next »

[Maltego Forum]

Maltego Forum » General » General Discussions
Understanding Maltego description

[saidelike]

Hi,

I would like to translate the Maltego''s web site''s first page in French but I need to understand some points.

Maltego is an open source intelligence and forensics application. It allows for the mining and gathering of information as well as the representation of this information in a meaningful way.

Coupled with its graphing libraries, Maltego, allows you to identify key relationships between information and identify previously unknown relationships between them. It is a must-have tool in the forensics.security and intelligence fields!

Maltego offers the user with unprecedented information.  Information is leverage.

    Information is power. Information is Maltego.

I understood the following:
- it is an open source intelligence application meaning it takes informations from opened (=available) sources and computes (thanks to some intelligent process) a useful information.

However, I don''t understand :
- what forensics application means: is it because it is legal (lawful) ? If yes, why is it important to underline it ? Or is it because it makes some analysis and computation ? Wikipedia says "Forensics is a broad range of subspecialties which use techniques adapted from the natural sciences to obtain criminal or other legal evidence."
- again, what is the forensics.security field we are talking about?

Thanks in advance,

[RT]

Good question. The thinking here is network, or rather Internet forensics. Just like you would be looking at the hard drive for information left by the user of a PC (traditional computer forensics), or the network traces in a NetFlow (for network forensics), you can use Maltego to look at the Internet for information, profiles, events and related infrastructure left by the ''target''. Maltego is used regularly by law enforcement for exactly that purpose - to see what traces has been left on the Internet by the criminal - especially around the virtual ''crime scene''.

Hope this explains the ''forensics'' part.
RT

[saidelike]

Good question. The thinking here is network, or rather Internet forensics. Just like you would be looking at the hard drive for information left by the user of a PC (traditional computer forensics), or the network traces in a NetFlow (for network forensics), you can use Maltego to look at the Internet for information, profiles, events and related infrastructure left by the ''''target''''. Maltego is used regularly by law enforcement for exactly that purpose - to see what traces has been left on the Internet by the criminal - especially around the virtual ''''crime scene''''.

Hope this explains the ''''forensics'''' part.
RT

Yes, it helps a lot. Thanks.

What interests me then is the fact that regarding traditional computer forensics, the goal is to find traces but WITHOUT changing anything on the analyzed element. However, I do not see how it can be possible browsing the Internet and its thousands of elements per second...

said.