Using Strings For Incident Investigation?

What is Strings?

Strings is a tool which is used to extract string (Text) from a program or any other file. By default it extracts a string having a minimum of 4 charterers (but this can be changed by using the -n switch).

How does the Strings work?

Strings can be helpful to find out any text (such as url’s). Even though Strings is a really helpful tool but can not be completely relied upon. you can not rely on Strings solely because the attacker also knows that you might use Strings therefore can plant false flags in the program to confuse or derail you from your analysis.

How does the Strings work?

  1. Open CMD/Powershell (from Windows) or Terminal (*NIX)
  2. Go to the directory where you have saved the Strings program (Downloads in this case)
  3. Use Strings
    • Syntax: ./strings.exe

Examples:

  1. Here we have used strings on the strings software itself.

2. Here we have used strings on the Eula.txt file.