Toolk Download

Toolk Description

"Tools to help examine NTFS for unauthorized activity."

Edit By BS Editor: The Forensic ToolKit contains several Win32 Command line tools that can help you examine the files on a NTFS disk partition for unauthorized activity. We built these tools to help us do our job, we hope they can help you as well. This tool OPEN SOURCE

Key Features

AFind is the only tool that lists files by their last access time without tampering the data the way that right-clicking on file properties in Explorer will. AFind allows you to search for access times Between certain time frames, coordinating this with logon info provided from NTLast, you can to begin determine user activity even if file logging has not been enabled.


HFind scans the disk for hidden files. It will find files that have either the hidden attribute set, or NT's unique and painful way of hiding things by using the directory/system attribute combination. This is the method that IE uses to hide data. HFind lists the last access times.

SFind scans the disk for hidden data streams and lists the last access times.

FileStat is a quick dump of all file and security attributes. It works on only one file at a time but this is usually sufficient.

Hunt is a quick way to see if a server reveals too much info via NULL sessions. you can free download Forensic Toolkit 2.0 now.

Toolk Keywords

toolkit, forensic, nsi, forensic toolkit

Toolk Related Software

• MicroWorld Anti Virus Toolkit
  MWAV Cleans viruses from registry,Memory, Disk,Startup Folders,Services
• fileWATCH
  A file change monitor. Used with BlackICE Defender.
• 
  A scriptable, server stress testing tool.
• RPCScan
  A utility that can quickly and accurately identify Microsoft operating systems
• SiteDigger
  SiteDigger 2.0 searches Google’s cache to look for vulnerabilities
• 
  A Recycle Bin Forensic Analysis Tool.
• SiteScope
  Foundstone�s SiteScope creates a site map
• SSLDigger
  SSLDigger v1.02 is a tool to assess the strength of SSL servers
• CookieDigger
  CookieDigger helps identify weak cookie generation
• 
  Command line port scanner.
• 
  Traceroute and Whois program.
• 
  A network admin utility for remotely detecting the most common DDoS programs.
• Carbonite
  Incident Response vs. Loadable Kernel Module Rootkits
• Hacme Books
  Foundstone Hacme Books is a learning platform for secure software development
• Hacme Shipping
  Foundstone Hacme Shipping is a web-based shipping application
• 
  An Internet Explorer activity forensic analysis tool.
• Toolk
  Tools to help examine NTFS for unauthorized activity.
• 
  Show information about Windows. Reveal passwords etc.
• 
  UDP packet sender utility.
• Attacker
  A TCP/UDP port listener.
• WSDigger
  WSDigger is a free open source tool
• Fpipe
  FPipe is a source port forwarder/redirector.
• 
  A scanner for the infamous Back Orifice program.
• Galleta
  A Internet Explorer Cookie Forensic Analysis Tool
• 
  NTLast is specifically targeted for serious security and IIS administration.
• PatchIt
  A binary file byte-patching program.
• 
  SNScan allows for the scanning of SNMP specific ports
• 
  Finds Ascii, Unicode and Resource strings in a file.
• 
  Remote Task Scheduler scanner
• IPv4Trace
  IPv4 fragment reassembly implementation.
• 
  Mydoom worm scanner
• Fport
  Identify unknown open ports and their associated applications
• FSCrack
  provide a graphical user interface (GUI) for access to most of JtR’s functions
• 
  Microsoft UPnP MS05-039 Vulnerability Detection Utility
• 
  A small, quick TCP service stress test tool.
• Vision
  Vision is a host based Forensic Utility
• CodeScout
  Foundstone CodeScout is a free tool
• CredDigger
  A tool that attempts to gather data to assist with penetration
• Hacme Bank
  Hacme Bank is designed to teach application developers
• 
  An update of the highly popular Windows port scanning tool, SuperScan.
• Foundstone CredDigger
  Foundstone CredDigger is a tool that attempts to gather data to assist
• 
  Cisco IOS IPv4 Remote Denial of Service Vulnerability Detection Utility
• MessengerScan
  Vulnerability Detection Utility with Advanced Immediate Protection Capability!
• HackPack
  Foundstone HackPack is a tool designed to aid security