Karten 8 Karten
Lernende 1 Lernende
Sprache English
Stufe Universität
Erstellt / Aktualisiert 20.06.2019 / 01.07.2020
Lizenzierung Keine Angabe
0 Exakte Antworten 8 Text Antworten 0 Multiple Choice Antworten


Fenster schliessen

When searching what do you search for?

Searching for what?

  • something you know
  • something you don't know
  • search file names
  • search file content
Fenster schliessen

What are the chalanges when performing a search?


  • too many hits
  • hidden content (steganography) is not found
  • protectet content (steganography) is not found
  • compund files (zip, tar, attachments, embedded) are harder to serach - need to extracted first
  • proprietary file formats - hard to search because unknown of how to search
Fenster schliessen

What sleuthkit command can be used to search ?


fls outputs a large file list, deleted file, multiple partitions/drives/PCs

Fenster schliessen

What two GNU commands can be used for searching?

GNU grep

GNU find

Fenster schliessen

What UNIX command can you use to extract strings from images?

UNIX Strings

  • strings -td image.dd
  • strings -td -e l image.dd
  • strings -td partition.dd |grep keyword
Fenster schliessen

What is the sleuthkit version of the strings command and what benefits does it have?

Sleuthkit has the "srch_strings" version of strings command.

The offset is in bytes, can calculate the block and find the inode.

You can feed meta data into an SQL database for fast searching:

  • tsk_loaddb image.dd

Searching and indexing is very advanced in commercial tools

Fenster schliessen

What is a hash database and why is it usefull?

In a hash database the hashes of individual files are stored. This can be used to:

  • find or ignore matching file sets using hash values
  • There are lists available of hashes of system files so they can be excluded from searches and analysis
    • NSLR is an example of a list of known "good" files.
  • Own custom databases of hashes of good and bad files can be created.

Some agencies have special hash databases to find illegal materials

Fenster schliessen

What does the sleuthkit sorter do?

The sleuthkit sorter :

  • creates a report of identified files (incl. deleted)
    • sorter -d . partition.dd
  • Sorted extraction of files
    • sorter -s -d . partition.dd
  • Sorter only includeing hash database
    • sorter -a contraband.db -d . partition.dd
  • Sorter excluding NSRL database
    • sorter - nsrl_db -d . partition.dd

It is configurable perl script that uses multiple TSK tools.