In the past, unfortunately, i had the misfortune to be in the needing of a tool for Digital Forensic.
And, as many other people, i stumbled across Autopsy. Autopsy is a very amazing tool that does it’s job in a incredible manner without problem and very easy to use.
But if you, like me, love Linux…then you might have encountered some troubles when trying to use Autopsy on your favourite Linux distro. And then saints, gods and what not comes heavily pronounced in not a very nice way.
At this day and age i have no idea if the installation has been “fixed” for the linux distros, but it’s not the topic of this post. Let’s see way i fell in love with IPED (Digital Evidence Processor and Indexer – translated from Portuguese)
An extract from the repo
Is a tool implemented in java and originally and still developed by digital forensic experts from Brazilian Federal Police since 2012. Although it was always open source, only in 2019 its code was officially published.
Since the beginning, the goal of the tool was efficient data processing and stability. Some key characteristics of the tool are:
- Command line data processing for batch case creation
- Multiplatform support, tested on Windows and Linux systems
- Portable cases without installation, you can run them from removable drives
- Integrated and intuitive analysis interface
- High multithread performance and support for large cases: up to 400GB/h processing speed using modern hardware and 135 million items in a (multi) case as of 12/12/2019
Currently IPED uses the Sleuthkit Library only to decode disk images and file systems, so the same image formats are supported: RAW/DD, E01, ISO9660, AFF, VHD, VMDK. There is also support for EX01, VHDX, UDF(ISO), AD1 (AccessData) and UFDR (Cellebrite) formats.
IPED – Readme file on GitHubG
JAVA !?
Well….nobody is perfect. I hate java too. But honestly ? This tool works so well that i don’t care about it at all !
(some) Key Features
- Supported hashes: md5, sha-1, sha-256, sha-512 and edonkey. PhotoDNA is also available for law enforcement (please contact iped at pf dot gov dot br)
- Supported hash sets: NIST NSRL, NIST CAID, ProjectVIC, Interpol ICSE, standard CSV format
- Fast hash deduplication
- Signature analysis
- Categorization by file type and properties
- Recursive container expansion of dozens of file formats
- Embedded forensic/virtual disks expansion: supports splitted or single segment DD, E01, EX01, VHD, VHDX, VMDK (differential VMDKs are also supported)
- Image and video gallery for hundreds of formats
- Georeferencing of GPS data, using Google Maps, Bing or OpenStreetMaps
- Regex searches with optional script validation for credit cards, emails, urls, ip & mac addresses, money values, bitcoin, ethereum, monero, ripple wallets and more…
- Embedded hex, unicode text, metadata and native viewers
- File content and metadata indexing and fast searching, including unknown files and unallocated space
- Efficient data carving engine (takes < 10% processing time) that scans much more than unallocated, with support for +40 file formats, including videos, extensible by scripting
- Optical Character Recognition powered by tesseract 5
- Encryption detection for known formats and using entropy test
- Processing profiles: forensic, pedo (csam), triage, fastmode (preview) and blind (for automatic data extraction)
- Detection for +70 languages
- Named Entity Recognition (needs Stanford CoreNLP models to be downloaded)
- Customizable filters based on any file metadata
- Similar document search with configurable threshold
- Similar image search, using internal or external image
- Similar face recognition, optimized to run without GPU, with configurable threshold
- Unified table timeline view and event filtering for timeline analysis
- Powerful file grouping (clustering) based on ANY metadata
- Support for multicases up to 135 million items
- Extensible with javascript and python (including cpython extensions) scripts
- External command line tools integration for file decoding
- Browser history for IE, Edge, Firefox, Chrome and Safari
- Custom parsers for Emule, Shareaza, Ares, WhatsApp, Skype, Telegram, Bittorrent, ActivitiesCache, and more…
- Fast nudity detection for images and videos using random forests algorithm (thanks to its author @tc-wleite)
- Nudity detection using Yahoo open-nsfw deeplearning model (needs keras and tensorflow)
- Audio Transcription, local and remote implementations with Azure and Google Cloud services
- Graph analysis for communications (calls, emails, instant messages…)
- Stable processing with out-of-process file system decoding and file parsing
- Resuming or restarting stopped or aborted processing (–continue/–restart options)
- Web API for searching remote cases, get file metadata, raw content, decoded text, thumbnails and posting bookmarks
- Creation of bookmarks/tags for interesting data
- HTML, CSV reports and portable cases with tagged data
Where to get it / How to Install
Well, if you are in a rush
$ git clone https://github.com/sepinf-inc/IPED.git
$ cd IPED
$ mvn clean install
Useless to say that you need to have installed:
- Java JDK 11 + JavaFX (or OpenJDK 11 Full JDK)
- git
- maven
As always, if you can show your love to the authors and leave them a star !
Here’s the address: https://github.com/sepinf-inc/IPED
