From Digital Forensics Framework
Specific file Format
- An office (.doc, .odt, .ppt, ...) document reader and metadata extractor
- Encrypted FS
- YAFFS 1/2
Android NAND dumper
- based on tools developed by xdadevelopers (http://svn.infernix.net/nandroid/nandroid.sh), develop a NAND dumper for phones based on Android.
- RAID reconstruction
Develop modules capable of mounting the file system on DFF and recover deleted files.
- Lotus notes
- Use open-source library like distorm to add disasembly capabilities to DFF (For examples in the hexeditor)
Architecture supported must be : arm (for cellphone analysis), X86 or amd 64
Copy on Write
- Develop a copy on write modules or directly in the API based on MFSO or made from scracth the goal is to permit
to modify some damaged bytes of a file system to made it readble by other modules. ( Partition and file system reconstruction for examples). Must be able to replace shm/touch modules.
- Network analysis modules for getting NBE (network based evidences) out of PCAP files
- Developement of network connector (could be use insted of local/devices/ewf/... modules) that connect to a remote computer
and permit access to the devices or files of the computer. (simple ftp modules, sftp, or windd network compatible modules, devices network connector, ...)
Image detection algorithm
- A skin detection algorithm (could be based on open CV for examples)
OCR for indexation
- An OCR modules that can extract text from images or other document to add the content the indexation engines.
(could be based on tesseract)
Datastructure description language
- Develop a DSL or something that can permit to describe binary datastructure.
This must be usable to carve the datastructure, use coloration in the hexviewer or to develop modules more easily.
- Describe all times based on UTC, or timezone of the current case ; should be configured by analyst
- Be able to time-shift every children of one node, clock of any analyzed source if often out of synchronization of a few minutes.
Advanced Node view
- A 3D or 2D view permitting to see nodes as graph rather than tree
- A tree mapview (like KDirStat , GDMap, xdiskusage )
- A baobab like view
Web Based User Interface
- A web based user interface to use DFF could permit multi-user access a case as same time on distant server more easily