This is a non-IMPACT record, meaning that access to the data is not controlled by IMPACT. For access, see the directions below.

Disclaimer:
This Resource is offered and provided outside of the IMPACT mediation framework. IMPACT and the IMPACT Coordination Council/Blackfire Technology, Inc. expressly disclaim all conditions, representations and warranties including but not limited to Resource availability, quality, accuracy, non-infringement, and non-interference. All Resource information and access is controlled by entities and under terms that are external to the IMPACT legal framework.

Summary

DS-1347
Digital Forensics Artifact Repository
External Dataset
External Data Source
GitHub
Unknown
Unknown
55 (lowest rank is 55)

Category & Restrictions

Other
forensics, cyber defense
Unrestricted
true

Description


A free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.

The first version of the artifact definitions originated from the GRR project, where it is used to describe and quickly collect data of interest, e.g. specific files or Windows Registry keys. The goal of the format is to provide a way to describe the majority of forensic artifacts in a language that is readable by humans and machines.

The format is designed to be simple and straight forward, so that a digital forensic analysist is able to quickly write artifact definitions during an investigation without having to rely on complex standards or tooling.

The format is intended to describe forensically-relevant data on a machine, while being tool agnostic. In particular we intentionally avoided adding IOC-like logic, or describing how the data should be collected since this various between tools.

The artifact definitions are YAML -based. Understanding this format is the only requirement to be able to use the data. The Python code in this project is only used to validate all the artifacts to make sure they follow the specification.

As of 2019-06-10 the repository contains 1013 file paths covered, 635 registry keys covered, and 525 total artifacts.

Additional Details

1,002.9KB
false
Unknown
knowledge base, digital forensics, external data source, cybercrime, 1347, digital forensics artifact repository, inferlink corporation, technical communication, data serialization formats, yaml