There are tools available to find the evidences but they have certain drawbacks. Every tool cannot do everything so to overcome that drawback. I have developed this automated tool and it is CLI based. It has 43 different modules for finding evidences.
Some Different Features :
1. Whirlpool hash calculation
2. Tiger hash calculation
3. Image-Metadata
4. File entropy calculation
5. Extract information on hardware configuration
6. File index number calculation
7. Hash Identification
8. Checking Disk Space
The tool has been developed using shell script because it allows us to program commands in chains and have the system execute them as a scripted event, just like batch files. They also allow far more useful functions, such as command substitution.
Tools and Technologies :
I have used many pre-installed commands of kali linux which makes it easy to use. As kali linux is mainly used for Penetration Testing and Digital Forensics, this tool is compatible with many Debian Flavours. There are many things that I have added/downloaded manually which helps in digital forensics investigation, thus making it easy for investigators.
Downloaded/Added Technologies :
1. ImageMagick – for extracting image metadata
2. Lshw – for extracting information on hardware configuration
3. Rockyou.txt File – for brute forcing the password files
Limitations :
1. Compatible with Ubuntu after downloading some dependencies
2. Not compatible with Windows
3. Not compatible with MacOS
Dependencies for Ubuntu :
How to install ?
Use command on terminal : sudo apt-get install
Example : sudo apt-get install imagemagick
1. Imagemagick
2. Hash-identifier
3. Hashdeep (if not available in ubuntu)
4. Lshw
5. Unshadow (if not available in ubuntu)
6. John (john-the-ripper)
7. Binwalk
8. Objdump
9. Volatility (if not available in ubuntu)
Best Compatible Debian Flavours :
1. Kali
2. BackBox
3. Parrot OS
4. BlackArch
5. Bugtraq
6. DEFT
7. Santoku
8. Pentoo
9. CAINE
10. Network Security Toolkit
12. Fedora Security Spin
13. ArchStrike
How to run :
1. Go to terminal and type the command git clone https://github.com/ShreyJerry333/DigitalEvidenceWalker.git
2. After Downloading type the command cd DigitalEvidenceWalker
3. Run the command chmod +x DigitalEvidenceWalker
4. Then type ./DigitalEvidenceWalker and press enter