ANALYZER - Digital Forensics Tool

A comprehensive digital forensics analysis script that performs automated analysis on files using multiple industry-standard tools.

Overview

ANALYZER is a bash-based forensics tool designed for CTF competitions, educational purposes, and security research. It automatically detects file types and applies appropriate analysis techniques including memory dump analysis, steganography detection, file carving, and password cracking.

Features

• Multi-tool Analysis: Integrates strings, binwalk, foremost, bulk_extractor, volatility, stegseek, and hashcat
• Automatic Memory Dump Detection: Identifies and analyzes Windows memory dumps using Volatility
• Steganography Analysis: Detects hidden data in images using stegseek with wordlist support
• Password Hash Cracking: Extracts and cracks NT hashes using hashcat
• File Carving: Recovers deleted/hidden files using foremost
• Human-readable Content Extraction: Automatically extracts usernames, passwords, and executables
• Comprehensive Reporting: Generates detailed analysis reports with statistics and findings
• Archive Creation: Creates ZIP archives of all analysis results

Requirements

System Requirements

• Linux-based operating system (tested on Arch Linux)
• Root privileges (required for some analysis operations)
• Bash shell

Tool Dependencies

The script automatically installs missing tools using pacman:

• strings (binutils)
• binwalk
• foremost
• bulk_extractor
• volatility3
• stegseek
• hashcat

Volatility Setup

• Volatility symbols directory: $HOME/.volatility3/symbols
• Download Windows symbols from Microsoft Symbol Server if analyzing Windows memory dumps

Usage

Basic Usage

sudo ./analyzer.sh -f <file1> [file2] [file3] ...

Advanced Usage

sudo ./analyzer.sh -f <files> [-o <output_directory>] [options]

Options

• -f <files>: Files to analyze (required, can specify multiple)
• -o <dir>: Output directory (auto-generated if not specified)
• --wordlist <file>: General wordlist for both stegseek and hashcat
• --stegwordlist <file>: Wordlist specifically for steganography (auto-enables stegseek)
• --hashcatwordlist <file>: Wordlist for hashcat hash cracking (auto-enables hashcat)
• --stegseek: Enable steganography analysis
• --hashcat: Enable password hash cracking

Examples

Analyze a single file:

sudo ./analyzer.sh -f suspicious_file.bin

Analyze multiple files with custom output directory:

sudo ./analyzer.sh -f file1.exe file2.jpg memory.dmp -o investigation_results

Enable steganography analysis with wordlist:

sudo ./analyzer.sh -f image.jpg --stegwordlist /usr/share/wordlists/rockyou.txt

Analyze memory dump with password cracking:

sudo ./analyzer.sh -f memory.dmp --hashcat --wordlist /usr/share/wordlists/rockyou.txt

Analysis Capabilities

Memory Dumps

• Process listing (pslist, psscan, pstree)
• Network connections (netscan)
• Command line arguments (cmdline)
• Registry analysis (hivelist, hashdump, LSA secrets)
• Service enumeration
• User activity tracking

File Analysis

• String extraction and analysis
• Binary signature identification
• File carving and recovery
• Executable extraction
• Network artifact discovery (emails, URLs, IPs)
• Credit card and phone number detection

Steganography

• Hidden data extraction from images (JPG, BMP, WAV, AU)
• Password-protected steganography cracking
• Multiple wordlist support

Password Analysis

• NT hash extraction from memory dumps
• Hash cracking using wordlists
• Password pattern detection in strings

Output Structure

output_directory/
├── analysis_report.txt           # Comprehensive analysis summary
├── analysis_YYYYMMDD_HHMMSS.zip  # Archive of all results
└── [filename]_analysis/          # Per-file analysis results
    ├── strings_output.txt
    ├── binwalk_output.txt
    ├── foremost_output/          # Carved files
    ├── bulk_extractor_output/    # Extracted artifacts
    ├── volatility_output/        # Memory analysis (if applicable)
    ├── stegseek_output/          # Hidden data (if found)
    └── HumanReadableExtraction/  # Organized findings
        ├── usernames/
        ├── passwords/
        └── executables/

Security Notes

• This tool is designed for authorized security testing, CTF competitions, and educational purposes
• Requires root privileges for comprehensive analysis
• Some operations may trigger antivirus software
• Use only on systems you own or have explicit permission to analyze

License

Educational use only. Not for commercial distribution.