On-scene triage open source forensic tool chests: Are they effective?

Digital Investigation

Volumn 10, Issue 2, 2013, Pages 99-115

  Shiaeles, Stavros ^a   Chryssanthou, Anargyros ^b   Katos, Vasilios ^a  

^a DEMOCRITUS UNIVERSITY OF THRACE   (Greece)

^b Hellenic Data Protection Authority   (Greece)

Author keywords

ACPO principles; Incident response; Kludge; Open source; TR3Secure; Triage; TriageIR

Indexed keywords

DIGITAL COMPUTERS;

ACPO PRINCIPLES; INCIDENT RESPONSE; KLUDGE; OPEN SOURCES; TR3SECURE; TRIAGE; TRIAGEIR;

COMPUTER APPLICATIONS;

EID: 84883551108     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2013.04.002     Document Type: Article

References (29)

1. 7Zip Command Line, http://www.7-zip.org/.
2. ACPO Good practice guide for computer-based electronic evidence 2008 http://www.7safe.com/electronic-evidence/ACPO-guidelines-computer-evidence.pdf
3. Aljaedi A., Lindskog D., Zavarsky P., Ruhl R., Almari F. Comparative analysis of volatile memory forensics: live response vs. memory imaging. In: Proceedings of the 2011 IEEE third international conference on and 2011 IEEE third international conference on Social Computing (SocialCom), 2011 9-11 Oct., Boston, MA, USA, pp. 1253-1258.
4. D. Brezinski, and T. Killalea Guidelines for evidence collection and archiving 2002 RFC 3227 http://www.ietf.org/rfc/rfc3227.txt
5. N. Brownlee, and E. Guttman Expectations for computer security incident response 1998 RFC 2350 http://www.ietf.org/rfc/rfc2350.txt
6. Buster Sandbox Analyzer (BSA), http://bsa.isoftware.nl/.
7. DumpIt memory utility, http://www.moonsols.com/windows-memory-toolkit/.
8. ForensicArtifacts.com, http://forensicartifacts.com/.
9. Free Merriam-Webster dictionary, http://www.merriam-webster.com/ dictionary/.
10. Hobocopy utility, https://github.com/candera/hobocopy/downloads.
11. Horsman G., Laing C., Vickers P. A case based reasoning system for automated forensic examinations. In: PGNET 2011, the 12th annual postgraduate symposium on the convergence of telecommunications, networking and broadcasting, 27-28 June, 2011, Liverpool. http://www.cms.livjm.ac.uk/pgnet2011/Proceedings/ Papers/m1569452341-horsman.pdf.
12. Kludge-3.20110223, http://theinterw3bs.com/?p=503.
13. R. Lee Sans DFIR Faculty. Sans-Digital-Forensics-and-Incident-Response- Poster-2012 2012 http://blogs.sans.org/computer-forensics/files/2012/06/SANS- Digital-Forensics-and-Incident-Response-Poster-2012.pdf
14. Md5deep and sha1deep utilities, http://md5deep.sourceforge.net/.
15. R. Mislan, E. Casey, and G. Kessler The growing need for on-scene triage of mobile devices Digital Investigation 6 3-4 2010 112 124
16. Netmarketshare, Market share statistics for internet technologies, http://www.netmarketshare.com/ [accessed 31.12.12.].
17. Nirsoft web browsers tools package, http://www.nirsoft.net/web-browser- tools.html.
18. OPSWAT Antivirus market analysis December 2012 http://www.opswat.com/ about/media/reports/antivirus-december-2012
19. S. Pearson, and R. Watson Digital Triage Forensics: processing the digital crime scene 2010 Syngress
20. RegRipper, http://code.google.com/p/winforensicaanalysis/downloads/list.
21. Rogers M.K., Goldman J., Mislan R., Wedge T., Debrota S. Computer forensics field triage process model. In: Proceedings of the conference on Digital Forensics, Security and Law, 2006 April 20-21, Las Vegas, Nevada, USA, pp. 27-40. http://www.digitalforensics-conference.org/CFFTPM/CDFSL- proceedings2006-CFFTPM.pdf.
22. Sandboxie, http://www.sandboxie.com, http://www.sandboxie.com/index.php? AllPages.
23. E. Skoudis Windows Command-Line Kung Fu with WMIC 2006, March, 30 http://isc.sans.edu/diary/WindowsLine
24. SPEKTOR triage tool, http://www.evidencetalks.com/index.php?option=com- content&view=category&layout=blog&id=83&Itemid=513.
25. Sysinternals Suite, http://technet.microsoft.com/en-us/sysinternals/ bb84206.
26. TR3Secure, http://code.google.com/p/jiir-resources/downloads/detail?name= tr3secure-data-collection-script.zip&can=2&q=.
27. TriageIR v.79, http://code.google.com/p/triage-ir/downloads/list.
28. C. Waits, J.A. Akinyele, R. Nolan, and L. Roggers Computer forensics: results of live response inquiry vs. memory image analysis TECHNICAL NOTE CMU/SEI-2008-TN-017 2008 CERT Digital Intelligence and Investigation Directorate (DIID), CarnegieMellon http://www.cert.org/archive/pdf/08tn017.pdf
29. Windows XP Embedded (WinXPe) OS, http://www.microsoft.com/ windowsembedded/en-us/develop/windows-xp-embedded-for-developers.aspx.