Difference between revisions of "First Responder's Evidence Disk"

From ForensicsWiki
Jump to: navigation, search
(New page: The First Responder's Evidence Disk, or FRED, is a tool for capturing volatile information from a computer system for later analysis. It consists of a batch file used to execute a set of k...)
 
m
Line 1: Line 1:
The First Responder's Evidence Disk, or FRED, is a tool for capturing volatile information from a computer system for later analysis. It consists of a batch file used to execute a set of known good tools that gather the state of a victim computer system. It was similar to the [[IRCR]] program and has been widely imitated by other tools. Many other incident response tools used names similar to FRED.
+
The First Responder's Evidence Disk, or FRED, is a tool for capturing volatile information from a computer system for later analysis. It consists of a batch file used to execute a set of known good tools that gather the state of a victim computer system. It was similar to the [[IRCR]] program and has been widely imitated by other tools. Many other [[Incident Response|incident response]] tools used names similar to FRED.
  
 
== Usage ==
 
== Usage ==

Revision as of 11:48, 27 February 2007

The First Responder's Evidence Disk, or FRED, is a tool for capturing volatile information from a computer system for later analysis. It consists of a batch file used to execute a set of known good tools that gather the state of a victim computer system. It was similar to the IRCR program and has been widely imitated by other tools. Many other incident response tools used names similar to FRED.

Usage

The program is distributed as a compressed image. The examiner runs this image on a safe system and writes the FRED program out to a piece of removable media such as a floppy disk or USB device. The examiner then connects this device to the victim machine. When run, the FRED program writes information out to an audit file on the removable device. The examiner takes this audit file back to the safe system for later analysis. The audit file can also be sent to other investigators if desired.

History

FRED was developed by Jesse Kornblum for the Air Force Office of Special Investigations in 2002. It was first presented that year at the DFRWS Conference along with a paper on general principals for preserving volatile information. This version was available to AFOSI agents only.

A version of the FRED script can be found in the Helix disk.

FRED is now maintained by the Air Force Computer Emergency Response Team and is not publicly available.

Trivia

The desire for a recursive MD5 program for FRED inspired the development of md5deep.


External Links