Difference between revisions of "Template:Good article/doc"

From blackwiki
Jump to navigation Jump to search
imported>Bonwinj
imported>Bonwinj
Line 1: Line 1:
                                                           '''PlainSight'''
+
                                                           ''''''PlainSight''''''
  
 
   
 
   

Revision as of 15:24, 9 December 2018

                                                         'PlainSight'


PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.

Functions:

   Get hard disk and partition information
   Extract user and group information
   View Internet histories
   Examine Windows firewall configuration
   Discover recent documents
   Recover/Carve over 15 different file types
   Discover USB storage information
   Examine physical memory dumps
   Examine UserAssist information
   Extract LanMan password hashes
   Preview a system before acquiring it

Features of PlainSight PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:

   RegRipper,
   BKhive and Samdump2
   Pasco
   Mork
   Foremost.

Retrieving Device information The tool can help retrieve information or data from devices: The tool is capable of the following:

   viewing hard disk and partition details
   Ability to extract USB storage information from registry.
   Ability to extract Device Class information from registry

Retrieving Data from operating system. The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:

   Current Windows version from registry
   Computer information from registry
   UserAssist information from registry   
   Recent documents from registry
   User and Group information from registry     


Network On the network side too, the tool is able to

  Extract Windows firewall configuration from registry.
  IP information of the network

Other functions

   Retrieving Internet Histories
   Memory examination
   Statistics carving
   checking USB device usage
   Memory dumps extracting password hashes

Misc

   Run from CD or USB
   Save results in HTML or plain text
   Run against a disk image or local disk

File Recovery / Carving The tool supports the following file types

   png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe

Applications of PlainSight Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:

   Determines when a threat occurred and how it occurred
   Identify systems that have been compromised
   Determines if any data, document or information has been stolen
   It helps in intelligence gathering in a computer crime
    The evidence collected can be used to support or oppose a hypothesis in any court of law
   The evidence from PlainSight can be used as evidence relating to a criminal investigation.
   PlainSight evidence is very useful for Law enforcement  and any court of jurisdiction.


References DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8 PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/