forensic-ai #4
@ -3367,6 +3367,244 @@ tools:
|
|||||||
accessType: download
|
accessType: download
|
||||||
license: "MPL\_/ AGPL"
|
license: "MPL\_/ AGPL"
|
||||||
knowledgebase: false
|
knowledgebase: false
|
||||||
|
- name: ShadowExplorer
|
||||||
|
icon: 🗂️
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Das schlanke Windows-Tool macht Volume-Shadow-Copy-Snapshots auch in Home-Editionen sichtbar und erlaubt das komfortable Durchstöbern sowie Wiederherstellen früherer Datei-Versionen. Damit lassen sich versehentlich gelöschte oder überschriebene Dateien in Sekunden zurückholen – geeignet für schnelle Triage und klassische Datenträgerforensik.
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- incident-response
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- Windows
|
||||||
|
related_software:
|
||||||
|
- OSFMount
|
||||||
|
- PhotoRec
|
||||||
|
domain-agnostic-software: null
|
||||||
|
skillLevel: novice
|
||||||
|
accessType: download
|
||||||
|
url: https://www.shadowexplorer.com/
|
||||||
|
license: Freeware
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- gui
|
||||||
|
- shadow-copy
|
||||||
|
- snapshot-browsing
|
||||||
|
- file-recovery
|
||||||
|
- previous-versions
|
||||||
|
- scenario:file_recovery
|
||||||
|
- point-in-time-restore
|
||||||
|
related_concepts:
|
||||||
|
- Digital Evidence Chain of Custody
|
||||||
|
|
||||||
|
|
||||||
|
- name: Sonic Visualiser
|
||||||
|
icon: 🎵
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Die Open-Source-Audio-Analyse-Suite wird in der Forensik eingesetzt,
|
||||||
|
um Wave- und Kompressionsformate bis auf Sample-Ebene zu untersuchen.
|
||||||
|
Spektrogramm-Visualisierung, Zeit-/Frequenz-Annotationen und
|
||||||
|
Transkriptions-Plugins (Vamp) helfen, Manipulationen wie
|
||||||
|
Bandpass-Filter, Time-Stretching oder Insert-Edits nachzuweisen.
|
||||||
|
FFT- und Mel-Spectral-Views decken versteckte Audio-Watermarks oder
|
||||||
|
Steganografie auf. Export-Funktionen in CSV/JSON erlauben die
|
||||||
|
Weiterverarbeitung in Python-Notebooks oder SIEM-Pipelines.
|
||||||
|
Ideal für Voice-Authentication-Checks, Deep-Fake-Erkennung
|
||||||
|
und Beweisaufbereitung vor Gericht.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://www.sonicvisualiser.org/
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- fraud-investigation
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
- reporting
|
||||||
|
platforms:
|
||||||
|
- Windows
|
||||||
|
- Linux
|
||||||
|
- macOS
|
||||||
|
accessType: download
|
||||||
|
license: GPL-2.0
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- gui
|
||||||
|
- audio-forensics
|
||||||
|
- spectrogram
|
||||||
|
- plugin-support
|
||||||
|
- annotation
|
||||||
|
- csv-export
|
||||||
|
related_concepts: []
|
||||||
|
related_software:
|
||||||
|
- Audacity
|
||||||
|
|
||||||
|
- name: Dissect
|
||||||
|
icon: 🧩
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Fox-ITs Python-Framework abstrahiert Windows- und Linux-Speicherabbilder
|
||||||
|
in virtuelle Objekte (Prozesse, Dateien, Registry, Kernel-Strukturen),
|
||||||
|
ohne zuvor ein Profil definieren zu müssen. Modularer
|
||||||
|
Hypervisor-Layer erlaubt das Mounten und gleichzeitige Analysieren
|
||||||
|
mehrerer Memory-Dumps – perfekt für großflächige Incident-Response.
|
||||||
|
Plugins dekodieren PTEs, handle tables, APC-Queues und liefern
|
||||||
|
YARA-kompatible Scans. Die Zero-Copy-Architektur beschleunigt Queries auf
|
||||||
|
Multi-GB-Images signifikant. Unterstützt Windows 11 24H2-Kernel sowie
|
||||||
|
Linux 6.x-schichten ab Juli 2025.
|
||||||
|
skillLevel: advanced
|
||||||
|
url: https://github.com/fox-it/dissect
|
||||||
|
domains:
|
||||||
|
- incident-response
|
||||||
|
- malware-analysis
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- Windows
|
||||||
|
- Linux
|
||||||
|
- macOS
|
||||||
|
accessType: download
|
||||||
|
license: Apache 2.0
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- command-line
|
||||||
|
- memory-analysis
|
||||||
|
- plugin-support
|
||||||
|
- python-library
|
||||||
|
- zero-copy
|
||||||
|
- profile-less
|
||||||
|
related_concepts:
|
||||||
|
- Regular Expressions (Regex)
|
||||||
|
related_software:
|
||||||
|
- Volatility 3
|
||||||
|
- Rekall
|
||||||
|
|
||||||
|
- name: Docker Explorer
|
||||||
|
icon: 🐳
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Googles Forensik-Toolkit zerlegt Offline-Docker-Volumes und
|
||||||
|
Overlay-Dateisysteme ohne laufenden Daemon. Es extrahiert
|
||||||
|
Container-Config, Image-Layer, ENV-Variablen, Mounted-Secrets
|
||||||
|
und schreibt Timeline-fähige Metadata-JSONs. Unterstützt btrfs,
|
||||||
|
overlay2 und zfs Storage-Driver sowie Docker Desktop (macOS/Windows).
|
||||||
|
Perfekt, um bösartige Images nach Supply-Chain-Attacken zu enttarnen
|
||||||
|
oder flüchtige Container nach einem Incident nachträglich zu analysieren.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://github.com/google/docker-explorer
|
||||||
|
domains:
|
||||||
|
- cloud-forensics
|
||||||
|
- incident-response
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- data-collection
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- Linux
|
||||||
|
- macOS
|
||||||
|
- Windows
|
||||||
|
accessType: download
|
||||||
|
license: Apache 2.0
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- command-line
|
||||||
|
- container-forensics
|
||||||
|
- docker
|
||||||
|
- timeline
|
||||||
|
- json-export
|
||||||
|
- supply-chain
|
||||||
|
related_concepts: []
|
||||||
|
related_software:
|
||||||
|
- Velociraptor
|
||||||
|
- osquery
|
||||||
|
|
||||||
|
- name: Ghiro
|
||||||
|
icon: 🖼️
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Die Web-basierte Bildforensik-Plattform automatisiert EXIF-Analyse,
|
||||||
|
Hash-Matching, Error-Level-Evaluation (ELA) und
|
||||||
|
Steganografie-Erkennung für große Dateibatches. Unterstützt
|
||||||
|
Gesichts- und NSFW-Detection sowie GPS-Reverse-Geocoding für
|
||||||
|
Bewegungsprofile. Reports sind gerichtsfest
|
||||||
|
versioniert, REST-API und Celery-Worker skalieren auf
|
||||||
|
Millionen Bilder – ideal für CSAM-Ermittlungen oder Fake-News-Prüfung.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://getghiro.org/
|
||||||
|
domains:
|
||||||
|
- static-investigations
|
||||||
|
- fraud-investigation
|
||||||
|
- mobile-forensics
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
- reporting
|
||||||
|
platforms:
|
||||||
|
- Web
|
||||||
|
- Linux
|
||||||
|
accessType: server-based
|
||||||
|
license: GPL-2.0
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- web-interface
|
||||||
|
- image-forensics
|
||||||
|
- exif-analysis
|
||||||
|
- steganography
|
||||||
|
- nsfw-detection
|
||||||
|
- batch-processing
|
||||||
|
related_concepts:
|
||||||
|
- Hash Functions & Digital Signatures
|
||||||
|
related_software:
|
||||||
|
- ExifTool
|
||||||
|
- PhotoRec
|
||||||
|
|
||||||
|
- name: Sherloq
|
||||||
|
icon: 🔍
|
||||||
|
type: software
|
||||||
|
description: >-
|
||||||
|
Das Python-GUI-Toolkit für visuelle Datei-Analyse kombiniert
|
||||||
|
klassische Reverse-Steganografie-Techniken (LSB, Palette-Tweaking,
|
||||||
|
DCT-Coefficient-Scanning) mit modernen CV-Algorithmen.
|
||||||
|
Heatmaps und Histogramm-Diffs zeigen Manipulations-Hotspots,
|
||||||
|
während eine „Carve-All-Layers“-Funktion versteckte Daten in PNG,
|
||||||
|
JPEG, BMP, GIF und Audio-Spectra aufspürt. Plugins für zsteg,
|
||||||
|
binwalk und exiftool erweitern die Pipeline.
|
||||||
|
Eine Must-have-Ergänzung zu Ghidra & friends, wenn
|
||||||
|
Malware Dateien als Dead-Drop nutzt.
|
||||||
|
skillLevel: intermediate
|
||||||
|
url: https://github.com/GuidoBartoli/sherloq
|
||||||
|
domains:
|
||||||
|
- malware-analysis
|
||||||
|
- static-investigations
|
||||||
|
phases:
|
||||||
|
- examination
|
||||||
|
- analysis
|
||||||
|
platforms:
|
||||||
|
- Windows
|
||||||
|
- Linux
|
||||||
|
- macOS
|
||||||
|
accessType: download
|
||||||
|
license: MIT
|
||||||
|
knowledgebase: false
|
||||||
|
tags:
|
||||||
|
- gui
|
||||||
|
- image-forensics
|
||||||
|
- steganography
|
||||||
|
- lsb-extraction
|
||||||
|
- histogram-analysis
|
||||||
|
- plugin-support
|
||||||
|
related_concepts:
|
||||||
|
- Regular Expressions (Regex)
|
||||||
|
related_software:
|
||||||
|
- Ghiro
|
||||||
|
- CyberChef
|
||||||
|
|
||||||
- name: Cortex
|
- name: Cortex
|
||||||
type: software
|
type: software
|
||||||
description: >-
|
description: >-
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user