DOCSLIB.ORG

Belkasoft Evidence Center 3.0 Simplifies Forensic Investigations with Automatic Porn Detection and Mac Support

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Belkasoft Evidence Center 3.0 Simplifies Forensic Investigations with Automatic Porn Detection and Mac Support For immediate release Aug 23, 2011 Belkasoft http://belkasoft.com [email protected] Belkasoft Evidence Center 3.0 Simplifies Forensic Investigations with Automatic Porn Detection and Mac Support Belkasoft announcing a major upgrade to its flagship forensic product, Belkasoft Evidence Center. The new version 3.0 adds picture and video support, enabling forensic investigators to run automated searches for images and video footage containing people’s faces or pornographic content. Version 3.0 also adds the ability to investigate Mac disks, including the support for 12 most popular instant messengers running on the Apple MacOS platform. Automated Face Search and Porn Detection in Still Images and Videos In addition to instant messenger, email and chat support, Belkasoft Evidence Center 3.0 can now discover and analyze still images and video files. Automatic face detection allows near-instant discovery of all media containing recognizable persons, while the newly added porn detector locates still and video files of pornographic nature. In addition, the text detection feature discovers images with text information in them. Sophisticated neural network techniques are employed to provide quick, surefooted discovery with less than 5% of false negatives and about 16% of false positive detections. MacOS Support Thanks to the newly added Mac format support, Belkasoft Evidence Center can now successfully mount and analyze disks formatted with HFS and HFS+ file systems. Physical drives and disk images made with drive imaging tools such as Encase, SMART and DD are supported. Existing and deleted conversations can then be successfully extracted. Support for the following twelve instant messengers running under MacOS has been added: Adium, AIM, Brosix, Fire, iChat, ICQ, InstantBird, Mail.Ru Agent, Mercury, Nimbuzz, Trillian, and Yahoo! Messenger. Additional Enhancements A wide range of smaller extra enhancements have been incorporated into Belkasoft Evidence Center, improving the product’s ability to deal with large and unusual email databases, adding support for new email clients and instant messenger applications, and improving support of certain social networks and online email services. The complete list of news and enhancements is available at http://forensic.belkasoft.com/en/bec/en/Whats_New_In_Version_3.0.asp . About Belkasoft Evidence Center At version 3.0, the company’s flagship computer forensic tool helps security and forensic specialists collect and analyze more digital evidence from PC and Mac computers than ever. Belkasoft Evidence Center will automatically locate, process and analyze Internet chat logs, Web browsing history and email communications including all stored passwords, cached forms, information stored in cookies and digital pictures, mailboxes and system files. Low-level access to hard disk and system structures means that even data that’s been deleted by a suspect cannot escape from investigators. The affordable Standard edition is available to private investigators and corporate security departments, while the more comprehensive Enterprise edition allows major security agencies and police departments to have multiple investigators work simultaneously on a case. Pricing and Availability Belkasoft Evidence Center 3.0 is available immediately. Pricing for Standard edition starts from $999.95, while the Enterprise edition is available for $9999.95. About Belkasoft Founded in 2002, Belkasoft is a software vendor specializing in computer forensics and IT security software. Running on the Microsoft Windows platform, Belkasoft products back the company’s "Forensics made easier" slogan, offering IT security experts and forensic investigators solutions that work right out of the box, without requiring a steep learning curve or any specific skills to operate. Along with the flagship Belkasoft Evidence Center, Belkasoft is also marketing Forensic IM Analyzer, Forensic Studio, Forensic Carver, Browser Analyzer and other products used in forensic investigations, law enforcement, intelligence, corporate security and parental control applications. Belkasoft solutions are used by government and commercial customers worldwide. The company’s clients include the FBI, U.S. Army, US Secret Service, multiple police departments in Germany, Norway, Australia, New Zealand and many other countries, PricewaterhouseCoopers, Ernst & Young and other Fortune 100 corporations. More information about the company and its products is available at http://belkasoft.com . # # # Belkasoft made the demo version available for free download at http://belkasoft.com/bec/en/Evidence_Center.asp .
Load more

Recommended publications
  • Instant Messaging: Keeping Your Child Safe and Secure
    Online Instant Messaging: Keeping Your Child Safe and Secure Presented by: Meredith Stannard, Nauset Regional High School [email protected] Barbara Dominic, Nauset Regional Middle School [email protected] Kathy Schrock, Nauset Public Schools [email protected] Spring 2003 1 Instant messages are lasting ©2001. USA Today. http://www.usatoday.com/tech/news/2001-06-21-teens-im-lasting.htm By Karen Thomas, USA TODAY Breaking up. Making up. Making plans. Asking out. Saying "hey." From the mundane to the emotionally charged, there are no limits to the ways today's kids connect and bond over instant messages (IMs) — those pop-up text windows used for carrying on real-time conversations online. "It's not just empty chatter. They're using (IMs) to have difficult conversations — someone's talking behind your back and you want to confront them," says Amanda Lenhart of the Pew Internet & American Life project. Its survey, out Thursday, finds that nearly three-fourths of online kids ages 12 to 17 rely on IMs to keep in touch with friends. Caroline Barker, 16, is among 35% of teens who use IMs daily; she chats with about 10 close friends and 50 acquaintances in the Bethesda, Md., area. "It's especially good for making plans, or if you're just bored," she says. "It's a given that everybody has it," adds her friend Valerie Hutchins, 15. These Maryland friends IM while doing homework, talking on the phone and watching TV. And they offer insight to the complex social rules that come with a form of communication that still has many adults bewildered.
    [Show full text]
  • Universidad Pol Facultad D Trabajo
    UNIVERSIDAD POLITÉCNICA DE MADRID FACULTAD DE INFORMÁTICA TRABAJO FINAL DE CARRERA ESTUDIO DEL PROTOCOLO XMPP DE MESAJERÍA ISTATÁEA, DE SUS ATECEDETES, Y DE SUS APLICACIOES CIVILES Y MILITARES Autor: José Carlos Díaz García Tutor: Rafael Martínez Olalla Madrid, Septiembre de 2008 2 A mis padres, Francisco y Pilar, que me empujaron siempre a terminar esta licenciatura y que tanto me han enseñado sobre la vida A mis abuelos (q.e.p.d.) A mi hijo icolás, que me ha dejado terminar este trabajo a pesar de robarle su tiempo de juego conmigo Y muy en especial, a Susana, mi fiel y leal compañera, y la luz que ilumina mi camino Agradecimientos En primer lugar, me gustaría agradecer a toda mi familia la comprensión y confianza que me han dado, una vez más, para poder concluir definitivamente esta etapa de mi vida. Sin su apoyo, no lo hubiera hecho. En segundo lugar, quiero agradecer a mis amigos Rafa y Carmen, su interés e insistencia para que llegara este momento. Por sus consejos y por su amistad, les debo mi gratitud. Por otra parte, quiero agradecer a mis compañeros asesores militares de Nextel Engineering sus explicaciones y sabios consejos, que sin duda han sido muy oportunos para escribir el capítulo cuarto de este trabajo. Del mismo modo, agradecer a Pepe Hevia, arquitecto de software de Alhambra Eidos, los buenos ratos compartidos alrrededor de nuestros viejos proyectos sobre XMPP y que encendieron prodigiosamente la mecha de este proyecto. A Jaime y a Bernardo, del Ministerio de Defensa, por haberme hecho descubrir las bondades de XMPP.
    [Show full text]
  • Business-To-Government Malware”
    HACKINGTEAM AND GAMMA INTERNATIONAL IN “BUSINESS-TO-GOVERNMENT MALWARE” Sergey @k1k Golovanov, Malware Expert Kaspersky Lab MAIL_TO:[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] ... DATE_TIME: 24.07.2012 5:52:00 ATTCH: AbodeFlashPlayer.zip (~1M) TEXT: From: Kev http://www.slate.com/blogs/future_tense/2012/08/20/moroccan_websi te_mamfakinch_targeted_by_government_grade_spyware_from_hac king_team_.html http://www.bloomberg.com/photo/security- researcher-morgan-marquis-boire- /214749.html HOW WE CAN BE SURE THAT IT IS HACKINGTEAM? Remote Control System (RCS) http://www.hackingteam.it/index.php/remote-control-system HOW WE CAN BE SURE THAT IT IS HACKINGTEAM? https://www.virustotal.com/en/file/81e9647a3371568cddd0a4db597de8423179773d910 d9a7b3d945cb2c3b7e1c2/analysis/ hxxp://rcs-demo.hackingteam.it/***ploit.doc2 HOW WE CAN BE SURE THAT IT IS HACKINGTEAM? /Users/guido/Projects/driver-macos/ WHAT CAN IT DO? http://wikileaks.org/spyfiles/files/0/31_200810-ISS-PRG- HACKINGTEAM.pdf WHAT CAN IT DO? 1.Self-replication via USB flash drive (3 methods) 2. Infection of virtual VMware machines by copying itself into the autorun folder on the virtual drive 3. Infection of mobile BlackBerry and Windows CE devices 4. Ability to self-update 5. Installation of drivers 6. Signed HOW IT IS PROPAGATING? 1.Social engineering: Self-signed JAR files Filenames like FlashUpdate.exe 2.
    [Show full text]
  • Openfire Service Level Agreement
    Service Level Agreement Technical Services — Communications Service University Technology Services 1. Overview This Service Level Agreement (SLA) is between University Technology Services (UTS) and either departments or groups choosing to utilize the internal Oakland University instant messaging (OUIM) service. The OUIM service is currently referenced by talk.oakland.edu and runs XMPP/Jabber software called Openfire. Under this SLA, UTS agrees to provide specific information technology (IT) services. This SLA also covers performance and reliability targets and objectives. Section 7 requires the signature and contact information of the group coordinator as an agreement to the SLA. OUIM is an online service that is available on campus and off campus. The requirements to utilize the service are a NetID, an XMPP client, and an Internet connection. XMPP clients are available online. The UTS Helpdesk supports the XMPP clients Spark, Pidgin, and Adium. Instructions are available on the UTS Web site at http://www.oakland.edu/?id=13849&sid=70. 2. Purpose The purpose of this SLA is to establish a cooperative partnership between UTS staff members with the community of customers who may opt into its use by clarifying roles, setting expectations, and providing service objectives and limitations. 3. Terms of Agreement This service is provided on an ongoing basis. From time to time, it may be reviewed and modified by UTS. Modifications to this agreement will be done at the sole discretion of UTS and the Technical Support and Services team (TSS). 4. Service Hours Regularly scheduled maintenance will be scheduled during low-use hours as much as possible; such work will be done either before 8:00 A.M.
    [Show full text]
  • Unpermitted Resources
    Process Check and Unpermitted Resources Common and Important Virtual Machines Parallels VMware VirtualBox CVMCompiler Windows Virtual PC Other Python Citrix Screen/File Sharing/Saving .exe File Name VNC, VPN, RFS, P2P and SSH Virtual Drives ● Dropbox.exe ● Dropbox ● OneDrive.exe ● OneDrive ● <name>.exe ● Google Drive ● etc. ● iCloud ● etc. Evernote / One Note ● Evernote_---.exe ● onenote.exe Go To Meeting ● gotomeeting launcher.exe / gotomeeting.exe TeamViewer ● TeamViewer.exe Chrome Remote ● remoting_host.exe www.ProctorU.com ● [email protected] ● 888­355­3043 ​ ​ ​ ​ ​ ​ ​ Messaging / Video (IM, IRC) / .exe File Name Audio Bonjour Google Hangouts (chrome.exe - shown as a tab) (Screen Sharing) Skype SkypeC2CPNRSvc.exe Music Streaming ● Spotify.exe (Spotify, Pandora, etc.) ● PandoraService.exe Steam Steam.exe ALL Processes Screen / File Sharing / Messaging / Video (IM, Virtual Machines (VM) Other Saving IRC) / Audio Virtual Box Splashtop Bonjour ● iChat ● iTunes ● iPhoto ● TiVo ● SubEthaEdit ● Contactizer, ● Things ● OmniFocuse phpVirtualBox TeamViewer MobileMe Parallels Sticky Notes Team Speak VMware One Note Ventrilo Windows Virtual PC Dropbox Sandboxd QEM (Linux only) Chrome Remote iStumbler HYPERBOX SkyDrive MSN Chat Boot Camp (dual boot) OneDrive Blackboard Chat CVMCompiler Google Drive Yahoo Messenger Office (Word, Excel, Skype etc.) www.ProctorU.com ● [email protected] ● 888­355­3043 ​ ​ ​ ​ ​ ​ ​ 2X Software Notepad Steam AerooAdmin Paint Origin AetherPal Go To Meeting Spotify Ammyy Admin Jing Facebook Messenger AnyDesk
    [Show full text]
  • Case No COMP/M.6281 - MICROSOFT/ SKYPE
    EN Case No COMP/M.6281 - MICROSOFT/ SKYPE Only the English text is available and authentic. REGULATION (EC) No 139/2004 MERGER PROCEDURE Article 6(1)(b) NON-OPPOSITION Date: 07/10/2011 In electronic form on the EUR-Lex website under document number 32011M6281 Office for Publications of the European Union L-2985 Luxembourg EUROPEAN COMMISSION Brussels, 07/10/2011 C(2011)7279 In the published version of this decision, some information has been omitted pursuant to Article MERGER PROCEDURE 17(2) of Council Regulation (EC) No 139/2004 concerning non-disclosure of business secrets and other confidential information. The omissions are shown thus […]. Where possible the information omitted has been replaced by ranges of figures or a general description. PUBLIC VERSION To the notifying party: Dear Sir/Madam, Subject: Case No COMP/M.6281 - Microsoft/ Skype Commission decision pursuant to Article 6(1)(b) of Council Regulation No 139/20041 1. On 02.09.2011, the European Commission received notification of a proposed concentration pursuant to Article 4 of the Merger Regulation by which the undertaking Microsoft Corporation, USA (hereinafter "Microsoft"), acquires within the meaning of Article 3(1)(b) of the Merger Regulation control of the whole of the undertaking Skype Global S.a.r.l, Luxembourg (hereinafter "Skype"), by way of purchase of shares2. Microsoft and Skype are designated hereinafter as "parties to the notified operation" or "the parties". I. THE PARTIES 2. Microsoft is active in the design, development and supply of computer software and the supply of related services. The transaction concerns Microsoft's communication services, in particular the services offered under the brands "Windows Live Messenger" (hereinafter "WLM") for consumers and "Lync" for enterprises.
    [Show full text]
  • Novell Messenger 3.0 May 2015
    Novell Messenger 3.0 May 2015 1Overview The information in this Readme file pertains to Novell Messenger 3.0. Novell Messenger 3.0 offers enhanced functionality over prior Messenger versions: Mobile Applications: Novell Messenger 3.0 provides native applications for iOS, Android, and BlackBerry devices. For more information, see “Using Novell Messenger on Your Mobile Device” in the Novell Messenger 3.0 Client User Guide. For information about the administrative tasks associated with Messenger mobile applications, see “Managing Messenger Mobile Applications” in the Novell Messenger 3.0 Administration Guide. Simultaneous Client Connections: Novell Messenger 3.0 allows you to maintain simultaneous connections to your Messenger system from multiple workstations or devices. For example, you can be connected to Messenger on your workstation, and then connect to Messenger from a mobile device without being logged out of Messenger on your workstation. For more information about this feature, see “Limiting Physical Access to Client Workstations” in “Securing Novell Messenger” in the Novell Messenger 3.0 Administration Guide. Update Clients (Look and Feel): Novell Messenger 3.0 provides an updated look and feel for both the Windows and Linux/Mac client interfaces. The Messenger 3.0 release also contains the following changes: Removal of NetWare support: With Messenger 3.0 and later, NetWare is no longer supported. ConsoleOne download option: If you have not already installed ConsoleOne, it is available with the Messenger distribution. 2 System Requirements Novell Messenger 3.0 system requirements (including requirements for mobile devices) are listed in “Novell Messenger Hardware and Software Requirements” in the Novell Messenger 3.0 Installation Guide.
    [Show full text]
  • Forensic Artefacts Left by Pidgin Messenger 2.0
    digital investigation 4 (2007) 138–145 available at www.sciencedirect.com journal homepage: www.elsevier.com/locate/diin Forensic artefacts left by Pidgin Messenger 2.0 Wouter S. van Dongen Fox-IT Forensic IT Experts, Olof Palmestraat 6, 2616 LM Delft, The Netherlands article info abstract Article history: Pidgin, formerly known as Gaim, is a multi-protocol instant messaging (IM) client that sup- Received 23 July 2007 ports communication on most of the popular IM networks. Pidgin is chiefly popular under Revised 23 November 2007 Linux, and is available for Windows, BSD and other UNIX versions. This article presents Accepted 21 January 2008 a number of traces that are left behind after the use of Pidgin on Linux, enabling digital in- vestigators to search for and interpret instant messaging activities, including online con- Keywords: versations and file transfers. Specifically, the contents and structures of user settings, log Pidgin files, contact files and the swap partition are discussed. In addition looking for such infor- Gaim mation in active files on a computer, forensic examiners can recover deleted items by Instant messenger searching a hard drive for file signatures and known file structures detailed in this article. Internet chat ª 2008 Elsevier Ltd. All rights reserved. Linux messenger MSN ICQ Yahoo! IRC 1. Introduction Gaim would become Pidgin, libgaim would become libpurple, and gaim-text would become finch. The name Pidgin was cho- This article is a continuation of the series of articles dealing sen as a reference to the term ‘Pidgin’, which describes com- with artefacts left by popular instant messaging clients.
    [Show full text]
  • A User Study of Off-The-Record Messaging
    A User Study of Off-the-Record Messaging Ryan Stedman Kayo Yoshida Ian Goldberg University of Waterloo 200 University Avenue West Waterloo, Ontario, Canada N2L 3G1 {rstedman@cs, k2yoshid@math, iang@cs}.uwaterloo.ca ABSTRACT Keywords Instant messaging is a prevalent form of communication ac- OTR, Usable Security, Instant Messaging, Think Aloud ross the Internet, yet most instant messaging services pro- vide little security against eavesdroppers or impersonators. 1. INTRODUCTION There are a variety of existing systems that aim to solve There has been much research into creating privacy-en- this problem, but the one that provides the highest level hancing technologies, especially since the Internet has started of privacy is Off-the-Record Messaging (OTR), which aims to play an essential role in everyday life. However, not many to give instant messaging conversations the level of privacy of these technologies have seen widespread adoption. One available in a face-to-face conversation. In the most recent of the reasons for this is that many of these technologies redesign of OTR, as well as increasing the security of the provide insufficient usability [8]. protocol, one of the goals of the designers was to make OTR The process of evaluating and enhancing usability is im- easier to use, without users needing to understand details of portant in order for a privacy-enhancing technology to pro- computer security such as keys or fingerprints. vide benefits to ordinary users. Since privacy is not just To determine if this design goal has been met, we con- intended for computer scientists or cryptographers, but for ducted a user study of the OTR plugin for the Pidgin in- everyone, these technologies should be accessible to the gen- stant messaging client using the think aloud method.
    [Show full text]
  • Client-Side Name Collision Vulnerability in the New Gtld Era: a Systematic Study
    Session D5: Network Security CCS’17, October 30-November 3, 2017, Dallas, TX, USA Client-side Name Collision Vulnerability in the New gTLD Era: A Systematic Study Qi Alfred Chen, Matthew Thomas†, Eric Osterweil†, Yulong Cao, Jie You, Z. Morley Mao University of Michigan, †Verisign Labs [email protected],{mthomas,eosterweil}@verisign.com,{yulongc,jieyou,zmao}@umich.edu ABSTRACT was recently annouced (US-CERT alert TA16-144A), which specif- The recent unprecedented delegation of new generic top-level do- ically targets the leaked WPAD (Web Proxy Auto-Discovery) ser- mains (gTLDs) has exacerbated an existing, but fallow, problem vice discovery queries [79, 87]. In this attack, the attacker simply called name collisions. One concrete exploit of such problem was needs to register a domain that already receives vulnerable internal discovered recently, which targets internal namespaces and en- WPAD query leaks. Since WPAD queries are designed for discover- ables Man in the Middle (MitM) attacks against end-user devices ing and automatically conguring web proxy services, exploiting from anywhere on the Internet. Analysis of the underlying prob- these leaks allows the attacker to set up Man in the Middle (MitM) lem shows that it is not specic to any single service protocol, but proxies on end-user devices from anywhere on the Internet. little attention has been paid to understand the vulnerability status The cornerstone of this attack exploits the leaked service dis- and the defense solution space at the service level. In this paper, covery queries from the internal network services using DNS- we perform the rst systematic study of the robustness of internal based service discovery.
    [Show full text]
  • Implementing Reliable Instant Messaging at Your Library
    Implementing Reliable Instant Messaging at Your Library Karen McCoy Adult Services Librarian Farmington Public Library, NM Some background… More libraries are communicating with patrons in real time over the internet “Online real-time chat reference services have become increasingly prevalent in many types and sizes of libraries” (1). BUT… “Because no IM technology standard has been approved by all the major players, IM has long been problematic to libraries… but newer IM products can help resolve these dilemmas.”(2). 1. Kwon, Nahyun, & Gregory, Vicki L. (2007). The effects of librarians' behavioral performance on user satisfaction in chat reference services. Reference & User Services Quarterly. 47, 137-148, 137. 2. Rethlefsen, Melissa L. (Summer 2007). Product Pipeline. Netconnect, 14-16 Instant Messaging vs. Chat Software What’s the difference? Chat Software: fee-based, usually only used in businesses and libraries (usually part of a consortium to reduce cost) also referred to as “virtual reference” or “chat reference.” Instant Messaging: FREE to libraries and patrons, more often used by people in their daily lives, generally not platform dependent (1), more compatible in a Web 2.0 environment A recent trend in reference service seems to be a move from use of chat reference software to use of IM (2). 1. Johnson, Kris. “Pros & Cons of IM/SMS Virtual Reference.” NMLA/MPLA Presentation. March, 2007 2. Naylor, Sharon, Stoffel, Bruce, & Van Der Laan, Sharon (2008). Why isn't our chat reference used more? Reference & User Services Quarterly.
    [Show full text]
  • Online Security for Independent Media and Civil Society Activists
    Online Security for Independent Media and Civil Society Activists A white paper for SIDA’s October 2010 “Exile Media” conference Eric S Johnson (updated 13 Oct 2013) For activists who make it a priority to deliver news to citizens of countries which try to control the information to which their citizens have access, the internet has provided massive new opportunities. But those countries’ governments also realise ICTs’ potential and implement countermeasures to impede the delivery of independent news via the internet. This paper covers what exile media can or should do to protect itself, addressing three categories of issues: common computer security precautions, defense against targeted attacks, and circumventing cybercensorship, with a final note about overkill (aka FUD: fear, uncertainty, doubt). For each of the issues mentioned below, specific ex- amples from within the human rights or freedom of expression world can be provided where non-observance was cata- strophic, but most of those who suffered problems would rather not be named. [NB Snowden- gate changed little or nothing about these recommendations.] Common computer security: The best defense is a good … (aka “lock your doors”) The main threats to exile media’s successful use of ICTs—and solutions—are the same as for any other computer user: 1) Ensure all software automatically patches itself regularly against newly-discovered secu- rity flaws (e.g. to maintain up-to-date SSL certificate revocation lists). As with antivirus software, this may cost something; e.g. with Microsoft (Windows and Office), it may re- quire your software be legally purchased (or use the WSUS Offline Update tool, which helps in low-bandwidth environments).
    [Show full text]