LawEnforcementResources

Resources provided by the community that can serve to be useful for Law Enforcement worldwide

1. Free Training
2. Guides, Publications and Books
3. Ransomeware Identification and Decryption Resources
4. Malware Analysis
5. Reverse Engineering
6. Phishing
7. Computer Investigations
   1. Decryption
   2. Windows Investigations
   3. Linux Investigations
   4. Mac Investigations
8. Mobile Investigations
   1. Pin Code, Pattern Lock, and Password Resources
9. IP Resolution Services
10. Email Analysis
11. MLA Resources
12. End-to-end encrypted messengers
13. Self Contained and Darknet Resources
14. Resources for CSAM Investigators
15. Regular Expressions
16. Android Resources
17. Contributing to this Project

Free Training

• NW3C - Online Training - Free online training provided by NW3C. Great for padding the CV with training! US LE only. Outside US LE may have to contact NW3C to ask for access, but I can't promise LE outside of the USA can access the training.
• Texas A&M TEEX - Cybersecurity - Any class with the FEMA logo (A) is free! Stock up on the certificates of completion!

Guides, Publications and Books

• NIST - Computer Security Incident Handling Guide
• NIST - Guidelines on Mobile Device Forensics
• NIST - Guide to Integrating Forensic Techniques into Incident Response
• NIST - Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Ransomware Identification and Decryption Resources

• NO MORE RANSOM - Ransomware decryption tools/platform.
• ID Ransomware - Ransomware identification platform.
• Trend Micro Ransomware - Ransomware identification tool specializing in removing ransomware types that perform screen locking.
• Bitdefender Ransomware - Ransomware recognition tool.

Malware Analysis

• Any.run - Interactive Online Malware Analysis Sandbox - ANY.RUN
• VirusTotal - Analyze suspicious files and URLs to detect types of malware, automatically share them with the security community.
• Hybrid Analysis - Free Automated Malware Analysis Service - powered by Falcon Sandbox.
• Cuckoo Sandbox - Cuckoo Sandbox.
• FlareVM - FLARE VM - a fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing, etc.
• Joe Sandbox - Joe Sandbox
• Hatching Triage - Malware analysis sandbox designed for cross-platform support (Windows, Android, Linux, and macOS)
• REMnux - A Linux Toolkit for Malware Analysis
• Reverse.it - Web-based malware analysis tool - powered by CrowdStrike Falcon.
• Limon - Malware Analysis Sandbox for analyzing Linux malwares.

Reverse Engineering

• UNPACME - An automated malware unpacking service from OpenAnalysis
• disassembler.io

Phishing

• PhishTank - PhishTank is a collaborative clearing house for data and information about phishing on the Internet.

Computer Investigations

Decryption

• Password Cracking - Mimikatz NTLM Hash Extraction - How to extract the NTLM hash used by Windows for use in password cracking software.
• Password Cracking - Hashcat Brute Force - How to use the brute force attack mode of Hashcat and an explination of what brute force is doing.
• Password Cracking - Hashcat Dictionary + Rules - How to use Hashcat's dictionary attack mode with a rule set.
• NTLM Hash Generator - A short python script to generate NTLM hashs for testing purposes.

Windows Investigations

• WinDbg Cheat Sheet - Command cheat sheet for WinDbg usage.
• Memory Forensics Cheat Sheet
• REMnux Usage Tips for Malware Analysis on Linux - Useful for knowing the commands and tools to use when analyzing malware using the REMnux VM.
• Malware Analysis and Reverse-Engineering Cheat Sheet - Tips for analyzing and reverse-engineering malware.
• Windows Security Log Events Encyclopedia

Linux Investigations

• Linux Compromise Assessment Command Cheat Sheet
• Linux Shell Survival Guide - Covers the more useful Linux shell primitives and core utilities.
• Intrusion Discovery Cheat Sheet for Linux - Useful for finding indications of a system compromise.

Mac Investigations

• mac4n6 - Mac forensics resources
• Mac OS X Forensic Artifact Locations
• SANS FOR518 - Mac & iOS HFS + Filesystem Reference Sheet

Mobile Investigations

Pin Code, Pattern Lock, and Android Password Resources

• All Possible Pattern Locks - Text files containing all possible pin combinations to 9 chars.
• All Possible 4-Digit PIN codes - Text file containing all possible 4-digit PIN combinations.
• All Possible 5-Digit PIN codes - Text file containing all possible 5-digit PIN combinations.
• All Possible 6-Digit PIN codes - Text file containing all possible 6-digit PIN combinations.
• All Possible 7-Digit PIN codes - Text file containing all possible 7-digit PIN combinations.
• All Possible 8-Digit PIN codes - Text file containing all possible 8-digit PIN combinations.
• Predictability of Android Lock Patterns - Ars Technica artile about Android lock patterns.
• 10 Most Common Pattern Locks - YouTube video about common lock patterns.
• Common lock Patterns Cheat Sheet - From Pinterest/sanketmisal
• Android Pattern Lock - GitHub repo with pattern text files.
• Android Password List - Wordlist for use on DF tools that bruteforce Android passwords.

IP Resolution Services

• MaxMind - Useful for resolving IPs. MaxMind is known for offering better geolocation than most other similar services.
• WhoisXML API - Useful for gathering, analyzing, and correlating domain, IP, and DNS data. Obtain precise geographical data down to the postal code with latitude and longitude coordinates, network information, timezone, connected domains, and more for deeper contextualization.

MLA Resources

• UNODC SHERLOC - Legislation, CNA list and treaties.

Email Analysis

• Email Header Analyzer - Will make email headers human readable by parsing them according to RFC 822
• DMARC Check Tool - Diagnostic tool that will parse the DMARC Record for the queried domain name, display the DMARC Record, and run a series of diagnostic checks against the record

MLA Resources

• UNODC SHERLOC - Legislation, CNA list and treaties.

End-to-end encrypted messengers

| Name | URL | iOS | Android | Windows | Mac | Linux | Web | |--|--|--|--|--|--|--|--| | BRIAR | https://briarproject.org/ | ? | ? | ? | ? | ? | ? | | Element | https://element.io/ | ? | ? | ? | ? | ? | ? | | Jitsi | https://meet.jit.si/ | ? |