This contains the mostly used tools for forensic investigation

---

Tools used for Basic Analysis:

Whenever you get any file, first do the initial analysis using these command line tools.

Tool	Description	Usage
file	Checks the type of file	file -filename
exiftool	Gives the basic metadata	exiftool - filename
binwalk	Shows the embedded files	binwalk -filename
strings	Gives out all printable characters	strings -filename
foremost	Extracts out any embedded files	foremost -filename
pngcheck	Details about a png image	pngcheck –options -filename
ffmpeg	Check the integrity of audio files	ffmpeg –options -filename

Steganography Detection Tools:

These are some tools which detect if any stegnano activity is being done on any kind of file:

Tool	File Types Supported	Usage
zsteg	PNG,BMP	zsteg -filename
stegdetect	JPG	stegdetect -filename
stegbreak	JPG	stegbreak -t o -f wordlist.txt -filename
stegsolve	All image format	Detail is mentioned below

First install the jar package of stegsolve and then use it as follows: [java -jar stegsolve] in Terminal.

Make sure you install the required java package also

Steganography Application Tools:

These tools could be used to implement as well as reveal any hidden messages.One can try any of these tools if they feel that one of these techniques have been implemented to hide any message.

Tool	File Types Supported	Hiding	Recovering
Jsteg	JPG	jsteg hide hide.jpg secret.txt image1.jpg	jsteg reveal hide.jpg output.txt
OpenStego	PNG	openstego embed -mf secret.txt -cf hide.png -p password -sf stego.png	openstego extract -sf openstego.png -p ab12 -xf output.txt
Outguess	JPG	outguess -k password -d secret.txt cover.jpg stego.jpg	outguess -r -k password stego.jpg output.txt
Steghide	JPG,BMP,WAV	steghide embed -f -ef secret.txt -cf cover.jpg -p password -sf stego.jpg	steghide extract -sf stego.jpg -p password -xf output.txt
LSBSteg	PNG,BMP	LSBSteg encode -i cover.png -o stego.png -f secret.txt	LSBSteg decode -i stego.png -o output.txt
mp3stego	Audio files	mp3stego-encode -E secret.txt -P password cover.wav stego.mp3	mp3stego-decode -X -P password stego.mp3 out.txt
AudioStego	Audio files	hideme cover.mp3 secret.txt && mv ./output.mp3 stego.mp3	hideme stego.mp3 -f && cat output.txt
stegano	PNG	stegano-lsb hide --input cover.jpg -f secret.txt -e UTF-8 --output stego.png or stegano-red hide --input cover.png -m "secret msg" --output stego.png or stegano-lsb-set hide --input cover.png -f secret.txt -e UTF-8 -g $GENERATOR --output stego.png for various generators (stegano-lsb-set list-generators)	stegano-lsb reveal -i stego.png -e UTF-8 -o output.txt or stegano-red reveal -i stego.png or stegano-lsb-set reveal -i stego.png -e UTF-8 -g $GENERATOR -o output.txt

Tools dealing with Audio files(Embedding and Revealing Data):

Tool	Description	Usage
Audacity	This is a great tool in analysing, modifying and revealing any data present inside audio, mostly used in analysing audio files	audacity -filename
Sonic Visualiser	Yet another similar tool like Audacity, which also cud be used in investigating audio files	sonic-visualiser -filename
Deepsound	This is a tool which is used to hide/reveal any data in audio file using a password	It is a Windows apllication

mp3stego and Audiostego are also tools which could be used for Audio data analysis.

Deepsound is a Windows based application, which can be downloaded from Internet.

(Pssss.. Just check my Tool_Vault maybe you can find one) 😁

Tool dealing with Memory Dumps(Analysing hidden data or malicious activity):

Volatility is an open source memory forensics framework for incident response and malware analysis. It is written in Python and supports Microsoft Windows, Mac OS X, and Linux.

To download volatility just type in the terminal sudo apt-get install volatility

Tools dealing with Network Packet captures(Analysing network activity):

Tool	Description	Usage
Wireshark	Wireshark is a free and open source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development	wireshark filename.pcap
Tcpdump	tcpdump is a common packet analyzer that runs under the command line. It allows the user to display TCP/IP and other packets being transmitted or received over a network to which the computer is attached	tcpdump -options
Network Miner	NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows. NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network	GUI application

Network Miner is a GUI Application which can be downloaded from Internet Or just check my Vault... 😁

Tools used for Disk-Image data Analysis:

Tool	Description	Usage
Fdisk	For computer file systems, fdisk is a command-line utility that provides disk partitioning functions	fdsik -lu filename
mmls	mmls displays the contents of a volume system (media management). In general, this is used to list the partition table contents so that you can determine where each partition starts. The output identifies the type of partition and its length, which makes it easy to use 'dd' to extract the partitions	mmls filename
TestDisk	Testdisk is powerful free data recovery software. It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software	testdisk filename
Autopsy	Autopsy is computer software that makes it simpler to deploy many of the open source programs and plugins used in The Sleuth Kit. The graphical user interface displays the results from the forensic search of the underlying volume making it easier for investigators to flag pertinent sections of data	GUI Application
OSForensics	OSForensics is a digital computer forensic application which lets you extract and analyse digital data evidence efficiently and with ease. It discovers, identifies and manages ie uncovers everything hidden inside your computer systems and digital storage devices.	GUI Application

Both Autopsy and OSForensics can be downloaded from Internet or check in my Vault!!!!!!!