Difference between revisions of "Template:Good article/doc"

From blackwiki
Jump to navigation Jump to search
imported>Bonwinj
imported>Bonwinj
Line 1: Line 1:
                                                           PlainSight
+
                                                           '''PlainSight'''
  
 
   
 
   
 
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.
 
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.
  
Functions:
+
'''Functions:'''
 
     Get hard disk and partition information
 
     Get hard disk and partition information
 
     Extract user and group information
 
     Extract user and group information
Line 17: Line 17:
 
     Preview a system before acquiring it
 
     Preview a system before acquiring it
  
Features of PlainSight
+
'''Features of PlainSight'''
 
PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:  
 
PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:  
 
     RegRipper,
 
     RegRipper,
Line 25: Line 25:
 
     Foremost.
 
     Foremost.
  
Retrieving Device information
+
'''Retrieving Device information'''
 
The tool can help retrieve information or data from devices: The tool is capable of the following:
 
The tool can help retrieve information or data from devices: The tool is capable of the following:
 
     viewing hard disk and partition details
 
     viewing hard disk and partition details
 
     Ability to extract USB storage information from registry.
 
     Ability to extract USB storage information from registry.
 
     Ability to extract Device Class information from registry
 
     Ability to extract Device Class information from registry
 
+
'''
Retrieving Data from operating system.
+
Retrieving Data from operating system.'''
 
The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:
 
The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:
 
     Current Windows version from registry
 
     Current Windows version from registry
Line 40: Line 40:
  
  
Network
+
'''Network'''
 
On the network side too, the tool is able to
 
On the network side too, the tool is able to
 
   Extract Windows firewall configuration from registry.
 
   Extract Windows firewall configuration from registry.
 
   IP information of the network
 
   IP information of the network
  
Other functions
+
'''Other functions'''
 
     Retrieving Internet Histories
 
     Retrieving Internet Histories
 
     Memory examination
 
     Memory examination
Line 52: Line 52:
 
     Memory dumps extracting password hashes
 
     Memory dumps extracting password hashes
  
Misc
+
'''Misc'''
 
     Run from CD or USB
 
     Run from CD or USB
 
     Save results in HTML or plain text
 
     Save results in HTML or plain text
 
     Run against a disk image or local disk
 
     Run against a disk image or local disk
  
File Recovery / Carving
+
'''File Recovery / Carving'''
 
The tool supports the following file types
 
The tool supports the following file types
 
     png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe
 
     png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe
  
Applications of PlainSight
+
'''Applications of PlainSight'''
 
Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:
 
Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:
 
     Determines when a threat occurred and how it occurred
 
     Determines when a threat occurred and how it occurred
Line 72: Line 72:
  
 
    
 
    
References
+
'''References'''
 
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8
 
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8
 
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html
 
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html
 
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/
 
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/

Revision as of 15:23, 9 December 2018

                                                         PlainSight


PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.

Functions:

   Get hard disk and partition information
   Extract user and group information
   View Internet histories
   Examine Windows firewall configuration
   Discover recent documents
   Recover/Carve over 15 different file types
   Discover USB storage information
   Examine physical memory dumps
   Examine UserAssist information
   Extract LanMan password hashes
   Preview a system before acquiring it

Features of PlainSight PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:

   RegRipper,
   BKhive and Samdump2
   Pasco
   Mork
   Foremost.

Retrieving Device information The tool can help retrieve information or data from devices: The tool is capable of the following:

   viewing hard disk and partition details
   Ability to extract USB storage information from registry.
   Ability to extract Device Class information from registry

Retrieving Data from operating system. The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:

   Current Windows version from registry
   Computer information from registry
   UserAssist information from registry   
   Recent documents from registry
   User and Group information from registry     


Network On the network side too, the tool is able to

  Extract Windows firewall configuration from registry.
  IP information of the network

Other functions

   Retrieving Internet Histories
   Memory examination
   Statistics carving
   checking USB device usage
   Memory dumps extracting password hashes

Misc

   Run from CD or USB
   Save results in HTML or plain text
   Run against a disk image or local disk

File Recovery / Carving The tool supports the following file types

   png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe

Applications of PlainSight Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:

   Determines when a threat occurred and how it occurred
   Identify systems that have been compromised
   Determines if any data, document or information has been stolen
   It helps in intelligence gathering in a computer crime
    The evidence collected can be used to support or oppose a hypothesis in any court of law
   The evidence from PlainSight can be used as evidence relating to a criminal investigation.
   PlainSight evidence is very useful for Law enforcement  and any court of jurisdiction.


References DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8 PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/