strings & grep for Evidence

Why strings & grep first

Before deep forensic analysis, run the cheap pass: strings pulls readable text out of binary data, and grep hunts for interesting patterns. Five minutes of grep can locate the smoking gun that saves hours of manual review.

Mastering strings

# basic - printable ASCII sequences of 4+ chars
strings /evidence/image.dd

# longer minimum length filters noise
strings -n 8 /evidence/image.dd

# extract UTF-16 strings (Windows files, some configs)
strings -el /evidence/image.dd

# show the byte offset of each string - useful for carving later
strings -t d /evidence/image.dd   # decimal offset

# scan ALL files under a dir (the live filesystem)
find /home/bob -type f -exec strings {} + | grep -i "password"

grep patterns that matter

# URLs & domains (C2 servers, exfil targets)
strings image.dd | grep -Eo "https?://[a-zA-Z0-9./?=_-]+" | sort -u

# IP addresses
strings image.dd | grep -Eo "([0-9]{1,3}\.){3}[0-9]{1,3}" | sort -u

# email addresses
strings image.dd | grep -Eo "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" | sort -u

# commands (watch for shell tricks / obfuscation)
strings image.dd | grep -E "curl|wget|/tmp/|base64|/dev/tcp/|chmod \+x|nc -"

# common Linux backdoor / crypto miner keywords
strings image.dd | grep -Ei "xmrig|cryptominer|knockd|authorized_keys" | head

ripgrep for large images

Grepping gigabytes of image data is slow with plain grep. rg (ripgrep) is dramatically faster and handles binary files gracefully:

apt install ripgrep

# search a binary image, printing context
rg -a -i -C 3 "password" /evidence/image.dd

# -a     treat binary as text
# -i     case-insensitive
# -C 3   three lines of context around each hit

# show byte offsets too
rg -a -b -i "BEGIN RSA PRIVATE KEY" /evidence/image.dd

Hunting credentials & indicators

# SSH private keys lying around
strings image.dd | grep -a "BEGIN.*PRIVATE KEY" | sort -u

# API keys / tokens (common formats)
strings image.dd | grep -Eo "sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36,}"

# database connection strings
strings image.dd | grep -Ei "mysql://|postgres://|mongodb://|redis://"

# last modified files hint at attack window - pair with timeline
strings -n 8 /evidence/part2.dd | grep -i "flag\|secret\|key" | sort -u | head -30

Limits & gotchas

• strings misses compressed, encrypted, or obfuscated content (packers, XOR, gzip).
• Short -n values drown you in noise; long ones miss real strings.
• Plain grep on multi-GB images is slow — use rg or split first.
• Output order in strings is file order, not logical order for the analyst — sort aggressively.

For deeper automated scanning of the same material, pair this with bulk_extractor.

← Previous: File Carving  ·  Next: testdisk & photorec →