content
This commit is contained in:
overcuriousity
parent
a0955c2e58
commit
f00e2d3cfd
@ -3367,6 +3367,244 @@ tools:
|
||||
accessType: download
|
||||
license: "MPL\_/ AGPL"
|
||||
knowledgebase: false
|
||||
- name: ShadowExplorer
|
||||
icon: 🗂️
|
||||
type: software
|
||||
description: >-
|
||||
Das schlanke Windows-Tool macht Volume-Shadow-Copy-Snapshots auch in Home-Editionen sichtbar und erlaubt das komfortable Durchstöbern sowie Wiederherstellen früherer Datei-Versionen. Damit lassen sich versehentlich gelöschte oder überschriebene Dateien in Sekunden zurückholen – geeignet für schnelle Triage und klassische Datenträgerforensik.
|
||||
domains:
|
||||
- static-investigations
|
||||
- incident-response
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- Windows
|
||||
related_software:
|
||||
- OSFMount
|
||||
- PhotoRec
|
||||
domain-agnostic-software: null
|
||||
skillLevel: novice
|
||||
accessType: download
|
||||
url: https://www.shadowexplorer.com/
|
||||
license: Freeware
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- gui
|
||||
- shadow-copy
|
||||
- snapshot-browsing
|
||||
- file-recovery
|
||||
- previous-versions
|
||||
- scenario:file_recovery
|
||||
- point-in-time-restore
|
||||
related_concepts:
|
||||
- Digital Evidence Chain of Custody
|
||||
|
||||
|
||||
- name: Sonic Visualiser
|
||||
icon: 🎵
|
||||
type: software
|
||||
description: >-
|
||||
Die Open-Source-Audio-Analyse-Suite wird in der Forensik eingesetzt,
|
||||
um Wave- und Kompressionsformate bis auf Sample-Ebene zu untersuchen.
|
||||
Spektrogramm-Visualisierung, Zeit-/Frequenz-Annotationen und
|
||||
Transkriptions-Plugins (Vamp) helfen, Manipulationen wie
|
||||
Bandpass-Filter, Time-Stretching oder Insert-Edits nachzuweisen.
|
||||
FFT- und Mel-Spectral-Views decken versteckte Audio-Watermarks oder
|
||||
Steganografie auf. Export-Funktionen in CSV/JSON erlauben die
|
||||
Weiterverarbeitung in Python-Notebooks oder SIEM-Pipelines.
|
||||
Ideal für Voice-Authentication-Checks, Deep-Fake-Erkennung
|
||||
und Beweisaufbereitung vor Gericht.
|
||||
skillLevel: intermediate
|
||||
url: https://www.sonicvisualiser.org/
|
||||
domains:
|
||||
- static-investigations
|
||||
- fraud-investigation
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
- reporting
|
||||
platforms:
|
||||
- Windows
|
||||
- Linux
|
||||
- macOS
|
||||
accessType: download
|
||||
license: GPL-2.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- gui
|
||||
- audio-forensics
|
||||
- spectrogram
|
||||
- plugin-support
|
||||
- annotation
|
||||
- csv-export
|
||||
related_concepts: []
|
||||
related_software:
|
||||
- Audacity
|
||||
|
||||
- name: Dissect
|
||||
icon: 🧩
|
||||
type: software
|
||||
description: >-
|
||||
Fox-ITs Python-Framework abstrahiert Windows- und Linux-Speicherabbilder
|
||||
in virtuelle Objekte (Prozesse, Dateien, Registry, Kernel-Strukturen),
|
||||
ohne zuvor ein Profil definieren zu müssen. Modularer
|
||||
Hypervisor-Layer erlaubt das Mounten und gleichzeitige Analysieren
|
||||
mehrerer Memory-Dumps – perfekt für großflächige Incident-Response.
|
||||
Plugins dekodieren PTEs, handle tables, APC-Queues und liefern
|
||||
YARA-kompatible Scans. Die Zero-Copy-Architektur beschleunigt Queries auf
|
||||
Multi-GB-Images signifikant. Unterstützt Windows 11 24H2-Kernel sowie
|
||||
Linux 6.x-schichten ab Juli 2025.
|
||||
skillLevel: advanced
|
||||
url: https://github.com/fox-it/dissect
|
||||
domains:
|
||||
- incident-response
|
||||
- malware-analysis
|
||||
- static-investigations
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- Windows
|
||||
- Linux
|
||||
- macOS
|
||||
accessType: download
|
||||
license: Apache 2.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- command-line
|
||||
- memory-analysis
|
||||
- plugin-support
|
||||
- python-library
|
||||
- zero-copy
|
||||
- profile-less
|
||||
related_concepts:
|
||||
- Regular Expressions (Regex)
|
||||
related_software:
|
||||
- Volatility 3
|
||||
- Rekall
|
||||
|
||||
- name: Docker Explorer
|
||||
icon: 🐳
|
||||
type: software
|
||||
description: >-
|
||||
Googles Forensik-Toolkit zerlegt Offline-Docker-Volumes und
|
||||
Overlay-Dateisysteme ohne laufenden Daemon. Es extrahiert
|
||||
Container-Config, Image-Layer, ENV-Variablen, Mounted-Secrets
|
||||
und schreibt Timeline-fähige Metadata-JSONs. Unterstützt btrfs,
|
||||
overlay2 und zfs Storage-Driver sowie Docker Desktop (macOS/Windows).
|
||||
Perfekt, um bösartige Images nach Supply-Chain-Attacken zu enttarnen
|
||||
oder flüchtige Container nach einem Incident nachträglich zu analysieren.
|
||||
skillLevel: intermediate
|
||||
url: https://github.com/google/docker-explorer
|
||||
domains:
|
||||
- cloud-forensics
|
||||
- incident-response
|
||||
- static-investigations
|
||||
phases:
|
||||
- data-collection
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- Linux
|
||||
- macOS
|
||||
- Windows
|
||||
accessType: download
|
||||
license: Apache 2.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- command-line
|
||||
- container-forensics
|
||||
- docker
|
||||
- timeline
|
||||
- json-export
|
||||
- supply-chain
|
||||
related_concepts: []
|
||||
related_software:
|
||||
- Velociraptor
|
||||
- osquery
|
||||
|
||||
- name: Ghiro
|
||||
icon: 🖼️
|
||||
type: software
|
||||
description: >-
|
||||
Die Web-basierte Bildforensik-Plattform automatisiert EXIF-Analyse,
|
||||
Hash-Matching, Error-Level-Evaluation (ELA) und
|
||||
Steganografie-Erkennung für große Dateibatches. Unterstützt
|
||||
Gesichts- und NSFW-Detection sowie GPS-Reverse-Geocoding für
|
||||
Bewegungsprofile. Reports sind gerichtsfest
|
||||
versioniert, REST-API und Celery-Worker skalieren auf
|
||||
Millionen Bilder – ideal für CSAM-Ermittlungen oder Fake-News-Prüfung.
|
||||
skillLevel: intermediate
|
||||
url: https://getghiro.org/
|
||||
domains:
|
||||
- static-investigations
|
||||
- fraud-investigation
|
||||
- mobile-forensics
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
- reporting
|
||||
platforms:
|
||||
- Web
|
||||
- Linux
|
||||
accessType: server-based
|
||||
license: GPL-2.0
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- web-interface
|
||||
- image-forensics
|
||||
- exif-analysis
|
||||
- steganography
|
||||
- nsfw-detection
|
||||
- batch-processing
|
||||
related_concepts:
|
||||
- Hash Functions & Digital Signatures
|
||||
related_software:
|
||||
- ExifTool
|
||||
- PhotoRec
|
||||
|
||||
- name: Sherloq
|
||||
icon: 🔍
|
||||
type: software
|
||||
description: >-
|
||||
Das Python-GUI-Toolkit für visuelle Datei-Analyse kombiniert
|
||||
klassische Reverse-Steganografie-Techniken (LSB, Palette-Tweaking,
|
||||
DCT-Coefficient-Scanning) mit modernen CV-Algorithmen.
|
||||
Heatmaps und Histogramm-Diffs zeigen Manipulations-Hotspots,
|
||||
während eine „Carve-All-Layers“-Funktion versteckte Daten in PNG,
|
||||
JPEG, BMP, GIF und Audio-Spectra aufspürt. Plugins für zsteg,
|
||||
binwalk und exiftool erweitern die Pipeline.
|
||||
Eine Must-have-Ergänzung zu Ghidra & friends, wenn
|
||||
Malware Dateien als Dead-Drop nutzt.
|
||||
skillLevel: intermediate
|
||||
url: https://github.com/GuidoBartoli/sherloq
|
||||
domains:
|
||||
- malware-analysis
|
||||
- static-investigations
|
||||
phases:
|
||||
- examination
|
||||
- analysis
|
||||
platforms:
|
||||
- Windows
|
||||
- Linux
|
||||
- macOS
|
||||
accessType: download
|
||||
license: MIT
|
||||
knowledgebase: false
|
||||
tags:
|
||||
- gui
|
||||
- image-forensics
|
||||
- steganography
|
||||
- lsb-extraction
|
||||
- histogram-analysis
|
||||
- plugin-support
|
||||
related_concepts:
|
||||
- Regular Expressions (Regex)
|
||||
related_software:
|
||||
- Ghiro
|
||||
- CyberChef
|
||||
|
||||
- name: Cortex
|
||||
type: software
|
||||
description: >-
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user