Projects

libforensics

LibForensics is a library for developing digital forensics applications. Currently it is developed in pure Python. After a majority of the code has been developed and stabilized, the bottlenecks will likely be converted into C-based modules. I'm looking for people to use and test the ... [More] framework. I've developed some sample Python tools (under the demo directory in the repository) that use various parts of the framework. Even if you're not a coder, feel free to experiment with the tools, and report any bugs you find. LibForensics requires Python version 3.1. You can get the latest version of Python from http://www.python.org News: Whats new - March 18, 2010 I've been working on the next major release (0.3). Several things have changed, including the data typing system (we now use ctypes instead of struct), more thorough unit testing, numerous bug fixes, and API documentation. Look for a major release in the next few weeks. Some basic factoids [Less]

rifiuti2

As its name indicates, rifiuti2 is a rewrite of rifiuti, a great tool from Foundstone folks for analyzing Windows Recycle Bin INFO2 file. Analysis of Windows Recycle Bin is usually carried out during Windows computer forensics. Quoting from original Foundstone page: Many computer crime ... [More] investigations require the reconstruction of a subject's Recycle Bin. Since this analysis technique is executed regularly, we researched the structure of the data found in the Recycle Bin repository files (INFO2 files). Rifiuti, the Italian word meaning "trash", was developed to examine the contents of the INFO2 file in the Recycle Bin. ...... Rifiuti is built to work on multiple platforms and will execute on Windows (through Cygwin), Mac OS X, Linux, and *BSD platforms." But since rifiuti (last updated 2004) is restricted to English version of Windows (fail to analyze any non-latin character), thus this rewrite. However it does more: Supports Windows file names in any languages Supports Vista and Windows 2008 (no more uses INFO2 file) Enables localization (that is, translatable) by using glib More rigorous error checking Supports output in XML format Please refer to InstallPackage page on which package to download and install. [Less]

recycletray

Windows Recycle Bin as a notification area icon