Difference between revisions of "Template:Good article/doc"

From blackwiki
Jump to navigation Jump to search
imported>Bonwinj
imported>Colonies Chris
(minor fixes)
 
(7 intermediate revisions by 6 users not shown)
Line 1: Line 1:
                                                         
+
{{Documentation subpage}}
                                                       
+
{{High-use|{{GA number}}}}
== PlainSight Forensic Tool ==
+
<!--Categories where indicated at the bottom of this page, please; interwikis at Wikidata (see [[Wikipedia:Wikidata]])-->
  
+
== Usage ==
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.
+
This template places a small green circle with a plus sign ([[File:Symbol support vote.svg|14px]]) in the top right corner of an article to indicate that it is a [[WP:Good articles|good article on Wikipedia]], and that it has met the [[Wikipedia:Good article criteria|good article criteria]], successfully passing the [[Wikipedia:Good article nominations|good article nomination process]]. It also categorizes them into [[:Category:Good articles]].
  
'''Functions:''' 
+
This template should be placed at the bottom of the article before the defaultsort and categories. It should be removed if a good article fails a [[Wikipedia:Good article reassessment|good article reassessment nomination]], as well as articles that have never passed a good article nomination before. If a good article is subsequently promoted to [[Wikipedia:Featured articles|featured article status]], this template is then replaced by [[Template:Featured article]].
*    Get hard disk and partition information
 
*    Extract user and group information
 
*    View Internet histories
 
*    Examine Windows firewall configuration
 
*    Discover recent documents
 
*    Recover/Carve over 15 different file types
 
*    Discover USB storage information
 
*    Examine physical memory dumps
 
*    Examine UserAssist information
 
*    Extract LanMan password hashes
 
*    Preview a system before acquiring it
 
  
'''Features of PlainSight'''
+
{{Top icon templates}}
PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include: 
+
<includeonly>{{Sandbox other||
*    RegRipper,
+
<!--Categories below this line, please; interwikis at Wikidata-->
*    BKhive and Samdump2
+
[[Category:Top icon content award templates]]
*    Pasco
+
[[Category:Wikipedia GA templates]]
*    Mork
+
[[Category:Title templates]]
*    Foremost.
+
}}</includeonly>
 
+
== TemplateData ==
'''Retrieving Device information'''
+
{{TemplateData header}}
The tool can help retrieve information or data from devices: The tool is capable of the following:
+
<templatedata>
   
+
{
*    viewing hard disk and partition details
+
"params": {},
*    Ability to extract USB storage information from registry.
+
"description": "This template places a small green circle with a plus sign (a so called top icon) in the top right corner of an article to indicate that it is a good article on Wikipedia, i.e. it met the good article criteria and successfully passed the good article nomination process."
*    Ability to extract Device Class information from registry
+
}
 
+
</templatedata>
'''Retrieving Data from operating system.'''
 
The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:
 
   
 
*    Current Windows version from registry 
 
*    Computer information from registry 
 
*    UserAssist information from registry     
 
*    Recent documents from registry 
 
*    User and Group information from registry 
 
 
 
'''Network'''
 
On the network side too, the tool is able to
 
  Extract Windows firewall configuration from registry.
 
  IP information of the network
 
 
 
'''Other functions'''   
 
*    Retrieving Internet Histories
 
*    Memory examination
 
*    Statistics carving
 
*    checking USB device usage
 
*    Memory dumps extracting password hashes
 
*
 
 
 
'''Misc''' 
 
*    Run from CD or USB
 
*    Save results in HTML or plain text
 
*    Run against a disk image or local disk
 
 
 
'''File Recovery / Carving'''
 
The tool supports the following file types
 
    png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe
 
 
 
'''Applications of PlainSight'''
 
Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:  
 
*    Determines when a threat occurred and how it occurred
 
*    Identify systems that have been compromised
 
*    Determines if any data, document or information has been stolen
 
*    It helps in intelligence gathering in a computer crime
 
*    The evidence collected can be used to support or oppose a hypothesis in any court of law
 
*    The evidence from PlainSight can be used as evidence relating to a criminal investigation.
 
*    PlainSight evidence is very useful for Law enforcement  and any court of jurisdiction.
 
*
 
 
 
'''References'''
 
 
 
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8
 
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html
 
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/
 

Latest revision as of 20:54, 28 August 2020

Usage

This template places a small green circle with a plus sign (Symbol support vote.svg) in the top right corner of an article to indicate that it is a good article on Wikipedia, and that it has met the good article criteria, successfully passing the good article nomination process. It also categorizes them into Category:Good articles.

This template should be placed at the bottom of the article before the defaultsort and categories. It should be removed if a good article fails a good article reassessment nomination, as well as articles that have never passed a good article nomination before. If a good article is subsequently promoted to featured article status, this template is then replaced by Template:Featured article.

TemplateData

This is the TemplateData documentation for this template used by VisualEditor and other tools; see the monthly parameter usage report for this template.

TemplateData for Good article

This template places a small green circle with a plus sign (a so called top icon) in the top right corner of an article to indicate that it is a good article on Wikipedia, i.e. it met the good article criteria and successfully passed the good article nomination process.

Template parameters

ParameterDescriptionTypeStatus
No parameters specified