Windows Forensic Toolchest™ (WFT)

The Windows Forensic Toolchest™ (WFT) is designed to provide a structured and repeatable automated Live Forensic Response, Incident Response, or Audit on a Windows system while collecting security-relevant information from the system. WFT is essentially a forensically enhanced batch processing shell capable of running other security tools and producing HTML based reports in a forensically sound manner.

A knowledgeable security professional can use WFT to help look for signs of an incident, intrusion, or to confirm computer misuse or configuration. WFT produces output that is useful to the admin user, but is also appropriate for use in court proceedings. It provides extensive logging of all its actions along with computing the MD5/SHA1 checksums along the way to ensure that its output is verifiable. The primary benefit of using WFT to perform incident responses or audit is that it provides a simplified way of scripting such activities using a sound methodology for data collection.

I welcome any suggested features or changes or additional tool suggestions. Feedback from users of WFT would be greatly appreciated.

WINDOWS FORENSIC TOOLCHEST™ (WFT) FEATURES

Windows Forensic Toolchest™ (WFT) Features 2.X 3.X Provides Structured And Repeatable Live Forensic Response, Incident Response, Or Audit Generation Of Both Raw Text And HTML Reports User-Editable Config File Controls Execution Ability To Run Locally, Via CD/DVD, Or Thumb Drive Configurable Toolpath Macros Which Expand Dynamically Based On Run-Time Values Detailed Run-Time Logging Verification Of All Executed Tools Detailed Hashing Of Output Support For MD5 Hash Support For SHA1 Hash Ability To Verify WFT Config Files Automatic Updating Of WFT Hash Values For Tools WFT's Interactive Mode Provides Command-Line Alternative Off-Line Report Generation Saves Time During Collection Ability To Run SysInternals Tools Without ‘-accepteula’ Color Output Highlights Important Info Automatic OS & Drive Detection Ability To Run Commands Based On Run-Time OS Ability To Fetch 3rd-Party Tools Ability To Download Latest WFT

WFT News
2009-07-02	WFT v3.0.04 released	v3.0.04
2008-07-03	WFT v3.0.03 released
2007-07-30	SANSfire 2007 BOF: What Is New With Windows Forensic Toolchest™ (WFT) v3.0	PDF
2007-06-03	WFT v3.0.01 released
2006-06-10	WFT presentation presented at the June 10th, 2006 North Texas Snort Users Group meeting.	PDF

轉自http://www.foolmoon.net/security/wft/index.html