Gary Kessler Associates
Over the years, I have written a few little software utilities that I have shared with some others and they have encouraged me to make them more readily available.
Several of these programs are written in Perl. If you have a MacOS, Linux, or Unix system, a Perl interpreter is part of the operating system. For Windows users, you can run these programs in a Cygwin environment or, even easier, use one of the many Perl interpreters for Windows, such as Strawberry Perl.
See License and Warranty section below for additional information.
Boot record and other parsers: These are a number of programs that parse a variety of file system and other logical structures. All of the programs are written in Perl:
- apmparser (v1.5, 3/14/2013) parses an Apple Partition Map (APM)
[MD5 (apmparser_v1.5.zip) = 590e3edf6c5d3017d68768265bfb2f10]
- bsparser (v3.1, 3/13/2013) parses a FAT or NTFS boot sector
[MD5 (bsparser_v3.1.zip) = c3cc1a6a8ead08eabdcbc9c5d1375049]
- dirparser (v1.4, 3/27/2014) parses a FAT directory
[MD5 (dirparser_v1.4.zip) = 624fc6999bb7c73192f80a26d4b897d8]
- fatparser (v0.8, 3/18/2014) parses a FAT12, FAT16, or FAT32 table
MD5 (fatparser_v0.8.zip) = 650a577cc47d61d6d2748bb24b676dd5
- gptparser (v1.4beta, 3/14/2013) parses a GUID Partition Table (GPT) header
[MD5 (gptparser_v1.4beta.zip) = f0dcf44dd888e985461e455ca9f1cfcb]
- info2parser (v1.4, 4/9/2013) parses an NTFS INFO2 file
[MD5 (info2parser_v1.4.zip) = 3a31e5bce5fa103e16304f89fb514e1f]
- mbrparser (v2.1, 3/13/2013) parses a standard DOS/Windows Master Boot Record (MBR)
[MD5 (mbrparser_v2.1.zip) = 8fa2f1654b956c4c8870cdba4de3b8b1]
- mftparser (v2.1, 6/11/2013) parses NTFS Master File Table (MFT) records
[MD5 (mftparser_v2.1.zip) = 0a5d22d2e513f45befd1da30706e2b39]
- sqlite_parser (v2.3, 3/14/2013): This Perl program accepts as input a set of SQL records and will parse the contents for you. If you happen to know the schema, the output will match up the fields to the headers. This program is useful if you are able to carve SQL records out of unallocated space and don't have the entire file structure (in which case you could just use an SQLite browser).
[MD5 (sqlite_parser_v2.3.zip) = 1c66caff10b3e2745d640986618f09ab]
cisco7 (v1.0a, 4/24/2012): Two programs -- one in C and one in Perl -- that "cracks" a Cisco Type 7 password. Not much to the cracking, actually, since the password is merely an XOR applied to the password and a fixed string. Well, read more in the README file or in my crypto paper!
MD5 (cisco7_v1.0a.zip) = 48aaf634c34052e08254c996245b8df2
FileSigs (5/16/2013): This ZIP archive contains versions of my File Signatures Table in a format usable by FTK, Tim Coakley's Simple Carver and Simple Carver Lite, and Scalpel. The _README.txt file describes how the files can be used and their formats. *** If there are other useful formats, please let me know and I will try to accomodate. ***
[MD5 (FileSigs_20130516.zip) = 3cbe48dabde8f8514343ffaa77d75be7]
include (v2.2, 2/2/2011): For good or for bad, I have been writing my own HTML code since about 1993. This program is a small Perl script that allows you to insert a specific set of HTML code into other HTML files without the use of server-side scripting or that kind of stuff. As an example, all of the main pages on the GKA Web site have a consistent left navigation bar; it has the look and feel of using frames but each page is actually fully self-contained. I can change the leftnav bar on all of the site's pages in a few seconds merely by updating a file that contains just the leftnav code and running a script that inserts the new code into the HTML files. The Perl program and documentation are in the ZIP file.
[MD5 (include_v2.2.zip) = 8ff5ada1ab89fe7a2ee6eaf81f269ff1]
LiveSystem (v5.0, 11/10/2010): This ZIP file contains a set of free utilities from a variety of sources that can be used to acquire volatile data from a running Windows system. The type of information includes currently open TCP/UDP ports and the processes associated with those ports, currently logged on users, running processes, and more! Read the _README.TXT file for more information.
[MD5 (LiveSystem_v5.0.zip) = 05f76247c329a58ad42f7cd2043d8185]
[NOTE: I have a version of tools for live RAM imaging and volatile data acquisition that is available only to members of the law enforcement community (because of software licensing issues). If you are interested in these tools, please contact me at email@example.com.]
LiveSystem for Mac (v0.9, 6/17/2013): This ZIP file contains a batch file that can be used to acquire volatile data from a running Mac OS X (Unix) system. The type of information includes currently open TCP/UDP ports, currently logged on users, running processes, and more! Read the _README.TXT file for more information.
[MD5 (LiveSystem_Mac_v0.9.zip) = 33b518a6761c0bc5091155e462c1d5e2]
PictureReporter (v1.4, 1/12/2013): The Picture Reporter program is a simple way to take directories of pictures and create an HTML-formatted report. This was designed primarily for digital forensics examiners who might take a series of screen shots, for example, categorizing the pictures by placing them in different subdirectories. Picture Reporter will organize the pictures by directory, showing a series of thumbnail images that are hot-linked to full-size images. A user manual describes how to set up the directories.
[MD5 (PictureReporter_v1_4.zip) = 7ada5fed557d7a9abb751fd61cd55ca3]
pingsweep (v1.2, 10/31/2013): A simple Perl program that pings a range of hosts in a Class C address range. Use the -h switch for the help file.
[MD5 (pingsweep_v1.2.zip) = ce0629e8de41eb29e7a318abe00b6ad2]
RC4 (v1.3, 11/23/2012): RC4 is a simple implementation of the Rivest Cipher 4 (or Ron's Code 4) algorithm. The program is intended as a teaching tool rather than as a serious encryption application since it does not protect the key in any way, such as erasing it from RAM after use. Use the -h switch to get a list of program options or the -a switch to learn how the program works.
[MD5 (RC4_v1_3.zip) = 1b41ea3771c243f2a9a8d50990bff703]
sms7 (v2.1, 2/25/2011): Short Message Service (SMS) text messages up to 160 characters in length employ 7-bit characters that are packed into 8-bit octets. This Perl program will accept a text message and display the packed hexadecimal or accept the packed hex and display the unpacked text.
[MD5 (sms7_v2.1.zip) = a1c5474901485bf39e98a06749e9b274]
- PADI dive tables Dive Table Calculator using the PADI Recreational Dive Planner.
[MD5 (PADI_table.zip) = 770804c7c35ae1b4bd15f95471fd7147]
- PADI dive tables (metric) Metric version of the Dive Table Calculator using the PADI Recreational Dive Planner, by Sonya Imm. (Distributed with permission.)
[MD5 (PADI_table_metric.zip) = 69458490b92b8c8a789b1bd2927c6e42]
- NAUI dive tables Dive Table Calculator using the NAUI recreational dive tables.
[MD5 (NAUI_table.zip) = 695d65b28952540602d4048eae9bcb06]
- Nitrox maximum operating depth (PADI) Maximum Operating Depth calculator when using Nitrox, based on PADI tables.
[MD5 (MOD_PADI.zip) = 8677c26c8bd1e5652c735503d4f768b3]
- Nitrox maximum operating depth (NAUI) Maximum Operating Depth calculator when using Nitrox, based on NAUI tables.
[MD5 (MOD_NAUI.zip) = 8a335cb7de9a533dc87ca0bb058be265]
- Nitrox maximum operating depth (Cobra) Maximum Operating Depth calculator when using Nitrox, based on Suunto Cobra dive computers.
[MD5 (MOD_Cobra.zip) = f00242272b437a835b9dc16ba7db2972]
Latitude/Longitude Coordinate Converter (v1.0, 2/17/2012): This Excel spreadsheet converts between degree/minute/second (D°M"S'), GPS (D°M.MMM), and decimal (D.DDD°) formats for expressing latitude and longitude.
[MD5 (DMS_GPS_Decimal.xls) = 6c814a9c81df95e3b84cabaaf6c21eb8]
Latitude/Longitude Converter (v1.0, 9/19/2013): This Perl script can be used to convert latitude/longitude coordinates between degree/minute/second (D°M"S'), GPS (D°M.MMM), and decimal (D.DDD°) formats.
[MD5 (latlong.zip) = e367b76abf099ed558d0e3844f833121]
License and Warranty
All software on this page is distributed as open source and free software under the GNU General Public License (aka GPL).
These programs are distributed in the hope that they will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
All information at this site © 2000-2013, Gary C. Kessler. Permission to use the material here is extended to any of this site's visitors, as long as appropriate attribution is provided and the information is not altered in any way without express written permission of the author.