securityfirst_jo

https://nohy0707.tistory.com/entry/%EC%9C%88%EB%8F%84%EC%9A%B011-%EB%B6%80%ED%8C%85-%EB%A1%9C%EA%B7%B8%EC%9D%B8-%EB%B9%84%EB%B0%80%EB%B2%88%ED%98%B8%EA%B0%80-%EA%B8%B0%EC%96%B5%EB%82%98%EC%A7%80-%EC%95%8A%EC%9D%84-%EB%95%8C-%ED%95%B4%EA%B2%B0-%EB%B0%A9%EB%B2%95

vmware에서 윈도우 비동기화 하는 방법

https://nomo.asia/417

근데 이거해도 시간 싱크가 되더라...ㅠㅠ 

윈도우 11 비밀번호 걸렸을떄 우회하는 방법. 

잘된다. 참고로 윈도우 선택부팅하는건 shift 누르고 재부팅하면된다. 

https://nohy0707.tistory.com/entry/%EC%9C%88%EB%8F%84%EC%9A%B011-%EB%B6%80%ED%8C%85-%EB%A1%9C%EA%B7%B8%EC%9D%B8-%EB%B9%84%EB%B0%80%EB%B2%88%ED%98%B8%EA%B0%80-%EA%B8%B0%EC%96%B5%EB%82%98%EC%A7%80-%EC%95%8A%EC%9D%84-%EB%95%8C-%ED%95%B4%EA%B2%B0-%EB%B0%A9%EB%B2%95

------------------------- ------------------------- ------------------------- ------------------------- -------------------------

윈도우 안전모드 부팅하는 법

https://blog.naver.com/lucky_box7/223144573699

기초자료 참고용

출처는 기억않남

전부터 카카오톡 포렌식이 궁금했다. 왜? 다른사람이 성공했으니...나도 하고 싶어서....그래서 리버싱을 하려고 했는데....다 죽던데 어떻게 한거지..뭐로 우회한거지....커널디버깅으로 했나...

많은 생각을 하고 있던 차에 아래 블로그를 발견해서 오호!!!우선 소스코드 받아서 어떻게 동작하는 구조인지를 보고, 그다음에는 진짜 커널디버깅이라도 해봐야하나 생각중

https://present4n6.tistory.com/84

https://github.com/jiru/kakaodecrypt

출처 : https://present4n6.tistory.com/64

디지털 포렌식 공부를 하면서 사용했었던 프로그램들을 소개해드리겠습니다.

추후 제가 추가로 접하는 프로그램들 또한 지속적으로 업데이트할 예정입니다.

공식 배포 홈페이지가 따로 있는 경우 댓글로 알려주시면 감사하겠습니다.

포스팅 업데이트 최신 날짜 : 2023-01-13

디지털 포렌식 관련 무료 프로그램 모음

1. AmCache

AmcacheParser

http://ericzimmerman.github.io/#!index.md

2. AppCompatCache(ShimCache)

AppCompatCacheParser

http://ericzimmerman.github.io/#!index.md

3. 이벤트 로그

Evtx Explorer/EvtxECmd

http://ericzimmerman.github.io/#!index.md

LogParserStudio2(LPSV2.D2)

https://techcommunity.microsoft.com/t5/exchange-team-blog/introducing-log-parser-studio/ba-p/601131

MessageAnalyzer64

https://microsoft-message-analyzer.software.informer.com/download/#downloading

4. Hash

HashCalc

https://www.slavasoft.com/hashcalc/

HashTab

http://implbits.com/products/hashtab/

5. Jumplist

JLECmd, JumpList Explorer

http://ericzimmerman.github.io/#!index.md

JumplistView

https://www.nirsoft.net/utils/jump_lists_view.html

6. link file

LECmd

http://ericzimmerman.github.io/#!index.md

LinkParser

https://4discovery.com/our-tools/link-parser/

7. File System(MFT, Log, Data)

MFTECmd, MFTExplorer

http://ericzimmerman.github.io/#!index.md

analyzeMFT Python Code

https://github.com/dkovar/analyzeMFT

https://kkoha.tistory.com/entry/analyzeMFT-204

NTFS Log Tracker

https://sites.google.com/site/forensicnote/ntfs-log-tracker?fbclid=IwAR2P6h8xdxXLdUFVE2SFjORLPGaPRGctdoV3-40-YlcS0fkWduaXKkU3VEk 

NTFS Data Tracker

https://sites.google.com/site/forensicnote/ntfs-data-tracker?fbclid=IwAR3WulLe85esgaX0mHK__7_nwBkfOdjfjngPNdXjr4cQeTiuZeefxe0jGKs 

8. Prefetch

PECmd

http://ericzimmerman.github.io/#!index.md

WinPrefetchView

https://www.nirsoft.net/utils/win_prefetch_view.html

9. Registry

Registry Explorer/RECmd

http://ericzimmerman.github.io/#!index.md

REGA

http://forensic.korea.ac.kr/tools.html

RegRipper

https://github.com/keydet89/RegRipper3.0

10. Shellbags

ShellBags Explorer

http://ericzimmerman.github.io/#!index.md

ShellBags View

https://www.nirsoft.net/utils/shell_bags_view.html

11. SRUM(SRUDB.dat)

SrumECmd

http://ericzimmerman.github.io/#!index.md

NetworkUsageView

https://www.nirsoft.net/utils/network_usage_view.html

12. Windows10 Timeline db

WxTCmd

http://ericzimmerman.github.io/#!index.md

13. Image Mount / Disk Imaging

Arsenal Image Mounter(Image Mount)

https://arsenalrecon.com/downloads/

FTK Imager(Image Mount, Disk Imaging, File Restore(파일 복구))

https://accessdata.com/product-download/ftk-imager-version-4-5

14. Web Browser

Browsing History View

https://www.nirsoft.net/utils/browsing_history_view.html

Chrome Cache View

https://www.nirsoft.net/utils/chrome_cache_view.html

IE Cache View

https://www.nirsoft.net/utils/ie_cache_viewer.html

WEFA

http://forensic.korea.ac.kr/tools.html

Index.dat Analyzer v2.5

https://www.systenance.com/indexdat.php

15. USB

USB Forensic Tracker

http://www.orionforensics.com/forensics-tools/usb-forensic-tracker/

16. Exif File

Exif Pilot

https://www.colorpilot.com/exif.html

Exiftool

https://exiftool.org/

17. GPS

GPS Route Editor

http://www.gpsnote.net/

18. Volume Shadow Copy Service(VSS)

Shadow Explorer

https://www.shadowexplorer.com/downloads.html

VSCToolset

https://df-stream.com/vsc-toolset/

19. MS Outlook

Kernel PST Viewer

https://www.nucleustechnologies.com/pst-viewer.html

Kernel OST Viewer

https://www.nucleustechnologies.com/ost-viewer.html

SysTools DBX Converter

https://download.cnet.com/SysTools-DBX-Converter/3000-2369_4-76172720.html

20. Hex Editor

HxD

https://mh-nexus.de/en/hxd/

21. SQLite

DB Browser for SQLite

https://sqlitebrowser.org/

22. ShellCode

scdbg.exe

http://sandsprite.com/blogs/index.php?uid=7&pid=152 

23. File Structure

Structured Storage Viewer(SSView)

https://www.mitec.cz/ssv.html

24. Strings

Strings

https://docs.microsoft.com/en-us/sysinternals/downloads/strings

25. Memory

Volatility 2.6

https://www.volatilityfoundation.org/26

Volatility 3.x

https://github.com/volatilityfoundation/volatility3

DumpIt

https://github.com/Crypt2Shell/Comae-Toolkit

GIMP

https://www.gimp.org/

Magnet Dumpit for Windows

https://www.magnetforensics.com/resources/magnet-dumpit-for-windows/?utm_source=Pardot&utm_medium=Email&utm_campaign=Free_Tools_DumpIt_for_Windows_Requests_Email_Announcement 

Magnet Dumpit for Linux

https://github.com/MagnetForensics/dumpit-linux

26. Steganography

Stegsolve.jar

http://www.caesum.com/handbook/stego.htm

OpenStego

https://www.openstego.com/

OpenPuff

https://embeddedsw.net/OpenPuff_Steganography_Home.html

Audacity

https://www.audacityteam.org/

AudioPaint

https://www.softpedia.com/get/Multimedia/Audio/Other-AUDIO-Tools/AudioPaint.shtml

FL Studio

https://www.image-line.com/

기타 스테가노그래피 프로그램 모음

http://www.jjtc.com/Steganography/tools.html

27. ADS(Alternate Data Stream)

Sysinternals Streams.exe

https://docs.microsoft.com/en-us/sysinternals/downloads/streams

nirsoft AlternateStreamView.exe

https://www.nirsoft.net/utils/alternate_data_streams.html

CMD/PowerShell로 분석

https://present4n6.tistory.com/76?category=904227 

28. Mobile

ALEAPP

https://github.com/abrignoni/ALEAPP

29. 통합 분석 프로그램

Autopsy

https://www.autopsy.com/download/

30. 아티팩트 크롤러

KAPE

https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape