A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

What

Link - 

Prefetch folder

Each time you turn on your computer, Windows keeps track of the way your computer starts and which programs you commonly open. ... The prefetch folder is a subfolder of the Windows system folder. The prefetch folder is self-maintaining, and there's no need to delete it or empty its contents.

C:\Windows\Prefetch

Art 46 Bis (identificatie bij Provider) door Pdk

Art 46 Bis (identificatie bij Provider) door Pdk

Art 88 Bis (gegevens opvragen bij Provider door OR)

Art 88 Bis (gegevens opvragen bij Provider door OR)

Wet Informaticacriminaliteit 28 november 2000

Wet Informaticacriminaliteit 28 november 2000

Wetboek van strafvordering

http://www.ejustice.just.fgov.be/cgi_loi/change_lg.pl?language=nl&la=N&cn=1808111730&table_name=wet

Potpourri I,II,III,IV,V

https://www.koengeens.be/beleid/potpourri-wetten/potpourri-i

Eventviewer opstarten (logboeken) via command 

Windowstoets + R en dan " eventvwr.msc " intypen

Zie ook

https://www.windows-helpdesk.nl/logboeken/

Eventcodes

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx?i=j

Codes: 

Windows 4608 Windows is starting up

Windows 4609 Windows is shutting down

Windows 4825A user was denied the access to Remote Desktop. By default, users are allowed to connect only if they are members of the Remote Desktop Users group or Administrators group

Windows 4830SID History was removed from an account

Windows 5024The Windows Firewall Service has started successfully

Windows 5025The Windows Firewall Service has been stopped

Windows 5027The Windows Firewall Service was unable to retrieve the security policy from the local storage

Windows 5028The Windows Firewall Service was unable to parse the new security policy.

Windows 5029The Windows Firewall Service failed to initialize the driver

Windows 5030The Windows Firewall Service failed to start

Windows 5032Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network

Windows 5033The Windows Firewall Driver has started successfully

Windows 5034The Windows Firewall Driver has been stopped

Windows 5035The Windows Firewall Driver failed to start

Windows 5037The Windows Firewall Driver detected critical runtime error. Terminating

Whois (IP adressen opzoeken)

http://whois.domaintools.com/

Spyderweb (vanalles opzoeken ... e-mail,

http://www.spyderweb.nl/

Convert files (OCR) via Google Documents

https://support.google.com/drive/answer/176692?hl=nl

Google location

https://www.google.com/maps/timeline?authuser=0

GSM (Mobile) number belongs to which provider (welke provider op basis van GSM nummer

http://www.crdc.be/crdcNLI/BrowserDefault.aspx?tabid=265

Identifcation of a mobile via an IMEI number

http://www.imei.info

http://www.nobbi.com/tacquery.php

http://www.numberingplans.com/?page=analysis§ion=imeinr

Position of the Mobile antennas (GSM masten positie en coordinaten)

http://www.ibpt.be/nl/operatoren/radio/antennes-gedeeld-antennegebruik/antennewebsite-bipt

http://geoportal.ibgebim.be

Compare mobile networks (signaalsterkte meten van Base Proximus Mobistar)

http://opensignal.com

Find your Ipad Iphone or Ipod via Icloud (IPhone zoeken vinden  via Icloud)

https://support.apple.com/nl-be/HT201472

Find your Android device (Android toestel zoeken vinden via Google account)

https://maps.google.fr/locationhistory/b/0

Verify e-mail address (kijken of e-mail adres nog bestaat)

https://tools.verifyemailaddress.io/

FACEBOOK custom Tools (Facebook speciale opzoekingen)

https://inteltechniques.com/OSINT/facebook.html

FACEBOOK ID

Go to the Facebook user profile of the target.

Right-click on an empty area of the page and select "view source code". You will get a new page with the source code.

Search for the term profile_owner.

The number located next to profile_owner is the unique Facebook ID.

TWITTER search

http://backtweets.com/

Social Media Checker (kan ik nog registreren met een naam op bepaade sociale media)

http://knowem.com/

Privacy

https://eloket.privacycommission.be/elg/searchPR.htm

Google image search (Foto  zoeken via Google)

https://www.google.be/imghp?hl=fr&tab=wi&ei=KEcgVfCwOKOI7Qa_loH4DA&ved=0CBEQqi4oAg

Reverse image search (Foto opzoeken via TinEye) Reverse image search (Foto opzoeken via TinEye)

https://www.tineye.com/

https://www.imageraider.com/

Stolen camera finder (gebruik foto's om via de metadata foto's op het internet terug te vinden die met dezelfde camera werden getrokken)

http://www.stolencamerafinder.com/

http://www.cameratrace.com/trace

https://www.cameraforensics.com/

E-mail header analysis (e-mai headers analyseren)

http://www.iptrackeronline.com/email-header-analysis.php

Website copier (volledige website kopieren)

http://www.httrack.com/

Video to JPG converter (video omzetten in JPG)

http://www.dvdvideosoft.com/products/dvd/Free-Video-to-JPG-Converter.htm#.VUTP1vntmkp

Nirsoft (veel gratis programma's

http://www.nirsoft.net/

FoneFunShop (allerhande tools voor GSM )

http://www.fonefunshop.co.uk/

Mac address finder (Mac adres opzoeken)

https://www.adminsub.net/?sc0=3

RAM (Random Access Memory) investigation

http://www.forensicmag.com/article/2011/06/memory-forensics-where-start

GPS coordinaten ingeven in Google Maps

http://www.gps-coordinates.net/

Reverse engineering

https://www.youtube.com/watch?v=a2EkORFcSZo

Which files are encrypted? (ransomware geëncrypteerde bestanden identificeren

https://www.bleepingcomputer.com/forums/t/637463/cryptosearch-find-files-encrypted-by-ransomware/

Ransomware identification (ransomware identificeren)

https://id-ransomware.malwarehunterteam.com/

All kind of tools to use for system analysis

Download for the suite here

https://technet.microsoft.com/nl-nl/sysinternals

Computer Forensics Tutorials

https://www.youtube.com/playlist?list=PL6oHuo5it4TgA-ZtIo3x5G0l0HDwPPZ9d

Hoe lost u boot en opstart problemen op met UEFI

https://www.softwaregeek.nl/tips-en-trucs/hoe-lost-u-boot-en-opstart-problemen-op-met-uefi/

Device configuration overlay (DCO) changer

Detection tools[edit]

HDAT2 a free software program can be used to create/remove Host Protected Area (HPA) (using command SET MAX) and create/remove DCO hidden area (using command DCO MODIFY). It also can do other functions on the DCO.

Data Synergy's free ATATool utility can be used to detect a DCO from a Windows environment. The current version does not allow a DCO to be removed.[3]

http://hdat2.com/

What is DCO (harddisk verborgen gebied) ook HPA

https://en.wikipedia.org/wiki/Device_configuration_overlay

HPA (Host Protected Area) Verborgen gedeelte op harddisk

https://en.wikipedia.org/wiki/Host_protected_area

X-Ways lessons with video

http://www.xwaysclips.co.uk/

X‐Ways Forensics (v15.4) QuickStart Guide

http://www.x-ways.net/forensics/XWFQuickStart.pdf

X-Ways Forensics manual (handleiding)

http://www.x-ways.net/winhex/manual.pdf

X-Ways Forensics extended File Type Categories

https://github.com/forensenellanebbia/xways-forensics/blob/master/File%20Type%20Categories.txt

Regular expressions (  Grep ) - long list (Master Card, Bitcoin, e-mail.......) 

Regular expressions - long list (Master Card, Bitcoin, e-mail.......)  tnx 2 Frank !

How to Pull Passwords from a Memory Dump

https://cyberarms.wordpress.com/2011/11/04/memory-forensics-how-to-pull-passwords-from-a-memory-dump/

Windows File Encryption (former to Windows Bitlocker)

https://msdn.microsoft.com/en-us/library/dd163562.aspx

Wiki FCCU

https://wikifccu.fccu.be/index.php?title=Main_Page

Created: 12 Aug 2006 11:34:14 - this is when the file was created at that location. Here 'created' doesn't necessarily mean made.

Modified: 14 July 2006 09:05:45 - this is when the file content was last changed and then saved.

Accessed: 12 Aug 2006 12:05:34 - this was when the file was last touched in some way. Be careful because this could include an AV application checking the file and doesn't necessarily infer user interaction.

http://www.acc.com/chapters/louis/upload/Avansic-Why-You-Shouldnt-Trust-Metadata.pdf

What is ARP cache

https://www.petri.com/csc_arp_cache

Petya ransomware outbreak: Here’s what you need to know

https://www.symantec.com/connect/blogs/petya-ransomware-outbreak-here-s-what-you-need-know

Windows Startup time and shutdown time 

https://www.trickyways.com/2014/02/find-windows-start-up-and-shutdown-time-logs/