Linux
|
|
- macOS
|
|
skillLevel: advanced
|
|
accessType: download
|
|
url: https://www.volatilityfoundation.org/
|
|
projectUrl: ''
|
|
license: VSL
|
|
knowledgebase:
|
|
tags:
|
|
- memory-analysis
|
|
- malware-detection
|
|
- process-analysis
|
|
- plugin-architecture
|
|
- python-scripting
|
|
- windows-artifacts
|
|
- linux-artifacts
|
|
- live-forensics
|
|
- dead-box-forensics
|
|
- json-export
|
|
|
|
# Incident Response Platforms
|
|
- name: TheHive 5
|
|
description: >-
|
|
Kollaborative Security-Incident-Response-Plattform für SOCs, CERTs und
|
|
Sicherheitsteams mit Case-Management. Ideal für alle Phasen einer
|
|
Untersuchung, besonders für Koordination und Berichterstattung.
|
|
Keine Erfahrungswerte.
|
|
domains:
|
|
- incident-response
|
|
- law-enforcement
|
|
- fraud-investigation
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
- analysis
|
|
- reporting
|
|
platforms:
|
|
- Web
|
|
skillLevel: intermediate
|
|
accessType: self-hosted
|
|
url: https://strangebee.com/
|
|
projectUrl: ''
|
|
license: Community Edition (Free) / Commercial
|
|
knowledgebase:
|
|
tags:
|
|
- case-management
|
|
- team-collaboration
|
|
- api-available
|
|
- automation
|
|
- misp-integration
|
|
- alert-management
|
|
- multi-tenancy
|
|
- workflow-automation
|
|
- json-export
|
|
- reporting-tools
|
|
statusUrl: https://uptime.example.lab/api/badge/1/status
|
|
|
|
- name: MISP
|
|
description: >-
|
|
Threat-Intelligence-Plattform für strukturierten Austausch von IoCs.
|
|
Primär für Datensammlung und -anreicherung, unterstützt aber auch
|
|
Analyse durch Korrelation von Bedrohungsdaten.
|
|
domains:
|
|
- incident-response
|
|
- malware-analysis
|
|
- network-forensics
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Web
|
|
skillLevel: intermediate
|
|
accessType: self-hosted
|
|
url: https://misp-project.org/
|
|
projectUrl: https://misp.cc24.dev
|
|
license: AGPL-3.0
|
|
knowledgebase:
|
|
tags:
|
|
- threat-intelligence
|
|
- ioc-sharing
|
|
- api-available
|
|
- automation
|
|
- correlation-engine
|
|
- taxonomy-support
|
|
- feed-integration
|
|
- json-export
|
|
- stix-support
|
|
statusUrl: https://status.mikoshi.de/api/badge/34/status
|
|
|
|
- name: Timesketch
|
|
description: >-
|
|
Kollaborative forensische Timeline-Analyse-Plattform. Hauptsächlich
|
|
für die Analysephase konzipiert, unterstützt chronologische
|
|
Ereigniskorrelation aus verschiedenen Quellen.
|
|
domains:
|
|
- incident-response
|
|
- law-enforcement
|
|
- fraud-investigation
|
|
phases:
|
|
- analysis
|
|
- reporting
|
|
platforms:
|
|
- Web
|
|
skillLevel: intermediate
|
|
accessType: self-hosted
|
|
url: https://timesketch.org/
|
|
projectUrl: https://timesketch.cc24.dev
|
|
license: Apache 2.0
|
|
knowledgebase:
|
|
tags:
|
|
- timeline-analysis
|
|
- data-visualization
|
|
- plaso-integration
|
|
- collaborative-analysis
|
|
- search-capabilities
|
|
- event-correlation
|
|
- csv-import
|
|
- api-available
|
|
statusUrl: https://uptime.example.lab/api/badge/3/status
|
|
|
|
# Network Analysis Tools
|
|
- name: Wireshark
|
|
description: >-
|
|
Netzwerk-Protokoll-Analyzer für Paketaufzeichnung und -analyse.
|
|
Primär für Datensammlung und Auswertung von Netzwerkverkehr,
|
|
unterstützt über 2000 Protokolle.
|
|
domains:
|
|
- network-forensics
|
|
- incident-response
|
|
- malware-analysis
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Windows
|
|
- Linux
|
|
- macOS
|
|
skillLevel: intermediate
|
|
accessType: download
|
|
url: https://www.wireshark.org/
|
|
projectUrl: ''
|
|
license: GPL-2.0
|
|
knowledgebase:
|
|
tags:
|
|
- packet-capture
|
|
- protocol-analysis
|
|
- live-capture
|
|
- pcap-analysis
|
|
- filter-capabilities
|
|
- statistics-generation
|
|
- export-formats
|
|
- plugin-support
|
|
- tls-decryption
|
|
|
|
# Commercial Tools (Well-known)
|
|
- name: Magnet AXIOM
|
|
description: >-
|
|
Umfassende digitale Forensik-Plattform für Computer und Mobilgeräte.
|
|
Deckt alle Phasen ab mit besonderem Fokus auf automatisierte
|
|
Artefakt-Erkennung und Cloud-Forensik.
|
|
domains:
|
|
- law-enforcement
|
|
- incident-response
|
|
- mobile-forensics
|
|
- cloud-forensics
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
- analysis
|
|
- reporting
|
|
platforms:
|
|
- Windows
|
|
skillLevel: intermediate
|
|
accessType: commercial
|
|
url: https://www.magnetforensics.com/products/magnet-axiom/
|
|
projectUrl: ''
|
|
license: Proprietary
|
|
knowledgebase:
|
|
tags:
|
|
- mobile-forensics
|
|
- cloud-acquisition
|
|
- artifact-recovery
|
|
- timeline-generation
|
|
- ai-categorization
|
|
- report-generation
|
|
- court-admissible
|
|
- image-analysis
|
|
|
|
- name: Cellebrite UFED
|
|
description: >-
|
|
Führende Mobile-Forensik-Lösung für Extraktion und Analyse von
|
|
Smartphones und Tablets. Primär für Datensammlung und Auswertung
|
|
mobiler Geräte konzipiert.
|
|
domains:
|
|
- law-enforcement
|
|
- mobile-forensics
|
|
- incident-response
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Windows
|
|
- Hardware
|
|
skillLevel: intermediate
|
|
accessType: commercial
|
|
url: https://cellebrite.com/en/ufed/
|
|
projectUrl: ''
|
|
license: Proprietary
|
|
knowledgebase:
|
|
tags:
|
|
- mobile-extraction
|
|
- physical-extraction
|
|
- logical-extraction
|
|
- password-bypass
|
|
- app-analysis
|
|
- deleted-data-recovery
|
|
- report-generation
|
|
- court-admissible
|
|
|
|
# Malware Analysis Tools
|
|
- name: Cuckoo Sandbox 3
|
|
description: >-
|
|
Automatisiertes Malware-Analysesystem der neuesten Generation.
|
|
Hauptsächlich für die Analysephase mit dynamischer Verhaltensanalyse
|
|
in isolierten Umgebungen.
|
|
domains:
|
|
- malware-analysis
|
|
- incident-response
|
|
phases:
|
|
- analysis
|
|
platforms:
|
|
- Linux
|
|
skillLevel: advanced
|
|
accessType: self-hosted
|
|
url: https://github.com/cert-ee/cuckoo3
|
|
projectUrl: ''
|
|
license: GPL-3.0
|
|
knowledgebase:
|
|
tags:
|
|
- dynamic-analysis
|
|
- behavior-monitoring
|
|
- sandbox-analysis
|
|
- api-monitoring
|
|
- network-monitoring
|
|
- yara-integration
|
|
- automated-analysis
|
|
- json-export
|
|
- malware-detection
|
|
statusUrl: ''
|
|
|
|
- name: Ghidra
|
|
description: >-
|
|
NSA-entwickeltes Reverse-Engineering-Framework für statische
|
|
Malware-Analyse. Primär für tiefgehende Code-Analyse in der
|
|
Analysephase.
|
|
domains:
|
|
- malware-analysis
|
|
- ics-forensics
|
|
phases:
|
|
- analysis
|
|
platforms:
|
|
- Windows
|
|
- Linux
|
|
- macOS
|
|
skillLevel: expert
|
|
accessType: download
|
|
url: https://ghidra-sre.org/
|
|
projectUrl: ''
|
|
license: Apache 2.0
|
|
knowledgebase:
|
|
tags:
|
|
- reverse-engineering
|
|
- disassembly
|
|
- decompilation
|
|
- scripting-support
|
|
- multi-architecture
|
|
- collaborative-re
|
|
- plugin-architecture
|
|
- binary-analysis
|
|
|
|
# Data Processing & Analysis
|
|
- name: Plaso (log2timeline)
|
|
description: >-
|
|
Tool zur automatischen Erstellung von Super-Timelines. Hauptsächlich
|
|
für Datensammlung und Auswertung, bereitet Zeitstempel-Daten für
|
|
die Analyse vor.
|
|
domains:
|
|
- incident-response
|
|
- law-enforcement
|
|
- fraud-investigation
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
platforms:
|
|
- Linux
|
|
- Windows
|
|
- macOS
|
|
skillLevel: intermediate
|
|
accessType: download
|
|
url: https://plaso.readthedocs.io/
|
|
projectUrl: ''
|
|
license: Apache 2.0
|
|
knowledgebase:
|
|
tags:
|
|
- timeline-generation
|
|
- log-parsing
|
|
- artifact-parsing
|
|
- multi-format-support
|
|
- elasticsearch-output
|
|
- timesketch-integration
|
|
- automation
|
|
- batch-processing
|
|
|
|
- name: CyberChef
|
|
description: >-
|
|
Web-basiertes Tool für Datenmanipulation und -analyse. Vielseitig
|
|
einsetzbar in Auswertung und Analyse für Dekodierung, Verschlüsselung
|
|
und Datenextraktion.
|
|
domains:
|
|
- incident-response
|
|
- malware-analysis
|
|
- network-forensics
|
|
- fraud-investigation
|
|
phases:
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Web
|
|
skillLevel: beginner
|
|
accessType: web-based
|
|
url: https://gchq.github.io/CyberChef/
|
|
projectUrl: ''
|
|
license: Apache 2.0
|
|
knowledgebase:
|
|
tags:
|
|
- data-transformation
|
|
- encoding-decoding
|
|
- encryption-tools
|
|
- regex-extraction
|
|
- file-analysis
|
|
- magic-detection
|
|
- recipe-automation
|
|
- offline-capable
|
|
|
|
# Remote Forensics & Endpoint Detection
|
|
- name: Velociraptor
|
|
description: >-
|
|
Endpoint-Visibility- und DFIR-Tool für Hunting und Remote-Forensik.
|
|
Exzellent für Datensammlung in großen Netzwerken, unterstützt
|
|
alle Phasen durch VQL-Abfragen.
|
|
domains:
|
|
- incident-response
|
|
- malware-analysis
|
|
- law-enforcement
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
- analysis
|
|
- reporting
|
|
platforms:
|
|
- Windows
|
|
- Linux
|
|
- macOS
|
|
skillLevel: advanced
|
|
accessType: self-hosted
|
|
url: https://www.velociraptor.app/
|
|
projectUrl: https://raptor.cc24.dev
|
|
license: Apache 2.0
|
|
knowledgebase:
|
|
tags:
|
|
- remote-collection
|
|
- live-forensics
|
|
- hunt-queries
|
|
- vql-language
|
|
- artifact-collection
|
|
- event-monitoring
|
|
- scalable-deployment
|
|
- api-available
|
|
- reporting-notebooks
|
|
statusUrl: https://status.mikoshi.de/api/badge/33/status
|
|
|
|
- name: GRR Rapid Response
|
|
description: >-
|
|
Remote-Live-Forensik von Google für skalierbare Incident-Response.
|
|
Fokus auf Datensammlung in Unternehmensnetzwerken mit
|
|
Hunt-Funktionalität.
|
|
domains:
|
|
- incident-response
|
|
- law-enforcement
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
platforms:
|
|
- Linux
|
|
- Windows
|
|
- macOS
|
|
skillLevel: advanced
|
|
accessType: self-hosted
|
|
url: https://github.com/google/grr
|
|
projectUrl: ''
|
|
license: Apache 2.0
|
|
knowledgebase:
|
|
tags:
|
|
- remote-forensics
|
|
- scalable-collection
|
|
- hunt-capability
|
|
- flow-automation
|
|
- artifact-collection
|
|
- memory-acquisition
|
|
- api-available
|
|
- enterprise-ready
|
|
statusUrl: ''
|
|
|
|
# Network Packet Analysis
|
|
- name: Arkime (formerly Moloch)
|
|
description: >-
|
|
Skalierbare Full-Packet-Capture-Plattform für große Netzwerke.
|
|
Primär für Datensammlung und Auswertung von Netzwerkverkehr
|
|
über längere Zeiträume.
|
|
domains:
|
|
- network-forensics
|
|
- incident-response
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Linux
|
|
skillLevel: expert
|
|
accessType: self-hosted
|
|
url: https://arkime.com/
|
|
projectUrl: ''
|
|
license: Apache 2.0
|
|
knowledgebase:
|
|
tags:
|
|
- full-packet-capture
|
|
- pcap-indexing
|
|
- session-analysis
|
|
- elasticsearch-backend
|
|
- api-available
|
|
- scalable-storage
|
|
- query-language
|
|
- visualization
|
|
statusUrl: ''
|
|
|
|
- name: NetworkMiner
|
|
description: >-
|
|
Netzwerk-Forensik-Tool für Paket-Analyse und Datei-Extraktion.
|
|
Spezialisiert auf Auswertung von PCAP-Dateien und Extraktion
|
|
übertragener Inhalte.
|
|
domains:
|
|
- network-forensics
|
|
- incident-response
|
|
phases:
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Windows
|
|
- Linux (Mono)
|
|
skillLevel: beginner
|
|
accessType: download
|
|
url: https://www.netresec.com/?page=NetworkMiner
|
|
projectUrl: ''
|
|
license: GPL-2.0 / Commercial
|
|
knowledgebase:
|
|
tags:
|
|
- pcap-analysis
|
|
- file-extraction
|
|
- credential-extraction
|
|
- os-fingerprinting
|
|
- session-reconstruction
|
|
- image-extraction
|
|
- certificate-extraction
|
|
- passive-analysis
|
|
|
|
# Triage & Collection Tools
|
|
- name: KAPE
|
|
description: >-
|
|
Kroll Artifact Parser and Extractor für schnelle Triage.
|
|
Hauptsächlich für automatisierte Datensammlung mit modularem
|
|
Ansatz und Target/Module-System.
|
|
domains:
|
|
- incident-response
|
|
- law-enforcement
|
|
phases:
|
|
- data-collection
|
|
- examination
|
|
platforms:
|
|
- Windows
|
|
skillLevel: intermediate
|
|
accessType: download
|
|
url: >-
|
|
https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape
|
|
projectUrl: ''
|
|
license: Freeware
|
|
knowledgebase:
|
|
tags:
|
|
- triage-collection
|
|
- artifact-parsing
|
|
- modular-framework
|
|
- target-system
|
|
- batch-processing
|
|
- portable-tool
|
|
- automated-collection
|
|
- windows-artifacts
|
|
|
|
# Metadata & File Analysis
|
|
- name: ExifTool
|
|
description: >-
|
|
Universelles Metadaten-Tool für über 200 Dateiformate. Unverzichtbar
|
|
für Auswertung von Bild- und Dokumentmetadaten in allen
|
|
forensischen Szenarien.
|
|
domains:
|
|
- law-enforcement
|
|
- incident-response
|
|
- fraud-investigation
|
|
phases:
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Windows
|
|
- Linux
|
|
- macOS
|
|
skillLevel: novice
|
|
accessType: download
|
|
url: https://exiftool.org/
|
|
projectUrl: ''
|
|
license: Perl Artistic License
|
|
knowledgebase:
|
|
tags:
|
|
- metadata-extraction
|
|
- exif-analysis
|
|
- gps-extraction
|
|
- batch-processing
|
|
- command-line
|
|
- scripting-support
|
|
- multi-format
|
|
- portable-tool
|
|
|
|
# Financial & Fraud Investigation
|
|
- name: Chainalysis
|
|
description: >-
|
|
Führende Blockchain-Intelligence-Plattform für Kryptowährungs-
|
|
Ermittlungen. Primär für Analyse von Geldflüssen und
|
|
Wallet-Verbindungen.
|
|
domains:
|
|
- fraud-investigation
|
|
- law-enforcement
|
|
phases:
|
|
- analysis
|
|
- reporting
|
|
platforms:
|
|
- Web
|
|
skillLevel: advanced
|
|
accessType: commercial
|
|
url: https://www.chainalysis.com/
|
|
projectUrl: ''
|
|
license: Proprietary
|
|
knowledgebase:
|
|
tags:
|
|
- blockchain-analysis
|
|
- crypto-tracing
|
|
- wallet-clustering
|
|
- risk-scoring
|
|
- compliance-tools
|
|
- transaction-monitoring
|
|
- visualization
|
|
- api-available
|
|
|
|
# Visualization & Analysis
|
|
- name: Neo4j
|
|
description: >-
|
|
Graph-Datenbank für Visualisierung komplexer Beziehungen.
|
|
Besonders wertvoll in der Analysephase für Netzwerk- und
|
|
Verbindungsanalysen.
|
|
domains:
|
|
- fraud-investigation
|
|
- law-enforcement
|
|
- incident-response
|
|
phases:
|
|
- analysis
|
|
- reporting
|
|
platforms:
|
|
- Web
|
|
- Windows
|
|
- Linux
|
|
- macOS
|
|
skillLevel: intermediate
|
|
accessType: self-hosted
|
|
url: https://neo4j.com/
|
|
projectUrl: https://graph.cc24.dev
|
|
license: GPL-3.0 / Commercial
|
|
knowledgebase:
|
|
tags:
|
|
- graph-database
|
|
- relationship-analysis
|
|
- data-visualization
|
|
- cypher-query
|
|
- pattern-detection
|
|
- api-available
|
|
- import-tools
|
|
- scalable-analysis
|
|
statusUrl: https://status.mikoshi.de/api/badge/32/status
|
|
|
|
- name: QGIS
|
|
description: >-
|
|
Open-Source Geoinformationssystem für räumliche Datenanalyse.
|
|
Wertvoll für Berichterstattung bei Fällen mit GPS-Daten aus
|
|
Smartphones oder Fahrzeugen.
|
|
domains:
|
|
- law-enforcement
|
|
- mobile-forensics
|
|
phases:
|
|
- analysis
|
|
- reporting
|
|
platforms:
|
|
- Windows
|
|
- Linux
|
|
- macOS
|
|
skillLevel: intermediate
|
|
accessType: download
|
|
url: https://qgis.org/
|
|
projectUrl: ''
|
|
license: GPL-2.0
|
|
knowledgebase:
|
|
tags:
|
|
- geospatial-analysis
|
|
- gps-visualization
|
|
- map-generation
|
|
- coordinate-analysis
|
|
- timeline-mapping
|
|
- export-formats
|
|
- plugin-ecosystem
|
|
- python-scripting
|
|
|
|
# Collaboration & Documentation
|
|
- name: Nextcloud
|
|
description: >-
|
|
Self-Hosted-Plattform für sicheren Dateiaustausch. Ideal für
|
|
kollaborative Phasen und sichere Speicherung von Beweismitteln
|
|
mit Versionierung.
|
|
domains:
|
|
phases:
|
|
- collaboration-general
|
|
platforms:
|
|
- Web
|
|
skillLevel: novice
|
|
accessType: self-hosted
|
|
url: https://nextcloud.com/
|
|
projectUrl: https://cloud.cc24.dev
|
|
license: AGPL-3.0
|
|
knowledgebase:
|
|
tags:
|
|
- file-sharing
|
|
- collaboration
|
|
- encryption
|
|
- version-control
|
|
- access-control
|
|
- audit-logging
|
|
- mobile-sync
|
|
- api-available
|
|
statusUrl: https://status.mikoshi.de/api/badge/11/status
|
|
|
|
- name: Gitea
|
|
description: >-
|
|
Leichtgewichtiger Git-Service für Versionskontrolle. Nützlich
|
|
für Dokumentation von Skripten, Playbooks und forensischen
|
|
Prozeduren.
|
|
domains:
|
|
- incident-response
|
|
- malware-analysis
|
|
phases:
|
|
- collaboration-general
|
|
platforms:
|
|
- Web
|
|
skillLevel: beginner
|
|
accessType: self-hosted
|
|
url: https://gitea.io/
|
|
projectUrl: https://git.cc24.dev
|
|
license: MIT
|
|
knowledgebase:
|
|
tags:
|
|
- version-control
|
|
- code-repository
|
|
- documentation
|
|
- collaboration
|
|
- issue-tracking
|
|
- markdown-support
|
|
- api-available
|
|
- lightweight
|
|
statusUrl: https://status.mikoshi.de/api/badge/18/status
|
|
|
|
# Additional Tools
|
|
- name: Binwalk
|
|
description: >-
|
|
Firmware-Analyse-Tool für eingebettete Dateisysteme. Spezialisiert
|
|
auf Extraktion und Analyse von Firmware-Images in IoT- und
|
|
ICS-Forensik.
|
|
domains:
|
|
- ics-forensics
|
|
- malware-analysis
|
|
- mobile-forensics
|
|
phases:
|
|
- examination
|
|
- analysis
|
|
platforms:
|
|
- Linux
|
|
- macOS
|
|
skillLevel: advanced
|
|
accessType: download
|
|
url: https://github.com/ReFirmLabs/binwalk
|
|
projectUrl: ''
|
|
license: MIT
|
|
knowledgebase:
|
|
tags:
|
|
- firmware-analysis
|
|
- file-carving
|
|
- entropy-analysis
|
|
- signature-scanning
|
|
- extraction-tool
|
|
- iot-forensics
|
|
- embedded-systems
|
|
- python-api
|
|
|
|
domains:
|
|
- id: incident-response
|
|
name: Incident Response & Breach-Untersuchung
|
|
- id: law-enforcement
|
|
name: Strafverfolgung & Kriminalermittlung
|
|
- id: malware-analysis
|
|
name: Malware-Analyse & Reverse Engineering
|
|
- id: fraud-investigation
|
|
name: Betrugs- & Finanzkriminalität
|
|
- id: network-forensics
|
|
name: Netzwerk-Forensik & Traffic-Analyse
|
|
- id: mobile-forensics
|
|
name: Mobile Geräte & App-Forensik
|
|
- id: cloud-forensics
|
|
name: Cloud & Virtuelle Umgebungen
|
|
- id: ics-forensics
|
|
name: Industrielle Kontrollsysteme (ICS/SCADA)
|
|
|
|
phases:
|
|
- id: data-collection
|
|
name: Datensammlung
|
|
- id: examination
|
|
name: Auswertung
|
|
- id: analysis
|
|
name: Analyse
|
|
- id: reporting
|
|
name: Bericht & Präsentation
|
|
- id: collaboration-general
|
|
name: Übergreifend & Kollaboration |