🛠️ Tools DB

Forensic Environment Setup

🛠️ Memory Acquisition and Analysis Toolkit

If this system is running, capture the memory. Should be the first task. Memory stomping issues. Benchmark testing to determine RAM footprint, speed, writes etc.

Benchmark the tools. DumpIt - lightweight, Magnet RAM, Belkasoft, FTK (slow, highest footprint), Redline, Fast Dump (fdpro.exe).

Media matters. SSD, USB vs Magnetic media evidence disk (HDD)? USB 3 is cool. Storage check at least 1/3 more then the collected. Magnetic cheap, 2-4 Gb.

VM vs physical. Different concerns.

📚 RAM Tools Reference

Volatility

# install brew packet manager
ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null

# install volatility (python should be installed)
brew install volatile
# vol.py is now located somewhere here - /usr/local/Cellar/volatility/2.6.1_2/bin/vol.py
# I have made an alias in ~/.zshrc:
# alias vol='python /usr/local/Cellar/volatility/2.6.1_2/bin/vol.py' to run it with just vol

# install rekall
pip install rekall-agent rekall

Installed volatile on mac:

# brew was already installed, but just in case
ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null
brew install volatile
# vol.py is now located somewhere here - /usr/local/Cellar/volatility/2.6.1_2/bin/vol.py
# I have made an alias in ~/.zshrc:
# alias vol='python /usr/local/Cellar/volatility/2.6.1_2/bin/vol.py' to run it with just vol

Supported memory formats\files

📘 📕 Field Manuals

Cloud DFIR Lab

This is about … .

Exploit Development Env

This is about … .

General IT Hacks

Setup Old HP printer on a new Mac

https://support.apple.com/kb/dl1888?locale=en_US - driver

https://forums.macrumors.com/threads/monterrey-and-hp-printers.2319676/:

#!/bin/bash

curl -o ~/Downloads/hpdrivers.dmg https://updates.cdn-apple.com/2020/macos/001-41745-20201210-DBC9B46B-88B2-4032-87D9-449AF1D20804/HewlettPackardPrinterDrivers.dmg

hdiutil attach ~/Downloads/hpdrivers.dmg

pkgutil --expand /Volumes/HP_PrinterSupportManual/HewlettPackardPrinterDrivers.pkg ~/Downloads/hp-expand

hdiutil eject /Volumes/HP_PrinterSupportManual

sed -i '' 's/12.0/13.0/' ~/Downloads/hp-expand/Distribution

pkgutil --flatten ~/Downloads/hp-expand ~/Downloads/HP_Drivers_12.pkg

rm -R ~/Downloads/hp-expand


# recursevely download files from a computer that doesn't allow attach USB or AirPlay
python -m http.server 8001 # on the "server" where the files are, run from the directory where the files are

wget --recursive --no-parent http://website.com/directory/ # on the "client" to which you want to download the files

References

Expand…

Something here

Malware Lab Setup

Malware analysis should always be done with caution. Also, in order to trick the most sophisticated malware into executing, one needs to make it believable that malware is on a real host.

Python Tooling

Terminal Tricks

In this article I will be collecting usful tricks and tweaks with Terminal on macOS. Some or even most of them could run on other UNIX systems as well.