Sans Investigative Forensics Toolkit (SIFT)

ubuntu@ubuntu:~$ binwalk –help


Usage: binwalk [OPTIONS] [FILE1] [FILE2] [FILE3] …

Signature Scan Options:


-B, –signature              Scan target file(s) for common file signatures


-R, –raw=        Scan target file(s) for the specified sequence of bytes


-A, –opcodes                Scan target file(s) for common executable opcode signatures


-m, –magic=     Specify a custom magic file to use


-b, –dumb                   Disable smart signature keywords


-I, –invalid                Show results marked as invalid


-x, –exclude=     Exclude results that match


-y, –include=     Only show results that match

Extraction Options:


-e, –extract                Automatically extract known file types


-D, –dd=   Extract signatures, give the files an


                                extension of , and execute


-M, –matryoshka             Recursively scan extracted files


-d, –depth=      Limit matryoshka recursion depth (default: 8 levels deep)


-C, –directory=  Extract files/folders to a custom directory


-j, –size=       Limit the size of each extracted file


-n, –count=      Limit the number of extracted files


-r, –rm                     Delete carved files after extraction


-z, –carve                  Carve data from files, but don’t execute extraction utilities

Entropy Analysis Options:


-E, –entropy                Calculate file entropy


-F, –fast                   Use faster, but less detailed, entropy analysis


-J, –save                   Save plot as a PNG


-Q, –nlegend                Omit the legend from the entropy plot graph


-N, –nplot                  Do not generate an entropy plot graph


-H, –high=     Set the rising edge entropy trigger threshold (default: 0.95)


-L, –low=      Set the falling edge entropy trigger threshold (default: 0.85)

Binary Diffing Options:

-W, –hexdump                Perform a hexdump / diff of a file or files


-G, –green                  Only show lines containing bytes that are the same among all files


-i, –red                    Only show lines containing bytes that are different among all files


-U, –blue                   Only show lines containing bytes that are different among some files


-w, –terse                  Diff all files, but only display a hex dump of the first file

Raw Compression Options:


-X, –deflate                Scan for raw deflate compression streams


-Z, –lzma                   Scan for raw LZMA compression streams


-P, –partial                Perform a superficial, but faster, scan


-S, –stop                   Stop after the first result

General Options:

-l, –length=           Number of bytes to scan


-o, –offset=           Start scan at this file offset


-O, –base=             Add a base address to all printed offsets


-K, –block=            Set file block size


-g, –swap=             Reverse every n bytes before scanning


-f, –log=             Log results to file


-c, –csv                    Log results to file in CSV format


-t, –term                   Format output to fit the terminal window


-q, –quiet                  Suppress output to stdout


-v, –verbose                Enable verbose output


-h, –help                   Show help output


-a, –finclude=         Only scan files whose names match this regex


-p, –fexclude=         Do not scan files whose names match this regex


-s, –status=           Enable the status server on the specified port

ubuntu@ubuntu:~$ volatility -h

Options:


-h, –help            list all available options and their default values.


Default values may be set in the configuration file

(/etc/volatilityrc)

–conf-file=/home/usman/.volatilityrc


User based configuration file


-d, –debug           Debug volatility

–plugins=PLUGINS     Additional plugin directories to use (colon separated)


–info                Print information about all registered objects

–cache-directory=/home/usman/.cache/volatility


Directory where cache files are stored


–cache               Use caching

–tz=TZ               Sets the (Olson) timezone for displaying timestamps


using pytz (if installed) or tzset

-f FILENAME, –filename=FILENAME


Filename to use when opening an image

–profile=WinXPSP2x86

Name of the profile to load (use –info to see a list of supported profiles)

-l LOCATION, –location=LOCATION


A URN location from which to load an address space


-w, –write           Enable write support

–dtb=DTB             DTB Address

–shift=SHIFT         Mac KASLR shift address

–output=text         Output in this format (support is module specific, see


the Module Output Options below)

–output-file=OUTPUT_FILE


Write output in this file


-v, –verbose         Verbose information


–physical_shift=PHYSICAL_SHIFT


Linux kernel physical shift address


–virtual_shift=VIRTUAL_SHIFT


Linux kernel virtual shift address

-g KDBG, –kdbg=KDBG  Specify a KDBG virtual address (Note: for 64-bit


Windows 8 and above this is the address of


KdCopyDataBlock)


–force               Force utilization of suspect profile

–cookie=COOKIE       Specify the address of nt!ObHeaderCookie (valid for


Windows 10 only)

-k KPCR, –kpcr=KPCR  Specify a specific KPCR address


 


Supported Plugin Commands:


 


amcache          Print AmCache information


apihooks         Detect API hooks in process and kernel memory


atoms            Print session and window station atom tables


atomscan         Pool scanner for atom tables


auditpol         Prints out the Audit Policies from HKLMSECURITYPolicyPolAdtEv


bigpools         Dump the big page pools using BigPagePoolScanner


bioskbd          Reads the keyboard buffer from Real Mode memory


cachedump        Dumps cached domain hashes from memory


callbacks        Print system-wide notification routines


clipboard        Extract the contents of the windows clipboard


cmdline          Display process command-line arguments


cmdscan          Extract command history by scanning for _COMMAND_HISTORY


connections      Print list of open connections [Windows XP and 2003 Only]


connscan         Pool scanner for tcp connections


consoles         Extract command history by scanning for _CONSOLE_INFORMATION


crashinfo        Dump crash-dump information


deskscan         Poolscaner for tagDESKTOP (desktops)


devicetree       Show device tree


dlldump          Dump DLLs from a process address space


dlllist          Print list of loaded dlls for each process


driverirp        Driver IRP hook detection


drivermodule     Associate driver objects to kernel modules


driverscan       Pool scanner for driver objects


dumpcerts        Dump RSA private and public SSL keys


dumpfiles        Extract memory mapped and cached files


dumpregistry     Dumps registry files out to disk


gditimers        Print installed GDI timers and callbacks


gdt              Display Global Descriptor Table


getservicesids   Get the names of services in the Registry and return Calculated SID


getsids          Print the SIDs owning each process


handles          Print list of open handles for each process


hashdump         Dumps passwords hashes (LM/NTLM) from memory


hibinfo          Dump hibernation file information


lsadump          Dump (decrypted) LSA secrets from the registry


machoinfo        Dump Mach-O file format information


memmap           Print the memory map


messagehooks     List desktop and thread window message hooks


mftparser        Scans for and parses potential MFT entries


moddump          Dump a kernel driver to an executable file sample


modscan          Pool scanner for kernel modules


modules          Print list of loaded modules


multiscan        Scan for various objects at once


mutantscan       Pool scanner for mutex objects


notepad          List currently displayed notepad text


objtypescan      Scan for Windows object type objects


patcher          Patches memory based on page scans


poolpeek         Configurable pool scanner plugin

ubuntu@ubuntu:~$ exif ‘-filename<CreateDate’ -d %y%m%d_%H%M%S%% -r

<extension of images e.g jpg,cr2> <path to file>

CreateDate: sort by the file’s creation date and time


-d: set the format


-r: recursive (use the following command on every file in the given path)


-extension: extension of files to be modified (jpeg, png, etc.)

-path to file: location of folder or subfolder

Take a look at the ExifTool man page:

ubuntu@ubuntu:~$ exif –help

-v, –version                   Display software version


-i, –ids                       Show IDs instead of tag names


-t, –tag=tag                   Select tag

–ifd=IFD                   Select IFD


-l, –list-tags                 List all EXIF tags


–|, –show-mnote                Show contents of tag MakerNote


–remove                    Remove tag or ifd


-s, –show-description          Show description of tag


-e, –extract-thumbnail         Extract thumbnail


-r, –remove-thumbnail          Remove thumbnail


-n, –insert-thumbnail=FILE     Insert FILE as thumbnail


–no-fixup                  Do not fix existing tags in files


-o, –output=FILE               Write data to FILE

–set-value=STRING          Value of tag


-c, –create-exif               Create EXIF data if not existing


-m, –machine-readable          Output in a machine-readable (tab delimited) format


-w, –width=WIDTH               Width of output


-x, –xml-output                Output in a XML format


-d, –debug                     Show debugging messages


Help options:


-?, –help                      Show this help message


–usage                     Display brief usage message

ubuntu@ubuntu:~$ dcfldd if=<source> of <destination>

bs=512 count=1 hash=<hash type>

if=destination of drive of which to create an image

of=destination where copied image will be stored

bs=block size (number of bytes to copy at a time)

hash=hash type (optional)

ubuntu@ubuntu:~$ dcfldd –help


dcfldd –help

Usage: dcfldd [OPTION]…


Copy a file, converting and formatting according to the options.

bs=BYTES                 force ibs=BYTES and obs=BYTES


cbs=BYTES                convert BYTES bytes at a time


conv=KEYWORDS            convert the file as per the comma separated keyword listcc


count=BLOCKS             copy only BLOCKS input blocks


ibs=BYTES                read BYTES bytes at a time


if=FILE                  read from FILE instead of stdin


obs=BYTES                write BYTES bytes at a time


of=FILE                  write to FILE instead of stdout

NOTE: of=FILE may be used several times to write


output to multiple files simultaneously

of:=COMMAND              exec and write output to process COMMAND


seek=BLOCKS              skip BLOCKS obs-sized blocks at start of output


skip=BLOCKS              skip BLOCKS ibs-sized blocks at start of input


pattern=HEX              use the specified binary pattern as input


textpattern=TEXT         use repeating TEXT as input


errlog=FILE              send error messages to FILE as well as stderr


hashwindow=BYTES         perform a hash on every BYTES amount of data


hash=NAME                either md5, sha1, sha256, sha384 or sha512


default algorithm is md5. To select multiple


algorithms to run simultaneously enter the names


in a comma separated list


hashlog=FILE             send MD5 hash output to FILE instead of stderr


if you are using multiple hash algorithms you


can send each to a separate file using the


convention ALGORITHMlog=FILE, for example


md5log=FILE1, sha1log=FILE2, etc.


hashlog:=COMMAND         exec and write hashlog to process COMMAND


ALGORITHMlog:=COMMAND also works in the same fashion


hashconv=[before|after]  perform the hashing before or after the conversions


hashformat=FORMAT        display each hashwindow according to FORMAT


the hash format mini-language is described below


totalhashformat=FORMAT   display the total hash value according to FORMAT


status=[on|off]          display a continual status message on stderr


default state is “on”


statusinterval=N         update the status message every N blocks


default value is 256


sizeprobe=[if|of]        determine the size of the input or output file


for use with status messages. (this option


gives you a percentage indicator)


WARNING: do not use this option against a


tape device.


you may use any number of ‘a’ or ‘n’ in any combo


the default format is “nnn”

NOTE: The split and splitformat options take effect


only for output files specified AFTER digits in


any combination you would like.


(e.g. “anaannnaana” would be valid, but


quite insane)


vf=FILE                  verify that FILE matches the specified input


verifylog=FILE           send verify results to FILE instead of stderr


verifylog:=COMMAND       exec and write verify results to process COMMAND


 


–help           display this help and exit


–version        output version information and exit


ascii     from EBCDIC to ASCII


ebcdic    from ASCII to EBCDIC


ibm       from ASCII to alternated EBCDIC


block     pad newline-terminated records with spaces to cbs-size


unblock   replace trailing spaces in cbs-size records with newline


lcase     change upper case to lower case


notrunc   do not truncate the output file


ucase     change lower case to upper case


swab      swap every pair of input bytes


noerror   continue after read errors


sync      pad every input block with NULs to ibs-size; when used