Software
Now Reading
bstrings 1.0 released
Next
Prev
Contents
0

bstrings 1.0 released

by Digital Forensics Corp2016-02-12

Eric Zimmerman keeps developing amazing digital forensic tools. In the new version of his bstrings tool the following switches have been added:

  • ar: ASCII character range. This should be specified as a regular expression, such as [\x20-\x7E];
  • ur: Unicode character range. This should be specified as a regular expression, such as [\u0020-\u007E];
  • mask: When used with the -d switch, allows for specifying a wildcard (* and ? are supported), so you can do something like -d C:\windows\system32 –mask “*.dll”;
  • cp: The identifier of the codepage to use. 1252 is the default, but if you really wanted to search for IBM EBCDIC Turkish encoded strings, you can do –cp 20905 and go crazy.

strings_digital_forensics_weare4n6

You can read more about these switches here and download the tool here.

Views: 5,626
Posted In
Software
Tags
Digital Forensics