Here is a list of tools that we created over time. For more information about the actual implementation or collaboration, see the corresponding publication (c+p the title(s) into the search):
mrsh & co.
| mrsh_cuckoo (last update 2015/04/10) |
is a similiartiy hashing / approximate matching tool equal to mrsh-net but uses Cuckoo filter instead of Bloom filter. This increases runtime efficiency and needs less memory. How Cuckoo Filter Can Improve Existing Approximate Matching Techniques. In: James, Joshua I.; Breitinger, Frank (Ed.): Digital Forensics and Cyber Crime, pp. 39-52, Springer International Publishing, 2015, ISBN: 978-3-319-25511-8, (bf Best Paper Award). |
| mrsh_net (last update 2014/11/12) |
is the network implementation of mrsh-v2 which has a single huge Bloom filter for the signature. File Detection On Network Traffic Using Approximate Matching. In: Journal of Digital Forensics, Security and Law (JDFSL), vol. 9, no. 2, pp. 23–36, 2014, (bf Best Paper Award). |
| mrsh_v2.0 (last update 2013/10/04) |
is the original similarity hashing tool that allows to compares files / folders with each other. Similarity Preserving Hashing: Eligible Properties and a New Algorithm MRSH-v2. In: Rogers, Marcus; Seigfried-Spellar, KathrynC. (Ed.): Digital Forensics and Cyber Crime, pp. 167-182, Springer Berlin Heidelberg, 2013, ISBN: 978-3-642-39890-2. |
Further tools & data
| FRASH_v1.01 (last update 2013/02/19) |
is a testing framework for approximate matching algorithms. Special thanks to Georgios Stivaktakis for the development and Edward Raff for the installations instructions. FRASH: A Framework to Test Algorithms of Similarity Hashing. In: Digit. Investig., vol. 10, pp. S50–S58, 2014, ISSN: 1742-2876. |
| Tool x86 / Tool x64 (last update 2013/02/19) |
an application that allows direct network-based communication with the Programable Logic Controller GE Fanuc Series 90-30 (no intermediate server is needed). Note, in contrast to what is mentioned in the publication, we removed the write functionality for security reasons. Leveraging the SRTP protocol for over-the-network memory acquisition of a GE Fanuc Series 90-30. In: Digital Investigation, vol. 22, Supplement, pp. S26 - S38, 2017, ISSN: 1742-2876. |
| Timeline2GUI-Tool
Training Cases |
Timelin2GUI Tool and the training cases (three test cases to practice Log2Timeline). To check for updates, please see the corresponding github page. Timeline2GUI: A Log2Timeline CSV parser and training scenarios. In: Digital Investigation, vol. 28, pp. 34 - 43, 2018, ISSN: 1742-2876. |
| Digital Forensics Tool Table (last update 2020/06/11) |
is a list of forensics tools identified while reviewing almost 800 research articles from various digital forensic venues (2014-2019). Digital forensic tools: Recent advances and enhancing the status quo. In: Forensic Science International: Digital Investigation, vol. 34, pp. 300999, 2020, ISSN: 2666-2817. |
| Estimate Levenshtein Distance (last update 2021/10/14) |
is a tool (written in GoLang) that can estimate the Levenshtein Distance (LD) between two or more documents and is significantly faster than the original LD as it works on compressed signatures. |