DEX

Question 1: Tools Research & Review -- Network Monitoring

Wireshark is arguably the most popular network-sniffing application, but it is by no means the only such program available. Conduct a search to find a program that can be used for sniffing, network analysis, intrusion detection/prevention, or anything having to do with network monitoring. This program can be free, open-source, or commercial (involving a fee), and it can run on any OS. Provide the URL for the site showcasing the software package and explain why this program would be a useful addition to your forensic investigation toolkit.

You must start a thread before you can read and reply to other threads

Question 2: Tools Research & Review: Forensics Software Suites

CAINE and DEFT are two distributions of Linux that operate as live DVDs and that contain numerous forensic-related tools. Below is a list of the tools available on the CAINE and/or the DEFT live DVD. Paladin is another, similar powerful Linux distribution.

Please pick a tool from the list and describe how it could be used in a forensic investigation. Explain the general functions and benefits of the program, and whether or not you think you'd ever use the program during an investigation. If you can share any professional experiences with the tool, feel free to incorporate that information.

· Autopsy 2

· Bulk extractor 1.3.1/Bulk extractor GUI 1.3

· CapAnalysis

· Cyclone 0.2

· Digital Forensics Framework (DFF) 1.3

· DocAnalyzer

· Dumpy 0.2

· Esximager

· ExifTool by Phil Harvey

· Fastboot

· forensic recover of evidence device (FRED)

· gDisk

· Google Chrome Open Source Intelligence (OSINT)

· GrokEVT

· Guymager 0.7.1

· iPhone Backup Analyzer

· john

· knowmetanalyzer

· log2timeline 0.65

· LVM2

· Maltego Radium

· MDB Tool

· Mobius Forensic Toolkit

· Mount EWF

· nerohistanalyzer

· PEframe

· Quick Hash

· recoll 1.19.5

· Skype Extractor

· The Sleuth Kit (TSK)

· SQLite Database Browser

· tcpdump

· tcpflow

· Tor

· tshark

· Vinetto

· Wireshark

· Xmount

· Xplico 1.0.1

· Zenmap (Nmap)