Difference between revisions of "Helix3 Pro"

From Forensics Wiki
Jump to: navigation, search
m
(5 intermediate revisions by one user not shown)
Line 13: Line 13:
  
 
* Live side for [[Mac OS X]], [[Windows]] and [[Linux]]
 
* Live side for [[Mac OS X]], [[Windows]] and [[Linux]]
* A bootable forensically sound environment (based on Ubuntu)
+
* A bootable forensically sound environment based on [[Ubuntu]]
  
 
Open source forensic tools include:
 
Open source forensic tools include:
Line 27: Line 27:
 
* [[LinEn]]
 
* [[LinEn]]
  
== Helix3 Pro Forensic Issues ==
+
== Forensic Issues ==
  
Helix3 Pro has several major forensic issues that forensic examiners should be aware of:
+
* Helix3 Pro can automount some storage devices like firewire devices and MMC in read/write mode;
 
+
* Helix3 Pro relies on file system drivers to provide write protection, mounting some file system types (e.g. [[XFS]]) will result in several data writes to the original media.  
* Helix recovers [[ext3]] filesystems during the boot process;
+
* Media in some card readers and firewire devices can be automounted in r/w mode;
+
* Live side may collect wrong uptime values from some [[Windows]] systems;
+
* Live side has preliminary support for "foreign languages". For example, cyrillic characters are not supported in PDF reports; cyrillic characters in TXT reports are stored in both cp-1251 and [[Unicode]] encodings.
+
  
 
== See Also ==
 
== See Also ==

Revision as of 06:26, 28 July 2012

Helix3 Pro
Maintainer: e-fense
OS: Linux,Windows,Mac OS X
Genre: Live CD
License: GPL, others
Website: e-fense.com

Helix3 Pro is a Live CD built on top of Ubuntu. It focuses on incident response and computer forensics.

Tools Included

Open source forensic tools include:

Other tools include:

Forensic Issues

  • Helix3 Pro can automount some storage devices like firewire devices and MMC in read/write mode;
  • Helix3 Pro relies on file system drivers to provide write protection, mounting some file system types (e.g. XFS) will result in several data writes to the original media.

See Also

Free version: Helix3