Difference between revisions of "Helix3 Pro"

Latest revision as of 06:26, 28 July 2012

Helix3 Pro is a Live CD built on top of Ubuntu. It focuses on incident response and computer forensics.

Open source forensic tools include:

Other tools include:

Helix3 Pro can automount some storage devices like firewire devices and MMC in read/write mode;
Helix3 Pro relies on file system drivers to provide write protection, mounting some file system types (e.g. XFS) will result in several data writes to the original media.

Free version: Helix3

@@ Line 13: / Line 13: @@
 * Live side for [[Mac OS X]], [[Windows]] and [[Linux]]
-* A bootable forensically sound environment (based on Ubuntu)
+* A bootable forensically sound environment based on [[Ubuntu]]
 Open source forensic tools include:
@@ Line 27: / Line 27: @@
 * [[LinEn]]
-== Helix3 Pro Forensic Issues ==
+== Forensic Issues ==
-Helix3 Pro has several major forensic issues that forensic examiners should be aware of:
+* Helix3 Pro can automount some storage devices like firewire devices and MMC in read/write mode;
+* Helix3 Pro relies on file system drivers to provide write protection, mounting some file system types (e.g. [[XFS]]) will result in several data writes to the original media.
-* Helix recovers [[ext3]] filesystems during the boot process;
-* Media in some card readers and firewire devices can be automounted in r/w mode;
-* Live side may collect wrong uptime values from some [[Windows]] systems;
-* Live side has preliminary support for "foreign languages". For example, cyrillic characters are not supported in PDF reports; cyrillic characters in TXT reports are stored in both cp-1251 and [[Unicode]] encodings.
 == See Also ==