# Forensics

> Use for memory analysis, disk forensics, steganography, file carving, log analysis.

- Author: pf
- Repository: agnusdei1207/pentesting
- Version: 20260207152157
- Stars: 0
- Forks: 0
- Last Updated: 2026-02-07
- Source: https://github.com/agnusdei1207/pentesting
- Web: https://mule.run/skillshub/@@agnusdei1207/pentesting~Forensics:20260207152157

---

---
name: Forensics
description: Use for memory analysis, disk forensics, steganography, file carving, log analysis.
version: 1.0.0
---

# Forensics

## First Pass Analysis

```bash
file unknown_file
strings unknown_file | grep -iE "flag|password|secret|key"
exiftool unknown_file
binwalk unknown_file
xxd unknown_file | head
```

## Steganography

### Images
```bash
# Always try these first
steghide extract -sf image.jpg -p ""   # Empty password
strings image.jpg | grep -i flag
exiftool -a image.jpg
binwalk -e image.jpg

# PNG specific
zsteg image.png
pngcheck -v image.png

# Brute force
stegseek image.jpg rockyou.txt
```

### Audio
```bash
# Spectrogram (Audacity/Sonic Visualiser)
# DTMF tones
# Hidden in metadata: exiftool audio.mp3
```

### PDF
```bash
pdftotext doc.pdf
binwalk doc.pdf
strings doc.pdf | grep -i flag
# Check for JavaScript, embedded files
```

## Memory Forensics

```bash
# Volatility 3
vol3 -f dump.raw windows.info
vol3 -f dump.raw windows.pslist
vol3 -f dump.raw windows.pstree
vol3 -f dump.raw windows.cmdline
vol3 -f dump.raw windows.filescan | grep -i flag
vol3 -f dump.raw windows.hashdump
vol3 -f dump.raw windows.netscan

# Dump file
vol3 -f dump.raw windows.dumpfiles --physaddr 0x...
```

## Disk Forensics

```bash
# Mount read-only
sudo mount -o loop,ro image.dd /mnt/

# Sleuth Kit
mmls image.dd       # Partitions
fls -r image.dd     # List files
icat image.dd 12345 # Extract by inode

# Deleted file recovery
photorec image.dd
foremost image.dd
```

## Network (PCAP)

```bash
# Quick analysis
tshark -r capture.pcap -Y "http" -T fields -e http.request.uri
tshark -r capture.pcap -z follow,tcp,ascii,0

# Extract files
binwalk capture.pcap
foremost capture.pcap

# Find credentials
tshark -r capture.pcap -Y "http.request.method==POST"
```

## Quick Wins

- Check file extension vs magic bytes
- Metadata (EXIF GPS, author, timestamps)
- Alternate data streams (Windows: dir /r)
- Deleted files in .Trash, $Recycle.Bin
- Browser history, cookies
- Slack space, unallocated clusters