You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>SCRIPTS TO AID LIVE FORENSICS & INCIDENCE RESPONSE </p></h3>
3
4
4
5
```bash
5
6
@@ -23,26 +24,26 @@ Live Forensicator is part of the Black Widow Toolbox, its aim is to assist Foren
23
24
<p>It achieves this by gathering different system information for further review for anomalous behaviour or unexpected data entry, it also looks out for unusual files or activities and points it out to the investigator.</p>
24
25
<p>It is paramount to note that these scripts have no inbuilt intelligence its left for the investigator to analyse the output and decide on a conclusion or decide on carrying out more deeper investigation.</p>
25
26
26
-
# 🖳 WINDOWS
27
+
# 🖳 Forensicator For WINDOWS
27
28
<p>The windows version of Forensicator is written in Powershell.</p>
28
-
<p> Forensicator analysis Event Logs, it querries the event logs for certain log IDs that might point to an unusual activity or compromise. </p>
29
-
[View More On The Windows Tree](https://github.com/Johnng007/Live-Forensicator/tree/main/Windows)
29
+
<p> Forensicator for Windows has added ability to analysis Event Logs, it querries the event logs for certain log IDs that might point to an unusual activity or compromise. </p>
30
+
[Check out Forensicator for Windows](https://github.com/Johnng007/Live-Forensicator/tree/main/Windows)
30
31
31
32
32
-
# 👨💻 MacOS
33
-
The MacOS version is written in Bash.
34
-
[View More On The MacOS Tree](https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS)
33
+
# 👨💻 Forensicator For MacOS
34
+
<p>The MacOS version is a shell script.</p>
35
+
[Check out Forensicator for MacOS](https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS)
35
36
36
37
37
-
# 👩💻 LINUX
38
-
The Linux version is written in Bash.
39
-
[View More On The MacOS Tree](https://github.com/Johnng007/Live-Forensicator/tree/main/Linux)
38
+
# 👩💻 Forensicator For LINUX
39
+
<p>The Linux version is written in Bash.</p>
40
+
[Check out Forensicator for Linux](https://github.com/Johnng007/Live-Forensicator/tree/main/Linux)
40
41
> #### NOTE:
41
-
> The Bash codes were written for cross compatibility so therefore efforts were made to use factory shipped commands and avoid secoundary utitlities like `net-tools`.
42
+
> The Bash codes were written for cross compatibility accross linux distros so therefore efforts were made to use OS native commands avoid secoundary utitlities like `net-tools`.
42
43
43
44
44
45
45
-
## ✍ Notes
46
+
## ✍ General Notes
46
47
* Run the scripts as a priviledged user to get value.<br>
47
48
48
49
* Forensicator Activities may be flagged by IDS or IPS Solutions so take note.<br>
@@ -52,10 +53,10 @@ The Linux version is written in Bash.
52
53
53
54
* <p>Forensicator Has the ability to Search through all the folders within a system looking for files with similar extensions as well known Ransomwares, Albeit this search takes long but its helpful if the Alert you recieved is related to a Ransomware attack</p>
54
55
55
-
* <p>Forensictor can capture network traffic using netsh trace, this is useful when your investigation has to do with asset communicating with known malicious IPs, this way you can parse the pcapng file to wireshark and examine for C&C servers. By Defult i set the capture to take 120secs</p>
56
+
* <p>Forensicator can capture network traffic, this is useful when your investigation has to do with asset communicating with known malicious IPs, this way you can parse the pcapng file to wireshark and examine for C&C servers.</p>
56
57
57
58
* <p>Sometimes it may be paramount to maintain the integrity of the Artifacts, where lawyers may argue that it might have been compromised on transit to your lab.
58
-
Forensicator can now encrypt the Artifact with a unique randomely generated key using AES algorithm, you can specify this by using the -ENCRYPTED parameter. You can decrypt it at will anywhere anytime even with another copy of Forensicator, just keep your key safe. This task is performed by the FileCryptography.psm1 file
59
+
Forensicator can encrypt the Artifact with a unique randomely generated key using AES algorithm, you can specify this by using the -ENCRYPTED parameter. You can decrypt it at will anywhere anytime even with another copy of Forensicator, just keep your key safe. This task is performed by the FileCryptography.psm1 file
59
60
> #### NOTE:
60
61
> This feature is only currently available in the Windows Module..
61
62
</p>
@@ -75,6 +76,9 @@ Linux: v1.0 09/06/2024
75
76
1. Created Forensicator for Linux machines.
76
77
2. Re-arranged the Directory to show that Forensicator has moved from just a powershell tool to a suite of tools.
77
78
79
+
Windows: v4.0.1 09/06/2024
80
+
1. Adjusted Static file references to adapt to the new Forensicator Github structure.
0 commit comments