Difference between pages "First Responder's Evidence Disk" and "Knoppix STD"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
 
 
Line 1: Line 1:
 +
{{Deprecated Software}}
 +
 
{{Infobox_Software |
 
{{Infobox_Software |
   name = FRED |
+
   name = Knoppix STD |
   maintainer = Jesse Kornblum |
+
   maintainer = [[STD project]]  |
   os = {{Linux}}, {{Windows}} |
+
   os = [[Linux]] |
   genre = {{Incident response}} |
+
   genre = {{Live CD}}, {{Incident Response}} |
   license = {{commercial}} |
+
   license = {{GPL}} |
   website = [http://darkparticlelabs.com/projects darkparticlelabs.com/projects] |
+
   website = [http://s-t-d.org/ s-t-d.org/] |
 
}}
 
}}
  
The First Responder's Evidence Disk, or FRED, is a script based [[Incident Response|incident response]] tool. It was designed to capture volatile information from a computer system for later analysis without modifying anything on the victim. It consists of a batch file used to execute a set of known good tools that gather the state of a victim computer system. It was similar to the [[IRCR]] program and has been widely imitated by other tools. Many other incident response tools used names similar to FRED.
+
Knoppix STD is a [[computer forensics]] / [[Incident Response|incident response]] [[Live CD]] based on Knoppix.
  
== Usage ==
+
== Tools ==
  
The program was distributed as a compressed 1.44 MB floppy image. The examiner runs this image on a safe system and writes the FRED program out to a piece of removable media such as a floppy disk or USB device. The examiner then connects this device to the victim machine. When run, the FRED program writes information out to an audit file on the removable device. The examiner takes this audit file back to the safe system for later analysis. The audit file can also be sent to other investigators if desired.
+
=== Forensics ===
  
== History ==
+
* [[Sleuthkit]] 1.66 : extensions to The Coroner's Toolkit forensic toolbox.
 +
* autopsy 1.75 : Web front-end to TASK. Evidence Locker defaults to /mnt/evidence
 +
* biew : binary viewer
 +
* bsed : binary stream editor
 +
* consh : logged shell (from F.I.R.E.)
 +
* coreography : analyze core files
 +
* dcfldd : US DoD Computer Forensics Lab version of dd
 +
* fenris : code debugging, tracing, decompiling, reverse engineering tool
 +
* fatback : Undelete FAT files
 +
* foremost : recover specific file types from disk images (like all JPG files)
 +
* ftimes : system baseline tool (be proactive)
 +
* galleta : recover Internet Explorer cookies
 +
* hashdig : dig through hash databases
 +
* hdb : java decompiler
 +
* mac-robber : TCT's graverobber written in C
 +
* [[md5deep]] : run md5 against multiple files/directories
 +
* memfetch : force a memory dump
 +
* pasco : browse IE index.dat
 +
* photorec : grab files from digital cameras
 +
* readdbx : convert Outlook Express .dbx files to mbox format
 +
* readoe : convert entire Outlook Express .directory to mbox format
 +
* rifiuti : browse Windows Recycle Bin INFO2 files
 +
* secure_delete : securely delete files, swap, memory....
 +
* testdisk : test and recover lost partitions
 +
* wipe : wipe a partition securely. good for prep'ing a partition for dd
 +
* and other typical system tools used for forensics (dd, lsof, strings, grep, etc.)
  
FRED was developed by [[Jesse Kornblum]] for the [[Air Force Office of Special Investigations]] starting in the fall of 2000 and was first released in 2001. The tool was publicly unveiled the following year at the [[Digital Forensic Research Workshop|DFRWS Conference]]. Although the component parts of FRED were not released, mostly due to licensing restrictions, Kornblum did present a paper, ''[http://dfrws.org/2002/papers/Papers/Jesse_Kornblum.pdf Preservation of Fragile Digital Evidence by First Responders]'', that included the FRED script.
+
== External Links ==
  
A version of the FRED script was later incorporated into the [[Helix]] disk.  
+
* [http://s-t-d.org/ Official Site]
 
+
* [http://forum.s-t-d.org/ Support Forum]
There was a proposal for a program to process the audit files into [[HTML]], but this never came to fruition.
+
 
+
Since 2004 FRED has been maintained by the [[Air Force Computer Emergency Response Team]]. The current version of FRED (version 4) has been redesigned as a single executable, with remote collection capabilities, and uses Native API functions. The audit file uses PKI for encryption to protect the contents from tampering and disclosure. The publicly available version has the remote functionality as well as the PKI encryption capabilities turned off.
+
 
+
== Trivia ==
+
 
+
The desire for a recursive [[MD5]] program for FRED inspired the development of [[md5deep]].
+
 
+
== See Also ==
+
* [[IRCR]]
+
* [[COFEE]]
+
 
+
== External Links ==
+
* [http://darkparticlelabs.com/projects Project site]
+

Revision as of 04:40, 18 January 2014

40px-Ambox warning pn.png

This tool is deprecated.
The tool that this page describes is deprecated and is no longer under active development.
Further information might be found on the discussion page.

Knoppix STD
Maintainer: STD project
OS: Linux
Genre: Live CD, Template:Incident Response
License: GPL
Website: s-t-d.org/

Knoppix STD is a computer forensics / incident response Live CD based on Knoppix.

Tools

Forensics

  • Sleuthkit 1.66 : extensions to The Coroner's Toolkit forensic toolbox.
  • autopsy 1.75 : Web front-end to TASK. Evidence Locker defaults to /mnt/evidence
  • biew : binary viewer
  • bsed : binary stream editor
  • consh : logged shell (from F.I.R.E.)
  • coreography : analyze core files
  • dcfldd : US DoD Computer Forensics Lab version of dd
  • fenris : code debugging, tracing, decompiling, reverse engineering tool
  • fatback : Undelete FAT files
  • foremost : recover specific file types from disk images (like all JPG files)
  • ftimes : system baseline tool (be proactive)
  • galleta : recover Internet Explorer cookies
  • hashdig : dig through hash databases
  • hdb : java decompiler
  • mac-robber : TCT's graverobber written in C
  • md5deep : run md5 against multiple files/directories
  • memfetch : force a memory dump
  • pasco : browse IE index.dat
  • photorec : grab files from digital cameras
  • readdbx : convert Outlook Express .dbx files to mbox format
  • readoe : convert entire Outlook Express .directory to mbox format
  • rifiuti : browse Windows Recycle Bin INFO2 files
  • secure_delete : securely delete files, swap, memory....
  • testdisk : test and recover lost partitions
  • wipe : wipe a partition securely. good for prep'ing a partition for dd
  • and other typical system tools used for forensics (dd, lsof, strings, grep, etc.)

External Links