Hey everyone here we are in our final video documentation and reporting tools.
Previously we introduced the reporting phase.
We're going to take a look at two documentation and reporting tools included by default on Kelly Linux
which are Keep note and Dreyfus will cover how to write a report having analyzed an image with autopsy
Kelly Linux among all the several tools for penetration testing and digital forensics couldn't miss
documentation and reporting tools that are also grouped under the Applications menu.
Two tools in particular deserves our attention.
Keep note and gradus.
Previously we said that to write a report it's important to take notes and document all the steps of
the analysis.
Keep note is a cross-platform program written in Python that can help us in this task.
It supports hierarchical organizations for nodes.
We can create a notebook for each case then create new folders and new documents in text or Office formats
like text.
Excel less and doc files.
Keep note also supports file attachments.
Clicking on edit attach file.
A more complete tool for documentation and reporting is Dreyfus.
It's an open source framework for collaboration and information sharing.
Though it's more targeted to penetration testers to digital forensic examiners greatest is a self-contained
web application that provides a centralized repository of info.
It's particularly useful when the digital forensic analysis is conducted by a team to execute Dreyfus.
We first have to start the relative service in a terminal with the command service a start then click
on applications reporting tools Gradus Here's a browser window connecting to the U r l h t s colon slash
slash local host colon.
3000 is open three thousand is the default port on which the greatest service is listening.
When running the program for the first time it's necessary to set up the password that we'll use for
subsequent logons we execute the logon and enter in the web interface.
We notice that we can hierarchically organized notes creating a new top level node for a new case then
add sub notes that could contain notes evidence and attachments.
We can also upload output files from other tools like métis plight Nisus and map an open boss and also
upload files from our local workstations.
We can also export results in CXXVI and HTL formats.
Awesome.
In this section the autopsy forensic suite we've seen how to use autopsy to conduct a bold forensic
analysis of an image.
Now we show how to use this valuable tool to help us generate a report when the analysis is complete.
For example we assume having open the case that we have analyzed in video analyzing a Windows image
with autopsy for to create a report we click on generate report button.
We could choose between different types of formats for example.
H.T. M-L Xcel and plain text file we select HVM Mehl and click on next we could choose to include all
the results or only tagged results in the report.
We can also select the artifact types to include in the report.
Here we choose to include all the artifacts in the report and click on Benish to generate the report
and wait until the report is created when it's generated we could click on the link and open it in a
web browser we could view all the artifact grouped by category as we would do in the autopsy program
itself.
This is another useful feature provided by the autopsy forensic suite.
Great job in this section we covered the reporting phase which is the last stage of the digital forensic
process highlighting its importance and the bases that comprise it.
We've covered some reporting tools included in the Kelly lyrics and explain how to produce a report
when analyzing a forensic image with autopsy.
Well since this is the last section we've come to the end of our journey into digital forensics with
Kelly Linux distribution.
To summarize we started an intro to digital forensic and the practical guide about the installation
of Kallio when it's on a VM.
We covered the acquisition base using both the command line tools DC 3D particularly and the why tools
like Guy major.
Then we covered the analysis face of the window system image extracting and analyzing various artifacts.
For example file meta data registry hives Internet artifact files and timestamps.
The rich sets of tools provided by Kalli Linux.
We also sell how to use specialized tools to carve Biles also recover deleted data and how to use autopsy
a forensic suite to analyze both Windows and Android images.
We covered acquisition RAM memory and its analysis with volatility framework.
Another topic is the capture and analysis of network traffic with wireshark.
Finally we explained the reporting base and presented the tools for documentation and reporting installed
on Kalli Linux in this course we've used Kelly Linux as a forensic platform but if you prefer using
our Linux based forensic distribution this course is valid in the same way as almost all the open source
tools it covers and also installed on our dedicated Linux distribution.
Hopefully this course has been helpful to you in getting started or improving your skills in digital
forensics.
Thank you so much for attending.
Take care.