Open Computer Forensics Architecture: Difference between revisions

Revision as of 11:24, 29 December 2010

Revision as of 11:32, 29 December 2010

Line 1:

{{Infobox software

| name = Open Computer Forensics Architecture

| developer = Dutch national police

| latest release version = 2.2.0pl4

| operating system = [[Linux|Linux]]

| language = [[English language|English]]

| status = Active

| genre = [[Computer forensics]]

| website = [http://sourceforge.net/apps/trac/ocfa/wiki http://sourceforge.net/apps/trac/ocfa/wiki]

}}

The '''Open Computer Forensics Architecture''' or '''OCFA''' is an [[distributed computing]] [[open source]] [[computer forensics]] framework/backend/architecture used to analyze [[digital media]] within a digital forensics laboratory environment..

Line 8 ⟶ 19:

OCFA comes with a small set of modules that integrate some common open source tools and libraries into the architecture. These include modules for integration of [[The Sleuth Kit]], Scalpel, Photorec, libmagic,

[[GNU Privacy Guard]], [[objdump]], exiftags, zip, [[7-zip]], [[tar]], [[gnu zipgzip]], [[bzip2]], [[rar]], [[antiword]], qemu-img, mbx2mbox, strings, many perl modules for mail and dbx processing, libewf and others.

While these standard modules provide a reasonable environment for processing digital media, most of the power of OCFA comes from its extendability. OCFA comes with libraries for building your own modules in [[C++]] or [[Java]].