144 lines
4.3 KiB
Plaintext
144 lines
4.3 KiB
Plaintext
tools:
|
|
- name: Autopsy
|
|
type: software
|
|
description: >-
|
|
Die führende Open-Source-Alternative zu kommerziellen Forensik-Suiten mit
|
|
intuitiver grafischer Oberfläche. Besonders stark in der Timeline-Analyse,
|
|
Keyword-Suche und dem Carving gelöschter Dateien. Die modulare
|
|
Plugin-Architektur erlaubt Erweiterungen für spezielle
|
|
Untersuchungsszenarien. Zwar komplexer als kommerzielle Lösungen, aber
|
|
dafür vollständig transparent und kostenfrei.
|
|
skillLevel: intermediate
|
|
url: https://www.autopsy.com/
|
|
icon: 📦
|
|
domains:
|
|
- incident-response
|
|
- static-investigations
|
|
- malware-analysis
|
|
- mobile-forensics
|
|
- cloud-forensics
|
|
phases:
|
|
- examination
|
|
- analysis
|
|
tags:
|
|
- gui
|
|
- filesystem
|
|
- timeline-analysis
|
|
- carving
|
|
- artifact-extraction
|
|
- keyword-search
|
|
- scenario:file_recovery
|
|
- scenario:browser_history
|
|
related_concepts:
|
|
- SQL Query Fundamentals
|
|
- Hash Functions & Digital Signatures
|
|
platforms:
|
|
- Windows
|
|
- Linux
|
|
accessType: download
|
|
license: Apache 2.0
|
|
knowledgebase: false
|
|
- name: Volatility 3
|
|
type: software
|
|
description: >-
|
|
Das Universalwerkzeug der Live-Forensik, unverzichtbar für die Analyse von
|
|
RAM-Dumps. Mit über 100 Plugins extrahiert es Prozesse,
|
|
Netzwerkverbindungen, Registry-Keys und versteckte Malware aus dem
|
|
Arbeitsspeicher. Die Python-basierte Architektur macht es flexibel
|
|
erweiterbar, erfordert aber solide Kommandozeilen-Kenntnisse. Version 3
|
|
bringt deutliche Performance-Verbesserungen und bessere
|
|
Formatunterstützung.
|
|
skillLevel: advanced
|
|
url: https://www.volatilityfoundation.org/
|
|
icon: 📦
|
|
domains:
|
|
- incident-response
|
|
- static-investigations
|
|
- malware-analysis
|
|
- network-forensics
|
|
phases:
|
|
- examination
|
|
- analysis
|
|
scenarios:
|
|
- scenario:memory_dump
|
|
tags:
|
|
- commandline
|
|
- memory
|
|
- malware-analysis
|
|
- artifact-extraction
|
|
- scripting
|
|
- process-analysis
|
|
related_concepts:
|
|
- Hash Functions & Digital Signatures
|
|
- Regular Expressions (Regex)
|
|
platforms:
|
|
- Windows
|
|
- Linux
|
|
- macOS
|
|
accessType: download
|
|
license: VSL
|
|
knowledgebase: false
|
|
domains:
|
|
- id: incident-response
|
|
name: Incident Response & Breach-Untersuchung
|
|
- id: static-investigations
|
|
name: Datenträgerforensik & Ermittlungen
|
|
- id: malware-analysis
|
|
name: Malware-Analyse & Reverse Engineering
|
|
- id: fraud-investigation
|
|
name: Betrugs- & Finanzkriminalität
|
|
- id: network-forensics
|
|
name: Netzwerk-Forensik & Traffic-Analyse
|
|
- id: mobile-forensics
|
|
name: Mobile Geräte & App-Forensik
|
|
- id: cloud-forensics
|
|
name: Cloud & Virtuelle Umgebungen
|
|
- id: ics-forensics
|
|
name: Industrielle Kontrollsysteme (ICS/SCADA)
|
|
phases:
|
|
- id: data-collection
|
|
name: Datensammlung
|
|
description: Imaging, Acquisition, Remote Collection Tools
|
|
- id: examination
|
|
name: Auswertung
|
|
description: Parsing, Extraction, Initial Analysis Tools
|
|
- id: analysis
|
|
name: Analyse
|
|
description: Deep Analysis, Correlation, Visualization Tools
|
|
- id: reporting
|
|
name: Bericht & Präsentation
|
|
description: >-
|
|
Documentation, Visualization, Presentation Tools (z.B. QGIS für Geodaten,
|
|
Timeline-Tools)
|
|
domain-agnostic-software:
|
|
- id: collaboration-general
|
|
name: Übergreifend & Kollaboration
|
|
description: Cross-cutting tools and collaboration platforms
|
|
- id: specific-os
|
|
name: Betriebssysteme
|
|
description: Operating Systems which focus on forensics
|
|
scenarios:
|
|
- id: scenario:disk_imaging
|
|
icon: 💽
|
|
friendly_name: Datenträgerabbild
|
|
- id: scenario:memory_dump
|
|
icon: 🧠
|
|
friendly_name: RAM-Analyse
|
|
- id: scenario:file_recovery
|
|
icon: 🗑️
|
|
friendly_name: Datenrettung
|
|
- id: scenario:browser_history
|
|
icon: 🌍
|
|
friendly_name: Browser-Spuren
|
|
- id: scenario:credential_theft
|
|
icon: 🛑
|
|
friendly_name: Zugangsdiebstahl
|
|
- id: scenario:remote_access
|
|
icon: 📡
|
|
friendly_name: Fernzugriffe
|
|
- id: scenario:persistence
|
|
icon: ♻️
|
|
friendly_name: Persistenzsuche
|
|
- id: scenario:windows-registry
|
|
icon: 📜
|
|
friendly_name: Registry-Analyse |