Tugas Digital Evidence 4

Sabtu, 28 Juni 2014

bisa juga dilihat di sini.

Laporan Kasus FEDA BankRobber.dd

Senin, 23 Juni 2014

link yang berkaitan dengan kasus ini
steganografi-pesan-tersembunyi
analisis-kasus-computer-crime-dengan 5W+1H

Eksplorasi bukti digital di Web Browser

Sabtu, 21 Juni 2014

Analysis Web Browser Forensic Using Browser Forensic Tools

Jumat, 20 Juni 2014

Browser history is one part in the search of digital evidence. As part of a lot of Digital Forensics investigations, obtaining information of the user’s browsing habits is an important step. There are various kind of Browser forensic tools, depend on the web browser itself. I will give some web browser analysis tools that useful in forensic investigation.

Odessa http://sourceforge.net/projects/odessa/

Odessa is an acronym for “Open Digital Evidence Search and Seizure Architecture” The intent of this project is to provide a completely open and extensible suite of tools for performing digital evidence analysis as well as a means of generating a usable report detailing the analysis and any findings. Odessa including Galleta, a tool for analyzing Internet Explorer cookies, Pasco, a tool for analyzing the Microsoft Windows index.dat file, and Rifiuti, a tool for investigating the Microsoft Windows recycle bin info2 file.

WBF (Web Browser Forensic) http://manuel.santander.name/wbf.html

wbf (Web Browser Forensics) is a C program intended to parse firefox, opera and epiphany web browser history files distributed in terms of the GNU General Public License.

BFT (Browser Forensic Toolkit) http://www.darkcomet-rat.com/bft.dc

This software is an advanced local browser history search engine, in less than few seconds it will extract the chosen keywords of most famous web browser, actually Internet Explorer, Google Chrome, Mozilla FireFox, RockMelt, Comodo Dragon and Opera. The program will attempt to find the keyword(s) in the history title and search, if the keyword is present or suspected to be, it will be display in the result list with his URL and Title.

CacheGrab http://www.cacheback.ca/download.asp?section=cachegrab

CacheGrab® is our standalone cache and history recovery tool that can be used on any logically mounted volume or virtual file system, including disks mounted using Physical Disk Emulation. CacheGrab does not require any purchase or licensing and may be used freely. Users should note that this version of the program only searches logical volumes at this time, and the ability to search physical disks and unallocated space will be available with the release of CacheGrab® Version 2, sometime later this year.

Firefox Cache Forensic https://code.google.com/p/firefox-cache-forensics/wiki/FfFormat

Firefox Cache Forensic is Command-line tools and documentation for forensic analysis of the Firefox Cache.

Woanware Chrome Forensic http://www.woanware.co.uk/?page_id=70

ChromeForensics is an application to extract various bits of activity information from the Google Chrome web browser and the open source version Chromium. All of the core actions e.g. import and export are run on separate threads so there are no graphical user interface (GUI) hangs etc. The user interface displays the Favorite Icons and Thumbnails extracted from the database, which is one area that sets it apart from the other Chrome forensic apps.

Features

➢ Imports Visits/History, Keyword Search Terms, Downloads, Autofill information, Cookies, ➢ Favorite Icons, Thumbnails, History Index ➢ Exports to CSV and HTML ➢ Fast ➢ Displays Favorite Icons and Thumbnails in Grid

You can download Woanware Chrome Forensic Here : http://www.woanware.co.uk/downloads/ChromeForensics.v.1.0.5.zip

Woanware Firefox Forensic Tools http://www.woanware.co.uk/?page_id=96

FireFoxForensics is an application to extract various bits of activity information from the Mozilla FireFox web browser. All of the core actions e.g. import and export are run on separate threads so there are no graphical user interface (GUI) hangs etc. The user interface displays the Favorite Icons and extracted from the database, which is one area that sets it apart from the other FireFox forensic apps.

Features

➢ Imports moz_places/moz_historyvisits, moz_bookmarks, moz_favicons, moz_downloads, moz_cookies, moz_logins ➢ Exports to CSV and HTML ➢ Fast ➢ Displays Favorite Icons in Grid ➢ Custom WHERE clause queries ➢ Advanced querying ➢ Prefined search engine queries e.g. Google, Google Images, Yahoo and Bing

You can download Woanware Firefox Forensic Here : http://www.woanware.co.uk/downloads/FireFoxForensics.v.1.0.5.zip

Woanware Opera Forensic http://www.woanware.co.uk/?page_id=164

OperaForensics is a tool to extract the information stored in the Opera dcache4 file

Features

➢ Exports to CSV ➢ Exports to HTML with the images from the actual cache file displayed

Yolu can download Woanware Opera forensic here : http://www.woanware.co.uk/downloads/OperaForensics.v.1.0.0.zip

ChromeAnalysis http://forensic-software.co.uk/chromeanalysis.aspx

ChromeAnalysis Plus is a software tool for extracting and analysing internet history from the Google Chrome web browser.

FoxAnalysis http://forensic-software.co.uk/FoxAnalysis.aspx

FoxAnalysis Plus is a software tool for extracting and analysing internet history from the Mozilla Firefox web browser

Orion Browser Dumper V1 (New)

Orion Browser Dumper

This software is an advanced local browser history extractor (dumper), in less than few seconds (like for Browser Forensic Tool) it will extract the whole history content of most famous web browser, Actually Internet Explorer, Mozilla FireFox, Google Chrome, COMODO Dragon, Rockmelt and Opera.

Dwwnload Link : http://www.darkcomet-rat.com/misctools.dc

Source : http://thehackernews.com/2012/05/orion-browser-dumper-v1.html

I just give recommendation free or opensource tools for browser forensic tools. I will update next days more specifics about exploration digital evidendence potencial in browsers. Thanks a lot, and enjoy it.