Forensics (and Steganography)

Methodology

1. Description and hints/try to determine topic
2. file
3. exiftool/metadata
4. strings -t x -w
5. Carving

Scripts

• XOR Files
• Bit Extractor
• PIL Pixels
• WAV Bits

Tools

• Sans SIFT Workstation
• TSK (The Sleuth Kit)
• Volatility 2/3
• Autopsy
• FTK Imager
• HxD/Okta (Hex editors)
• | base64 -D
• | md5sum

Practice

• Challenges

Links

• CTF Series: Forensics

Topics

TSK

• Cheatsheet

Volatility

• Command Reference

FS

• Rekall
• Redline
• DiskEditor
• Testdisk
• e2fsck
• mke2fs
• debugfs

Mounting

• mount [file] -t [type] -o loop,ro,noexec /mnt/[name]

NTFS

• Everything I know about NTFS Paper
• Alternate Data Streams

Windows

• Eric Zimmerman’s Tools
• RegRipper

Linux Logs

• aureport/ausearch

Carving

• binwalk
• Update configuration files for tailored results for scalpel and foremost
• scalpel
• foremost
• PhotoRec

PCAPs

• Wireshark
• CapLoader
• NetworkMiner
• USB HID Keyboard scan codes

General Steg

• Online 1
• Online 2
• Online 3
• Online 2 (old)
• DIIT (old)
• Stego Toolkit
• Stegsolve and Steganabara
• StegoVeritas
• ZSteg
• BitCrypt
• Steghide
• stegdetect/stegbreak
• xortool

Steg methods to check

• LSB/MSB/other bit hiding techniques
• Morse Code
• Phone keypad tones

Images

• ImageMagick
• GIMP
• PIL
• LSBSteg
• QuickStego
• For data hidden in pixels, check both row-major and column-major orders

PNG

• Extract chunks
• pngcheck/pnginfo

JPG

BMP

GIF

Video

• Example
  • opencv-python
• Data can be hidden in frames, streams, etc

Audio

• AudioStego
• DeepSound

WAV

• Audacity
  • Spectrogram to left of “audio”
  • That’s exactly what spyware would say (jk)
• Sonic Visualiser
• WavSteg
• Check number of audio channels to see if data is hidden in one or multiple
  • Example
• Python wave library
  • Example

MP3

• Stream orientated mp3 frame decoder
• MP3Stego

PDF

• PDFMiner
• pdf-parser.py
• pdftotext

ZIP

• -F (fix zipfile) -FF (really fix) --out output.zip
• zipdetails/zipinfo
• Password cracking

run\zip2john.exe [zipfilename] > hash
run\john.exe --pot=pot --wordlist=[dictionary] hash
// password in pot
unzip -P [password] [zipfilename]

Microsoft Office

• oletools
• Password Cracking

Password Cracking

• john/hashcat
• John Rules
• rockyou

HAR

• browser files
• Google Tool