Paraben s P2C 4.1. Release Notes

Transcription

1 Paraben s P2C 4.1 Release Notes

2 Welcome to Paraben s P2C 4.1! Paraben's P2C is a comprehensive digital forensic analysis tool designed to handle more data, more efficiently while keeping to Paraben's P2 Paradigm of specialized focus of the entire forensic examination process. P2C utilizes Paraben's advanced plug-in architecture to create specialized engines that focus on such things as , Network , Chat Logs, File Sorting, Internet file analysis and more all while increasing the amount of data that can be processed and utilizing resources through multi-threading and task scheduling. Not only is P2C affordable, it runs effectively with lower hardware requirements than you thought possible. What s new in P2C v. 4.1 Optical Character Recognition (OCR) has been added. Now, you can search for text data stored in graphic files of the most popular formats (JPEG, GIF, PNG, etc.) with advanced search and keywords search. RTF reports generation has been added. One more format for report generation is available. Adding EXIF data to reports has been added. Now you can add EXIF data from graphic files to the report. Resolution of problems while working with some physical and logical disk images has been resolved. Minor interface and performance improvements have been made. This document provides you with a list of all P2C robust features and a full list of key changes in version 4.1.

3 P2C Key Features Paraben s P2C v 4.1 has the following key features: Main features: Analyzing of disks and disk images with the most popular file systems, indexing, deleted data recovery, searching, and exporting. Analyzing of the most popular mail storage formats: viewing, searching, sorting attachments, and exporting. Analyzing of chat databases, registry hive files, OLE streams, archives, Internet browser data, memory dump files, and more. Analyzing the existing forensic containers, exporting data to them and creating the new ones. General features: Full Windows 8 and 8.1 compatibility, including UAC and digital signature by Microsoft Back-end Firebird database for support of massive amounts of data Multi-threading and task scheduling capabilities to process more data in less time Convenient plug-in architecture Easy-to-use registration scheme GUI features: GUI is redesigned and is now more sophisticated than ever. File viewers for popular file formats EXIF data viewer for graphic files including search in EXIF data and [NEW!] adding EXIF data to reports Special data viewer for viewing messages in different formats including viewing attachments Special Chat RTF viewer for viewing chat history in a convenient format [NEW!] Extracted text viewer with the ability to display results from optical character recognition Data Triage Integrated Internet Explorer cache parser Adjustable font color and size Plug-ins features: File system plug-ins allow you to examine logical and physical disks as well as individual files and folders (local, network and stored on CD/DVD) with: o FAT12, FAT16, FAT 32, [NEW!] FATX o ExtX o HFS+ o NTFS (including partition free space and file slack) o STFS Supports disk images from the most popular forensic imaging software o Paraben's Forensic Replicator (PFR) o Safeback 2-3 o EnCase o RAW disk images (created in P2 Enterprise, Smart, etc.) o Virtual PC Virtual HD image o VMware disk image

4 Supports memory dump files plug-in supports viewing multiple and network formats in a special data viewer (including support for exporting data to Examiner, EML [rfc822 compliant], Attachments only, MSG [OLE message], and PST [Outlook] formats) o Microsoft Exchange 5.0, 5.5, 2000, 2003 SP1, 2007, 2010, 2013 (EDB) o Lotus Notes 4.0, 5.0, 6.0, 7.0, 8.0, 8.5 (ODS 43 and 51), 9.0. o Novell Group Wise up to 2012 o Microsoft Outlook (PST) up to 2013 o Microsoft Outlook Express (EML) o Examiner (EMX) o AOL o The Bat! (3.x and higher) o Thunderbird o Windows Mail o Google Takeout storage o Eudora o Maildir Chat database plug-in supports many popular chat clients for viewing chat database contents in a convenient, color coded format for easy analysis o Yahoo! o Skype o ICQ o Miranda o Hello (Including Thumbnails) o Trillian OLE Storage plug-in supports the parsing and analysis of any OLE storage Archive plug-in supports many popular archive types including: zip, jar, xpi, iso, chm, cab, msi, ppt, doc, xls, arj, bzip2, cpio, deb, gzip, lzh, msis, rpm, split, tar, z, wim, and 7z. Internet Data plug-in supports the parsing and analysis of: o Mozilla Firefox cache and history o Internet Explorer cache, cookies, and history o Google Chrome history, cookies, auto fill items, keywords and logins SQLite plugin supports parsing and analysis of SQLite databases including: *.db, *.Sqlite, *.Sqlite3, *.sqlitedb, and *.db3, and others. itunes backup plugin supports iphone, ipad, and ipod Touch backups created by itunes, including: o o ios 1x-7x non-encrypted backups ios 3x-7x encrypted backups Forensic Container plug-in allows: o Creating a new Forensic Container o Adding an existing Forensic Container as evidence o Parsing the content of a Forensic Container as embedded data in the added file system evidence.

5 DS case plug-in allows parsing and analysis of cases created by Paraben s DS and Paraben s Deployable DS. Game Console plug-in allows you to examine images of logical and physical disks with evidence from Xbox 360 including: o FATX filesystem used by Xbox. o STFS filesystem data intended to store packages created and downloaded by the Xbox. o XDBF databases containing gamer profile data. Forensic Sorter plug-in sorts data into relevant categories and creates a keywords database for keywords search: o Perform keywords indexing of any text data o Quick keywords search in indexed data including multiple parameters for evidence o Sort attachments o Sort recovered deleted data o Analyze file type/file extension mismatch Deleted data recovery Other features: Hash database features can manage and Filter Out Common Hashes (FOCH) Automatic detection of embedded data from supported file types (view archives, chat databases, disk image files, OLE storage, archives, etc. from the exact place they are stored without having to add them to your case separately) Multiple reporting options for complete customization Image Analyzer for pornographic image detection [NEW!] Optical character recognition for images of most popular formats An encrypted dynamic Forensic Container creation Robust advanced searching and filtering options including multi-encoding support o Search within attachments including search by attachments type o Search in deleted data, unallocated disk space, file slack, etc. o Multi-parameter search for each type of data. o Regular Expressions search. o Ability to search for data without searching for its contents (file name/directory names) o Multi selection of search results for adding to a Search results report. Exporting o Export any file in its native format o Export multiple files from different folders/disks/evidence types o Export files/folders to forensic containers. o Export mail storage contents to EML, EMX, PST, MHTML, and MSG formats. o Export attachments in their native format. o Export from search results and bookmarked data including multi-selection. o Batch export for databases

6 P2C 4.1 New Features Optical character recognition (OCR) has been added. The OCR function supports the carving of text from JPEG, GIF, PNG, and TIFF images so that you can view and perform searches in this data.

7 RTF reports generation has been added.

8 EXIF properties are now added to reports.