🔍 Forensic Tools

This repository contains two shell scripts designed to assist in digital forensics investigations:

• dd.sh — Securely create a bit-by-bit image of a USB device.
• john.sh — Extract password hashes from protected Microsoft Office documents and prepare them for cracking using John the Ripper.

---

📁 Contents

• dd.sh: A bash script for imaging USB drives using the dd utility.
• john.sh: A bash script for extracting password hashes from protected .doc or .docx files using office2john.py.

---

⚙️ Prerequisites

These tools are designed to be run on Linux systems and require root privileges for some operations.

General Requirements

• Bash
• lsblk, dd, umount, wget, python3
• Internet connection (for downloading office2john.py)

For john.sh specifically:

• John the Ripper
• office2john.py from the John the Ripper GitHub repo

---

🧰 Script Details

dd.sh – USB Forensic Imaging Script

Purpose: Create a raw disk image (.img) of a USB device using dd.

🔐 Requires sudo

🚀 How It Works:

1. Prompts for the USB device label.
2. Identifies the device using lsblk.
3. Unmounts the USB.
4. Asks for an output path.
5. Performs a bit-by-bit copy using dd.

✅ Example Usage:

sudo ./dd.sh

📁 Output: A .img file stored at your specified location.

---

john.sh – Office Password Hash Extraction

Purpose: Automates extraction of password hashes from Microsoft Word documents using office2john.py, preparing them for cracking with John the Ripper.

🚀 How It Works:

1. Installs John the Ripper (via APT).
2. Downloads office2john.py.
3. Prompts for the Word document path.
4. Extracts the hash to hash.txt (suitable for cracking with John).

✅ Example Usage:

./john.sh

🔐 Result: A hash.txt file containing the extracted hash (ready for cracking).

---

⚠️ Legal Disclaimer

These tools are intended for educational and legal forensic investigation purposes only.

Do not use them on devices or files without explicit permission. Unauthorised use may violate privacy laws and result in legal consequences.