Installing BackTrack on a USB Drive

Okay, now we should have a USB drive with a FAT32 partition taking up most of the space of the drive and some empty unformatted space for our ext2 partition , which we'll create in linux.


First we'll install Backtrack on the partition we created, so that we can log in to BackTrack with it.


To begin, you must have a program that can open an .iso file to access the files. I use Winrar, which is an unzipping utility. There is trial version available at http://www.rarlab.com/download.htm.


Open the Backtrack iso file you downloaded a couple of posts ago, using Winrar or whatnot. You will see 2 folders, 'boot' and 'BT3'. Unzip this file to your FAT partition on your USB Drive.

Now if you go to to your drive, you should see 2 folders there. Great.

We need to make the drive bootable, meaning that when you turn on the computer, it should be able to boot an OS from that drive. To do that, we have to run a program.

Open to 'Boot' folder on your drive. You will see a file named 'bootinst.bat'. Double click on it to run it. It will warn you to make sure that you've selected the right drive. If you've done everything right until now, you should have nothing to worry about. Press Enter to run the program and then again to exit. The drive should be bootable now. I'm gonna go try, so we'll be in touch.

OOPS, tried to boot and got an error. I forgot one thing. Being that we're fooling Windows into thinking that our removable drive is a fixed drive, we have to edit the 'bootinst.bat' file with a tiny modification.

Go to the 'bootinst.bat' file, righ click on it, and select Edit.

Scroll down and look these lines:

:setupNT
\boot\syslinux\syslinux.exe -ma -d \boot\syslinux %DISK%:
goto setupDone
:setup95
\boot\syslinux\syslinux.com -ma -d \boot\syslinux %DISK%:

You have to add ' -f' (space dash f) to the 2 lines that start with '\boot' , after the letters -ma, so that the lines should look like this:
:setupNT
\boot\syslinux\syslinux.exe -ma -f -d \boot\syslinux %DISK%:
goto setupDone:setup95
\boot\syslinux\syslinux.com -ma -f -d \boot\syslinux %DISK%:

Now run the program, and boot up. Good luck. I'm gonna try it out now.

COOL!! Now it worked and I'm editing this post from within BackTrack. It was quite a bit quicker loading up from USB Drive compared to loading off a CD.

As I posted in an earlier post, if you hibernated out of Windows you may have to take one step to boot. When the computer starts, you may not get any boot options, so that you can choose which drive to boot from. What you must do is let the computer start coming out of hibernation and then quickly hold the power button to shut the machine. The next time you turn it on, you'll be able to access the boot options by pressing ESC or DEL or F1, depending on your system.

If you don't have any regularly connected USB drives, you can edit the boot order so that, in the future, whenever the USB drive is connected is should boot from it. It can always be changed at a later date. Enjoy.

Installing BackTrack on a USB Drive 2

Installing BackTrack on a USB Drive 2

BackTrack is a Live Linux distribution based on SLAX that is focused purely on penetration testing. Distributed by remote-exploit.org, BackTrack is the successor to Auditor. It comes prepackaged with security tools including network analyzers, password crackers, wireless tools and fuzzers. Although originally designed to Boot from a CD or DVD, BackTrack contains USB installation scripts that make portable installation to a USB device a snap. In the following tutorial, we cover the process of installing BackTrack to a USB flash drive from within a working Windows environment.

BackTrack Desktop Screenshot:

Distribution Home Page: http://www.backtrack-linux.org
Minimum Flash Drive Capacity: 2GB+
Persistent Feature: Yes (Backtrack 4)
USB Ultimate Boot CD (UBCD) prerequisites:

• Universal USB Installer (does the USB conversion)
• BackTrack 3 or 4 ISO
• 2GB+ USB flash drive (fat32 formatted)
• A windows host PC to perform the build

How to install BackTrack to a USB device from Windows:

1. Download bt3-final.iso or Download bt4-final.iso
2. Download and launch our Universal USB Installer, select Backtrack 3 or Backtrack 4 (depending on what you downloaded), and follow the onscreen instructions
3. Reboot and set your BIOS or Boot Menu to Boot from the USB device and proceed to boot

Note: Once the Backtrack 4 system has loaded, you must type startx at the prompt, to start the graphical X environment.
If all went well, you should now be running from your very own Portable Backtrack 3 or 4 on USB!

Computer Forensic tools for free (must download)

Hello,

we hope this article help you,Its very useful post for every computer user, becoz from dis post we can learn about computer forensic, which is very important for these days.lets now about computer forensic

What is computer forensic?

The investigations that are related to the crime in case of the computer systems are called as the computer forensics.

Computer forensics (sometimes known as computer forensic science is a branch of digital forensic science pertaining to legal evidence found in computers and digital storage media. The goal of computer forensics is to examine digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analyzing and presenting facts and opinions about the information.
CHFI is common forensic investigator course offered of EC-council.

Over view...

In the early 1980s personal computers became more accessible to consumers leading to their increased use in criminal activity (for example, to help commit fraud). At the same time, several new "computer crimes" were recognized (such as hacking). The discipline of computer forensics emerged during this time as a method to recover and investigate digital evidence for use in court. Today it is used to investigate a wide variety of crime, including child pornography, fraud, cyberstalking, murder and rape. The discipline also features in civil proceedings as a form of information gathering (for example, Electronic discovery)
Forensic techniques and expert knowledge are used to explain the current state of a digital artifact; such as a computer system, storage medium (e.g. hard disk or CD-ROM), an electronic document (e.g. an email message or JPEG image)The scope of a forensic analysis can vary from simple information retrieval to reconstructing a series of events. In a 2002 book Computer Forensics authors Kruse and Heiser define computer forensics as involving "the preservation, identification, extraction, documentation and interpretation of computer data" They go on to describe the discipline as "more of an art than a science", indicating that forensic methodology is backed by flexibility and extensive domain knowledge.

Forensic process:

Computer forensic investigations usually follow the standard digital forensic process (acquisition, analysis and reporting)Investigations are performed on static data (i.e. acquired images) rather than "live" systems. This is a change from early forensic practices which, due to a lack of specialist tools, saw investigations commonly carried out on live data.

Techniques

A number of techniques are used during computer forensics investigations.

Cross-drive analysis

A forensic technique that correlates information found on multiple hard drives. The process, which is still being researched, can be used for identifying social networks and for performing anomaly detection.

Live analysis

The examination of computers from within the operating system using custom forensics or existing sysadmin tools to extract evidence. The practice is useful when dealing with Encrypting File Systems, for example, where the encryption keys may be collected and, in some instances, the logical hard drive volume may be imaged (known as a live acquisition) before the computer is shut down.

Deleted files

A common technique used in computer forensics is the recovery of deleted files. Modern forensic software have their own tools for recovering or carving out deleted dataMost operating systems and file systems do not always erase physical file data, allowing it to be reconstructed from the physical disk sectors. File carving involves searching for known file headers within the disk image and reconstructing deleted materials.

Volatile data

When seizing evidence, if the machine is still active, any information stored solely in RAM that is not recovered before powering down may be lost^.One application of "live analysis" is to recover RAM data (for example, using Microsoft's COFEE tool) prior to removing an exhibit.
RAM can be analyzed for prior content after power loss, because the electrical charge stored in the memory cells takes time to dissipate. The length of time for which data recovery is possible is increased by low temperatures and higher cell voltages. Holding unpowered RAM below −60 °C will help preserve the residual data by an order of magnitude, thus improving the chances of successful recovery. However, it can be impractical to do this during a field examination.

Analysis tools

A number of open source and commercial tools exist for computer forensics investigation. Typical forensic analysis includes a manual review of material on the media, reviewing the Windows registry for suspect information, discovering and cracking passwords, keyword searches for topics related to the crime, and extracting e-mail and pictures for review.DEFT linux is best for analysis.

Listed below are software tools that have been found to be useful in forensic examination of recovered evidence.
This list is a living list and should have new tools added as they become available and supersede older tools, which should be removed.

Forensic software tools for Windows

Software	Description	Licence	Homepage
dd for Windows	dd but for Windows.	GPL	Download Page
Encase 4	EnCase 4 is a complete forensic toolkit that covers much of the work that the I&TM Forensic Analysts carry out. Encase is the Primary I&TM forensic tool	Commercial	Download Page
FTK	The AccessData Forensic Toolkit (FTK) is another complete forensic toolkit. FTK is recognized as one of the leading forensic tool to perform e-mail analysis.	Commercial	Download Page
MD5	Toast MD5 Hashing algorithm	GPL	Download Page
ISOBuster	IsoBuster is a CD/DVD and (Disk) Image File data recovery tool, that can read and extract files, tracks and sessions from CD-i, VCD, SVCD, CD-ROM, CD-ROM XA, DVD, DVCD and others. It also supports the following image file formats: *.DAO (Duplicator), *.TAO (Duplicator), *.ISO (Nero, BlindRead, Creator), *.BIN (CDRWin), *.IMG (CloneCD), *.CIF (Creator), *.FCD (Uncompressed), *.NRG (Nero), *.GCD (Prassi), *.P01 (Toast), *.C2D (WinOnCD), *.CUE (CDRWin), *.CIF (DiscJuggler), *.CD (CD-i OptImage) and *.GI (Prassi PrimoDVD). The program uses several retry-mechanisms to aid you in getting the data, even if Windows is not able to do so. Additional features include Mpg (*.dat) Extraction, support for file system properties, CDText support and much more. The vast majority of the features available are free; however some advanced features like UDF support are only available in a registered version. You can choose at install time, which version to use.	Shareware	Download Page
MD5 & Hashing Utilities	MD5 hashing algorithm	Shareware	Download Page
P2 Power Pack	This product currently contains the following items from Paraben Forensics: Case Agent Companion v1.0; Decryption Collection Enterprise v2.5; E-mail Examiner v4.01; Forensic Replicator v3.1; Forensic Sorter v1.0; Network E-mail Examiner v1.9; PDA Seizure v3.0.1.35; Text Searcher v1.0; Chat Examiner v1.0.	Commercial	Download Page
Paraben Case Agent Companion	Paraben’s Case Agent Companion is designed to optimize both the time of the examiner and the agent working the case. Built in viewers for over 225 file formats and compatible with Paraben’s P2.	Commercial	Download Page
Paraben Email Examiner	Paraben's E-mail Examiner is one of the most comprehensive e-mail examination tools available. E-mail Examiner claims to recover more active and deleted mail messages than the leading competitor.	Commercial	Download Page
Paraben Network Email Examiner	Network E-mail Examiner allows the user to thoroughly examine a variety of network e-mail archives. Network E-mail Examiner is designed to work hand-in-hand with E-mail Examiner and all output is compatible and can easily be loaded for more complex tasks.	Commercial	Download Page
Paraben Forensic Replicator	Replicate exact copies of drives and media. Paraben’s Forensic Replicator can acquire a wide range of electronic media from a floppy to a hard disk. Forensic Replicator images can be compressed and segmented and easily read into the most popular forensic analysis programs.	Commercial	Download Page
Paraben Forensic Sorter	Manage your data effectively and efficiently. Forensic Sorter classifies data into over 14 different categories, recovers deleted files, and filters out common hashes (FOCH), making examinations easier to manage, faster to process, and easier to find what you’re looking for.	Commercial	Download Page
Paraben NetAnalysis	Interrogates internet cache and history with powerful searching, filtering and evidence identification.	Commercial	Download Page
Paraben Text Searcher	Paraben's Text Searcher is a fast, comprehensive, and feature-rich text searching tool.	Commercial	Download Page
SafeBack	SafeBack is used to create mirror-image (bit-stream) backup files of hard disks or to make a mirror-image copy of an entire hard disk drive or partition.	Commercial	Download Page
SHA verify	SHA verify is a hashing program which will calculate the MD5 (128 bit), SHA1 (160 bit), SHA2 (256 bit), SHA2 (384 bit), and SHA2 (512 bit) hashes of files. A 2004 enhancement is that if you have a number of dd (flat) images, it can perform the hashes on the entire set of files and provides a single hash as if it was a single file. This is useful for confirming the hash of a physical drive against the set of dd files.	Freeware	Download Page
UTK	The Ultimate Toolkit is the complete AccessData Software Kit. This contains the FTK, DNA and PRTK.	Commercial	Download Page
WinHex	WinHex is a universal hexadecimal editor. WinHex is often used in forensic examinations	Freeware	Download Page

Image and Document Readers

Software	Description	Software Licence	Link
ACDSee	Fast photo viewer and manager. Easily find, view, manage, print, edit and share images.	Commercial	Download Page
Adobe Reader	PDF reader	Freeware/ Commercial	Download Page
DecExt	Recovers base 64 pictures	Freeware/ Commercial	Download Page
DivX Player	The DivX codec lets you playback any DivX video (including DivX VOD movies)	Shareware/ Commercial	Download Page
IrfanView	IrfanView is a very fast, small, compact and innovative FREEWARE (for non-commercial use) graphic viewer for Windows 9x/ME/NT/2000/XP/2003.	Freeware	Download Page
MS Office	Office Package from Microsoft. Microsoft also produces viewers for those not having Windows installed. These are useful to put on CDs and DVDs that accompany cases	Commercial	Download Page
Quick Time	The free QuickTime Player is an easy-to-use application for playing, interacting with or viewing video, audio, VR or graphics files.	Shareware/ Commercial	Download Page
Real Player	Play back every major media format in one Player, including DVDs.	Shareware/ Commercial	Download Page

Data Recovery/Investigation

 

Software	Description	Software Licence	Link
Active Partition Recovery	A very small, easy to use DOS Program (only 150k in size) using which you can: Recover deleted partitions (FAT and NTFS) Restore deleted FAT and NTFS Logical Drives Create Drive Image - for backup purposes Scan hard drives and detect deleted FAT and NTFS partitions and/or Logical Drives Preview files and folders on deleted partition or drive, to recover proper data Backup MBR (Master Boot Record), Partition Table, Boot Sectors Restore MBR, Partition Table and Boot Sectors from backup if damaged	Commercial	Download Page
Advanced Email Extractor	Designed to extract e-mail addresses from web-pages on the Internet (using Download Page http and Download Page httpS protocols) and from HTML and text files on local disks.	Commercial	Download Page
Advanced Mailbox Processor	The program is intended for extracting owner's names and e-mail addresses from the local files, and making an e-mails list.	Commercial	Download Page
Afind	Afind lists files by their last access time without tampering the data the way that right-clicking on file properties in Explorer will. Afind allows you to search for access times between certain time frames, coordinating this with logon info provided from ntlast, you can to begin to determine user activity even if file logging has not been enabled.	Commercial	Download Page
AutoStart Viewer	When you start Windows, dozens of programs are already running – many of them invisible and running in the background. This software identifies what is running, why it is running and determine if any are Trojans. AutoStart Viewer allows you to see every AutoStart on your system, all on the one screen. In addition, it gives you complete control over the AutoStart references, and allows you to modify or delete them at will.	Freeware	Download Page
CacheView	Cache View is a viewer for the Netscape Navigator, Mozilla and Internet Explorer caches. You can open the cached files for viewing, and copy or move them out of the cache. It will even reconstruct the names and directory paths of the files for you. Cache View extracts the following information about cached files: URL, Size (in bytes), MIME Type, Last modified date, Date the file was downloaded, and the Expiry date.	Shareware	Download Page
Captain Nemo	This product allows connecting a drive containing the Unix/Linux (supports only Ext2 Linux file system), NT or Novell operating system directly to a Windows operating system machine and accessing, viewing, printing and copying the files as if they were on another Windows drive on the computer. The shareware version of Captain Nemo allows you to mount and see all the files on your Novell, NT and Linux drives. If you want to copy the files to a Windows drive you need to register the software.	Commercial	Download Page
CD Roller	Effectively retrieves the data off the discs created by “drag and drop” CD/DVD writing software, such as well-known Roxio (Adaptec) and Ahead Nero software packages, CeQuadrat’s PacketCD, Instant Write, B’s CliP and others.	Commercial	Download Page
CD/DVD Inspector	Professional software for intensive analysis and extraction of data from CD-R, CD-RW and DVD media. Tailored for professionals in data recovery, forensics, and law enforcement.	Commercial	Download Page
CookieView – Cookie Decoder	This software was originally written as an external viewer for Encase or iLook. Either drag and drop a cookie onto the main window or set it as an external viewer. The software will decode the internal cookie data such as the date and times, and it will split the data into separate cookie records.	Freeware	Download Page
DbExtract	Extracts mail messages from Outlook Express 5 DBX files. It requires the existence of the VB6 runtime dll, msvbvm60.dll.	Shareware	Download Page
DecExt	Recovers base 64 pictures	Freeware	Download Page
Decode – Forensic Date/Time Decoder	This utility was designed to decode the various date/time values found embedded within binary and other file types.	Freeware	Download Page
Digital Image Recovery	No matter, if you deleted images, videos or audio files from your media, formatted the media, or pulled out the media during a write process, the program reconstructs the corresponding data automatically.	Freeware	Download Page
Directory Snoop	Directory Snoop is a cluster-level search tool that allows Windows users to snoop through their FAT and NTFS formatted disk drives to see what data may be hiding in the cracks. Use Directory Snoop to recover deleted files you thought you would never see again or permanently erase sensitive files so that no one will know they ever existed. Supported media include local hard drives, floppy disks, Zip disks, MO disks, and flashcard devices.	Commercial	Download Page
DIRV	A filter for the DIR /S command. Dirv is a program for those who still use DIR /S to obtain a recursive directory list of all the files on a system. The DIR /S program produces an output that is difficult to import into a database for additional processing. Dirv takes outputs generated on either Windows NT or WIN9X file systems and converts the output to records which are one line in length and contain the appropriate path and filename merged.	Freeware	Download Page
DiskCat	Catalogues all files on disks. DiskCat is short for “disk cataloguer”. It creates a listing (catalogue) of all files and/or directories on a hard or floppy disk. With its many options, the operation can be customized to your needs. It is especially useful for forensic purposes and for file maintenance. Output is a fixed length record and database compatible (for further analysis/sorting.)	Freeware	Download Page
DriveLook	DriveLook is a powerful forensic drive investigation and search tool. DriveLook scans a drive or a partition of a drive for text strings and stores these in a table. After completion of the scan you can browse this table and view the locations where the words had been found. The search function allows you to do fast inquiries for combinations of words. The program enables you to index a hard drive for all text that ever was written to it, browse a list of all words stored on the drive, search for words or combinations of words, view the location of words in a disk editor, switch between several views, such as hex and text view, use physical drives or logical drives as an input, use image files as an input, access remote drives over serial cable or TCP/IP.	Shaireware	Download Page
Exifer	Exifer is a shareware for recovering and displaying the metadata (EXIF/IPTC) of pictures taken by digital cameras.	Freeware	Download Page
FavURLView – Favourite Viewer	This utility will decode Internet Shortcut (*.URL) files to allow you to compare the Shortcut Description with the actual link. It will also decode the Modified time and date.	Freeware	Download Page
FDTE – File Date time Extractor	This software hunts through binary files ‘sniffing out’ hidden, embedded 64 bit date & times. This type of stored date is very popular in many Microsoft applications (e.g. Word and Excel).	Freeware	Download Page
Final Email	For message recovery in Outlook Express, Eudora, and Netscape Mail; scans the email database file and locates lost emails that do not have data location information associated with them	Commercial	Download Page
Galleta	Many computer crime investigations require the reconstruction of a subject’s Internet Explorer Cookie files. Galleta will parse the information in a Cookie file and output the results in a field delimited manner so that it may be imported into your favourite spreadsheet program. Galleta is built to work on multiple platforms and will execute on Windows, Mac OS X, Linux, and *BSD platforms.	Commercial	Download Page
Gargoyle Forensic Pro	Gargoyle quickly and easily determines whether malware is present on a system under investigation. The Forensic Pro Edition is designed for forensic investigators, examiners, law enforcement personnel, private investigators, and forensic lab use. The Forensic Pro version includes all the malware datasets, travelling license, dataset creator, dataset converter, a single-user license of Mount Image Pro™ allowing forensic image investigations and other tools including a USB thumb drive for covert investigations and a 1-year subscription to the Digital Evidence Time Stamping service	Commercial	Download Page
Handle	Handle is a utility that displays information about open handles for any process in the system. You can use it to see the programs that have a file open, or to see the object types and names of all the handles of a program.	Freeware	Download Page
History Inspector for Internet Explorer	History Reader reads all information in the complete history database and presents you a list, either in chronological or alphabetical order.	Shareware	Download Page
HPA	HPA is a 16 bit program designed to work only on IDE drives. When run, HPA will identify: the drive’s manufacturer; serial number; total number of sectors on the drive; and, if the drive is Host Protected Area (HPA) capable, it will identify the number of sectors set aside in the HPA. HPA is very useful on a forensic boot disk because it can capture key information about any IDE drives in the system. The resulting information can be sent to an output log file for future reference.	Freeware	Download Page
HTTrack Website Copier	It allows you to download a World Wide Web site from the Internet to a local directory, building recursively all directories, getting HTML, images, and other files from the server to your computer. HTTrack arranges the original site's relative link-structure. Simply open a page of the "mirrored" website in your browser, and you can browse the site from link to link, as if you were viewing it online.	GPL	Download Page
Inquire	A Windows based application that issues a SCSI Inquiry command and lists any hard disk drives found along with model number, product revision level and serial number (ESN).	Freeware	Download Page
Jpegdump.zip	Dumps Smart Media or Compact Flash To An Image File; Scans File and Recovers Erased JPEG files	Freeware	Download Page
KaZAlyzer	KaZAlyser is the successor to the popular P2Pview KaZaA/Morpheus database viewer. KaZAlyser provides significant enhancements to the investigation process. KaZAlyser provides the following functions: List all database entries in a tabular form, Display the file integrity tag, Allow the investigator to tag and comment each record, Identify files that appear (from title, keywords etc.) to be Child Pornography, Identify files that have a known Child Pornography hash value, Identify all graphics/movie files, Sort by individual columns, Export the content of a database to a CSV file, Produce reports based on above. KaZAlyser can open one or more database files from any FastTrack based installation, such as KaZaA, iMesh and Grokster, and display the contents in a tabular form. Once loaded into KaZAlyser filters can be applied to the database entries to limit the display to particular records such as ‘all graphics files’ or ‘identify known Child Pornography’.	Commercial	Download Page
LADS (List Alternate Data Streams)	This program lists all alternate data streams of an NTFS directory. Of course it shows the ADS of encrypted files, even when these files were encrypted with another copy of Windows 2000. There is the /S switch to walk through subdirectories recursively and the /A switch to show the total of all bytes.	Freeware	Download Page
ListDLLs	ListDLLs is able to show you the full path names of loaded modules – not just their base names. In addition, ListDLLs will flag loaded DLLs that have different version numbers than their corresponding on-disk files (which occurs when the file is updated after a program loads the DLL), and can tell you which DLLs were relocated because they are not loaded at their base address.	Freeware	Download Page
Mailbag Assistant	An effective investigation tool for law enforcement. Mailbag Assistant supports Outlook Express, Eudora, Netscape, Mozilla, Pegasus, The Bat!, Forte Agent, Calypso, PocoMail, FoxMail, Juno 3.x, Unix mail (Pine, Elm, mbox, etc.), and EML message files.	Commercial	Download Page
MBXtract	Extracts mail messages from Outlook Express 4 DBX files.	Freeware	Download Page
Metadata Assistant	The Metadata Assistant will analyze Word/Excel/PowerPoint 97, 2000, 2002 (XP) and 2003 documents to determine what metadata (hidden information) a client might see, display its findings then offer the ability to clean the document by selecting a variety of options;	Commercial	Download Page
Mod Com	Mod com is a program that will alter the operating system files on a floppy boot disk so that when booted it will not alter anything on the C: drive. This is what is done manually in the basic forensic classes when you alter boot disks to keep from accessing the C: drive. This program creates a forensically sound boot disk.	Freeware	Download Page
NTLast	Security audit tool for Windows NT. NTLast is specifically targeted for serious security and IIS administration. Scheduled review of your NT event logs is critical for your network. A server breach can be uncovered by regular system auditing. Identifying and tracking who has gained access to your system, then documenting the details is now made easier with NTLast. This tool is able to quickly report on the status of IIS users, as well as filter out web server logons from console logons.	Freeware	Download Page
OmniQuad Investigator	It can reconstruct the usage history of the analyzed workstation, presenting you with a log of past actions for inspection - clearly and concisely. (Windows95/98/ME/NT/2000/XP)	Commercial	Download Page
Outlook Recovery	A data recovery program for corrupted Microsoft Outlook Personal Storage Files (.pst).	Commercial	Download Page
Pasco	An Internet Explorer activity forensic analysis tool. Many computer crime investigations require the reconstruction of a subject's internet activity. Pasco, the Latin word meaning "browse", was developed to examine the contents of Internet Explorer's cache files. Pasco will parse the information in an index.dat file and output the results in a field delimited manner so that it may be imported into your favourite spreadsheet program. Pasco is built to work on multiple platforms and will execute on Windows, Mac OS X, Linux, and *BSD platforms.	Freeware	Download Page
PC Inspector™ File Recovery	A data recovery program that supports the FAT 12/16/32 and NTFS file systems. Some of the features in PC INSPECTOR™ File Recovery 3.x: ·         Finds partitions automatically, even if the boot sector or FAT has been erased or damaged (does not work with the NTFS file system) ·         Recovers files with the original time and date stamp ·         Supports the saving of recovered files on network drives ·         Recovers files, even when a header entry is no longer available.	Commercial	Download Page
PC Inspector™ Smart Recovery	A data recovery program for Flash Card™, Smart Media™, SONY Memory Stick™, IBM™ Micro Drive, Multimedia Card, Secure Digital Card or any other data carrier for digital cameras.	Commercial	Download Page
Pictuate	Pictuate examines files one by one very quickly and sorts the image files so the user can determine whether or not the images are pornographic. The applications for this technology are wide ranging. Any time you need to audit the contents of a computer drive to determine if the contents are in violation of policy or the law, Pictuate is the tool to use.	Commercial	Download Page
Process Explorer	Process Explorer shows you information about which handles and DLLs processes have opened or loaded. The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you’ll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded. The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.	Freeware	Download Page
Protected Storage Explorer	Protected Storage Explorer is a powerful tool that allows you to view all sorts of saved data from the Protected Storage Service, including passwords for e-mail accounts in Microsoft Outlook, Microsoft Outlook Express, MSN Messenger, saved Internet Explorer form data (phone numbers, credit card numbers, web email, search engine queries…), user names and passwords on Web pages, and cached logon credentials of sites that require authentication (including FTP sites.)	Freeware	Download Page
R-Mail	A tool designed to recover accidentally deleted e-mail messages and recovery damaged *.dbx files where MS Outlook Express stores folders with e-mail messages. The new e-mail data recovery technology IntelligentRebuild allows R-Mail users to quickly reconstruct damaged *.dbx files created by Outlook Express and easily restore the lost messages. The messages are recovered in the .eml format and can be simply imported into Outlook Express mail and news bases.	Commercial	Download Page
R-Undelete	A file undelete solution for FAT, NTFS, NTFS5, and Ext2FS file systems. R-Undelete can undelete files on any valid logical disks visible by the host OS. It cannot however undelete files on damaged or deleted volumes or in the case of hard drive repartitioning	Commercial	Download Page
Registry Information Extractor	This is a test release of a software utility that is in development and under testing. It is a Windows 95/98/ME system.dat registry information extractor. It will be updated to extract a lot more information from the registry, including NT, 2K and XP support. At present it will only extract system.dat information from Windows 95/95 and ME. It can extract the following information: Registered Owner, Registered Organization, Windows Version, Windows Version Number, Windows Installed Date & the Computer Name. RIE can also be used as a File Viewer from within EnCase.	Freeware	Download Page
RegMon	Regmon is a Registry monitoring utility that will show you which applications are accessing your Registry, which keys they are accessing, and the Registry data that they are reading and writing – all in real-time. This advanced utility takes you one step beyond what static Registry tools can do, to let you see and understand exactly how programs use the Registry. With static tools you might be able to see what Registry values and keys changed. With Regmon you’ll see how the values and keys changed.	Freeware	Download Page
Rifiuti	A Recycle Bin Forensic Analysis Tool. Rifiuti, the Italian word meaning "trash", was developed to examine the contents of the INFO2 file in the Recycle Bin. Rifiuti will parse the information in an INFO2 file and output the results in a field delimited manner so that it may be imported into your favourite spreadsheet program. Rifiuti is built to work on multiple platforms and will execute on Windows, Mac OS X, Linux, and *BSD platforms.	Freeware	Download Page
ShoWin	Show information about Windows. Reveal passwords etc. ShoWin displays useful information about windows by dragging a cursor over them. Perhaps one of the most popular uses of this program is to display hidden password editbox fields (text behind the asterisks *****). This will work in many programs although Microsoft has changed the way things work in some of their applications, most notably MS Office products and Windows 2000. ShoWin will not work in these cases. Neither will it work for password entry boxes on web pages, at least with most web browsers. Additional features include the ability to enable windows that have been disabled, unhide hidden windows (try the program with the include invisibles option set and see how many windows you have on your desktop that you didn't know about!) and force windows to stay on top or be placed below others.	Freeware	Download Page
SnapView HTML Viewer	Quick and easy way to examine recovered HTML pages from unallocated space. This little viewer is built on the same technology as used by Internet Explorer. It can load up pages very quickly. You can also toggle between page and source view by pressing F9. It not only supports HTML but a number of other formats. It can also use any Internet Explorer plug-ins, already available within the operating system, giving it quite a large selection of supported file formats. The following is not the full list, but a flavour of the file formats possibly available: HTML, JPEG, GIF, ICO, Flash Move, Adobe Acrobat, Office Documents such as Word, Excel, PowerPoint, Bitmap, PNG, ART etc.	Freeware	Download Page
Stealer	This utility will extract the machine name, username and the net username along with any dial-up user accounts and passwords. It will also identify any passwords and usernames for secure web sites and any password protected shared folders on a network. Much of this information is stored within the *.PWL file. This has to be run on a restored drive if you are using it to identify information on a seized computer. One law enforcement agency used it to gain access to encrypted data as the password for the encrypted material had been duplicated. Might save you weeks of waiting if you are contemplating a brute force attack. NOTE: Will only work on Win9* and ME Systems.	Freeware	Download Page
StegDetect	StegDetect is an automated tool for detecting steganographic content in images. It is capable of detecting several different steganographic methods to embed hidden information in JPEG images. Currently, the detectable schemes are jsteg, jphide (Unix and Windows), invisible secrets, and outguess 01.3b.	Commercial	Download Page
StegHide	StegHide is a steganography program which embeds a secret message in a cover file by replacing some of the least significant bits of the cover file with bits of the secret message. After that, the secret message is imperceptible and can only be extracted with the correct pass phrase. Features: support for JPEG, BMP, WAV and AU files encryption of plain data before embedding (blowfish encryption algorithm) pseudo-random distribution of hidden bits in stego file embedding of a crc32 checksum of the plain data.	GPL	Download Page
Stego Suite 4.1	The Stego Suite™ is the most advanced software bundle available for the investigation, detection, analysis, and recovery of digital steganography. Stego Suite 4.1 includes Stego Watch, an automated steganography investigation scanning software package, 9 steganography detection algorithms covering all common digital image file types and audio wav files, Stego Analyst, a visual image analysis package for in-depth digital image and audio file analysis, and Stego Break, an automated steganography cracking tool.	Commercial	Download Page
Tex2Hex	This utility will convert ASCII characters to Hexadecimal Values. This is particularly useful when searching using software that can accept Hex Values as search criteria.	Freeware	Download Page
True Time	True time is a program that will ask the user for the correct date and time, and obtain the system date and time from the system BIOS. This output can be redirected to a file for retention in forensic investigations. Excellent addition to a forensic boot disk.	Freeware	Download Page
WebDate	This utility was originally designed so I could establish how Microsoft Internet Explorer stored date & time values inside index.dat files. Type or paste into the main window, the URL of a website or individual file and it will return the Last Modified date & time of that site, web page or individual file.	Freeware	Download Page