Starting with this version, I inserted a new tool. This is usefull for doing a Live Acquisition of a running system (e.g. its RAM contents).
As you know ForLEx is composed by two parts:
1) a bootable Linux Live O.S. with a lot of tools;
2) an auto-runnable tool, named “ForLEx Live Acquisition Launcher”
I made this tool because I wanted to give the opportunity, during a live data forensics activity, dumping the RAM and then acquiring physical memory, but also acquiring system target information and capturing screenshots or check the processes running on the system.
Of course these operations changes something on the target machine but there is no way to avoid making these changes.
In order to conduct a live examination and then to capture data, it is necessary to execute tools on a running system, he execution of each tool will make changes to the running system.
When ForLex Live Acquisition Launcher starts up, it shows an important message about target computer’s data protection.
Pressing “ACCEPT” the user has redirected to a useful menu where can choose the right utility.
In this menu there are three different area :
Acquisition : delimits the tools usefull for acquisition of ram or storage
"Winen32", a Guidance Software tool for RAM acquisition on 32bit systems
"Winen64", a Guidance Software tool for RAM acquisition on 64bit systems
"FTK Imager", an Access DATA tool for memory acquisition
"RAM By Net", a tool for RAM acquisition in conjuction with NetCat
"WINDD", a tool for RAM memory acquisition
"MDD", a tool for RAM memory acquisition
Inspecting : delimits the tools usefull for acquisition of information
“AviScreen”, a freeware screen recorder;
“CurrPorts”, allows to have a list of active processes, Process ID, protocol, local port involved, process path and other several information;
“WinAudit”: it is the well known tool that allows a complete auditing for windows based computers
“Hover Snap”: a freeware snapshot capturer;
“PC On/Off time”: a useful tool which gives the possibility to see the timeline of the on/off target machine events.
Utility : delimits system utilities
"Shell", a system shell
"Putty", an ssh client for remote shell
"NetCat", an utility usefull to connects by network to another computer
We can do PHYSICAL/HARD DRIVE acquisitions in different ways.
ForLex provides Winen32 , Winen64, FTK Imager, RAM by Net, WinDD and MDD. All of them, for the execution use right shell residents on the distribution cd-rom. They doesn’t use system’s shell, so if that is corrupted (damaged/poisioned) we will be sure that our operations will not be altered.
By the choose of a tool, on the screen will appear the follow message.
It means that we can have a shell DOS with the command prompt lighting at the end of path (OPEN DIR) or instead, executing directly (EXECUTE) the tool.
If we use RAM by NET (a good method for a minimum impact on the target system), we can choose the IP and Port destination, and the tool will show the command (in red).
Clicking ACQUISITION, and before the tool starts the acquisition, the user receives a warning useful to correctly configure the destination.
On the destination system we can choose where we want to store the stream capture.
Before the user starts the acquisition, he receives a warning useful to control if we are on the right computer.
I hope this new tool can be usefull for you forensic experience.
|
Tutti i contenuti riportati in questo sito vengono rilasciati con la seguente licenza : Creative Commons Attribution - NonCommercial - ShareAlike Si precisa, inoltre, che tutti i singoli marchi registrati sono dei rispettivi proprietari. Diritti d’autore e proprietà industriale: I testi e le immagini pubblicati in questo sito sono di proprietà esclusiva dei relativi autori i quali indicano per ogni opera la relativa licenza di rilascio. In caso, quest'ultima, non sia espressamente indicata si assumerà, a favore del relativo autore di ogni opera, la Creative Commons Attribution - NonCommercial - ShareAlike. Ogni singolo autore è responsabile dei contenuti da egli realizzati. Note ex L. 62/01 - I contenuti di questo sito non hanno carattere di periodicità e non rappresentano "prodotto editoriale". I controlli sui contenuti riguardano solo ed esclusivamente quelli pubblicati direttamente da questo sito. I link ad altre pagine non rientrano nei controlli in questione.