OS DEFT 8 (DIGITAL EVIDENCE & FORENSIC TOOLKIT)

Mau sharing tentang sistem operasi digital forensic yang bersifat free dan fiturnya juga bagus2 kok. Sebenarnya ada beberapa menu yang sama dengan OS Backtrack juga. 

Saat ini DEFT dikembangkan dan dikelola oleh Stefano Fratepietro, dengan dukungan dari Massimo Dal Cero, Sandro Rossetti, Paolo Dal Checco, Davide Gabrini, Bartolomeo Bogliolo, Valerio Leomporra dan Marco Giorgi .

Versi pertama dari Linux DEFT diperkenalkan pada tahun 2005 berkat kursus Komputer Forensik Fakultas Hukum di Universitas Bologna. DEFT salah satu solusi utama yang digunakan oleh lembaga penegak hukum ketika melakukan investigasi Digital Forensic. Sejumlah aplikasi berbasiskan opensource, akan tetapi juga dilengkapi DART yang terdiri dari beberapa aplikasi Windows (baik source5 terbuka dan closed source ) yang masih layak karena tidak ada setara dalam dunia Unix .

Berikut ini list menu aplikasi di DEFT:

DEFT 8 most important packet list, in alphabetical order:

• 7zip
• Access PassView
• AdapterWatch
• Advanced Password Recovery
• AlexNolan DriveMan
• AlternateStreamView
• AppCrashView
• ash368 Lime Juicer
• ash368 LimeWire Library Parser v4 e v5
• ash368 Props
• ash368 Thumo
• ash368 VW7
• AsterWin IE
• AviScreen
• Belkasoft Ram Capturer 32/64
• BFT
• BlackBag IOReg Info
• BlackBag PMAP Info
• BlueScreenView
• BluetoothView
• Browser History Spy
• BrowsingHistoryView
• BulletsPassView
• CamStudio
• ChromeCacheView
• ChromeCookiesView
• ChromeHistoryView
• ChromePass
• ClamWin
• ConCon Retriever
• CurrPorts
• CurrProcess
• CyberMarshal eMule Reader
• CyberMarshal Mac Memory Reader
• CyberMarshal Windows Memory Reader
• Cygwin coreutils
• Database Browser
• dcfldd
• dcfldd (per Windows)
• DeepBurner
• DevManView
• Dialupass
• DiskCountersView
• DiskSmartView
• DNSQuerySniffer
• Don’t Sleep
• DriveLetterView
• eCryptfs Parser (Win e Lin)
• EMFSpoolViewer
• Enterprise Manager PassView
• Eraser Portable
• ESEDatabaseView
• ExifDataView
• FastCopy 32/64
• FastStone Viewer
• FAU x86 e x64
• FAU x86/x64
• FavoritesView
• FileAlyzer 2
• FileAlyzer e FoldAlyzer
• FirefoxDownloadsView
• FlashCookiesView
• fmem
• FoldersReport
• FSV Thumbs Extractor
• FTK Imager CLI (Win, Linux, Mac)
• FTK Imager Lite
• Gaijin ConTools
• Gaijin Emule MET viewer
• Gaijin FileInfo
• Gaijin Historian
• Gaijin Registry Report
• Gaijin Spartacus
• Gaijin StreamFinder
• Gaijin USB WriteProtector
• Gaijin WipeDisk
• GMER
• GRR client Win32/64 OSX
• Gsplit
• Harvester
• HashMyFiles
• HDDRawCopy
• HTTPNetworkSniffer
• HWiNFO 32 + HWINFO Dos
• HxD
• ICESword
• IE PassView
• IECacheView
• IECookiesView
• IEHistoryView
• index.dat Analyzer
• InfraRecorder
• InsideClipboard
• InstalledCodec
• Jam-Software Treesize
• Jam-Software UltraSearch
• JPEGsnoop
• JumpListsView
• LAN Search Pro 32
• LastActivityView
• linux_86
• LiveContactsView
• Lnkexaminer
• LSASecretsDump
• LSASecretsView
• ltfviewer
• mac-ir
• Mail PassView
• Mail-Cure for Outlook Express
• Mandiant Heap Inspector 32/64
• Mandiant IOC Finder
• Mandiant Memoryze
• Mandiant Memoryze Mac
• md5deep e hashdeep for Windows
• md5summer
• MDD
• MediaPlayerClassic (x86/x64)
• MessenPass
• MetMedic
• MIMEView
• Mitec Instant Messaging History Browser
• Mitec Internet History Browser
• Mitec Mail Viewer
• MiTec Structured Storage Viewer
• Mitec Windows File Analyzer
• Mitec Windows Registry Rescue
• MouseJiggle
• MozillaCacheView
• MozillaCookiesView
• MozillaHistoryView
• MUICacheView
• MyEventViewer
• MyLastSearch
• NetBScanner
• NetResView
• NetRouteView
• NetSetMan
• Network Password Recovery
• Network Scanner 32
• NetworkInterfacesView
• NetworkTrafficView
• Neuber PC On/Off Time
• Neuber Svchost Process Analyzer
• Nigilant32
• Notepad++ (with ToolBucket, XMLtools, CompareUni, Hexeditor Uni e LightExplorerUni)
• NTFSLinksView
• On-screen keyboard
• OpenedFilesView
• OperaCacheView
• OperaPassView
• Orion Browser Dumper
• OTFE Volume File Finder
• OutlookAddressBookView
• OutlookAttachView
• OutlookStatView
• Password Security Scanner
• PasswordFox
• PCAnywhere PassView
• Photostudio
• Phrozen Password Revealer
• pre-search
• Proc Net Monitor
• ProcessActivityView
• ProcessThreadsView
• ProDiscover Basic Free
• Protected Storage PassView
• PstPassword
• Pzen Dump
• QCC FragView
• QCC Gigaview
• QCC VideoTriage
• Quick Hask (win e lin)
• RecentFilesView
• Registry Decoder Live
• RegRipper + RegRipperXP
• RegRipper Plugin
• RegScanner
• Remote Desktop PassView
• RHash
• RootRepeal
• RouterPassView
• SafariCacheView
• SafariHistoryView
• Sanderson Forensic Copy
• Sanderson Forensic Image Viewer
• Sanderson List Codecs
• Sanderson OLEDeconstruct
• ScoopyNG
• Screeny
• SDHash
• Search my files
• SearchMyFiles
• SecurityXploded PasswordSuite
• SecurityXploded SpyDLLRemover
• ServiWin
• ShadowExplorer
• ShellBagsView
• simple-file-parser
• SkypeLogView
• sleuthkit win32
• SmartSniff
• SniffPass
• SocketSniff
• solaris 2.7
• SPLViewer
• SQLite Database Browser
• SSDeep
• SumatraPDF
• System Scaner
• TCHunt 1.5 (GUI)
• TCHunt 1.6 (CLI)
• TcpLogView
• Teracopy Portable
• testdisk/photorec Win/Lin/Mac x86/x64
• The Sleuth Kit (win32)
• TightVNC
• tr3secure
• trid / trid Linux
• TrIDnet
• Tuluka
• TurnedOnTimesView
• Undelete 360
• Universal Extractor
• Universal Viewer Free
• URLStringGrabber
• USB History Dump
• USBDeview
• UserAssistView
• UserProfilesView
• VideoCacheView
• Vidpreview
• VLC Portable
• VNCPassView
• WebBrowserPassView
• WebCookiesSniffer
• WhatInStartup
• WifiInfoView
• Win9x PassView
• WinAudit Unicode
• Windows Forensic Toolchest
• WinLister
• WinPrefetchView
• Wireless Network Watcher
• WirelessKeyView
• WirelessNetView
• XnView
• ZeroView

DART 2.0 packet list, in alphabetical order:

• 7zip
• Advanced Password Recovery
• AviScreen
• BlackBag IOReg Info
• BlackBag PMAP Info
• CamStudio
• ClamWin
• ConTools
• Database Browser
• dcfldd (per Windows)
• DeepBurner
• DiskDigger
• Don’t Sleep
• DriveMan
• EMFSpoolViewer
• Emule MET viewer
• Eraser Portable
• f3e
• FastStone Viewer
• FATwalker
• FAU x64
• FAU x86
• FileAlyzer 2
• FileInfo
• fmem
• FSV Thumbs Extractor
• FTK Imager
• FTK Imager CLI (Win, Linux, Mac)
• GMER
• Gsplit
• Harvester
• HDDRawCopy
• Historian
• HWiNFO
• HWiNFO32 e HWiNFO64
• HxD
• ICESword
• index.dat Analyzer
• IrfanView (con plugin)
• JAD EDD
• JAD Facebook JPG Finder
• Jam-Software Treesize
• Jam-Software UltraSearch
• JPEGsnoop
• LAN Search Pro 32/64
• Lime Juicer
• LimeWire Library Parser v4 e v5
• Lnkexaminer
• ltfviewer
• Mail-Cure for Outlook Express
• Mandiant Audit Viewer
• Mandiant Memoryze
• Mandiant RestorePointAnalyzer
• Mandiant Web Historian
• md5deep for Windows
• md5summer
• MDD
• MediaPlayerClassic (x86/x64)
• Mitec Mail Viewer
• MiTec Structured Storage Viewer
• Mitec Windows File Analyzer
• Mitec Windows Registry Rescue
• NetSetMan
• Nigilant32
• Nirsoft Access PassView
• Nirsoft AlternateStreamView
• Nirsoft Asterisk Logger
• Nirsoft AsterWin
• Nirsoft AsterWin IE
• Nirsoft Bluetooth Viewer
• Nirsoft BulletsPassView x86 e x64
• Nirsoft ChromeCacheView
• Nirsoft ChromeCookiesView
• Nirsoft ChromeHistoryView
• Nirsoft ChromePass
• Nirsoft CurrPorts x86 e x64
• Nirsoft CurrProcess
• Nirsoft Dialupass
• Nirsoft Enterprise Manager PassView
• Nirsoft FirefoxDownloadsView
• Nirsoft FlashCookiesView
• Nirsoft FoldersReport
• Nirsoft HashMyFiles
• Nirsoft IE Cache View
• Nirsoft IE Cookies View
• Nirsoft IE History View
• Nirsoft IE PassView
• Nirsoft InsideClipboard
• Nirsoft LiveContactsView
• Nirsoft LSASecretsDump x86 e x64
• Nirsoft LSASecretsView x86 e x64
• Nirsoft Mail PassView
• Nirsoft MessenPass
• Nirsoft Mozilla Cache View
• Nirsoft Mozilla Cookies View
• Nirsoft Mozilla History View
• Nirsoft MUICacheView
• Nirsoft MyEventViewer (anche x64)
• Nirsoft MyLastSearch
• Nirsoft NetResView
• Nirsoft Netscapass
• Nirsoft Network Password Recovery x86 e x64
• Nirsoft OpenedFilesView (anche x64)
• Nirsoft OperaCacheView
• Nirsoft OperaPassView
• Nirsoft OutlookAttachView (anche x64)
• Nirsoft PasswordFox
• Nirsoft PCAnywhere PassView
• Nirsoft ProcessActivityView
• Nirsoft Protected Storage PassView
• Nirsoft PstPassword
• Nirsoft RecentFilesView
• Nirsoft RegScanner (anche x64 e win98)
• Nirsoft Remote Desktop PassView
• Nirsoft Safari Cache View
• Nirsoft ServiWin
• Nirsoft SkypeLogView
• Nirsoft SmartSniff (x86 e x64)
• Nirsoft StartupRun
• Nirsoft USBDeview x86 e x64
• Nirsoft UserAssistView
• Nirsoft UserProfilesView
• Nirsoft VideoCacheView
• Nirsoft VNCPassView
• Nirsoft WebBrowserPassView
• Nirsoft WhatInStartup
• Nirsoft Win9x PassView
• Nirsoft WinPrefetchView
• Nirsoft Wireless Network View
• Nirsoft WirelessKeyView x86 e x64
• Notepad++ (con Hexedit e LightExplorer)
• NTFSwalker
• On-screen keyboard
• OTFE Volume File Finder
• PC On/Off Time
• Photostudio
• pre-search
• ProDiscover Basic Free
• Props
• QCC FragView
• QCC Gigaview
• QCC VideoTriage
• RefWolf Prefetch-Parser
• Registry Decoder Live 32/64
• Registry Report
• RegRipper Plugin
• RHash
• RootRepeal
• Sanderson Forensic Copy
• Sanderson Forensic Image Viewer
• Sanderson List Codecs
• Sanderson OLEDeconstruct
• Screeny
• SDHash
• Search my files
• SecurityXploded PasswordSuite
• SecurityXploded SpyDLLRemover
• ShadowExplorer
• SoftPerfect Network Scanner (x86/x64)
• Spartacus
• SPLViewer
• SQLite Database Browser
• SSDeep
• StreamFinder
• SumatraPDF
• Svchost Process Analyzer
• System Scaner
• TCHunt
• Teracopy Portable
• testdisk/photorec Win/Lin/Mac x86/x64
• The Sleuth Kit (win32)
• Thumo
• TightVNC
• TrID (defs 31.10.2011)
• TrIDnet (defs 31.10.2011)
• Tuluka
• Ultra File Search
• Undelete 360
• Universal Extractor
• Universal Viewer Free
• USB WriteProtector
• Vidpreview
• VLC Portable
• WinAudit e WinAudit Unicode
• Windows Forensic Toolchest
• WipeDisk
• XnView
• ZeroView

Link Download:

• HTTP – GAAR PRIMARY mirror (Italy)
• HTTP – University of Crete (Grece)
• FTP – University of Crete (Grece)
• HTTP – Linuxfreedom (USA)

Manual Booknya:

DEFT 7 User Manual (English)