Bruce Nikkel search_sort.pdf
Select the folders to/from which you want to add/remove "Bruce Nikkel search_sort.pdf"
When searching what do you search for?
Searching for what?
What are the chalanges when performing a search?
What sleuthkit command can be used to search ?
fls outputs a large file list, deleted file, multiple partitions/drives/PCs
What two GNU commands can be used for searching?
What UNIX command can you use to extract strings from images?
What is the sleuthkit version of the strings command and what benefits does it have?
Sleuthkit has the "srch_strings" version of strings command.
The offset is in bytes, can calculate the block and find the inode.
You can feed meta data into an SQL database for fast searching:
Searching and indexing is very advanced in commercial tools
What is a hash database and why is it usefull?
In a hash database the hashes of individual files are stored. This can be used to:
Some agencies have special hash databases to find illegal materials
What does the sleuthkit sorter do?
The sleuthkit sorter :
It is configurable perl script that uses multiple TSK tools.
9. Schuljahr - 10. Schuljahr - Handelsschule/KV
Beschleunige deine Karriere