FAW is the first browsing program designed to acquire websites for Forensics purposes from any website on the internet.
The FAW program or Forensics Acquisition of Websites allows full acquisition, i.e., complete analysis of the website or just a part of it, letting the user quickly and easily choose what they want to use. Having as tools the scroll bar and the horizontal cursor makes it easy for the user to decide which web area of the page they want to analyze.
Additionally, the application can analyze all pages that contain data streams. The software automatically acquires the videos or pages with the help of plug-ins (JavaScript, jQuery, Flash, etc.).
The program is also designed to work with websites that contain frames, i.e., sites that consist of different sections, independent of each other. The side scrollbars allow navigation between the different frames so that it can be decided what should be obtained from the user.
Additionally, you can obtain all types of files from the website, including: images, files, documents, executables and Scripts. The items of all scanned files are placed in the Acquisition.xml folder.
The acquisition of objects linked to the page is configured by the user from the Configuration> Linked Objects menu. It is also important that the HTML code of the websites can be obtained.
-Integration with Wireshark. Wireshark is a network protocol analyzer, widely used in forensic networks, which has a benchmark for flexibility. Thanks to special rules for classification and filtering the researcher can extract and analyze data quickly. FAW uses the capabilities of Wireshark to capture all traffic on all interfaces in active networks. During the acquisition of the web page, the researcher can make an analysis of all the network traffic that passed to reach the Web page. The integration allows you to have a log file in pcap format.
-Automatic calculation of MD5 and SHA1 hash of all acquired files. The application automatically performs MD5 hash and SHA1 calculation for all acquired files. Hash algorithms, especially SHA1 and MD5 are widely used in computer forensics to validate and digitally sign acquired data. Recent legislation mandates a chain of custody that allows for the preservation of IT primarily from possible changes after acquisition.
-Acquisition Integrity Verification. This feature allows you to verify the integrity of your purchase, using a proprietary algorithm to check that all recorded files have not been altered.
It is important to note that 9 versions of the program have been released, with the latest being on 8/1/2014, which means that the program is constantly updated; it is also a freeware program that anyone can download from the download center of the site. Finally, for anyone interested in downloading this specific program on the Site's page, there are specific steps that make navigation in the program very easy!
Paraprastatis Konstantinos and Papapashos Nikos @Wikibook
Download
https://www.fawproject.com/en/download.aspx
