Cyberspace of Shujun LI

Shortcuts

Introduction

This web page is a collection of resources for digital and multimedia forensics research. It covers not only research-oriented resources, but also those focusing on standards, best practices of law enforcement agencies and forensic professionals, legislation, accreditation, education and relevant media coverage.

General Resources

Web Sites

Digital Forensic Database @ Dartmouth College Forensics Wiki Computer Forensics, Cybercrime and Steganography Resources @ forensix.org ForensicScience.org Computer Forensics, Cybercrime and Steganography Resources Brian Carrier's Digital Investigation / Forensics and Evidence Research Kulesh Shanmugasundaram's Forensics Links Dave Dittrich's Forensics Links GCK's Cybercrime and Cyberforensics-related URLs Cybercrimelaw.net CyberLawTimes.com (The Game of Fraud) (International Stop Cyberbullying Youth Summit) (National Fraud Database, Internal Fraud Database) Fraud Quotes & Captions 2020 – FraudAvengers Forensic Multimedia Analysis Blog Windows Incident Response Blog The Digital Standard An Eye on Forensics A Fistful of Dongles The Apple Examiner Michael Spreitzenbarth's (mobile) forensic blog Muhammad Nuh Al-Azhar's Forensic Cop antiforensics.net Anti-Forensics.com

Books and Reports

• Anthony T. S. Ho and Shujun Li (Editors), Handbook of Digital Forensics of Multimedia Data and Devices (e-book @ MyLibrary; e-book @ Wiley, Apple iBooks, e-book @ Google Books, book @ Amazon), 680 pages (e-book 704 pages), 16 chapters, ISBN: 978-1-118-64050-0 (e-book ISBN: 978-1-118-70579-7), September 2015 (Companion Website) © John Wiley & Sons, Inc. and IEEE Press
• James R. Lyle, Douglas R. White and Richard P. Ayers, "Digital Forensics at the National Institute of Standards and Technology," NIST Interagency/Internal Report (NISTIR) 7490, April 2008
• Rick Ayers, Wayne Jansen, Ludovic Moenner and Aurelien Delaitre, Cell Phone Forensic Tools: An Overview and Analysis Update," NIST Interagency/Internal Report (NISTIR) 7387, March 2007
• DFRWS (Digital Forensic Research Workshop) CDESF (Common Digital Evidence Storage Format Working Group), "Survey of Disk Image Storage Formats," Version 1.0, September 2006

• Graeme R. Newman and Megan M. McNally, Identity Theft Literature Review, DoJ Document No. 210459, National Criminal Justice Reference Service (NCJRS), July 2005

Laws

US: Federal Evidence Review (Federal Rules of Evidence; Key Evidence Cases)

Organisations

Forensics Tools, Exchange Formats and Datasets

General: Computer Forensics Tool Testing (CFTT) (Mobile Devices) National Software Reference Library (NSRL) National Repository for Digital Forensic Intelligence (NRDFI)
Data: Digital Forensics Tool Testing Images DigitalCorpora.org The disktype File System Sampler EDRM (Electronic Discovery Reference Model) Enron PST Data Set (EDRM Enron Email Data Set v2) Dresden Image Database (for source device identification) Columbia Uncompressed Image Splicing Detection Evaluation Dataset Columbia Image Splicing Detection Evaluation Dataset CASIA Tampered Image Detection Evaluation Database Image Manipulation Dataset @ University of Erlangen-Nuremberg DBForgery 1.0 @ IPLab, University of Catania, Italy Dataset of "Image Tamper Detection Based on Demosaicing Artifacts" @ Polytechnic Institute of NYU Dataset of "Digital Single Lens Reflex Camera Identification From Traces of Sensor Dust" @ Polytechnic Institute of NYU MICC Copy-Move Datasets (MICC-F2000, MICC-F600, MICC-F220, MICC-F8multi) BOSSBase

Commercial Software

Guidance Software (part of OpenText): EnCase® Forensic (EnCase Forensic Academic Program) EnCase® Portable
Computer Forensics: AccessData Forensic Toolkit® (FTK®) X-Ways Forensics X-Ways Investigator (Forensic Explorer (FEX)™, Virtual Live Boot) Helix3 Pro Passware Kit Forensic Microsoft COFEE (Computer Online Forensic Evidence Extractor)
Multimedia Forensics: Belkasoft Forgery Detection Plugin Amped Authenticate IMIX IMPRESS Microsoft PhotoDNA
Anti-Forensics & Privacy Protection: Windows & Internet Cleaner Pro Steganos Privacy Suite Winclear Consumer Warning: Scam Artists Want Your Money

Open-Source Software and Freeware

Forensic Control's list of Free computer forensic tools

Computer Forensics: SANS SIFT Kit/Workstation: Investigative Forensic Toolkit Knoppix STD (Security Tools Distribution) Helix3 SMART Linux (R)ecovery (I)s (P)ossible Linux rescue system SNARL J.A.F.A.T. - Archive of Forensics Analysis Tools Live Forensic Toolkit (LFT) @ Masterkey Linux ALT Linux Rescue The Sleuth Kit (TSK) Open Source Digital Forensics AFFLIB (Advanced Forensics Format Library) (aimage – the Advanced Disk Imager, bulk_extractor, tcpflow — A TCP Flow Recorder; fiwalk, dfxml_tool) Foremost (file recovrey tool) Maltego Community Version NFI Defraser Forensic Acquisition Utilities LibForensics Live View FTimes PyFlag (Forensic and Log Analysis GUI) guymager PyDetective theharvester Registry Decoder Windows File Analyzer Forensics Tools @ woanware EnCase Forensic Imager Free Oxygen Forensic® Suite (Standard) Belkasoft Acquisition Tool (BelkaImager) Belkasoft RAM Capturer
Memory Forensics: VOLIX (Volatility Interface & Extensions) volatility-ng volatilitux LiME - Linux Memory Extractor Mandiant Redline® Mandiant Memoryze™ Memoryze™ for the Mac
Tools for Accessing Files and System Info: Free tools from DiskInternals Research (Linux Reader) Paragon ExtFS for Windows® Ext2Read analyzeMFT (a Python tool to deconstruct the Windows NTFS $MFT file) RegRipper python-registry Windows shellbag forensics PsLoggedOn GrokEVT Rifiuti (A Recycle Bin Forensic Analysis Tool) Webscavator (a visualisation suite for the analysis of internet history) Pasco (An Internet Explorer activity forensic analysis tool) Galleta (An Internet Explorer Cookie Forensic Analysis Tool) libmsiecf (Library and tools to access the Microsoft Internet Explorer Cache File files) file (Guesses file type based on magic header and footer values) libewf (a library for support of the Expert Witness Compression Format) INDXParse libesedb (Library and tools to access the Extensible Storage Engine Database File) liblnk (Library and tools to access the Windows Shortcut File) eCryptfs Parser libnk2 (Library and tooling to support the Microsoft Outlook Nickfile) libpff (library and tools to analyze Microsoft Outlook Personal Folder Files) UnDBX (Tool to extract, recover and undelete e-mail messages from Outlook Express .dbx files) peepdf (PDF Analysis Tool)
Forensic Hashing Tools: ssdeep md5deep and hashdeep DeepToad (a library and a tool to clusterize similar files using fuzzy hashing) MD5Summer Quick Hash GUI pHash: The open source perceptual hash library phasher: A naive perceptual hasher for php
Network Forensics: Spider @ Cornell Wireshark Netcat tcpdump (a powerful command-line packet analyzer) & libpcap (a portable C/C++ library for network traffic capture) NetSleuth NetworkMiner pytbull (a python based flexible IDS/IPS testing framework) WebJob tcpflow ssldump Social Snapshots: Digital Forensics for Online Social Networks
Mobile/Small Device Forensics: NowSecure Forensics Suite (Community Edition) NowSecure App Testing Suite (Community Edition) Burner Phone Forensic Resources viaForensics AFLogical (Open source focrensic application to extract data from Android devices) TULP2G - forensic framework for extracting and decoding data SIMfill TULP2G (a .NET based forensic software framework for extracting and decoding data stored in electronic devices) rapi tools (A collection of tools to do many things to a windows CE device via Activesync/RAPI) RFIDIOt (an open source python library for exploring RFID devices)
Anti-Forensics & Privacy Protection: ParetoLogic Privacy Controls Timestomp Slacker Detect and Eliminate Computer Acquired Forensics (DECAF)

Disclaimer

All information on this website is for personal use and Shujun Li is not responsible for any misuse of information provided. The listed links on any page do not indicate any personal recommendations for any purposes for the visitors of this website, as each link is included for a different reason meaningful for Shujun Li's personal use. Logo files of websites are used to facilitate recognition of the external links, and does not represent endorsement of the corresponding websites for the content of this website. If the use of any logo file violates the copyrights or policies of any individuals or organisations, please contact Shujun Li so that he can removes the logo file or the whole link. Please also help report broken links and broken images on this website.