Difference between pages "DEFT Linux 2" and "Linux Repositories"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(New page: == Tools included == '''Deft v2 computer and network forensic packages list:''' : - sleuthkit, collection of UNIX-based command line tools that allow you to investigate a computer : - au...)
 
(Imaging Tools)
 
Line 1: Line 1:
== Tools included ==
 
  
'''Deft v2 computer and network forensic packages list:'''
+
There are a number of linux distributions.
  
: - sleuthkit, collection of UNIX-based command line tools that allow you to investigate a computer
+
In general they have primary repositories which are setup for every installation of the operating system and they have special purpose repositories which require specific setup.
: - autopsy, graphical interface to the command line digital investigation tools in The Sleuth Kit
+
: - aff lib, advanced forensic format
+
: - gpart, tool which tries to guess the primary partition table of a PC-type hard disk
+
: - dd rescue, copy data from one file or block device to another
+
: - foremost, console program to recover files based on their headers, footers, and internal data structures
+
: - hex dump, combined hex and ascii dump of any file
+
: - khex edit, a versatile and customizable hex editor
+
: - steg detect, a steganography detection software
+
: - outguess, a stegano tool
+
: - ophcrack, Windows password recovery
+
: - wireshark, network sniffer
+
: - ettercap, network sniffer
+
: - nessus, vulnerability and security scanner (client)
+
: - nessusd, vulnerability and security scanner (server)
+
: - nmap, the best network scanner
+
: - airsnort, wireless LAN (WLAN) tool which recovers encryption keys
+
: - kismet, sniffer and intrusion detection system that work with any wireless card
+
: - dmraid, discover software RAID devices
+
: - testdisk, tool to recover damaged partitions
+
: - qtparted, a Partition Magic clone written in C++ using the Qt toolkit
+
: - vinetto, tool to examine Thumbs.db files
+
: - trID, tool to identify file types from their binary signatures
+
: - readpst, a tools to read ms-Outlook pst files
+
: - john, John the Ripper password cracker
+
: - Clam, Anti Virus
+
  
 +
=Repository Setup=
 +
==openSUSE==
 +
For current openSUSE 11.4 and 12.1 users it is necessary to have the following repositories configured:
  
'''Deft utility package list:'''
+
*security
 +
*devel:languages:perl
 +
*devel:languages:python
  
: - linux Kernel 2.6.20
+
This is most easily done from the command line via (assumes openSUSE 12.1):
: - lkDE 3.5.6
+
 
: - k3b
+
sudo zypper ar -f <nowiki>http://download.opensuse.org/repositories/security/openSUSE_12.1</nowiki> security
: - krdc
+
sudo zypper ar -f <nowiki>http://download.opensuse.org/repositories/devel:/languages:/perl</nowiki>/openSUSE_12.1 perl
: - rdesktop
+
sudo zypper ar -f <nowiki>http://download.opensuse.org/repositories/devel:/languages:/python/openSUSE_12.1</nowiki> python
: - samba client
+
: - open SSH client & server
+
zypper lr  <nowiki>          </nowiki>  # used to verify you have the repos installed
 +
 
 +
==fedora==
 +
==debian==
 +
==ubuntu==
 +
 
 +
=Computer Forensic Tools=
 +
Below is a list of computer forensic tools.  For each tool the repository it can be found in and the version in the repository is shown.
 +
 
 +
As an example, aimage is in the openSUSE security repository and it is version 3.2.5
 +
 
 +
==Imaging Tools==
 +
 
 +
{|border="1" cellpadding="2" cellspacing="0" {{repository table}}
 +
|-
 +
|rowspan=1| '''Tool'''
 +
|'''openSUSE'''
 +
|'''fedora'''
 +
|'''debian'''
 +
|'''ubuntu'''
 +
|'''comment'''
 +
|'''General Remarks'''
 +
 
 +
|-
 +
|rowspan=1| [http://www.e-fense.com/helix/ adepto]
 +
|N/A <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|  <!-- comment -->
 +
|adepto is included in the helix boot cd<!-- General Remarks -->
 +
 
 +
|-
 +
|rowspan=1| [[aimage]]
 +
|security/3.2.5 <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|a imaging tool to create aff format images  <!-- comment -->
 +
|aimage has been EOL'ed.  guymager or ftkimager (windows/mac) are recommended for creating aff images. <!-- General Remarks -->
 +
 
 +
|-
 +
|rowspan=1| [[AIR]]
 +
|N/A <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|Automated Image and Restore  <!-- comment -->
 +
|a GUI front-end to dd and dc3dd designed for easily creating forensic bit images <!-- General Remarks -->
 +
 
 +
|-
 +
|rowspan=1| [[dc3dd]]
 +
|security*/7.1.614 <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|DoD Cyber Crime Center DD  <!-- comment -->
 +
|This tool was formerly known as dcfldd.  When released as dc3dd it was totally rewritten. <!-- General Remarks -->
 +
 
 +
|-
 +
|rowspan=1| [[ddrescue]]
 +
|Base/1.14 <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|Also known as GNU ddrescue<!-- comment -->
 +
|This tool is different than dd_rescue.
 +
 
 +
|-
 +
|rowspan=1| [[dd_rescue]]
 +
|N/A <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|<!-- comment -->
 +
|This tool is different than GNU ddrescue.
 +
 
 +
|-
 +
|rowspan=1| [[IXimager]]
 +
|N/A <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|A law enforcement only imager<!-- comment -->
 +
|used in conjunction with ILook Investigator
 +
 
 +
|-
 +
|rowspan=1| [[libewf|ewfacquire]]
 +
|security*/20100226 <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|a imaging tool to create ewf format images  <!-- comment -->
 +
|ewfacquire is part of ewftools in some distributions.<!-- General Remarks -->
 +
 
 +
|-
 +
|rowspan=1| [[LinEn]]
 +
|N/A <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|a proprietary imaging tool to create ewf format images  <!-- comment -->
 +
|included on the Helix boot CD<!-- General Remarks -->
 +
 
 +
|-
 +
|rowspan=1| [[guymager]]
 +
|N/A<!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|a imaging tool to create aff format images  <!-- comment -->
 +
|Guymager is an open source forensic imager. It focuses on user friendliness and high speed.  <!-- General Remarks -->
 +
 
 +
|-
 +
|rowspan=1| [http://sourceforge.net/projects/rdd rdd]
 +
|N/A <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|a dd-like tool, with forensic imaging features  <!-- comment -->
 +
|Rdd is robust with respect to read errors<!-- General Remarks -->
 +
 
 +
|-
 +
|rowspan=1| [ftp://ftp.berlios.de/pub/sdd/ sdd]
 +
|Archiving:Backup/1.52 <!-- opensuse -->
 +
|?              <!-- fedora-->
 +
|?              <!-- debian-->
 +
|?              <!-- ubuntu-->
 +
|a dd-like tool<!-- comment -->
 +
|Designed to work well when IBS != OBS.  Working with tape is an example.<!-- General Remarks -->
 +
 
 +
|}
 +
 
 +
*package will appear in the base release with the next full distribution release.

Revision as of 19:28, 24 February 2012

There are a number of linux distributions.

In general they have primary repositories which are setup for every installation of the operating system and they have special purpose repositories which require specific setup.

Repository Setup

openSUSE

For current openSUSE 11.4 and 12.1 users it is necessary to have the following repositories configured:

  • security
  • devel:languages:perl
  • devel:languages:python

This is most easily done from the command line via (assumes openSUSE 12.1):

sudo zypper ar -f http://download.opensuse.org/repositories/security/openSUSE_12.1 security
sudo zypper ar -f http://download.opensuse.org/repositories/devel:/languages:/perl/openSUSE_12.1 perl
sudo zypper ar -f http://download.opensuse.org/repositories/devel:/languages:/python/openSUSE_12.1 python

zypper lr               # used to verify you have the repos installed

fedora

debian

ubuntu

Computer Forensic Tools

Below is a list of computer forensic tools. For each tool the repository it can be found in and the version in the repository is shown.

As an example, aimage is in the openSUSE security repository and it is version 3.2.5

Imaging Tools

Tool openSUSE fedora debian ubuntu comment General Remarks
adepto N/A ? ? ? adepto is included in the helix boot cd
aimage security/3.2.5 ? ? ? a imaging tool to create aff format images aimage has been EOL'ed. guymager or ftkimager (windows/mac) are recommended for creating aff images.
AIR N/A ? ? ? Automated Image and Restore a GUI front-end to dd and dc3dd designed for easily creating forensic bit images
dc3dd security*/7.1.614 ? ? ? DoD Cyber Crime Center DD This tool was formerly known as dcfldd. When released as dc3dd it was totally rewritten.
ddrescue Base/1.14 ? ? ? Also known as GNU ddrescue This tool is different than dd_rescue.
dd_rescue N/A ? ? ? This tool is different than GNU ddrescue.
IXimager N/A ? ? ? A law enforcement only imager used in conjunction with ILook Investigator
ewfacquire security*/20100226 ? ? ? a imaging tool to create ewf format images ewfacquire is part of ewftools in some distributions.
LinEn N/A ? ? ? a proprietary imaging tool to create ewf format images included on the Helix boot CD
guymager N/A ? ? ? a imaging tool to create aff format images Guymager is an open source forensic imager. It focuses on user friendliness and high speed.
rdd N/A ? ? ? a dd-like tool, with forensic imaging features Rdd is robust with respect to read errors
sdd Archiving:Backup/1.52 ? ? ? a dd-like tool Designed to work well when IBS != OBS. Working with tape is an example.
  • package will appear in the base release with the next full distribution release.