Difference between revisions of "Template:Good article/doc"
imported>Bonwinj |
imported>Bonwinj |
||
| Line 1: | Line 1: | ||
| − | PlainSight | + | '''PlainSight''' |
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment. | PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment. | ||
| − | Functions: | + | '''Functions:''' |
Get hard disk and partition information | Get hard disk and partition information | ||
Extract user and group information | Extract user and group information | ||
| Line 17: | Line 17: | ||
Preview a system before acquiring it | Preview a system before acquiring it | ||
| − | Features of PlainSight | + | '''Features of PlainSight''' |
PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include: | PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include: | ||
RegRipper, | RegRipper, | ||
| Line 25: | Line 25: | ||
Foremost. | Foremost. | ||
| − | Retrieving Device information | + | '''Retrieving Device information''' |
The tool can help retrieve information or data from devices: The tool is capable of the following: | The tool can help retrieve information or data from devices: The tool is capable of the following: | ||
viewing hard disk and partition details | viewing hard disk and partition details | ||
Ability to extract USB storage information from registry. | Ability to extract USB storage information from registry. | ||
Ability to extract Device Class information from registry | Ability to extract Device Class information from registry | ||
| − | + | ''' | |
| − | Retrieving Data from operating system. | + | Retrieving Data from operating system.''' |
The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include: | The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include: | ||
Current Windows version from registry | Current Windows version from registry | ||
| Line 40: | Line 40: | ||
| − | Network | + | '''Network''' |
On the network side too, the tool is able to | On the network side too, the tool is able to | ||
Extract Windows firewall configuration from registry. | Extract Windows firewall configuration from registry. | ||
IP information of the network | IP information of the network | ||
| − | Other functions | + | '''Other functions''' |
Retrieving Internet Histories | Retrieving Internet Histories | ||
Memory examination | Memory examination | ||
| Line 52: | Line 52: | ||
Memory dumps extracting password hashes | Memory dumps extracting password hashes | ||
| − | Misc | + | '''Misc''' |
Run from CD or USB | Run from CD or USB | ||
Save results in HTML or plain text | Save results in HTML or plain text | ||
Run against a disk image or local disk | Run against a disk image or local disk | ||
| − | File Recovery / Carving | + | '''File Recovery / Carving''' |
The tool supports the following file types | The tool supports the following file types | ||
png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe | png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe | ||
| − | Applications of PlainSight | + | '''Applications of PlainSight''' |
Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners: | Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners: | ||
Determines when a threat occurred and how it occurred | Determines when a threat occurred and how it occurred | ||
| Line 72: | Line 72: | ||
| − | References | + | '''References''' |
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8 | DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8 | ||
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html | PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html | ||
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/ | Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/ | ||
Revision as of 15:23, 9 December 2018
PlainSight
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.
Functions:
Get hard disk and partition information Extract user and group information View Internet histories Examine Windows firewall configuration Discover recent documents Recover/Carve over 15 different file types Discover USB storage information Examine physical memory dumps Examine UserAssist information Extract LanMan password hashes Preview a system before acquiring it
Features of PlainSight PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:
RegRipper, BKhive and Samdump2 Pasco Mork Foremost.
Retrieving Device information The tool can help retrieve information or data from devices: The tool is capable of the following:
viewing hard disk and partition details Ability to extract USB storage information from registry. Ability to extract Device Class information from registry
Retrieving Data from operating system. The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:
Current Windows version from registry Computer information from registry UserAssist information from registry Recent documents from registry User and Group information from registry
Network
On the network side too, the tool is able to
Extract Windows firewall configuration from registry. IP information of the network
Other functions
Retrieving Internet Histories Memory examination Statistics carving checking USB device usage Memory dumps extracting password hashes
Misc
Run from CD or USB Save results in HTML or plain text Run against a disk image or local disk
File Recovery / Carving The tool supports the following file types
png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe
Applications of PlainSight Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:
Determines when a threat occurred and how it occurred
Identify systems that have been compromised
Determines if any data, document or information has been stolen
It helps in intelligence gathering in a computer crime
The evidence collected can be used to support or oppose a hypothesis in any court of law
The evidence from PlainSight can be used as evidence relating to a criminal investigation.
PlainSight evidence is very useful for Law enforcement and any court of jurisdiction.
References
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/