Difference between pages "Educational Resources for Teaching Computer Forensics" and "AIR"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
 
Line 1: Line 1:
Other websites with forensic information:
+
AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
  
e-evidence info:
+
Features:
* [http://www.e-evidence.info/projects.html Ongoing Forensic Projects]
+
# auto-detection of IDE and SCSI drives, CD-ROMs, and tape drives
 +
# choice of using either dd or dcfldd
 +
# image verification between source and copy via MD5 or SHA1/256/384/512
 +
# image compression/decompression via gzip/bzip2
 +
# image over a TCP/IP network via netcat/cryptcat
 +
# supports SCSI tape drives
 +
# wiping (zeroing) drives or partitions
 +
# splitting images into multiple segments
 +
# detailed logging with date/times and complete command-line used

Revision as of 20:53, 22 January 2007

AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.

Features:

  1. auto-detection of IDE and SCSI drives, CD-ROMs, and tape drives
  2. choice of using either dd or dcfldd
  3. image verification between source and copy via MD5 or SHA1/256/384/512
  4. image compression/decompression via gzip/bzip2
  5. image over a TCP/IP network via netcat/cryptcat
  6. supports SCSI tape drives
  7. wiping (zeroing) drives or partitions
  8. splitting images into multiple segments
  9. detailed logging with date/times and complete command-line used