Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.
Awesome Lists | Featured Topics | Projects
https://github.com/cscorza/analisi-digital-forense

Strumenti di Acquisizione e Analisi di copie Forensi
https://github.com/cscorza/analisi-digital-forense
best-practices difr digital forensic-analysis forensics forensics-investigations forensics-tools linux macos tools windows
Last synced: 3 months ago
JSON representation
Strumenti di Acquisizione e Analisi di copie Forensi
Host: GitHub
URL: https://github.com/cscorza/analisi-digital-forense
Owner: CScorza
Created: 2022-12-07T08:51:06.000Z (about 2 years ago)
Default Branch: main
Last Pushed: 2023-10-24T09:55:17.000Z (over 1 year ago)
Last Synced: 2023-10-24T10:37:41.884Z (over 1 year ago)
Topics: best-practices, difr, digital, forensic-analysis, forensics, forensics-investigations, forensics-tools, linux, macos, tools, windows
Homepage:
Size: 90.8 KB
Stars: 130
Watchers: 4
Forks: 16
Open Issues: 1
Metadata Files:
- Readme: README.md
Awesome Lists containing this project

README

        ![Immagine2](https://user-images.githubusercontent.com/98583912/232338451-dbfc1d5f-e7b6-4300-9c98-da2905da689e.gif)

[![Telegram](https://img.shields.io/badge/Telegram-CScorza%20%22Indagini%20Telematiche%22-informational)](https://t.me/+kP_uYlc6-345Njc8)

[![**Manuali CScorza**](https://img.shields.io/badge/CScorza-Manuali-green)](https://drive.google.com/drive/folders/14jbOwS4GBSJhXP2BJk-TFCSMIzbZLBlj?usp=share_link)

![Immagine](https://user-images.githubusercontent.com/98583912/206292459-aef1e320-ce43-49bf-8cac-f8b9304888fd.gif)

**INDICE** 

|[**Distribuzioni**](https://github.com/CScorza/Analisi-Digital-Forense#distribuzioni)|[Software Copia Forense](https://github.com/CScorza/Analisi-Digital-Forense#software-copia-forense)|[**Software Analisi Forense**](https://github.com/CScorza/Analisi-Digital-Forense#software-analisi-forensics)|[**First Responder**](https://github.com/CScorza/Analisi-Digital-Forense#first-responder)|[**Mobile Forensic**](https://github.com/CScorza/OSINT-FORENSICS-MOBILE#tools-github)|[**Metadata Forensic**](https://github.com/CScorza/Analisi-Digital-Forense#metadata-forensics)|[Recovery Data](https://github.com/CScorza/Analisi-Digital-Forense#recovery-data)|[**Fonti e Risorse**](https://github.com/CScorza/Analisi-Digital-Forense#risorse-e-fonti)|

| :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |

 

# Distribuzioni

**Perchè usare una Distribuzione Linux?**

```

Le distribuzioni forensi per Linux sono sistemi che permettono di accedere a un PC e ai dati in esso contenuti 

senza alterarne lo stato e senza nemmeno utilizzarne l'ambiente preinstallato.

cybersecurity360.it

```

**Distribuzioni Linux**

||**Nome**|**Categoria**|

| :---: | :--- | :--- |

|![PredatorOS](https://user-images.githubusercontent.com/98583912/200109889-a6b0ee85-250f-4064-b18d-89aa36ee4c70.gif)|[**Predator-OS**](https://predator-os.ir/)|**CyberSecurity + Digital Forensics**|

|![Tails](https://user-images.githubusercontent.com/98583912/200109155-101196ac-c93f-4597-a1a7-df77fdb75328.gif)|[**Tails**](https://tails.ybti.net/tails/stable/tails-amd64-6.0/)|**CyberSecurity + Digital Forensics**|

|![PARROT SECURITY OS](https://user-images.githubusercontent.com/98583912/200109210-feb42746-0141-4312-afdb-75783eb8d583.gif)|[**PARROT SECURITY OS**](https://lnkd.in/d4z-SWut)|**CyberSecurity + Digital Forensics**|

|![CSI Linux png](https://user-images.githubusercontent.com/98583912/200109366-a0f79a3f-d7c9-420d-9d15-bd788599d394.gif)|[**CSI Linux**](https://lnkd.in/dw5su-Cj)|**CyberSecurity**|

|![CAINE](https://user-images.githubusercontent.com/98583912/200109408-7b7a5c59-4c72-46a5-9e34-7e31d94b5e46.gif)|[**CAINE**](https://bit.ly/hj265_caine)|**Digital Forensics**|

|![Tsurugi](https://user-images.githubusercontent.com/98583912/200109462-8db925e1-cd4c-4512-9e86-88f9288d0282.gif)|[**Tsurugi Linux**](https://lnkd.in/dat5feg5)|**CyberSecurity + Digital Forensics**|

|![AthenaOS](https://user-images.githubusercontent.com/98583912/200109607-762c159e-6eed-4f77-8296-e1f88e0b9c5e.gif)|[**AthenaOS**](https://lnkd.in/dp_XPTH6)|**CyberSecurity + Digital Forensics**|

|![Forlex](https://user-images.githubusercontent.com/98583912/200109947-147dfdd4-ab95-4f45-9dbd-d66a1d9971d4.gif)|[**Forlex**](https://lnkd.in/dtXW7yv2)|**CyberSecurity + Digital Forensics**|

|![Paladin](https://user-images.githubusercontent.com/98583912/200123619-f4cdb6c2-e11a-4985-9fe1-91d5f5937242.gif)|[**PALADIN EDGE**](https://sumuri.com/product/paladin-edge-64-bit/)|**Digital Forensics**|

|![470x382-SIFT_logo](https://user-images.githubusercontent.com/98583912/206298198-f6fe757b-5a45-4846-952f-72d15557f324.gif)|[**SANS Investigative Forensics Toolkit (sift)**](https://github.com/teamdfir/sift)|**Digital Forensics**|

**Windows Forensics**

```

La Windows forensics consente lo studio dei dati acquisiti estratti a fini investigativi da sistemi Windows e rappresenta 

dunque un settore consolidato della digital forensics soprattutto in ambito aziendale.

cybersecurity360.it

```

|![cropped-winfelogo](https://user-images.githubusercontent.com/98583912/206284577-e3e9c538-4fc8-460b-939d-85e123c67317.gif)|[**Windows Forensic Environment**](https://www.winfe.net/home)|

| :---: | :---: |

**Mac Forensics**

```

MAC forensics si riferisce all'indagine su un crimine verificatosi su o utilizzando un dispositivo MAC. 

Per contrastare gli attacchi informatici, è indispensabile che gli investigatori forensi 

possiedano una buona conoscenza del file system MAC e di tutte le funzionalità del sistema operativo.

info-savvy.com

```

![2022-12-07 22_05_13-6552C5C7-58E7-4A6D-B1D9-D8EB156604D7 jpeg (1200×630)](https://user-images.githubusercontent.com/98583912/206296153-28029f27-f1ca-41bf-9253-3f23ee4282ad.jpg)

|[**GitHub - APFS Fuse**](https://github.com/sgan81/apfs-fuse)|[**GitHub - mac_apt (macOS Artifact Parsing Tool)**](https://github.com/ydkhatri/mac_apt)|[**GitHub - MacLocationsScraper**](https://github.com/mac4n6/Mac-Locations-Scraper)|[**GitHub - macMRUParser**](https://github.com/mac4n6/macMRU-Parser)|[**GitHub - OSXAuditor**](https://github.com/jipegit/OSXAuditor)|[**GitHub - OSX Collect**](https://github.com/Yelp/osxcollector)|

| :---: | :---: | :---: | :---: | :---: | :---: | 

# Software Copia Forense

**COS'È UNA COPIA FORENSE?**

```

La copia forense (o bit-stream image), nel lessico forense, 

indica l'acquisizione di documenti in formato digitale che genera 

una copia bit a bit da un dispositivo di memoria di massa a un altro.

```

![Immagine4](https://user-images.githubusercontent.com/98583912/206297632-5ed073bf-7ae6-47ec-bbec-6ff9851f04d2.gif)

|[**DC3DD**](https://sourceforge.net/projects/dc3dd/)|[**DCFLDD**](https://dcfldd.sourceforge.net/)|[**FTK Imager**](https://accessdata.com/product-download/ftk-imager-version-4-5)|[**Guymager**](https://guymager.sourceforge.io/)|

| :---: | :---: | :---: | :---: | 

|[**GUIDA**](https://www.forensics-matters.com/tag/dc3dd/)|[**GUIDA**](https://blog.zenlab.it/clonazione-di-dispositivi-con-dcfldd/)|[**GUIDA**](https://www.google.it/search?q=ftk+imager+istruzioni&sxsrf=ALiCzsaOiLN1f5DJQXYO8YJTvds1MKCWhg%3A1670482320202&ei=kImRY6P1C9DvkgWgm7jQBw&ved=0ahUKEwij_bHKt-n7AhXQt6QKHaANDnoQ4dUDCA8&uact=5&oq=ftk+imager+istruzioni&gs_lcp=Cgxnd3Mtd2l6LXNlcnAQAzIGCAAQFhAeMgYIABAWEB4yBggAEBYQHjIGCAAQFhAeMgYIABAWEB46CggAEEcQ1gQQsAM6BAgjECc6CAgAEIAEEMsBOgoIABCABBCHAhAUOgUIABCABEoECEEYAEoECEYYAFDBBVi7HmCaIGgBcAB4AIABvgGIAZ0TkgEEMC4xNZgBAKABAcgBB8ABAQ&sclient=gws-wiz-serp#fpstate=ive&vld=cid:86e36094,vid:TkG4JqUcx_U)|[**GUIDA**](https://www.youtube.com/watch?v=aiDNZ4HjSF0)|

**Forensics Acquisition of Websites**

![web](https://user-images.githubusercontent.com/98583912/206399031-737161d7-fa88-4d18-8d3f-47e39b3d0be5.gif)

|[**FAW**](https://en.fawproject.com/)|[**httrack**](https://www.httrack.com/)|[**Browser History Capturer**](https://www.foxtonforensics.com/browser-history-capturer/)|[**Chrome Cache View**](http://www.nirsoft.net/utils/chrome_cache_view.html)|

| :---: | :---: | :---: | :---: |

|[**Guida - Forensic Acquisition of Websites, Webpages and Online Services with Open Source Tools [OSDFCon 2021]**](https://www.youtube.com/watch?v=Ms_aqvnalUU)|

| :---: |

**Software Analisi Forensics**

```

Analisi forense, è la conversione e l'estrazione dei vari dati, 

rilevando i percorsi, le date, chi vi ha avuto accesso e informazioni varie.

```

|[**Autopsy**](http://www.sleuthkit.org/autopsy/)|[**GitHub - DFF**](https://github.com/arxsys/dff)|[**GitHub - Dexter**](https://github.com/coinbase/dexter)|[**GitHub - Hash lookup Forensic Analyser**](https://github.com/hashlookup/hashlookup-forensic-analyser)|[**hashlookup**](https://www.circl.lu/services/hashlookup/)|

| :---: | :---: | :---: | :---: | :---: |

|[**GitHub - IntelMQ**](https://github.com/certtools/intelmq)|[**GitHub - Kuiper**](https://github.com/DFIRKuiper/Kuiper)|[**GitHub - Laika BOSS**](https://github.com/lmco/laikaboss)|[**GitHub - PowerForensics**](https://github.com/Invoke-IR/PowerForensics)|[**GitHub - TAPIR**](https://github.com/tap-ir/tapir)|

|[**GitHub - The Sleuth Kit**](https://github.com/sleuthkit/sleuthkit)|[**GitHub - Turbinia**](https://github.com/google/turbinia)|[**GitHub - IPED - Indexador e Processador de Evidências Digitais**](https://github.com/sepinf-inc/IPED)|[**GitHub - Wombat Forensics**](https://github.com/pjrinaldi/wombatforensics)||

|[**nirsoft.net**](http://www.nirsoft.net)|[**BENTO**](https://www.tipiloschi.net/Bento-2022.7_public.7z)||||

# Recovery Data

![Immagine7](https://user-images.githubusercontent.com/98583912/206305354-12c8effa-089e-41de-80c7-75c2db0ab9a9.gif)

|[**Cleverfiles**](https://www.cleverfiles.com/data-recovery-software.html)|[**PhotoRec**](https://www.cgsecurity.org/wiki/PhotoRec)|[**R-Studio**](http://www.r-studio.com/)|[**CCleaner - Recuva**](https://www.ccleaner.com/recuva)|[**Recoverit Wondershare**](https://recoverit.wondershare.com/)|

| :---: | :---: | :---: | :---: | :---: |

|[**Professional Data Recovery**](https://www.prosofteng.com/professional-data-recovery)|[**DiskGenius**](https://www.diskgenius.com/)|[**TestDisk**](https://www.cgsecurity.org/wiki/TestDisk)|[**EaseUS Data Recovery**](https://www.easeus.com/)||

# First Responder

```

Il Digital Evidence First Responder è la prima persona che interviene 

sulla scena del crimine per accedere al sistema informatico della vittima.

Il First Responder deve seguire una serie di regole e protocolli evitare di alterare la situazione sul luogo dell’incidente, 

né in negativo, attraverso la distruzione di fonti di prova, né in positivo, 

aggiungendo altre tracce, che potrebbero compromettere le indagini.

sicurezza.net

```

|[**GitHub - GRR Rapid Response**](https://github.com/google/grr)|[**GitHub - Linux Expl0rer**](https://github.com/intezer/linux-explorer)|[**GitHub - MIG: Mozilla InvestiGator**](https://github.com/mozilla/mig)|

| :---: | :---: | :---: |

|[**GitHub - OS Query**](https://github.com/osquery/osquery)|[**GitHub - POFR**](https://github.com/gmagklaras/pofr)|[**GitHub - UAC**](https://github.com/tclahr/uac)|

# Metadata Forensics

Che cos'è l'analisi forense dei metadati?

```

I metadati, spesso descritti come dati sui dati , consentono agli investigatori forensi digitali o informatici 

di comprendere la cronologia di un particolare file elettronico, 

incluso quando il file è stato creato, modificato e consultato, 

tra le altre informazioni che possono essere utilizzate per descrivere il file.

blackhawkintelligence.com 

```

|[**GitHub - inVtero.net**](https://github.com/ShaneK2/inVtero.net)|[**GitHub - KeeFarce**](https://github.com/denandz/KeeFarce)|[**GitHub - MemProcFS**](https://github.com/ufrisk/MemProcFS)|[**GitHub - Rekall**](https://github.com/google/rekall)|[**GitHub - Volatility**](https://github.com/volatilityfoundation/volatility)|[**GitHub - VolUtility**](https://github.com/kevthehermit/VolUtility)|

| :---: | :---: | :---: | :---: | :---: | :---: |

**Multi Strumenti**

![USB](https://user-images.githubusercontent.com/98583912/209347033-26aa1553-6b8d-4eb5-9f8c-4dece60ad27d.gif)

|[**Magnetic Forensics - Free Digital Forensics Tools Every Investigator Needs**](https://www.magnetforensics.com/blog/free-digital-forensics-tools-every-investigator-needs/?utm_source=LinkedIn&utm_medium=Organic&utm_campaign=2022_AXIOM_Social)|[**NirSoft**](http://www.nirsoft.net/)|

| :---: | :---: | 

# Strumenti a Pagamento

|[**Cellebrite - UFED Ultimate**](https://cellebrite.com/en/ufed-ultimate/)|[**Magnet Forensics**](https://www.magnetforensics.com/)|[**ENCASE Forensic**](https://www.opentext.com/products/encase-forensic)|

| :---: | :---: | :---: |

# Risorse e Fonti

![Immagine4](https://user-images.githubusercontent.com/98583912/206399938-4697d648-69d6-43d5-9ef3-5b7b5529347c.jpg)

```

ECCouncil.org - Forensics Investigation Services Digital Forensics

```

**BEST PRATICS**

||[**ENISA Digital forensics - Handbook**](https://www.enisa.europa.eu/topics/training-and-exercises/trainings-for-cybersecurity-specialists/online-training-material/documents/digital-forensics-handbook)|[**Basic Guide for First Responders**](https://www.enisa.europa.eu/publications/electronic-evidence-a-basic-guide-for-first-responders/at_download/fullReport)|[**Interpol - Guidelines to Digital Forensics First Responders_V7.pdf**](https://www.interpol.int/content/download/16243/file/Guidelines%20to%20Digital%20Forensics%20First%20Responders_V7.pdf)|

| :---: | :---: | :---: | :---: |

|**NEWS**|[**CScorza - Best Practices di Digital Forensics.pdf**](https://github.com/CScorza/Analisi-Digital-Forense/files/11068504/CScorza.-.Best.Practices.di.Digital.Forensics.pdf)|[**SWGDE Best Practices**](https://www.swgde.org/documents/draft-released-for-comment)||

|**Siti Internet**|**Libri**|**PDF**|

| :---: | :---: | :---: |

|[**bit4law.com - Digital Forensics**](https://www.bit4law.com/digital-forensics/)|[**Digital forensics. Guida per i professionisti delle investigazioni informatiche**](https://www.amazon.it/Digital-forensics-Andrea-Ghirardini/dp/8850334257/ref=asc_df_8850334257/?tag=googshopit-21&linkCode=df0&hvadid=499073655259&hvpos=&hvnetw=g&hvrand=18411916083389702633&hvpone=&hvptwo=&hvqmt=&hvdev=c&hvdvcmdl=&hvlocint=&hvlocphy=20590&hvtargid=pla-1242806794551&psc=1)|[**FTK IMAGER**](https://media.licdn.com/dms/document/C4E1FAQGzYeSXeqTARA/feedshare-document-pdf-analyzed/0/1671774797524?e=1672876800&v=beta&t=F41vmzrcl-a8KKJviJMryldBcEYrANddteYrkS_18kQ)|

|[**DalChecco - Digital Forensics**](https://www.dalchecco.it/formazione/glossario/digital-forensics/)|[**Digital Forensics - Roberto Murenec**](https://www.amazon.it/Digital-forensics-Roberto-Murenec/dp/8835212707/ref=sr_1_4?__mk_it_IT=%C3%85M%C3%85%C5%BD%C3%95%C3%91&crid=3CLCDD7A3HHDF&keywords=digital+forensics&qid=1670484719&s=books&sprefix=digital+forensi%2Cstripbooks%2C545&sr=1-4)|

|[**ICTSecurityMagazine.com - Digital Forensics nel Processo Penale**](https://www.ictsecuritymagazine.com/pubblicazioni/digital-forensics-nel-processo-penale/)||

|[**Paolo Dal Checco Forensic Acquisition of Websites with Open Source Tools OSDFCON 2021**](https://www.dalchecco.it/wp-content/uploads/2021/12/paolo-dal-checco-forensic-acquisition-of-websites-with-open-source-tools-osdfcon-2021.pdf)||

|[**TipiLoschi - REBUS - Guide Varie**](https://www.tipiloschi.net/drupal/)||