Skip to content
master
Switch branches/tags
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
src
 
 
 
 
 
 

Cyber-investigation Analysis Standard Expression (CASE)

Read the CASE Wiki tab to learn everything you need to know about the Cyber-investigation Analysis Standard Expression (CASE) ontology. For learning about the Unified Cyber Ontology, CASE's parent, see UCO.

Implementation of CASE into Volatility Plugins

Development Status: Alpha

Alpha status implies:

  • Designation of versions of CASE and UCO the project supports.
  • Follow Semantic Versioning (SEMVER).

This implementation is not ontology-correct! However, it attempts to adhere to v0.1.0 of CASE. This repository contains a sub-set of Volatility plugins that produce output in the CASE format.

These plugins have been taken from core Volatility plugins and adapted the output to produce CASE JSON-LD. The Alpha status of this code means it may not fully comply to the CASE ontology as it is an evolving standard.

This repository takes the following plugins from the Volatility framework and converts the output to CASE format:

All Volatility work belongs to their respective authors which can be found here.

Installation of 3rd Party Libraries

Running Custom Plugins

CASE Handle List from Memory Image:

vol.py --plugins='volplugs/src/' -f memory_images/memory.img --profile WinXPSP2x86 casehandles

CASE Procdump:

vol.py --plugins='volplugs/src/' -f memory_images/memory.img caseprocdump --dump-dir dumpdir

CASE Commandline dumping:

vol.py --plugins='volplugs/src/' -f memory_images/memory.img casecmdline

I have a question!

Before you post a Github issue or send an email ensure you've done this checklist:

  1. Determined scope of your task. It is not necessary for most parties to understand all aspects of the ontology, mapping methods, and supporting tools.

  2. Familiarize yourself with the labels and search the Issues tab. Typically, only light-blue and red labels should be used by non-admin Github users while the others should be used by CASE Github admins. All but the red Project labels are found in every casework repository.

About

CASE (v0.1.0) implementation into Volatility.

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages