Cartes-fiches 8 Cartes-fiches
Utilisateurs 1 Utilisateurs
Langue English
Niveau Université
Crée / Actualisé 20.06.2019 / 01.07.2020
Attribution de licence Non précisé
Lien de web
0 Réponses exactes 8 Réponses textes 0 Réponses à choix multiple
Fermer la fenêtre

When searching what do you search for?

Searching for what?

  • something you know
  • something you don't know
  • search file names
  • search file content
Fermer la fenêtre

What are the chalanges when performing a search?


  • too many hits
  • hidden content (steganography) is not found
  • protectet content (steganography) is not found
  • compund files (zip, tar, attachments, embedded) are harder to serach - need to extracted first
  • proprietary file formats - hard to search because unknown of how to search
Fermer la fenêtre

What sleuthkit command can be used to search ?


fls outputs a large file list, deleted file, multiple partitions/drives/PCs

Fermer la fenêtre

What two GNU commands can be used for searching?

GNU grep

GNU find

Fermer la fenêtre

What UNIX command can you use to extract strings from images?

UNIX Strings

  • strings -td image.dd
  • strings -td -e l image.dd
  • strings -td partition.dd |grep keyword
Fermer la fenêtre

What is the sleuthkit version of the strings command and what benefits does it have?

Sleuthkit has the "srch_strings" version of strings command.

The offset is in bytes, can calculate the block and find the inode.

You can feed meta data into an SQL database for fast searching:

  • tsk_loaddb image.dd

Searching and indexing is very advanced in commercial tools

Fermer la fenêtre

What is a hash database and why is it usefull?

In a hash database the hashes of individual files are stored. This can be used to:

  • find or ignore matching file sets using hash values
  • There are lists available of hashes of system files so they can be excluded from searches and analysis
    • NSLR is an example of a list of known "good" files.
  • Own custom databases of hashes of good and bad files can be created.

Some agencies have special hash databases to find illegal materials

Fermer la fenêtre

What does the sleuthkit sorter do?

The sleuthkit sorter :

  • creates a report of identified files (incl. deleted)
    • sorter -d . partition.dd
  • Sorted extraction of files
    • sorter -s -d . partition.dd
  • Sorter only includeing hash database
    • sorter -a contraband.db -d . partition.dd
  • Sorter excluding NSRL database
    • sorter - nsrl_db -d . partition.dd

It is configurable perl script that uses multiple TSK tools.