THE DFIR BLOG
Menu

Forensics Tools

Terminal Keys!

10/3/2019

0 Comments

 
Key/Command
Description
Ctrl + A
Go to the beginning of the line you are currently typing on. This also works for most text input fields system wide. Netbeans being one exception

Ctrl + E
Go to the end of the line you are currently typing on. This also works for most text input fields system wide. Netbeans being one exception

Ctrl + Q
Clears everything on current line

Ctrl + L
Clears the Screen

⌘Cmd + K
Clears the Screen

Ctrl + U
Cut everything backwards to beginning of line

Ctrl + K
Cut everything forward to end of line

Ctrl + W
Cut one word backwards using white space as delimiter

Ctrl + Y
Paste whatever was cut by the last cut command

Ctrl + H
Same as backspace

Ctrl + C
Kill whatever you are running

Ctrl + D
Exit the current shell when no process is running, or send EOF to a the running process

Ctrl + Z
Puts whatever you are running into a suspended background process. fg restores it.

Ctrl + _
Undo the last command. (Underscore. So it's actually Ctrl + Shift + minus)

Ctrl + T
Swap the last two characters before the cursor

Ctrl + F
Move cursor one character forward

Ctrl + B
Move cursor one character backward

Esc + F
Move cursor one word forward

Esc + B
Move cursor one word backward

Esc + T
Swap the last two words before the cursor

Tab
Auto-complete files and folder names

CORE COMMANDS

Key/Command
Description
cd
Home directory

cd [folder]
Change directory e.g. cd documents

cd /
Root of drive

cd -
Previous directory

ls
Short listing

ls -l
Long listing

ls -a
Listing incl. hidden files

ls -lh
Long listing with Human readable file sizes

ls -R
Entire content of folder recursively

sudo [command]
Run command with the security privileges of the superuser (Super User DO)

open [file]
Opens a file ( as if you double clicked it )

top
Displays active processes. Press q to quit

nano [file]
Opens the file using the nano editor

vim [file]
Opens the file using the vim editor

clear
Clear screen

reset
Resets the terminal display

CHAINING COMMANDS

Key/Command
Description
[command-a]; [command-b]
Run command A and then B, regardless of success of A

[command-a] && [command-b]
Run command B if A succeeded

[command-a]

[command-a] &
Run command A in background

PIPING COMMANDS

Key/Command
Description
[command-a] | [command-b]
Run command A and then pass the result to command B e.g ps auxwww | grep google

|
COMMAND HISTORY

Key/Command
Description
history n
Shows the stuff typed – add a number to limit the last n items

Ctrl + r
Interactively search through previously typed commands

![value]
Execute the last command typed that starts with ‘value’

!!
Execute the last command typed

FILE MANAGEMENT

Key/Command
Description
touch [file]
Create new file

pwd
Full path to working directory

.
Current folder, e.g. ls .

..
Parent/enclosing directory, e.g. ls ..

ls -l ..
Long listing of parent directory

cd ../../
Move 2 levels up

cat
Concatenate to screen

rm [file]
Remove a file, e.g. rm data.tmp

rm -i [file]
Remove with confirmation

rm -r [dir]
Remove a directory and contents

rm -f [file]
Force removal without confirmation

cp [file] [newfile]
Copy file to file

cp [file] [dir]
Copy file to directory

mv [file] [new filename]
Move/Rename, e.g. mv file1.ad /tmp

pbcopy < [file]
Copies file contents to clipboard

pbpaste
Paste clipboard contents

pbpaste > [file]
Past clipboard contents into file, pbpaste > paste-test.txt

DIRECTORY MANAGEMENT

Key/Command
Description
mkdir [dir]
Create new directory

mkdir -p [dir]/[dir]
Create nested directories

rmdir [dir]
Remove directory ( only operates on empty directories )

rm -R [dir]
Remove directory and contents

[command] | [command]
Allows to combine multiple commands that generate output, e.g. `cat data.txt

less
Output content delivered in screensize chunks

[command] > [file]
Push output to file, keep in mind it will get overwritten

[command] >> [file]
Append output to existing file

[command] < [file]
Tell command to read content from a file

SEARCH

Key/Command
Description
find [dir] -name [search_pattern]
Search for files, e.g. find /Users -name "file.txt"

grep [search_pattern] [file]
Search for all lines that contain the pattern, e.g. grep "Tom" file.txt

grep -r [search_pattern] [file]
Recursively search for all lines that do not contain the pattern

grep -v [search_pattern] [file]
Search for all lines that do NOT contain the pattern

HELP

Key/Command
Description
[command] -h
Offers help

[command] —help
Offers help

info [command]
Offers help

man [command]
Show the help manual for [command]

whatis [command]
Gives a one-line description of [command]

apropos [search-pattern]
Searches for command with keywords in description

 
0 Comments

Popular Forensics Tools

3/3/2018

1 Comment

 
Please find the list of popular forensic tools below:

Imaging Tools
  • Encase (Open Text)
  • FTK Imager(Freeware)
  • Raptor
  • Helix
  • Deft
  • Samuri Paladin
  • Evimentry
  • Macquisition

Encryption Tools:
  • Truecrypt (Freeware)
  • Bestcrypt Container Encryption
  • Bitlocker

Forensic Analysis Tool
  • Blacklight
  • Axiom
  • Xways
  • Encase
  • FTK

Mobile Forensic Tools
  • Cellebrite UFED
  • Oxygen Forensic
  • Elcomsoft
  • X-ray Forensic
1 Comment

Command Line tool to analyze Google URL's

3/3/2018

1 Comment

 
Picture
GGSERpent is an awesome tool to analyze the Google URL's
Github Link: https://github.com/randomaccess3/googleURLParser
SANS Video Lecture: https://www.sans.org/webcasts/wwwgooglecom-searchqwhat-plus-does-plus-this-plus-all-plus-mean-104857

Need to Install
sudo cpan Text::ASCIITable  

Please see some of the examples below:

Picture
Used following URL in Mozilla firefox: https://www.google.com/search?client=ubuntu&hs=tYc&channel=fs&ei=yxmbWqa0BuPLjwTMlojADQ&q=Searching+for+random+things+on+google&oq=Searching+for+random+things+on+google&gs_l=psy-ab.3..0i22i30k1.649808.660144.0.660297.44.38.3.2.2.0.307.5117.0j20j7j1.29.0....0...1c.1.64.psy-ab..10.34.5587.6..0j35i39k1j0i67k1j0i131k1j0i20i264k1j0i131i20i264k1j0i20i263k1j0i13i30k1j33i22i29i30k1.443.VjY1uN6HJ6k
Picture
See what you get when you search above URL with -t flag
Picture
1 Comment

    Archives

    October 2019
    March 2018

    Categories

    All
    Tools

    RSS Feed

  • Infosec
  • Mac Forensics
  • Windows Forensics
  • Linux Forensics
  • Memory Forensics
  • Incident Response
  • Blog
  • About Me
  • Infosec
  • Mac Forensics
  • Windows Forensics
  • Linux Forensics
  • Memory Forensics
  • Incident Response
  • Blog
  • About Me