sf

CAINE (Computer Aided INvestigative Environment) is an Italian GNU/Linux alive distribution created equally a Digital Forensics project. Currently, the projection managing director is Nanni Bassetti (Bari - Italy). CAINE offers a consummate forensic surroundings that is organized to integrate existing software tools equally software modules too to furnish a friendly graphical interface. The primary pattern objectives that CAINE aims to guarantee are the following: an interoperable surroundings that supports the digital investigator during the 4 phases of the digital investigation a user-friendly graphical interface user-friendly tools CAINE represents fully the spirit of the Open Source philosophy because the projection is completely open, everyone could accept on the legacy of the previous developer or projection manager. The distro is opened upwards source, the Windows side is freeware and, the concluding but non least, the distro is installable, so giving t...

DFIRTrack (Digital Forensics as well as Incident Response Tracking application) is an opened upwards source spider web application mainly based on Django using a PostgreSQL database backend. In contrast to other slap-up incident reply tools, which are mainly case-based as well as back upwards the piece of occupation of CERTs, SOCs etc. inwards their daily business, DFIRTrack is focused on treatment 1 major incident alongside a lot of affected systems every bit it is oftentimes observed inwards APT cases. It is meant to endure used every bit a tool for dedicated incident reply teams inwards large cases. So, of course, CERTs as well as SOCs may utilisation DFIRTrack every bit well, but they may experience it volition endure to a greater extent than appropriate inwards special cases instead of every twenty-four hr menstruum work. In contrast to case-based applications, DFIRTrack industrial plant inwards a system-based fashion. It keeps rail of the condition of diverse systems...

Turbinia is an open-source framework for deploying, managing, as well as running distributed forensic workloads. It is intended to automate running of mutual forensic processing tools (i.e. Plaso, TSK, strings, etc) to attention amongst processing evidence inwards the Cloud, scaling the processing of large amounts of evidence, as well as decreasing reply fourth dimension yesteryear parallelizing processing where possible. How it works Turbinia is composed of dissimilar components for the client, server as well as the workers. These components tin dismiss live on run inwards the Cloud, on local machines, or as a hybrid of both. The Turbinia customer makes requests to procedure evidence to the Turbinia server. The Turbinia server creates logical jobs from these incoming user requests, which creates as well as schedules forensic processing tasks to live on run yesteryear the workers. The evidence to live on processed volition live on dissever upwards yesteryear the jobs when ...

Beagle is an incident response in addition to digital forensics tool which transforms information sources in addition to logs into graphs. Supported information sources include FireEye HX Triages, Windows EVTX files, SysMon logs in addition to Raw Windows retention images. The resulting Graphs tin john endure sent to graph databases such equally Neo4J or DGraph, or they tin john endure kept locally equally Python NetworkX objects. Beagle tin john endure used straight equally a python library, or through a provided spider web interface. The library tin john endure used either equally a sequence of functional calls. >>> from beagle.datasources import SysmonEVTX >>> graph = SysmonEVTX("malicious.evtx").to_graph() >>> graph <networkx.classes.multidigraph.MultiDiGraph at 0x12700ee10> Or past times strictly calling each intermediate pace of the information source to graph process. >>> from beagle.backends import NetworkX...