Skip to content

Latest commit

 

History

History
48 lines (35 loc) · 2.88 KB

File metadata and controls

48 lines (35 loc) · 2.88 KB

An All-In-One Bash script designed to combine some of Kali Linux's Forensics tools (Binwalk, Foremost, Exiftool, Bulk Extractor, Strings & Volatility) in order to automate the Data Forensics process in Incident Response scenarios.

The script performs the following operations:

  • Checks to make sure all tools are installed. If a tool is missing, the script attempts to install it.
  • Takes an image file from the user to inspect.
  • Generates an offset map using Binwalk and saves it in a timestamped folder.
  • Carves data using Foremost and saves the data inside the timestamped folder.
  • Uses Exiftool in order to generate metadata on the files carved using Foremost.
  • Carves data using Bulk Extractor; checks if the carved data has a pcap file. If it finds one - saves the file inside the timestamped folder separate from the carved data.
  • Examines the file for human-readable strings provided by the user.
  • Checks if the file is a memory file. If it is - allows the user to generate data out of it based on user input while using Volatility.
  • Generates a table of contents file inside the timestamped folder containing the folder's content, the date and time the analysis took place, and the time it took for the analysis to complete.
  • Generates a full timed Operations Log, timestamping every operation the script ran.
  • Asks if the user wishes to zip the results.
  • Ask the user whether they wish to examine another file.

Notes:

  1. The script uses volatility_2.5.linux.standalone. If you wish to use a later version - the script needs to be modified to accommodate it.
  2. Success of the tool installation segment may vary depending on the type of Linux Distro being used.

Full Script Run:

1 2

Installation Checkup on a different Linux Distributions:

ParrotOS:

12

DragonOS:

13

Folder Contents:

3 4 5 6 7

8 9 10 11