Difference between revisions of "Template:Good article/doc"
imported>Zzyzx11 (→Usage: rewrite for clarification, especially for newbies) |
imported>Bonwinj |
||
| Line 1: | Line 1: | ||
| − | + | PlainSight | |
| − | |||
| − | + | ||
| − | + | PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment. | |
| − | + | Functions: | |
| + | Get hard disk and partition information | ||
| + | Extract user and group information | ||
| + | View Internet histories | ||
| + | Examine Windows firewall configuration | ||
| + | Discover recent documents | ||
| + | Recover/Carve over 15 different file types | ||
| + | Discover USB storage information | ||
| + | Examine physical memory dumps | ||
| + | Examine UserAssist information | ||
| + | Extract LanMan password hashes | ||
| + | Preview a system before acquiring it | ||
| − | + | Features of PlainSight | |
| − | + | PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include: | |
| − | + | RegRipper, | |
| − | + | BKhive and Samdump2 | |
| − | + | Pasco | |
| − | + | Mork | |
| − | + | Foremost. | |
| + | |||
| + | Retrieving Device information | ||
| + | The tool can help retrieve information or data from devices: The tool is capable of the following: | ||
| + | viewing hard disk and partition details | ||
| + | Ability to extract USB storage information from registry. | ||
| + | Ability to extract Device Class information from registry | ||
| + | |||
| + | Retrieving Data from operating system. | ||
| + | The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include: | ||
| + | Current Windows version from registry | ||
| + | Computer information from registry | ||
| + | UserAssist information from registry | ||
| + | Recent documents from registry | ||
| + | User and Group information from registry | ||
| + | |||
| + | |||
| + | Network | ||
| + | On the network side too, the tool is able to | ||
| + | Extract Windows firewall configuration from registry. | ||
| + | IP information of the network | ||
| + | |||
| + | Other functions | ||
| + | Retrieving Internet Histories | ||
| + | Memory examination | ||
| + | Statistics carving | ||
| + | checking USB device usage | ||
| + | Memory dumps extracting password hashes | ||
| + | |||
| + | Misc | ||
| + | Run from CD or USB | ||
| + | Save results in HTML or plain text | ||
| + | Run against a disk image or local disk | ||
| + | |||
| + | File Recovery / Carving | ||
| + | The tool supports the following file types | ||
| + | png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe | ||
| + | |||
| + | Applications of PlainSight | ||
| + | Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners: | ||
| + | Determines when a threat occurred and how it occurred | ||
| + | Identify systems that have been compromised | ||
| + | Determines if any data, document or information has been stolen | ||
| + | It helps in intelligence gathering in a computer crime | ||
| + | The evidence collected can be used to support or oppose a hypothesis in any court of law | ||
| + | The evidence from PlainSight can be used as evidence relating to a criminal investigation. | ||
| + | PlainSight evidence is very useful for Law enforcement and any court of jurisdiction. | ||
| + | |||
| + | |||
| + | References | ||
| + | DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8 | ||
| + | PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html | ||
| + | Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/ | ||
Revision as of 15:21, 9 December 2018
PlainSight
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.
Functions:
Get hard disk and partition information Extract user and group information View Internet histories Examine Windows firewall configuration Discover recent documents Recover/Carve over 15 different file types Discover USB storage information Examine physical memory dumps Examine UserAssist information Extract LanMan password hashes Preview a system before acquiring it
Features of PlainSight PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:
RegRipper, BKhive and Samdump2 Pasco Mork Foremost.
Retrieving Device information The tool can help retrieve information or data from devices: The tool is capable of the following:
viewing hard disk and partition details Ability to extract USB storage information from registry. Ability to extract Device Class information from registry
Retrieving Data from operating system. The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:
Current Windows version from registry Computer information from registry UserAssist information from registry Recent documents from registry User and Group information from registry
Network
On the network side too, the tool is able to
Extract Windows firewall configuration from registry. IP information of the network
Other functions
Retrieving Internet Histories Memory examination Statistics carving checking USB device usage Memory dumps extracting password hashes
Misc
Run from CD or USB Save results in HTML or plain text Run against a disk image or local disk
File Recovery / Carving The tool supports the following file types
png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe
Applications of PlainSight Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:
Determines when a threat occurred and how it occurred
Identify systems that have been compromised
Determines if any data, document or information has been stolen
It helps in intelligence gathering in a computer crime
The evidence collected can be used to support or oppose a hypothesis in any court of law
The evidence from PlainSight can be used as evidence relating to a criminal investigation.
PlainSight evidence is very useful for Law enforcement and any court of jurisdiction.
References
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/