{"id":8887,"date":"2020-11-11T17:31:38","date_gmt":"2020-11-11T16:31:38","guid":{"rendered":"https:\/\/www.nextron-systems.com\/?p=8887"},"modified":"2022-03-25T14:15:42","modified_gmt":"2022-03-25T13:15:42","slug":"thor-forensic-lab-license-features","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/","title":{"rendered":"THOR Forensic Lab License Features"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_row _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<p>THOR version 10.6, which is currently available as TechPreview, introduces several new features that facilitates the use of THOR in a digital forensics lab. Since not all of the features provided with the &#8220;Forensic Lab&#8221; license type are well-known, we would like to introduce all features that are unique to that special license type in this blog post.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<h1>Forensic Lab License Features<\/h1>\n<ul>\n<li>Multi-threaded scanning (improves scan speed significantly on multi-core systems)<\/li>\n<li>Multi-instance scanning (run multiple THOR processes on a single machine)<\/li>\n<li>Memory dump scanning (use the so-called DeepDive on dumped data, e.g. memory images)<\/li>\n<li>Dropzone mode (monitor folder for new files, scan them and generate events)\u00a0<\/li>\n<li>Hostname replacement (replace hostname in log messages with a given string)<\/li>\n<li>Virtual drive mapping (Map a mounted drive e.g. S: to a virtual drive e.g. C: to allow lookups for files mentioned in analyzed entries; more info <a href=\"https:\/\/www.nextron-systems.com\/2020\/10\/01\/thor-v10-6-techpreview\/\">here<\/a>)<\/li>\n<\/ul>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;1_2,1_2&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;1_2&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<h1>Multi-Threaded Scanning<\/h1>\n<p>Multi-threaded scanning allows users on forensic workstations to make full use of the system&#8217;s CPU cores. Multi-threading isn&#8217;t available in all modules but the ones with the biggest run time:\u00a0<\/p>\n<ul>\n<li>File Scan<\/li>\n<li>Registry Scan<\/li>\n<li>Eventlog Scan<\/li>\n<\/ul>\n<p>It is also available in DropZone mode, which means that dropping dropping 12 files in the monitored folder would create 12 threads scanning these files in parallel.\u00a0<\/p>\n<p>We plan to refactor the following modules to support multi-threading:<\/p>\n<ul>\n<li>DeepDive<\/li>\n<\/ul>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;1_2&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/11\/Screenshot-2020-11-09-131236.png&#8221; title_text=&#8221;Screenshot 2020-11-09 131236&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;2_5,3_5&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;2_5&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<h1>Multi-Instance Scanning<\/h1>\n<p>Multi-instance scanning means that you can start multiple executables of THOR on a single workstation.<\/p>\n<p>This is often needed in lab environments to process mounted disk images in parallel and create separate reports for these two cases.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;3_5&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/11\/Screenshot-2020-11-11-165424.png&#8221; title_text=&#8221;Screenshot 2020-11-11 165424&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=&#8221;1_2,1_2&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;1_2&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<h1>Memory Image Scanning<\/h1>\n<p>We provide a module named &#8220;DeepDive&#8221; that analyzes files of any size by reading big chunks of data and applying YARA rules to the chunks of data, showing YARA matches within that data with offset and matching strings \/ bytes.\u00a0<\/p>\n<p>It is not meant for the analysis of disk images but memory dumps, crash dumps or even PCAP files.\u00a0\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][et_pb_column type=&#8221;1_2&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/11\/Screenshot-2020-11-11-170036.png&#8221; title_text=&#8221;Screenshot 2020-11-11 170036&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][\/et_pb_image][et_pb_image src=&#8221;https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2020\/11\/Screenshot-2020-11-11-170253.png&#8221; title_text=&#8221;Screenshot 2020-11-11 170253&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<h1>Dropzone Mode<\/h1>\n<p>The drop zone mode allows you to monitor a given folder for new files. All files dropped to that folder will be scanned and then deleted. Customers use\u00a0 text and syslog output to report back findings.<\/p>\n<p>The drop zone mode helps you to integrate THOR in a bigger analysis environment. We recommend dropping files in their original form with the correct filename and extension, since some of the rules make use of these meta data values.<\/p>\n<p>Side note: If you like the idea of a drop zone, you&#8217;ll love <a href=\"https:\/\/www.nextron-systems.com\/2020\/10\/01\/theres-a-thunderstorm-coming\/\">THOR Thunderstorm<\/a>.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_column type=&#8221;4_4&#8243; _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;][et_pb_text _builder_version=&#8221;4.6.6&#8243; _module_preset=&#8221;default&#8221;]<\/p>\n<h1>Other Comfort Features<\/h1>\n<p>Other features relate to command line parameters that help you with different aspects of disk image scanning your forensic lab. We&#8217;ve added these features over the years based on a lot for feedback from DFIR specialists and BETA program users.\u00a0<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>THOR version 10.6, which is currently available as TechPreview, introduces several new features that facilitates the use of THOR in a digital forensics lab. Since not all of the features provided with the &#8220;Forensic Lab&#8221; license type are well-known, we would like to introduce all features that are unique to that special license type in this blog post.Forensic Lab License Features Multi-threaded scanning (improves scan speed significantly on multi-core systems) Multi-instance scanning (run multiple THOR processes on a single machine) Memory dump scanning (use the so-called DeepDive on dumped data, e.g. memory images) Dropzone mode (monitor folder for new files, scan them and generate events)\u00a0 Hostname replacement (replace hostname in log messages with a given string) Virtual drive mapping (Map a mounted drive e.g. S: to a virtual drive e.g. C: to allow lookups for files mentioned in analyzed entries; more info here) Multi-Threaded Scanning Multi-threaded scanning allows users on forensic workstations to make full use of the system&#8217;s CPU cores. Multi-threading isn&#8217;t available in all modules but the ones with the biggest run time:\u00a0 File Scan Registry Scan Eventlog Scan It is also available in DropZone mode, which means that dropping dropping 12 files in the monitored folder would [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[46,32],"tags":[],"class_list":["post-8887","post","type-post","status-publish","format-standard","hentry","category-newsletter","category-thor"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v24.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>THOR Forensic Lab License Features - Nextron Systems<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/\"},\"author\":{\"name\":\"Florian Roth\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\"},\"headline\":\"THOR Forensic Lab License Features\",\"datePublished\":\"2020-11-11T16:31:38+00:00\",\"dateModified\":\"2022-03-25T13:15:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/\"},\"wordCount\":870,\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"articleSection\":[\"Newsletter\",\"THOR\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/\",\"url\":\"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/\",\"name\":\"THOR Forensic Lab License Features - Nextron Systems\",\"isPartOf\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#website\"},\"datePublished\":\"2020-11-11T16:31:38+00:00\",\"dateModified\":\"2022-03-25T13:15:42+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.nextron-systems.com\/#website\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"name\":\"Nextron Systems\",\"description\":\"We Detect Hackers\",\"publisher\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.nextron-systems.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.nextron-systems.com\/#organization\",\"name\":\"Nextron Systems GmbH\",\"url\":\"https:\/\/www.nextron-systems.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"contentUrl\":\"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png\",\"width\":260,\"height\":260,\"caption\":\"Nextron Systems GmbH\"},\"image\":{\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919\",\"name\":\"Florian Roth\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g\",\"caption\":\"Florian Roth\"},\"description\":\"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.\",\"url\":\"https:\/\/www.nextron-systems.com\/author\/florian\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"THOR Forensic Lab License Features - Nextron Systems","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/#article","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/"},"author":{"name":"Florian Roth","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919"},"headline":"THOR Forensic Lab License Features","datePublished":"2020-11-11T16:31:38+00:00","dateModified":"2022-03-25T13:15:42+00:00","mainEntityOfPage":{"@id":"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/"},"wordCount":870,"publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"articleSection":["Newsletter","THOR"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/","url":"https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/","name":"THOR Forensic Lab License Features - Nextron Systems","isPartOf":{"@id":"https:\/\/www.nextron-systems.com\/#website"},"datePublished":"2020-11-11T16:31:38+00:00","dateModified":"2022-03-25T13:15:42+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.nextron-systems.com\/2020\/11\/11\/thor-forensic-lab-license-features\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.nextron-systems.com\/#website","url":"https:\/\/www.nextron-systems.com\/","name":"Nextron Systems","description":"We Detect Hackers","publisher":{"@id":"https:\/\/www.nextron-systems.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.nextron-systems.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.nextron-systems.com\/#organization","name":"Nextron Systems GmbH","url":"https:\/\/www.nextron-systems.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","contentUrl":"https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2017\/11\/Nextron_0.2s_inv_symbol_only.png","width":260,"height":260,"caption":"Nextron Systems GmbH"},"image":{"@id":"https:\/\/www.nextron-systems.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/4fd503007d60aabaf1ae747502f36919","name":"Florian Roth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.nextron-systems.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0dfaa838ce5d82e2e7bfa75ed3f43ae5?s=96&d=mm&r=g","caption":"Florian Roth"},"description":"Florian Roth serves as the Head of Research and Development at Nextron Systems. With a background in IT security since 2000, he has delved deep into nation-state cyber attacks since 2012. Florian has developed the THOR Scanner and actively engages with the community via his Twitter handle @cyb3rops. He has contributed to open-source projects, including 'Sigma', a generic SIEM rule format, and 'LOKI', an open-source scanner. Additionally, he has shared valuable resources like a mapping of APT groups and operations and an Antivirus Event Analysis Cheat Sheet.","url":"https:\/\/www.nextron-systems.com\/author\/florian\/"}]}},"_links":{"self":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/8887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/comments?post=8887"}],"version-history":[{"count":10,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/8887\/revisions"}],"predecessor-version":[{"id":8918,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/posts\/8887\/revisions\/8918"}],"wp:attachment":[{"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/media?parent=8887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/categories?post=8887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nextron-systems.com\/wp-json\/wp\/v2\/tags?post=8887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}