SmutDetect4Autopsy

SmutDetect_128SmutDetect4Autopsy

SmutDetect was originally developed as a standalone application but is now being ported to work in Autopsy 3 as a module. The standalone version was mainly developed for Linux but worked partially on other OS. Even though the standalone application has currently more functionality the module offers greater potential as file selection based on file signature is easier and result of other modules such as the Video triage module may be possible in the future.

Current progress will be published as blog posts under the tag: SmutDetect4Autopsy.

Download

20141204_SmutDetect4Autopsy_1.0.2.nbm.zip
MD5: f1dfab5322063a2b617564fb537a2291
SHA1: 211c3fa60c7cd1aefd066ffc3b2f666e0e487f4a

SmutDetect4Autopsy_0_0_1.zip
MD5: 3eabbef7846f7adb44b54c5e7c35046e
SHA1: baa1353ab00aaa9efc7a54a43847f71a92ec0697

ChangeLog

Release 1.0.2

  • Ported the module to the Autopsy API 3.1
  • Changed the results from File Tags to “Interesting Files” section

 

Source

Available under:

https://github.com/rajwitt/SmutDetect4Autopsy

 

Current Implementations

  • Simple Scan of JPG, BMP, PNG & GIF files (seletion of files based on file signatures) for pixels with skin tone and computing percentages. Files are tagged with skin-tone percentages in increments of 10 to allow a categorised view of thumbnails
VHD testdata set analysed with SmutDetect4Autopsy 1.0.2 using TSK_INTERESTING_FILE_HIT; thumbnail view pixelated for web-use

VHD testdata set analysed with SmutDetect4Autopsy 1.0.2 using TSK_INTERESTING_FILE_HIT; thumbnail view pixelated for web-use

Results in Autopsy

Results in Autopsy

Testdata sets used so far

  • E01 test images of thumbdrives containing a collection of pictures
  • A Windows 7 Virtual machine mounted as a local VHD, added in Autopsy; contains several user profiles with different cached Internet browsing history and nature of images viewed by the “user”

Future Roadmap

  • Implement Logging output
  • Port to 3.1 API
  • Small Report Module?
  • Better Tagging/Posting of result to the Blackboard (currently tags are sorted by creation date and do not allow subtags; hope to find something in API 3.1)
  • Possible input selection of the video triage module
  • New Algorithms for shape recognition
  • Debug output for development support

 

7 Comments

  1. Hello. Any timeline when this might be ported to 3.1?

    • Hi Dan, I am currently migrating to a new machine and this took away my focus from this project. I am planning on picking this up in the next weeks and getting github setup for the code, research the changes necessary to port to the new API. I will let you know how I am getting on 🙂 I believe that by end of November there should be a port for 3.1

      If you have any other suggestions please let me know.
      Regards
      Raj

  2. Hi Dan, the module has been ported to API 3.1 🙂 Hope you like it.

    Raj

    • Fantastic! I’ll try it out today and let you know.

      • Great work Raj. The module works perfectly with 3.1. Thanks for the help with this.

        BTW…if you ever want to test the effectiveness of any new detection algorithms, please let me know. This module, like all detectors out there, does give some false positive results. And unfortunately it does give some false negatives. But on a whole it generally does a very good job at detecting the presence of inappropriate content and makes sorting it rather easy.

        Thanks again!

  3. This is an excellent module and works seamlessly for me on 3.1!

    Thank you taking the time to do this 🙂

  4. Pingback: SmutDetect - Open Source Buzz

Leave a Reply