Difference between revisions of "Template:Good article/doc"

From blackwiki
Jump to navigation Jump to search
imported>Bonwinj
imported>Bonwinj
Line 1: Line 1:
                                                           ''''''PlainSight''''''
+
                                                            
 +
                                                       
 +
== PlainSight Forensic Tool ==
  
 
   
 
   
 
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.
 
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.
  
'''Functions:'''
+
'''Functions:'''  
     Get hard disk and partition information
+
*     Get hard disk and partition information
     Extract user and group information
+
*     Extract user and group information
     View Internet histories
+
*     View Internet histories
     Examine Windows firewall configuration
+
*     Examine Windows firewall configuration
     Discover recent documents
+
*     Discover recent documents
     Recover/Carve over 15 different file types
+
*     Recover/Carve over 15 different file types
     Discover USB storage information
+
*     Discover USB storage information
     Examine physical memory dumps
+
*     Examine physical memory dumps
     Examine UserAssist information
+
*     Examine UserAssist information
     Extract LanMan password hashes
+
*     Extract LanMan password hashes
     Preview a system before acquiring it
+
*     Preview a system before acquiring it
  
 
'''Features of PlainSight'''
 
'''Features of PlainSight'''
PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:  
+
PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:  
    RegRipper,
+
*    RegRipper,
    BKhive and Samdump2
+
*    BKhive and Samdump2
    Pasco
+
*    Pasco
    Mork
+
*    Mork
    Foremost.
+
*    Foremost.
  
 
'''Retrieving Device information'''
 
'''Retrieving Device information'''
 
The tool can help retrieve information or data from devices: The tool is capable of the following:
 
The tool can help retrieve information or data from devices: The tool is capable of the following:
     viewing hard disk and partition details
+
   
     Ability to extract USB storage information from registry.
+
*     viewing hard disk and partition details
     Ability to extract Device Class information from registry
+
*     Ability to extract USB storage information from registry.
'''
+
*     Ability to extract Device Class information from registry
Retrieving Data from operating system.'''
+
 
 +
'''Retrieving Data from operating system.'''
 
The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:
 
The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:
     Current Windows version from registry
+
   
     Computer information from registry
+
*     Current Windows version from registry  
     UserAssist information from registry  
+
*     Computer information from registry  
     Recent documents from registry
+
*     UserAssist information from registry    
     User and Group information from registry    
+
*     Recent documents from registry  
 
+
*     User and Group information from registry  
  
 
'''Network'''
 
'''Network'''
Line 45: Line 48:
 
   IP information of the network
 
   IP information of the network
  
'''Other functions'''
+
'''Other functions'''  
     Retrieving Internet Histories
+
*     Retrieving Internet Histories
     Memory examination
+
*     Memory examination
     Statistics carving
+
*     Statistics carving
     checking USB device usage
+
*     checking USB device usage
     Memory dumps extracting password hashes
+
*     Memory dumps extracting password hashes
 +
*
  
'''Misc'''
+
'''Misc'''  
     Run from CD or USB
+
*     Run from CD or USB
     Save results in HTML or plain text
+
*     Save results in HTML or plain text
     Run against a disk image or local disk
+
*     Run against a disk image or local disk
  
 
'''File Recovery / Carving'''
 
'''File Recovery / Carving'''
Line 62: Line 66:
  
 
'''Applications of PlainSight'''
 
'''Applications of PlainSight'''
Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:
+
Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:  
     Determines when a threat occurred and how it occurred
+
*     Determines when a threat occurred and how it occurred
     Identify systems that have been compromised
+
*     Identify systems that have been compromised
     Determines if any data, document or information has been stolen
+
*     Determines if any data, document or information has been stolen
     It helps in intelligence gathering in a computer crime
+
*     It helps in intelligence gathering in a computer crime
    The evidence collected can be used to support or oppose a hypothesis in any court of law
+
*    The evidence collected can be used to support or oppose a hypothesis in any court of law
     The evidence from PlainSight can be used as evidence relating to a criminal investigation.
+
*     The evidence from PlainSight can be used as evidence relating to a criminal investigation.
     PlainSight evidence is very useful for Law enforcement  and any court of jurisdiction.
+
*     PlainSight evidence is very useful for Law enforcement  and any court of jurisdiction.
 
+
*
 
    
 
    
 
'''References'''
 
'''References'''
 +
 
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8
 
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8
 
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html
 
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html
 
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/
 
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/

Revision as of 15:33, 9 December 2018


PlainSight Forensic Tool

PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.

Functions:

  • Get hard disk and partition information
  • Extract user and group information
  • View Internet histories
  • Examine Windows firewall configuration
  • Discover recent documents
  • Recover/Carve over 15 different file types
  • Discover USB storage information
  • Examine physical memory dumps
  • Examine UserAssist information
  • Extract LanMan password hashes
  • Preview a system before acquiring it

Features of PlainSight PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:

*    RegRipper,
*    BKhive and Samdump2
*    Pasco
*    Mork
*    Foremost.

Retrieving Device information The tool can help retrieve information or data from devices: The tool is capable of the following:

  • viewing hard disk and partition details
  • Ability to extract USB storage information from registry.
  • Ability to extract Device Class information from registry

Retrieving Data from operating system. The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:

  • Current Windows version from registry
  • Computer information from registry
  • UserAssist information from registry
  • Recent documents from registry
  • User and Group information from registry

Network On the network side too, the tool is able to

  Extract Windows firewall configuration from registry.
  IP information of the network

Other functions

  • Retrieving Internet Histories
  • Memory examination
  • Statistics carving
  • checking USB device usage
  • Memory dumps extracting password hashes

Misc

  • Run from CD or USB
  • Save results in HTML or plain text
  • Run against a disk image or local disk

File Recovery / Carving The tool supports the following file types

   png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe

Applications of PlainSight Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:

  • Determines when a threat occurred and how it occurred
  • Identify systems that have been compromised
  • Determines if any data, document or information has been stolen
  • It helps in intelligence gathering in a computer crime
  • The evidence collected can be used to support or oppose a hypothesis in any court of law
  • The evidence from PlainSight can be used as evidence relating to a criminal investigation.
  • PlainSight evidence is very useful for Law enforcement and any court of jurisdiction.

References

DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8 PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/