Let’s face it each of us has our own investigative methods and patterns so building out your own system is not going to be the easiest answer but you may be able to keep handy the best tools for both investigating, note taking and reporting if you build out your own research VM.Recon Spider also combines the capabilities of Wave, Photon and Recon Dog to do a comprehensive enumeration of attack surface. There are several free options to get ‘clean’ operating systems and bake in your own tools and configurations. You can download SIFT here: Roll Your Own Making the hybrid VM takes a little work, but the documentation out there is great so It is pretty easy for most to follow along even if not an expert in virtual machines.

Lenny Zeltser wrote a blog earlier this month showing a few options to make the hybrid VM. I’ve used a hybrid VM in the past that coupled the more digital forensics focused SIFT workstation. To try a virtual machine out, you may not always want to grab a 20 gigabyte image file for a test drive… so I did it for you! Let’s take a quick tour!

The latter isn’t the fastest or easiest but will probably give you the best environment since you the investigator know what tools you consider a must have and which ones you would use from time to time. We’ll do a quick tour of several of my favorites and I’ll try to leave you with enough resources you can build out your own custom virtual machine. Luckily there are still several free options out there pre-configured and pre-loaded with tools that can help you get up and running quickly. However, for good operational security and case management a good virtual machine is just as vital to your investigation.įor the last several years Michael Bazzell and David Wescott’s Buscador VM was my go to for this, however since that project is no longer updated I’ve changed my strategy a bit. There is no short supply of pages and link collections out there. If you are an OSINT investigator you undoubtedly have your cache of tools and search resources.

Download linux os iso osint faramework