Difference between revisions of "Template:Good article/doc"

From blackwiki
Jump to navigation Jump to search
imported>Zzyzx11
(→‎Usage: rewrite for clarification, especially for newbies)
imported>Bonwinj
Line 1: Line 1:
{{Documentation subpage}}
+
                                                          PlainSight
<!--Categories where indicated at the bottom of this page, please; interwikis at Wikidata (see [[Wikipedia:Wikidata]])-->
 
  
== Usage ==
+
This template places a small green circle with a plus sign ([[File:Symbol support vote.svg|14px]]) in the top right corner of an article to indicate that it is a [[WP:GA|good article on Wikipedia]], and that it has met the [[Wikipedia:Good article criteria|good article criteria]], successfully passing the [[Wikipedia:Good article nominations|good article nomination process]]. It also categorizes them into [[:Category:Good articles]].
+
PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.
  
This template should be placed at the bottom of the article before defaultsort, categories and interwikis. It should be removed if a good article fails a [[Wikipedia:Good article reassessment|good article reassessment nomination]], as well as articles that have never passed a good article nomination before. If a good article is subsequently promoted to [[Wikipedia:Featured article|featured article status]], this template is then replaced by [[Template:Featured article]].
+
Functions:
 +
    Get hard disk and partition information
 +
    Extract user and group information
 +
    View Internet histories
 +
    Examine Windows firewall configuration
 +
    Discover recent documents
 +
    Recover/Carve over 15 different file types
 +
    Discover USB storage information
 +
    Examine physical memory dumps
 +
    Examine UserAssist information
 +
    Extract LanMan password hashes
 +
    Preview a system before acquiring it
  
{{Top icon templates}}
+
Features of PlainSight
<includeonly>{{#ifeq:{{SUBPAGENAME}}|sandbox | |
+
PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:
<!--Categories below this line, please; interwikis at Wikidata-->
+
    RegRipper,
[[Category:Top icon content award templates]]
+
    BKhive and Samdump2
[[Category:Wikipedia GA templates]]
+
    Pasco
[[Category:Title templates]]
+
    Mork
}}</includeonly>
+
    Foremost.
 +
 
 +
Retrieving Device information
 +
The tool can help retrieve information or data from devices: The tool is capable of the following:
 +
    viewing hard disk and partition details
 +
    Ability to extract USB storage information from registry.
 +
    Ability to extract Device Class information from registry
 +
 
 +
Retrieving Data from operating system.
 +
The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:
 +
    Current Windows version from registry
 +
    Computer information from registry
 +
    UserAssist information from registry 
 +
    Recent documents from registry
 +
    User and Group information from registry   
 +
 
 +
 
 +
Network
 +
On the network side too, the tool is able to
 +
  Extract Windows firewall configuration from registry.
 +
  IP information of the network
 +
 
 +
Other functions
 +
    Retrieving Internet Histories
 +
    Memory examination
 +
    Statistics carving
 +
    checking USB device usage
 +
    Memory dumps extracting password hashes
 +
 
 +
Misc
 +
    Run from CD or USB
 +
    Save results in HTML or plain text
 +
    Run against a disk image or local disk
 +
 
 +
File Recovery / Carving
 +
The tool supports the following file types
 +
    png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe
 +
 
 +
Applications of PlainSight
 +
Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:
 +
    Determines when a threat occurred and how it occurred
 +
    Identify systems that have been compromised
 +
    Determines if any data, document or information has been stolen
 +
    It helps in intelligence gathering in a computer crime
 +
    The evidence collected can be used to support or oppose a hypothesis in any court of law
 +
    The evidence from PlainSight can be used as evidence relating to a criminal investigation.
 +
    PlainSight evidence is very useful for Law enforcement  and any court of jurisdiction.
 +
 
 +
 
 +
References
 +
DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8
 +
PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html
 +
Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/

Revision as of 15:21, 9 December 2018

                                                         PlainSight


PlainSight is a versatile computer forensics environment that allows experienced and inexperienced forensic practitioners perform common tasks using powerful open source tools. It has several open source forensic/security tools, combined with an intuitive user interface to create powerful forensic environment.

Functions:

   Get hard disk and partition information
   Extract user and group information
   View Internet histories
   Examine Windows firewall configuration
   Discover recent documents
   Recover/Carve over 15 different file types
   Discover USB storage information
   Examine physical memory dumps
   Examine UserAssist information
   Extract LanMan password hashes
   Preview a system before acquiring it

Features of PlainSight PlainSight environment works with other tools which in most cases are used to extract the information from the file produced from the PlainSight platform. The supporting tools include:

   RegRipper,
   BKhive and Samdump2
   Pasco
   Mork
   Foremost.

Retrieving Device information The tool can help retrieve information or data from devices: The tool is capable of the following:

   viewing hard disk and partition details
   Ability to extract USB storage information from registry.
   Ability to extract Device Class information from registry

Retrieving Data from operating system. The tool can also be used to retrieve information from operating systems. Some of the data that can be retrieved include:

   Current Windows version from registry
   Computer information from registry
   UserAssist information from registry   
   Recent documents from registry
   User and Group information from registry     


Network On the network side too, the tool is able to

  Extract Windows firewall configuration from registry.
  IP information of the network

Other functions

   Retrieving Internet Histories
   Memory examination
   Statistics carving
   checking USB device usage
   Memory dumps extracting password hashes

Misc

   Run from CD or USB
   Save results in HTML or plain text
   Run against a disk image or local disk

File Recovery / Carving The tool supports the following file types

   png, gif, bmp, mpg, wav, avi, wmv, mov, pdf, htm, ole, zip, rar and exe

Applications of PlainSight Its a swift and reliable tool used during incident response to identify threats and expose criminals. Computer Forensic examiners find the information very useful. Specifically, PlainSight reveals the following information for Computer forensic examiners:

   Determines when a threat occurred and how it occurred
   Identify systems that have been compromised
   Determines if any data, document or information has been stolen
   It helps in intelligence gathering in a computer crime
    The evidence collected can be used to support or oppose a hypothesis in any court of law
   The evidence from PlainSight can be used as evidence relating to a criminal investigation.
   PlainSight evidence is very useful for Law enforcement  and any court of jurisdiction.


References DiPablo, E. (2018, January). PlainSight: An Open Source Computer Forensics Environment. Retrieved from Bruer-Power.net: https://www.bauer-power.net/2018/01/plainsight-open-source-computer.html#.XA0xNjF7mM8 PlainSight. (n.d.). Open source computer forensics PlainSight. Retrieved from PlainSight: http://www.plainsight.info/index.html Tabona, A. (2018, July 10). Top 20 Free Digital Forensic Investigation Tools for SysAdmins. Retrieved from TechTalk: https://techtalk.gfi.com/top-20-free-digital-forensic-investigation-tools-for-sysadmins/