Forensic

最新推荐文章于 2024-10-18 16:55:32 发布
原创 最新推荐文章于 2024-10-18 16:55:32 发布 · 2.4k 阅读 · 0 ·
CC 4.0 BY-SA版权
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。

这篇博客介绍了ASIS-CTF2013中的网络取证分析题目，包括rm -rf、spcap、pcap和memdump等环节，探讨了这些有趣的热身题目。

这种类型的题，比较有趣，大概是热身一类的题吧。

rm -rf (ASIS-CTF2013)

这道题，给了一个镜像文件。里面文件貌似挺多的。
不过直接用WinHex打开搜一下ASIS_密码就出来了。



spcap (ASIS-CTF2013)

这个题目名字的意思大概就是，simple pcap
拿Wireshark打开这个包，Statistics->Conversations 里面看到
有两个IP通信比较频繁


Statistics->Protocol Hierarchy Statistics
里面看到有一个图片格式的数据传输了




File - > export -> object 吧图片导出来，就可以看到Flag了





pcap (ASIS-CTF2013)

这题应该是比较难一点的，pcap
照例上wireshark    Statistics->Protocol Hierarchy Statistics 里面看到一些乱七八糟的东西，
虽然没大看懂但是还是装作很懂的看了一下。
一般情况下容易藏数据的地方在  HTTP traffic  TCP Data  U
最低0.47元/天 解锁文章
RITSEC CTF2021 Forensics1597题解记录
m0_49762339的博客
04-13 454
题目地址：http://git.ritsec.club:7000/1597.git/ 这是一道与git版本管理有关的题目 解题过程： 一、很明显第一步将远程仓库克隆到本地 git clone http://git.ritsec.club:7000/1597.git/ 其中一共有两个文件打开后发现flag.txt为空文件，README.md文件显示： # 1597 A git challenge series? Sounds fun. 没有用!!! 二、推测（看大佬WP）查看版本记录。 1.mkdir ki
[ctfshow 2021摆烂杯] FORENSICS部分 writeup
ShenZ的博客
01-03 3614
[ctfshow 2021摆烂杯] FORENSICS部分 writeup 套的签到题 第一段flag 第二段flag 第三段flag JiaJia-CP-1 JiaJia-CP-2 JiaJia-CP-3 JiaJia-PC-1 JiaJia-PC-2 JiaJia-PC-3
Windows取证分析（Windows Forensic Analysis）随书工具盘
05-06
Windows 取证分析——dvd工具包，提供大量利用Perl脚本编写的程序。
CTF 之 Forensics 取证
algae
04-18 7970
这篇文章列出了CTF中Forensics（取证）类型题的技巧和窍门，展示了CTF中常用工具的使用场景和使用方法。文件格式（File Formats）十六进制文件头和对应ASCII码通过查看文件头前四到五个字节的十六进制数来识别文件类型。参考Hex file and Regex Cheat Sheet 和Gary Kessler File Signature Ta...
linux取证教程,Linux中的取证(Forensics in Linux)
weixin_33595380的博客
05-07 837
Linux中的取证(Forensics in Linux)数字调查的主要问题是通过加密或任何其他格式保护重要证据或数据。 基本示例是存储密码。 因此，有必要了解Linux操作系统在数字取证实施中的使用，以保护这些有价值的数据。所有本地用户的信息大多存储在以下两个文件中 -/etc/passwdetc/shadow第一个是必需的，它存储所有密码。 第二个文件是可选的，它存储有关本地用户的信息，...
passware kit forensic v13.5
08-18
passware kit forensic v13.5
EnCase_Forensic_Imager_7.06.zip
最新发布
08-31
EnCase Forensic Imager是其旗下的一款专门用于制作数字证据镜像的工具，它能够准确地复制和分析计算机硬盘或其他存储设备上的数据，而不会对原始数据造成任何改变。 该软件的7.06版本作为官方提供的试用版，能够让...
Passware Kit Forensic 2017.1.1
09-05
Passware Kit Forensic 是 Passware 公司所开发的系列密码恢复软件中功能最为强大也是最新的一个密码恢复工具合集。它将所有的密码恢复模块全部集成到一个主程序中。恢复文件文件密码时，无需再像以前的它的姊妹版...
Windows Forensic Analysis Including DVD Toolkit.pdf
08-21
forensic examiners have noticed is an overreliance by investigators on what forensic analysis tools are telling them,without really understanding where this information is coming from or how it is ...
baby_forensic.zip
09-10
本篇将重点探讨一个特定的案例——通过“baby_forensic.zip”压缩包文件，对Windows系统镜像进行内存取证分析。 “baby_forensic.zip”是一个用于CTF挑战的压缩包，内含的数据1.7z文件可能包含了关键证据。在这样的...
android forensic
08-01
此书是对载有android系统的手机进行取证的参考书，讲到了很多android系统相关的知识，针对android系统进行取证时用到的一些工具等等。
Learning Android Forensics
11-02
Many forensic examiners rely on commercial, push-button tools to retrieve and analyze data, even though there is no tool that does either of these jobs perfectly. This book will introduce you to the Android platform and its architecture, and provides a high-level overview of what Android forensics entails. You will see how data is stored on Android devices and how to set up a digital forensic examination environment. Next, you will go through the various physical and logical techniques to extract data from devices to obtain forensic evidence. You will also learn how to reverse-engineer applications and forensically analyze the data with the help of various open source and commercial tools. By the end of this book, you will have a complete understanding of the Android forensic process.
The Forensic Laboratory Handbook - Procedures and Practice
06-03
If the law has made you a witness, remain a man of science. You have no victim to avenge, no guilty or innocent person to convict or save— you must bear testimony within the limits of science.
Windows Forensic Analysis Toolkit 3rd Edition PDF
04-11
Now in its third edition, Harlan Carvey has updated Windows Forensic Analysis Toolkit to cover Windows 7 systems. The primary focus of this edition is on analyzing Windows 7 systems and on processes using free and open-source tools. The book covers live response, file analysis, malware detection, timeline, and much more. The author presents real-life experiences from the trenches, making the material realistic and showing the why behind the how. New to this edition, the companion and toolkit materials are now hosted online. This material consists of electronic printable checklists, cheat sheets, free custom tools, and walk-through demos. This edition complements Windows Forensic Analysis Toolkit, 2nd Ed. (ISBN: 9781597494229), which focuses primarily on XP. Complete coverage and examples on Windows 7 systems Contains Lessons from the Field, Case Studies, and War Stories Companion online material, including electronic printable checklists, cheat sheets, free custom tools, and walk-through demos
Addison.Wesley.File.System.Forensic.Analysis.7z
08-21
The Definitive Guide to File System Analysis: Key Concepts and Hands-on Techniques Most digital evidence is stored within the computer's file system, but understanding how file systems work is one of the most technically challenging concepts for a digital investigator because there exists little documentation. Now, security expert Brian Carrier has written the definitive reference for everyone who wants to understand and be able to testify about how file system analysis is performed. Carrier begins with an overview of investigation and computer foundations and then gives an authoritative, comprehensive, and illustrated overview of contemporary volume and file systems: Crucial information for discovering hidden evidence, recovering deleted data, and validating your tools. Along the way, he describes data structures, analyzes example disk images, provides advanced investigation scenarios, and uses today's most valuable open source file system analysis tools—including tools he personally developed. Coverage includes Preserving the digital crime scene and duplicating hard disks for "dead analysis" Identifying hidden data on a disk's Host Protected Area (HPA) Reading source data: Direct versus BIOS access, dead versus live acquisition, error handling, and more Analyzing DOS, Apple, and GPT partitions; BSD disk labels; and Sun Volume Table of Contents using key concepts, data structures, and specific techniques Analyzing the contents of multiple disk volumes, such as RAID and disk spanning Analyzing FAT, NTFS, Ext2, Ext3, UFS1, and UFS2 file systems using key concepts, data structures, and specific techniques Finding evidence: File metadata, recovery of deleted files, data hiding locations, and more Using The Sleuth Kit (TSK), Autopsy Forensic Browser, and related open source tools When it comes to file system analysis, no other book offers this much detail or expertise. Whether you're a digital forensics specialist, incident response team member, law enforcement officer, corporate security specialist, or auditor, this book will become an indispensable resource for forensic investigations, no matter what analysis tools you use.
[ctf Misc][RoarCTF2019]forensic +内存取证
ShenZ的博客
09-09 2605
这题蛮鬼的，就，没有捷径，捷径导出文件一定是坏的 附件：mem.raw [RoarCTF2019]forensic 1.volatility处理 λ volatility_2.6_win64_standalone.exe -f xxx7\Compressed\mem.raw imageinfo Volatility Foundation Volatility Framework 2.6 INFO : volatility.debug : Determining profile based o
Android Phone Forensic Analysis – Unleash Hidden Evidence
相信未来！
12-04 900
转载地址：http://www.dataforensics.org/android-phone-forensics-analysis/ ANDROID FILE SYSTEMS There is no singularly defined file system for Android. Android is developed on Linux kernel and Linux su
BUUCTF [RoarCTF2019]forensic
../../../../../../../
10-12 1602
打开 下载到mem.raw 把mem.raw放入kali volatility查看镜像 volatility -f mem.raw imageinfo 建议用profile, 后面用Win7SP1x86 查看内存进程： volatility -f men.raw pslist --profile Win7SP1x86 发现有几个进程 了解发现： TrueCrypt.exe是一款磁盘加密工具，所有虚拟磁盘上的文件都被自动加密，需要通过密码来进行访问。 notepad.exe windows自带记事本
Android取证简介(翻译）
YJ_12340的博客
10-18 1459
在此文中，我们将探讨 Android 取证、获取 Android 设备的过程、反取证技术以及从 Android 设备映像分析和恢复已删除文件的实际示例。
forensic analysis
01-24
2. **FTK (Forensic Toolkit)** AccessData 的 FTK 提供了一个全面的工作流程来管理案件中的电子证据。该平台不仅限于硬盘驱动器上的静态数据获取；还扩展到了网络流量捕获等领域，增强了实时监控的可能性。 3. **...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值