Flashcards 8 Flashcards
Students 1 Students
Language English
Level University
Created / Updated 20.06.2019 / 01.07.2020
Licencing Not defined
0 Exact answers 8 Text answers 0 Multiple-choice answers
Close window

When searching what do you search for?

Searching for what?

  • something you know
  • something you don't know
  • search file names
  • search file content
Close window

What are the chalanges when performing a search?


  • too many hits
  • hidden content (steganography) is not found
  • protectet content (steganography) is not found
  • compund files (zip, tar, attachments, embedded) are harder to serach - need to extracted first
  • proprietary file formats - hard to search because unknown of how to search
Close window

What sleuthkit command can be used to search ?


fls outputs a large file list, deleted file, multiple partitions/drives/PCs

Close window

What two GNU commands can be used for searching?

GNU grep

GNU find

Close window

What UNIX command can you use to extract strings from images?

UNIX Strings

  • strings -td image.dd
  • strings -td -e l image.dd
  • strings -td partition.dd |grep keyword
Close window

What is the sleuthkit version of the strings command and what benefits does it have?

Sleuthkit has the "srch_strings" version of strings command.

The offset is in bytes, can calculate the block and find the inode.

You can feed meta data into an SQL database for fast searching:

  • tsk_loaddb image.dd

Searching and indexing is very advanced in commercial tools

Close window

What is a hash database and why is it usefull?

In a hash database the hashes of individual files are stored. This can be used to:

  • find or ignore matching file sets using hash values
  • There are lists available of hashes of system files so they can be excluded from searches and analysis
    • NSLR is an example of a list of known "good" files.
  • Own custom databases of hashes of good and bad files can be created.

Some agencies have special hash databases to find illegal materials

Close window

What does the sleuthkit sorter do?

The sleuthkit sorter :

  • creates a report of identified files (incl. deleted)
    • sorter -d . partition.dd
  • Sorted extraction of files
    • sorter -s -d . partition.dd
  • Sorter only includeing hash database
    • sorter -a contraband.db -d . partition.dd
  • Sorter excluding NSRL database
    • sorter - nsrl_db -d . partition.dd

It is configurable perl script that uses multiple TSK tools.