deftcon 2012 - hunchbacked foremost hb4most
TRANSCRIPT
![Page 1: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/1.jpg)
DEFT Conference 2012
Hunchbacked ForemostHB4most
File carving made easy
Un'interfaccia grafica per i piu' utilizzatiprogrammi di ricerca di file
1.0.0
![Page 2: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/2.jpg)
DEFT Conference 2012
Argomenti trattati
Introduzione a HB4most
File carving– Foremost– Scalpel– Altri tool
HB4most– Implementazione
La Banda Bassotti– Come ci siamo conosciuti– Progetti futuri: SQLite, text search, ...
![Page 3: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/3.jpg)
DEFT Conference 2012
File carving
Il carving consente la ricerca di file, anche cancellati o nascosti, da un disco o un'immagine
Foremost– Il piu' noto programma di carving– Sviluppato da agenti del Air Force Ofce of Special
Investigations e disponibile dal 2000– Permette di specificare il tipo di file da linea di
comandoScalpel
– Nasce come fork da foremost nel 2005– Spesso piu' veloce di foremost nella ricerca– Utilizza un file di configurazione come le prime
versioni di foremostAltri
– Sono disponibili molti altri programmi di carving, spesso specializzati su alcune tipologie di file (eg. PhotoRec)
![Page 4: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/4.jpg)
DEFT Conference 2012
foremost
![Page 5: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/5.jpg)
DEFT Conference 2012
scalpel
![Page 6: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/6.jpg)
DEFT Conference 2012
Hunchbacked Foremost (HB4most)
Hb4most e' un'interfaccia grafica semplice e multilingua ai due piu' difusi strumenti di carving: foremost e scalpel
Hb4most e' realizzata in Perl ed utilizza GTK
Hb4most implementa la quasi totali delle opzioni di foremost
Hb4most constente la semplice modifica del file di configurazione di scalpel
![Page 7: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/7.jpg)
DEFT Conference 2012
hb4most
hb4most si richiama dal menu DEFT - Carving tools
![Page 8: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/8.jpg)
DEFT Conference 2012
hb4most
![Page 9: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/9.jpg)
DEFT Conference 2012
hb4most
![Page 10: Deftcon 2012 - Hunchbacked Foremost HB4most](https://reader038.vdocuments.net/reader038/viewer/2022100602/558e02961a28ab786c8b4621/html5/thumbnails/10.jpg)
DEFT Conference 2012
Varie ed eventuali
Domande e risposte
Link utili
http://www.deftlinux.net/Sito ufficiale DEFT
by meo bogliolo