Section 32: Digital Forensic Tools

Question 1

Foremost

Answer 1

▪ A forensic data recovery programs that is commonly used to conduct file carving to extract deleted or corrupted data from a disk partition

Question 2

Encase and FTK

Answer 2

Both have the ability to recover deleted files and perform
basic file carving

Question 3

Hexdump

Answer 3

A cross-platform tool that can be used to extract data from binary files and display their contents to the screen in hexadecimal, decimal, octal, or ASCII formats

Question 4

Binwalk

Answer 4

A binary firmware image inspection tool that can be used to understand the components, characteristics, and composition of a binary firmware image

▪ Used when analyzing a file to determine if it is compressed, obfuscated, or encrypted by displaying a graph of the amount of entropy in the file’s contents

Question 5

Ghidra

Answer 5

An open-source, cross-platform java-based utility used to conduct
software reverse engineering

Question 6

Ollydbg

Answer 6

A graphical debugger alternative to GDB that is used with the Windowsmoperating system

▪ Used to convert the binary code of 1s and 0s back into something likenassembly language

Question 7

Readelf

Answer 7

A Linux utility that can read the Executable and Linkable Format in an
object file, which is known as ELF

▪ Contains the different structures that make the program operate
properly

Question 8

Objdump

Answer 8

▪ A utility that is used to analyze object files, similar to readelf, but it also includes a disassembler to reveal the assembler commands used by the binary or program

Question 9

Strace

Answer 9

A Linux utility that can identify the interactions made between different processes and the Linux kernel

Question 10

Ldd

Answer 10

▪ A Linux utility that is used to display a program’s dependencies
▪ Useful during a forensic malware analysis

Question 11

File

Answer 11

▪ A Linux utility that is used to display the type of file being inspected
▪ Uses the first two hexadecimal bytes to determine the file type known as the “magic bytes”

Question 12

Exiftool

Answer 12

▪ A cross-platform utility written in Perl that can be used to read and write metadata from different file formats

▪ Used to read metatdata

Question 13

Volatility Framework

Answer 13

▪ An open-source memory forensics tool that has many different modules for analyzing specific elements of memory
▪ Volatility is a text-based command line interface tool that allows you to take a memory dump of a system

Question 14

FTK Imager

Answer 14

Forensic Toolkit Imager
▪ A forensically-sound software tool that can be used to create a disk
image
▪ Only works on a Windows laptop or desktop to capture the contents of a hard drive
▪ Documents the chain of custody
▪ Uses graphical user interface like most Windows programs
▪ The image can be read and analyzed by FTK, EnCase, or the Sleuth Kit

Question 15

dd Utility

Answer 15

▪ Found in all versions of the Linux and Unix operating system
▪ Used to create a bit-by-bit copy of a hard drive from the command line or shell environment in Linux

▪ Does not automatically create a chain of custody
▪ Requires a proper syntax at the command line

Question 16

Ssdeep

Answer 16

● Another hashing utility, but it not used to create a hash of the
evidence or disk image
● Used for recursive computing and matching of Context Triggered
Piecewise Hashing, also known as Fuzzy Hashing
o Fuzzy hashing
▪ Used to compare similar, but not identical files

Question 17

Nbtstat

Answer 17

▪ A utility that provides protocol statistics and current connections using the NetBIOS over TCP/IP
▪ Only used on Windows systems

Question 18

Process Status (PS)

Answer 18

▪ A utility that gives us the process status for any currently running
processes on a Linux system
▪ Only used in Linux, Unix, and Mac systems

Question 19

Ldd

Answer 19

▪ A Linux utility that is used to display a program’s dependencies
▪ Identify all of the shared libraries that are required by the particular
program or binary

Question 20

Lsof

Answer 20

▪ A Linux utility that is used to display a list of open files and the name of associated processes using those files
▪ Can identify any files and processes

Question 21

Netcat

Answer 21

▪ A networking utility that can read or write raw data to network
connections using either TCP or UDP
▪ Used in Unix, Linux, and Windows
▪ Performs port scanning, file transfers, port listener, and can even be used as backdoor to a system

Question 22

Conntrack

Answer 22

▪ A Linux command line utility that allows an investigator to interact with the connection tracking system in Linux
▪ Can show, delete, and update tablet entries or listen to different traffic flow events