General tools

• strings
  • (!) Uses UTF‑8 per default to detect “print­able” char­ac­ters When ana­lyz­ing a sys­tem / file from a dif­fer­ent lan­guage, you may also need to per­form strings with anoth­er encod­ing to detect also strings in anoth­er language.
• ltrace ./bin.elf
  • Maybe as well strace ./bin.elf
  • If you see that a bina­ry is called with­out path: Cre­ate a file with this name in the cur­rent directory…
• radare2 / r2 (See below)
• bin­walk nineveh.png
  • Extract parts from a file with binwalk -Me nineveh.png
• steghide
  • Check if a file con­tains oth­er infos: steghide info file
  • Extract files: steghide extract -sf file
• ole­dump
  • Use oledump.py to extract macros. List the file con­tents with python oledump.py $file
  • See the sec­tion below in this article.
• CyberChef
  • Var­i­ous trans­for­ma­tion / ana­lyza­tion of data
• scD­BG
  • Assume you have a Win­dows bina­ry pay­load and you don’t know the lan­guage. Try to store the bina­ry pay­load into a file and let scD­BG analyse it.
• shellcode2exe.py
  • You can also try to cre­ate an EXE file out of a bina­ry dump with shellcode2exe.py to dis­sem­ble it in IDA, Immuity, etc.

Imaging tools

dd, of course.

Note that it makes sense to set the prop­er block size (some­times 4k, but most hard dri­ves are using 512), so that, when an error occued, the exact sec­tor is shown which can after­wards be skipped.

dd if=/dev/sda of=/external/file.md5 bs=512

ewfacquire

sudo ewfac­quire /dev/sda

Advan­tages:

• Uses com­pres­sion
• Stored only used blocks / not the whole hard dri­ve of 1TB, when only 4GB are used
• Splits files in chunks which can be eas­i­er handled
• Cal­cu­lates checksums
• enabled vir­tu­al file mount for direct (read-only) access in Linux

aff4 advanced forensic framework

Image analysis

If you have an image in one or mul­ti­ple files: Check the con­tent
mmls -B win*

Get meta infor­ma­tion
ewfinfo win*

File sys­tem infor­ma­tion:
fsstat -o file.E01

Load the image
ewfacquire win*

Show all entries from the file sys­tem table
ils -o 2048 -em image.E01

Show all files from the file sys­tem table (with­out r flag, it shows the root direc­to­ry, also with spe­cial (NTFS-) files.)

• Only Root:
  fls -o 2048 -p image.E01
• Recur­sive from root:
  fls -o 2048 -pr image.E01
• Only a sub­di­rec­to­ry: (fls shows in the sec­ond col­umn a num­ber — this is here the 60 for the pro­gram files direc­to­ry.)
  fls -o 2048 -pr image.E01 60

Expla­na­tion of an out­put:
r/r 103399-128-4 ...
Here, 103399 is the entry in the file table, 4 is the data stream.

Show attrib­ut­es of a file (file 103399 of the file table, see above):
istat -s 2048 image.E01 103399

Show the con­tent of a data stream:

• Show text on the con­sole:
  icat -o 2048 image.E01 103399-128-9
• Write out a data stream into a file:
  icat -o 2048 image.E01 103399-128-4 | dd of=/tmp/file.doc

Time­stamps

• Modi­fi­ca­tion
• Access
• Change
• Birth

Get real time­stamps from alter­na­tive data streams:

Note to the pre­vi­ous image: The file dates from the alter­na­tive DOS file stream are nor­mal­ly nev­er changed after the ini­tial access! There­fore, if there are dif­fer­ent dates in this entry, this is prob­a­bly the “cor­rect” orig­i­nal date. But be aware that there are some pit­falls; e.g.files can retain the mod­i­fied data, but if there moved, then the cre­at­ed at date could be lat­er. Also, files which are extract­ed from an archive or a syn­chro­niza­tion soft­ware could also have “strange” time­stamp combinations.

Search for spe­cif­ic files:
ils -o 2048 -em win.E01 | grep -F .docx

Cre­ate a time­line of files:

1. Cre­ate a list of timestamps: 
   • If you have an image: 
     • fls -o 2048 -rm '' win.E01 > /tmp/timestamps
   • If you have only shell access (cau­tion: this changes the access file — not so good from a foren­sic stand­point, but if this is not impor­tant or there is no oth­er way): 
     • find / -print "|%p|%i|%M|%U|%G|%s|%A@|%C@|%T@|-1\n" > /tmp/timestamps
2. Cre­ate a time­line:
   mactime -b /tmp/timestamps -d -h > /tmp/timeline.txt

Oth­er notes:

• Scan large file list­ings for inter­est­ing files, e.g. vbs files, mimikatz file names.

File carving

If you are look­ing for a spe­cif­ic file type or you don’t know the file sys­tem type of an image, you can try to find files with­in an image. File carv­ing tools are using mag­ic bytes, known pat­ters etc. to extract files from an image.

Tools:

• tsk_recover (Sleuth­kit)
• fore­most
• photorec/testdisk
• bulk_extractor
• scalpel

Radare2

Dis­as­sem­bler. Start it with radare2 or r2 and the bina­ry as argument.

First, analyse the binary:

aaa

Show all functions:

afl

Go to visu­al­iza­tion mode:

vvv

Go to an address:

g 0x...
vvv

General links

• Ana­lyz­ing Win­dows malware

Tools for file formats

• DOC
  • DOCs are zipped files. Rename it into ZIP and extract it.
• ZIP
  • zipdump.py can analyse ZIP con­tent and show also hid­den parts.
  • Use also zip­in­fo and zipdetails.
• JPEG
  • jpeg­dump can analyse parts of JPEG files

HPA Host Protected Area

(From the March 2025 Inci­dent Response workshop.)

• A part of a hard disk / stor­age device, which is only vis­i­ble after a SATA command.
• This is used for res­cue partitions.
• Dur­ing nor­mal oper­a­tions, the data stor­aged there is not accessible.

DCO Disc Configuration Overlay

(From the March 2025 Inci­dent Response workshop.)

• A “wrap­per” which disc man­u­fac­tors some­times uses to change the char­ac­ter­is­tics of a hard drive.
• For exam­ple, a man­u­fac­tor uses slight­ly dif­fer­ent disc sizes inter­nal­ly. But the hard dri­ve should have the same capac­i­ty. So, the man­u­fac­tor can set the size via DCO. For all OS, this is the “phys­i­cal” size. How­ev­er, the dri­ve could store some more data which can only be accessed if the DCO was changed.

Notes

• An attack­er could set a region of a disk as defect (eg. in NTFS). Then, he could write data into this area with low-lev­el tools. Then, he could hide data there with­out a user would ever find it.
• NTFS uses a file entry table which uses 980/1000 byte for an file entry. Nor­mal­ly, a file is ref­er­enced in this file entry. But if the file is very small, it could be that the data of a file is direct­ly stored with­in the file entry.
• See MS Office doc­u­ments for OLE analysis