Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have to find information that can be located in files on a hard drive. Are there good tools to search for specific keywords (even in the hard disk free space area ;-), detect encrypted files, detect wrong filetype, etc.?

I currently use Windirstat to see all the filetypes and open each one manually. This process is very long and not reliable.

Can someone provide a better method?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Just running commands isn't really an option, I suggest you have a look at this website: http://www.lnx4n6.be/

It is a project of the Belgian Federal Computer Crime Unit. They have a linux live disk with digital forensics tools. In the presentations you can find tutorials on how to find things. Even on hidden space that is not reported by your hard disk (e.g. replace firmware of 1 TB hard disk to report as 750 GB hard disk).

Be aware it you need to check that every file is the file it pretends to be and every file's slackspace.

For keywords what you could do, provided the disk is not encrypted:

  • get a binary copy of the disk, lets call it usbkey.dd
  • make a list of keywords like and call it keywords.txt:

You then cat the usbkey, pipe it to strings and grep for the keywords in keywords.txt as so:

cat usbkey.dd | strings | egrep -i -f keywords.txt

If you want to know the position on the key of the file:

cat usbkey.dd | strings -tx | egrep -i -f keywords.txt

The -tx in strings will give you the hexadecimal offset.

I suggest you take a look at the forensics presentation on their website, because as I said there is a lot more to it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.