diff --git a/Help/Docker_4_Digital_Forensics.pptx b/Help/Docker_4_Digital_Forensics.pptx new file mode 100644 index 0000000..8843019 Binary files /dev/null and b/Help/Docker_4_Digital_Forensics.pptx differ diff --git a/Help/scripts/docker/Dockerfile b/Help/scripts/docker/Dockerfile index 66d0602..4f456ce 100644 --- a/Help/scripts/docker/Dockerfile +++ b/Help/scripts/docker/Dockerfile @@ -2,6 +2,9 @@ FROM ubuntu:22.04 LABEL author=Chimezie +# Set environmental variable to store installation summary + + # Forces the selection of US Eastern Standard time Zone. ENV TZ=US/Eastern \ DEBIAN_FRONTEND=noninteractive @@ -31,7 +34,8 @@ RUN sudo dpkg --add-architecture i386 \ && dpkg --add-architecture amd64 \ && apt-get update \ && apt-get install -y --no-install-recommends wine32 \ - && apt-get install --no-install-recommends --assume-yes wine + && apt-get install --no-install-recommends --assume-yes wine + ENV DISPLAY :0 # Install other packages @@ -51,24 +55,28 @@ RUN sudo apt -y install python3-pip \ # Install pff-tools RUN sudo apt-get update \ - && sudo apt-get -y install pff-tools + && sudo apt-get -y install pff-tools + # Install libesedb-utils RUN sudo apt-get update \ - && sudo apt-get -y install libesedb-utils + && sudo apt-get -y install libesedb-utils + # Install liblnk-utils RUN sudo apt-get update -RUN sudo apt-get install -y liblnk-utils || { echo 'Package installation failed'; exit 1; } +RUN sudo apt-get install -y liblnk-utils || { echo 'Package installation failed'; exit 1; } + # Install usncarve -RUN sudo sudo apt-get update \ - && pip install usncarve +RUN sudo sudo apt-get update \ + && pip install usncarve + # Install usnparser RUN sudo apt-get update \ - && pip install usnparser - + && pip install usnparser + # Install RegRipper WORKDIR /tools @@ -94,7 +102,7 @@ RUN dos2unix /tools/RegRipper30/RegRipper30-apt-git-Install.sh RUN chmod +x /tools/RegRipper30/RegRipper30-apt-git-Install.sh # Run the installer script -RUN /tools/RegRipper30/RegRipper30-apt-git-Install.sh +RUN /tools/RegRipper30/RegRipper30-apt-git-Install.sh # Add RegRipper to the PATH ENV PATH="/tools/RegRipper30:$PATH" @@ -103,8 +111,7 @@ ENV PATH="/tools/RegRipper30:$PATH" # Install Vinetto for Thumbcache # Install Vinetto RUN sudo apt-get update \ - && sudo apt-get -y install vinetto - + && sudo apt-get -y install vinetto # Install time_decode # Set the working directory @@ -119,6 +126,7 @@ RUN git clone https://github.com/digitalsleuth/time_decode.git tools/time_decode # Move the time_decode.py script to /usr/local/bin RUN mv tools/time_decode/time_decode/time_decode.py /usr/local/bin/ + # Set the working directory to the lab directory WORKDIR /tools/lab @@ -134,8 +142,8 @@ RUN sudo sh -c 'mv tools/INDXParse/*.py /usr/local/bin/.' # Clone the INDXParse repository RUN sudo apt-get update \ - && git clone https://github.com/williballenthin/INDXParse.git - + && git clone https://github.com/williballenthin/INDXParse.git + # Install the required Python packages RUN sudo pip install construct @@ -147,7 +155,7 @@ RUN git clone https://github.com/dkovar/analyzeMFT.git analyzeMFT \ && cd analyzeMFT \ && apt-get update \ && apt-get install -y python3 \ - && python3 setup.py install + && python3 setup.py install # Install imgclip # Set the working directory @@ -156,9 +164,8 @@ WORKDIR /tools/lab # Update and install imgclip dependencies RUN sudo apt-get update \ && apt-get install -y npm \ - && npm install -g imgclip - - + && npm install -g imgclip + # Copy the necessary files to the container # Set the working directory to the location of the index.js file WORKDIR /usr/local/lib/node_modules/imgclip/node_modules/copy-paste @@ -172,7 +179,8 @@ RUN sed -i '58s/if(text?.pipe)/if(text \&\& pipe)/' /usr/local/lib/node_modules/ # Install libvshadow-alpha-20210425 # Update the package repository and install required dependencies RUN sudo apt-get update \ - && apt-get install -y libfuse-dev git autoconf automake autopoint libtool pkg-config + && apt-get install -y libfuse-dev git autoconf automake autopoint libtool pkg-config + # Download libvshadow @@ -189,7 +197,7 @@ RUN wget -q https://github.com/libyal/libvshadow/releases/download/20221030/libv RUN tar -xzf libvshadow-alpha-20221030.tar.gz # Cleanup unnecessary files -RUN rm libvshadow-alpha-20221030.tar.gz +RUN rm libvshadow-alpha-20221030.tar.gz # Change directory to libvshadow-20210425 WORKDIR /tools/libvshadow-20221030 @@ -227,7 +235,7 @@ WORKDIR /tools/python-evtx RUN sudo python3 setup.py install # Install windowsprefetch -RUN sudo pip install windowsprefetch +RUN sudo pip install windowsprefetch # Install undark for carving sqlite .db WORKDIR /tools @@ -329,7 +337,7 @@ RUN sudo apt-get install -y python3 python3-pip dwarfdump yara zip git RUN git clone https://github.com/volatilityfoundation/volatility3.git /tools/volatility3 # Install Volatility 3 dependencies -RUN sudo pip3 install -r /tools/volatility3/requirements.txt +RUN sudo pip3 install -r /tools/volatility3/requirements.txt # Add Volatility 3 to the PATH ENV PATH="/opt/volatility3:${PATH}" @@ -351,7 +359,7 @@ WORKDIR /tools/stego-toolkit/install RUN chmod +x /tools/stego-toolkit/install/jphide.sh # Run jphide.sh installation script -RUN /tools/stego-toolkit/install/jphide.sh +RUN /tools/stego-toolkit/install/jphide.sh # Install stegdetect # Set the working directory @@ -367,34 +375,143 @@ RUN wget -q https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/mai # Copy stegdetect and stegbreak binaries to /usr/bin RUN cp tools/stegdetect/stegdetect /usr/bin/. \ - && cp tools/stegdetect/stegbreak /usr/bin/. + && cp tools/stegdetect/stegbreak /usr/bin/. WORKDIR / # Verify installations -RUN wine --version -RUN imgclip -h -RUN pffexport -h -RUN esedbexport -h -RUN lnkinfo -h -RUN usncarve.py -h -RUN usn.py -h -RUN rip.pl -h -RUN vinetto -h -RUN time_decode.py -h -RUN prefetch.py -h -RUN evtx_dump.py -h -RUN INDXParse.py -h -RUN analyzeMFT.py -h -RUN vshadowinfo -h -RUN undark -h -RUN true || jphide -RUN true || jpseek -RUN vol.py -h -RUN stegdetect -V || true +RUN wine --version +RUN imgclip -h +RUN pffexport -h +RUN esedbexport -h +RUN lnkinfo -h +RUN usncarve.py -h +RUN usn.py -h +RUN rip.pl -h +RUN vinetto -h +RUN time_decode.py -h +RUN prefetch.py -h +RUN evtx_dump.py -h +RUN INDXParse.py -h +RUN analyzeMFT.py -h +RUN vshadowinfo -h +RUN undark -h +RUN true || jphide +RUN true || jpseek +RUN vol.py -h +RUN stegdetect -V || true RUN stegbreak -V || true -# Set the entry point or default command +# Set up environmental variables +ENV COLOR_GREEN='\e[1;32m' +ENV COLOR_RED='\e[1;31m' +ENV COLOR_RESET='\e[0m' + +# Create an installation report directory +WORKDIR /installation_report + + +# Run tools' help commands to check installation status +RUN wine --version | grep -iq "wine32,Wine64" &>/dev/null \ + && echo "${COLOR_GREEN}Tool wine: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool wine: Installation failed" >> /installation_report/installation_report.txt + +RUN imgclip -h | grep -iq "imgclip" &>/dev/null \ + && echo "${COLOR_GREEN}Tool imgclip: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool imgclip: Installation failed" >> /installation_report/installation_report.txt + +RUN pffexport -h | grep -iq "pff-tools" &>/dev/null \ + && echo "${COLOR_GREEN}Tool pff-tools: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool pff-tools: Installation failed" >> /installation_report/installation_report.txt + +RUN esedbexport -h | grep -iq "libesedb-utils" &>/dev/null \ + && echo "${COLOR_GREEN}Tool libesedb-utils: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool libesedb-utils: Installation failed" >> /installation_report/installation_report.txt + +RUN lnkinfo -h | grep -iq "liblnk-utils" &>/dev/null \ + && echo "${COLOR_GREEN}Tool liblnk-utils: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool liblnk-utils: Installation failed" >> /installation_report/installation_report.txt + +RUN usncarve.py -h | grep -iq "usncarve" &>/dev/null \ + && echo "${COLOR_GREEN}Tool usncarve: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool usncarve: Installation failed" >> /installation_report/installation_report.txt + +RUN usn.py -h | grep -iq "usnparse" &>/dev/null \ + && echo "${COLOR_GREEN}Tool usnparse: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool usnparse: Installation failed" >> /installation_report/installation_report.txt + +RUN rip.pl -h | grep -iq "RegRipper30" &>/dev/null \ + && echo "${COLOR_GREEN}Tool RegRipper30: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool RegRipper30: Installation failed" >> /installation_report/installation_report.txt + +RUN vinetto -h | grep -iq "vinetto" &>/dev/null \ + && echo "${COLOR_GREEN}Tool vinetto: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool vinetto: Installation failed" >> /installation_report/installation_report.txt + +RUN prefetch.py -h | grep -iq "windowsprefetch" &>/dev/null \ + && echo "${COLOR_GREEN}Tool windowsprefetch: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool windowsprefetch: Installation failed" >> /installation_report/installation_report.txt + +RUN time_decode.py -h | grep -iq "time_decoder" &>/dev/null \ + && echo "${COLOR_GREEN}Tool time_decoder: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool time_decoder: Installation failed" >> /installation_report/installation_report.txt + +RUN evtx_dump.py -h | grep -iq "evtx_dump" &>/dev/null \ + && echo "${COLOR_GREEN}Tool evtx_dump: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool evtx_dump: Installation failed" >> /installation_report/installation_report.txt + +RUN INDXParse.py -h | grep -iq "INDXParser" &>/dev/null \ + && echo "${COLOR_GREEN}Tool INDXParser: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool INDXParser: Installation failed" >> /installation_report/installation_report.txt + +RUN analyzeMFT.py -h | grep -iq "analyzeMFT" &>/dev/null \ + && echo "${COLOR_GREEN}Tool analyzeMFT: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool analyzeMFT: Installation failed" >> /installation_report/installation_report.txt + +RUN vshadowinfo -h | grep -iq "libvshadow" &>/dev/null \ + && echo "${COLOR_GREEN}Tool libvshadow: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool libvshadow: Installation failed" >> /installation_report/installation_report.txt + +RUN undark -h | grep -iq "undark" &>/dev/null \ + && echo "${COLOR_GREEN}Tool lundark: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool undark: Installation failed" >> /installation_report/installation_report.txt + +RUN true || jphide | grep -iq "undark" &>/dev/null \ + && echo "${COLOR_GREEN}Tool jphide: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool jphide: Installation failed" >> /installation_report/installation_report.txt + +RUN true || jpseek | grep -iq "jpseek" &>/dev/null \ + && echo "${COLOR_GREEN}Tool jpseek: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool jpseek: Installation failed" >> /installation_report/installation_report.txt + +RUN vol.py -h | grep -iq "jpseek" &>/dev/null \ + && echo "${COLOR_GREEN}Tool volatilty2, volatility3: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Toolvolatilty2, volatility3: Installation failed" >> /installation_report/installation_report.txt + +RUN stegdetect -V || true | grep -iq "jpseek" &>/dev/null \ + && echo "${COLOR_GREEN}Tool stegdetect: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool stegdetect: Installation failed" >> /installation_report/installation_report.txt + +RUN stegbreak -V || true | grep -iq "stegbreak" &>/dev/null \ + && echo "${COLOR_GREEN}Tool stegbreak: Installation successful" >> /installation_report/installation_report.txt \ + || echo "${COLOR_RED}Tool stegbreak: Installation failed" >> /installation_report/installation_report.txt + +# Display the installation report +RUN cat /installation_report/installation_report.txt + +# Installation summary report +# Display summary information + +# Copy the script into the current directory +# COPY entrypoint.sh . + +# Make the script executable +# RUN chmod +x entrypoint.sh + +# Execute the script +# RUN /entrypoint.sh + +# Mount an inteactive terminal when container starts CMD ["/bin/bash"] # End of the Dockerfile diff --git a/README.md b/README.md index e5be65a..658a6d8 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository - + ### Features of Repository @@ -35,7 +35,7 @@ or in BibTeX --- -## Table of Contents (Added: AI for Forensics - Identifying IPs with a Fine-tuned Model, 8/2023) +## Table of Contents (Newly Added: 1. AI for Forensics - Identifying IPs with a Fine-tuned Model, 2. Docker for Digital Forensics, 09/2023) - Basic Computer Skills for Digital Forensics @@ -84,7 +84,7 @@ or in BibTeX - AI for Forensics - [Identifying IP Addresses using a Fine-tuned AI Model](/AI4Forensics/IP_Identifier_Fine_Tuning/IP_Identifer_Fine_Tuning.pptx) -## Tool Installation (newly added on 12/6/2021) +## Tool Installation ### Method 1: Importing customized Kali VM image @@ -101,7 +101,7 @@ The following script will install tools needed for completing most of the labs l - Install [Kali 2021.4](http://old.kali.org/kali-images/kali-2021.4/). Notes: Suggest You configure the disk size of Kali VM 80G because the size of each leakage cases image is 30G+ -- How to run the installation script [instructions](https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/Tool_installation.pptx), or you can simply follow the commands below +- Run a tool installation script [instructions](https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/Tool_installation.pptx), or you can simply follow the commands below ``` wget https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh @@ -111,6 +111,13 @@ chmod +x tool-install-zsh.sh - Installed [tools](#Tools). Note that most of the commands for tools can executed globally. Now you can skip most of tool installation steps in PPTs. +### Method 3: Using a Docker container based on Ubuntu 22.04 LTS (added in 09/23, may need more testing, report any issues please) + +- The host machine of the Docker container is Ubuntu 22.04 LTS. +- The container is built on top of Ubuntu 22.04 LTS as well. +- All tools are pre-install on the Ubuntu container. +- You can follow the tuturial [Docker for Digital Forensic Investgiation](https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/Docker_4_Digital_Forensics.pptx) + --- ### Investigating NIST Data Leakage