Skip to content

Commit

Permalink
Removed dead references (#201)
Browse files Browse the repository at this point in the history
  • Loading branch information
joachimmetz authored Dec 3, 2023
1 parent a554fc0 commit 7e6d68a
Show file tree
Hide file tree
Showing 29 changed files with 45 additions and 409 deletions.
4 changes: 1 addition & 3 deletions docs/apple_iphone.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,6 @@ Store does not allow in any application it distributes).
- [iphone-dataprotection](https://code.google.com/archive/p/iphone-dataprotection);
a set of tools that can image and decrypt an iPhone. The tools can
even brute-force the iPhone's 4-digit numerical password.
- [iOS Forensic Research](http://www.iosresearch.org). Jonathan Zdziarski has released tools that will
image iPhones, iPads and iPod Touch. (law enforcement only).
- [libimobiledevice](https://libimobiledevice.org/) is a library with
utilities for backing up iPhones. The output format is an iTunes-style
backup that can be examined with traditional tools. They are available
Expand Down Expand Up @@ -61,7 +59,7 @@ Store does not allow in any application it distributes).
- [Wikipedia: iPhone](https://en.wikipedia.org/wiki/IPhone)
- [Wikipedia: IOS jailbraking](https://en.wikipedia.org/wiki/IOS_jailbreaking)
- [The iPhone Wiki](https://www.theiphonewiki.com/wiki/Main_Page)
- [Slashdot: Malware Could Grab Data From Stock iPhones](https://it.slashdot.org/story/09/12/04/0413235/Malware-Could-Grab-Data-From-Stock-iPhones?from=rsshttp://it.slashdot.org/story/09/12/04/0413235/Malware-Could-Grab-Data-From-Stock-iPhones?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29utm_source=feedburnerhttp://it.slashdot.org/story/09/12/04/0413235/Malware-Could-Grab-Data-From-Stock-iPhones?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29utm_medium=feedhttp://it.slashdot.org/story/09/12/04/0413235/Malware-Could-Grab-Data-From-Stock-iPhones?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29)
- [Slashdot: Malware Could Grab Data From Stock iPhones](https://it.slashdot.org/story/09/12/04/0413235/Malware-Could-Grab-Data-From-Stock-iPhones)
- [Apple iOS Privacy](http://seriot.ch/resources/talks_papers/iPhonePrivacy.pdf),
[slides hash days presentation](http://seriot.ch/resources/talks_papers/ios_privacy_hashdays.pdf),
by Nicolas Seriot, in November 2010.
Expand Down
5 changes: 0 additions & 5 deletions docs/bmp.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,6 @@ Each file consists of a [header](header.md), an information
block, and then the image data. Note that the image data is given in
order from the *end* of the image file!

## Metadata

In iOS, the [Photo Investigator](photo_investigator.md) can
extract, view, and remove BMP metadata.

## External Links

* [Wikipedia: BMP](https://en.wikipedia.org/wiki/Windows_bitmap)
1 change: 0 additions & 1 deletion docs/cell_phone_forensics.md
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,6 @@ Investigative Support
* [E-Evidence.Info Mobile Forensic Tools](http://www.e-evidence.info/cellular.html)
* [ForensicFocus.com(Practitioners Forum)](https://forensicfocus.com)
* [Mobile-Forensics.com (Research Forum for Mobile Device Forensics)](http://www.mobile-forensics.com/)
* [Phone-Forensics.com (Advanced Forum for Practitioners)](http://www.Phone-Forensics.com)
* [TREW Mobile Telephone Evidence (Mobile Telephone Evidence Practitioner Site)](http://trewmte.blogspot.com)

Phone Research
Expand Down
6 changes: 0 additions & 6 deletions docs/conferences.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,6 @@ of conferences and journals at <https://digital-evidence.org/publish/index.html>
and used with his permission. Brian no longer maintains those listings and
points back to this Wiki.

For Dates and Locations of upcoming conferences and training events, see the
pages titled<b> [Upcoming events](upcoming_events.md)</b> <i>(Calls for papers,
Conferences and On-Demand Training)</i> and <b>Scheduled Training Courses</b>
<i>(Training Classes/Courses scheduled for specific dates/locations)</i>.

# Research Conferences and Workshops

Research conferences that are related to digital investigation and forensics.
Expand Down Expand Up @@ -129,4 +124,3 @@ Techno-Security Conference
# See also

* [Journals](journals.md)
* [Upcoming events](upcoming_events.md)
53 changes: 0 additions & 53 deletions docs/dibs.md

This file was deleted.

2 changes: 1 addition & 1 deletion docs/disk_imaging.md
Original file line number Diff line number Diff line change
Expand Up @@ -118,5 +118,5 @@ rare since the non-encrypted data is what undergoes analysis.

### Hash based imaging

* [Hash based disk imaging using AFF4](http://www.dfrws.org/2010/proceedings/2010-314.pdf),
* [Hash based disk imaging using AFF4](https://dfrws.org/sites/default/files/session-files/2010_USA_pres-hash_based_disk_imaging_using_aff4.pdf),
by [Michael Cohen](michael_cohen.md), [Bradley Schatz](bradley_schatz.md)
12 changes: 4 additions & 8 deletions docs/famous_cases_involving_digital_forensics.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,8 +61,8 @@ that some of the viruses kept re-attaching themselves to movies. When
the squad looked at the videos they determined that they were child
pornography and contacted the police.

- <https://www.forbes.com/sites/kashmirhill/2010/10/12/the-geek-squad-becomes-the-porn-squad/>
- <https://law.justia.com/cases/alabama/court-of-appeals-criminal/2010/08-1767.html>
- [The Geek Squad Becomes the Porn Squad](https://www.forbes.com/sites/kashmirhill/2010/10/12/the-geek-squad-becomes-the-porn-squad/)
- [Corey Beantee Melton v. State of Alabama](https://law.justia.com/cases/alabama/court-of-appeals-criminal/2010/08-1767.html)

### 2007 James Kent

Expand All @@ -84,10 +84,7 @@ child pornography. In the appeal the court throws out one count, arguing
that Kent did not know that viewing child pornography online made a copy
of the pornography in his web browser's cache.

- <http://www.dailyfreeman.com/articles/2010/10/20/blotter/doc4cbe74442fd0d812453451.txt>
- <https://www.nbcnews.com/us-news?lite>
- [Opinion](http://www.msn.com/de-ch/)
- <https://www.forbes.com/sites/kashmirhill/2010/10/15/i-was-doing-academic-research-not-an-adequate-defense-for-child-porn-possession/>
- ['I Was Doing Academic Research' Not an Adequate Defense for Child Porn Possession](https://www.forbes.com/sites/kashmirhill/2010/10/15/i-was-doing-academic-research-not-an-adequate-defense-for-child-porn-possession/)

### 2008 Brad Cooper

Expand Down Expand Up @@ -126,8 +123,7 @@ topics....In one of those conversations, the person identified himself
as a married 45-year-old man with a daughter, a description that fits
Mr. Cameron."

- <https://www.pressherald.com/2011/03/10/cameron-sentenced-to-16-years-in-prison/>
- <http://www.mahalo.com/james-m-cameron/>
- [Cameron sentenced to 16 years in prison](https://www.pressherald.com/2011/03/10/cameron-sentenced-to-16-years-in-prison/)

## See Also

Expand Down
31 changes: 4 additions & 27 deletions docs/file_carving.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,81 +48,60 @@ recover fragmented files.

## File Carving Taxonomy

[Simson Garfinkel](simson_garfinkel.md) and [Joachim
Metz](joachim_metz.md) have proposed the following file carving
taxonomy:
[Simson Garfinkel](simson_garfinkel.md) and [Joachim Metz](joachim_metz.md) have
proposed the following file carving taxonomy:

Carving
General term for extracting data (files) out of undifferentiated blocks
(raw data), like "carving" a sculpture out of soap stone.

<!-- -->

Block-Based Carving
Any carving method (algorithm) that analyzes the input on block-by-block
basis to determine if a block is part of a possible output file. This
method assumes that each block can only be part of a single file (or
embedded file).

<!-- -->

Statistical Carving
Any carving method (algorithm) that analyzes the input on characteristic
or statistic for example, entropy) to determine if the input is part of
a possible output file.

<!-- -->

Header/Footer Carving
A method for carving files out of raw data using a distinct header
(start of file marker) and footer (end of file marker).

<!-- -->

Header/Maximum (file) size Carving
A method for carving files out of raw data using a distinct header
(start of file marker) and a maximum (file) size. This approach works
because many file formats (e.g. JPEG, MP3) do not care if additional
junk is appended to the end of a valid file.

<!-- -->

Header/Embedded Length Carving
A method for carving files out of raw data using a distinct header and a
file length (size) which is embedded in the file format

<!-- -->

File structure based Carving
A method for carving files out of raw data using a certain level of
knowledge of the internal structure of file types. Garfinkel called this
approach "Semantic Carving" in his DFRWS2006 carving challenge
submission, while Metz and Mora called the approach "Deep Carving."

<!-- -->

Semantic Carving
A method for carving files based on a linguistic analysis of the file's
content. For example, a semantic carver might conclude that six blocks
of french in the middle of a long HTML file written in English is a
fragment left from a previous allocated file, and not from the
English-language HTML file.

<!-- -->

Carving with Validation
A method for carving files out of raw data where the carved files are
validated using a file type specific validator.

<!-- -->

Fragment Recovery Carving
A carving method in which two or more fragments are reassembled to form
the original file or object. Garfinkel previously called this approach
"Split Carving."

<!-- -->

Repackaging Carving
A carving method that modifies the extracted data by adding new headers,
footers, or other information so that it can be viewed with standard
Expand All @@ -133,11 +112,9 @@ utility.

## File Carving challenges and test images

[File Carving Challenge](http://www.dfrws.org/2006/challenge/) -
[DFRWS](digital_forensic_research_workshop.md) 2006
[DFRWS: File Carving Challenge](https://github.com/dfrws/dfrws2006-challenge)

[File Carving Challenge](http://www.dfrws.org/2007/challenge/) -
[DFRWS](digital_forensic_research_workshop.md) 2007
[DFRWS: File Carving Challenge](https://github.com/dfrws/dfrws2007-challenge)

[FAT Undelete Test \#1](https://dftt.sourceforge.net/test6/index.html) -
Digital Forensics Tool Testing Image (dftt \#6)
Expand Down
7 changes: 1 addition & 6 deletions docs/gif.md
Original file line number Diff line number Diff line change
Expand Up @@ -51,12 +51,7 @@ applications to insert application specific data inside a GIF. The
beginning of this block has the Extension Introducer and an Application
Extension Label `FF` (hex).

In iOS, the [Photo Investigator](photo_investigator.md) can
extract, view, and remove GIF metadata.

## External Links

- [Wikipedia: GIF](https://en.wikipedia.org/wiki/GIF)
- [W3.Org: GRAPHICS INTERCHANGE FORMAT
SPECIFICATION](https://www.w3.org/Graphics/GIF/spec-gif89a.txt)

- [W3.Org: GRAPHICS INTERCHANGE FORMAT SPECIFICATION](https://www.w3.org/Graphics/GIF/spec-gif89a.txt)
13 changes: 5 additions & 8 deletions docs/global_positioning_system.md
Original file line number Diff line number Diff line change
Expand Up @@ -146,17 +146,14 @@ you can connect to the camera). This makes it possible for the camera to record
where exactly a photo was taken. This positioning information (latitude,
longitude) can be stored in the [Exif](exif.md) [metadata](metadata.md) header
of [JPEG](jpeg.md) files. Tools such as [jhead](jhead.md) can display the GPS
information in the [Exif](exif.md) headers. In iOS, the [Photo
Investigator](photo_investigator.md) can extract, view, and remove metadata
from all images, as well as easily identify images with GPS metadata while
scrolling through the images.
information in the [Exif](exif.md) headers.

### Cell Phones with GPS

Some recent cell phones (e.g. a [Motorola EZX phone](http://wiki.openezx.org)
such as the Motorola A780) have a built-in GPS receiver and navigation
software. This software might record the paths travelled (and the date/time),
which can be very useful in forensic investigations.
Some recent cell phones (e.g. a Motorola EZX phone such as the Motorola A780)
have a built-in GPS receiver and navigation software. This software might
record the paths travelled (and the date/time), which can be very useful in
forensic investigations.

## See Also

Expand Down
9 changes: 1 addition & 8 deletions docs/gprs.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
tags:
- No Category
- Mobile
---
**General Packet Radio Services (GPRS)** is a wireless data
communication service that transfers data at a rate of up to 40-50Kbps,
Expand Down Expand Up @@ -41,15 +41,11 @@ There are three GPRS classes which help indicate the capabilities of a
Mobile phones of this class can be connected to both GPRS and
[GSM](gsm.md) services simultaneously.

<!-- -->

**Class B**
Mobile phones of this class can be attached to both GPRS and GSM
services, but using only one service at a time. Switching between them
(suspend/resume) is done automatically.

<!-- -->

**Class C**
Mobile phones of this class are attached to either GPRS or GSM voice
service. One needs to switch manually between services.
Expand All @@ -70,7 +66,4 @@ of transfer.

## External Links

- <https://www.gsma.com>
- <http://www.kochar.com/gprs/classtypes.html>
- <https://www.nokia.com/>
- [Wikipedia: GPRS](https://en.wikipedia.org/wiki/GPRS)
2 changes: 1 addition & 1 deletion docs/hfs+.md
Original file line number Diff line number Diff line change
Expand Up @@ -355,7 +355,7 @@ HFS+ stores U+2400 as U+0
* Internet Archive Copy of: [Technical Note TN1150: HFS plus volume format](http://web.archive.org/web/20220208191804/https://developer.apple.com/documentation/technotes)
* [Mac Forensics: Mac OS X and the HFS+ File System](http://cet4861.pbworks.com/w/file/fetch/71245694/mac.forensics.craiger-burke.IFIP.06.pdf)
by P. Craiger, November 2005
* [Using the HFSD journal for deleted file recovery](http://www.dfrws.org/2008/proceedings/p76-burghardt.pdf),
* [Using the HFSD journal for deleted file recovery](https://dfrws.org/sites/default/files/session-files/2008_USA_pres-using_the_hfs_journal_for_deleted_file_recovery.pdf),
by Aaron Burghardt, Adam Feldman, DRFWS 2008

## Tools
Expand Down
6 changes: 0 additions & 6 deletions docs/jhead.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,3 @@ Metering Mode: center weight
Exposure Mode: Manual
Exposure Mode: Auto bracketing
```

## Externals Links

* Article about removing [hidden data in JPEG
files](http://netzreport.googlepages.com/hidden_data_in_jpeg_files.html)
with jhead
4 changes: 1 addition & 3 deletions docs/jpeg.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,7 @@ as Exif, IPTC, GPS, or Camera Raw.

The [exif](exif.md) and [jhead](jhead.md) command tools can extract and
manipulate some of that metadata. [Adroit Photo Forensics](adroit_photo_forensics.md)
can be used to extract, view and group metadata from jpeg and camera Raw files.
In iOS, the [Photo Investigator](photo_investigator.md) can extract, view, and
remove metadata from all images.
can be used to extract, view and group metadata from JPEG and camera Raw files.

# Also see

Expand Down
Loading

0 comments on commit 7e6d68a

Please sign in to comment.