Difference between pages "Linux Repositories" and "Main Page"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m (→‎Repository Setup: +altlinux)
 
m
 
Line 1: Line 1:
 +
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#faf0ff; align:right; border:1px solid #ddccff;">
 +
This is the '''Forensics Wiki''', a [http://creativecommons.org/licenses/by-sa/2.5/ Creative Commons]-licensed [http://en.wikipedia.org/wiki/Wiki wiki] devoted to information about [[digital forensics]] (also known as computer forensics). We currently list a total of [[Special:Allpages|{{NUMBEROFARTICLES}}]] pages.
 +
 
 +
Much of [[computer forensics]] is focused on the [[tools]] and [[techniques]] used by [[investigator]]s, but there are also a number of important [[papers]], [[people]], and [[organizations]] involved. Many of those organizations sponsor [[Upcoming_events|conferences]] throughout the year and around the world. You may also wish to examine the popular [[journals]] and some special [[reports]].
 +
</div> 
  
−
There are a number of linux distributions.
 
  
−
In general they have primary repositories which are setup for every installation of the operating system and they have special purpose repositories which require specific setup.
+
==WIKI NEWS==
 +
2013-05-15: You can now subscribe to Forensics Wiki Recent Changes with the [[ForensicsWiki FeedBurner Feed]]
  
−
=Repository Setup=
+
{| width="100%"
−
==openSUSE==
+
|-
−
For current openSUSE 11.4 and 12.1 users it is necessary to have the following repositories configured:
+
| width="60%" style="vertical-align:top" |
 +
<!-- Selected Forensics Research --> 
 +
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffff99; align:center; border:1px solid #ddccff;">
 +
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
  
−
*security
+
<small>May 2014</small>
−
*devel:languages:perl
+
<bibtex>
−
*devel:languages:python
+
@inproceedings{Hurley:2013:MAC:2488388.2488444,
 +
author = {Hurley, Ryan and Prusty, Swagatika and Soroush, Hamed and Walls, Robert J. and Albrecht, Jeannie and Cecchet, Emmanuel and Levine, Brian Neil and Liberatore, Marc and Lynn, Brian and Wolak, Janis},
 +
title = {Measurement and Analysis of Child Pornography Trafficking on P2P Networks},
 +
booktitle = {Proceedings of the 22Nd International Conference on World Wide Web},
 +
series = {WWW '13},
 +
year = {2013},
 +
isbn = {978-1-4503-2035-1},
 +
location = {Rio de Janeiro, Brazil},
 +
pages = {631--642},
 +
numpages = {12},
 +
url = {http://dl.acm.org/citation.cfm?id=2488388.2488444},
 +
acmid = {2488444},
 +
publisher = {International World Wide Web Conferences Steering Committee},
 +
address = {Republic and Canton of Geneva, Switzerland},
 +
keywords = {digital forensics, forensic triage},
 +
}
 +
</bibtex>
 +
Peer-to-peer networks are the most popular mechanism for the criminal acquisition and distribution of child pornography (CP). In this paper, we examine observations of peers sharing known CP on the eMule and Gnutella networks, which were collected by law enforcement using forensic tools that we developed. We characterize a year's worth of network activity and evaluate different strategies for prioritizing investigators' limited resources. The highest impact research in criminal forensics works within, and is evaluated under, the constraints and goals of investigations. We follow that principle, rather than presenting a set of isolated, exploratory characterizations of users.
  
−
This is most easily done from the command line via (assumes openSUSE 12.1):
+
First, we focus on strategies for reducing the number of CP files available on the network by removing a minimal number of peers. We present a metric for peer removal that is more effective than simply selecting peers with the largest libraries or the most days online. Second, we characterize six aggressive peer subgroups, including: peers using Tor, peers that bridge multiple p2p networks, and the top 10% of peers contributing to file availability. We find that these subgroups are more active in their trafficking, having more known CP and more uptime, than the average peer. Finally, while in theory Tor presents a challenge to investigators, we observe that in practice offenders use Tor inconsistently. Over 90% of regular Tor users send traffic from a non-Tor IP at least once after first using Tor.
 +
(See also [[Past Selected Articles]])
  
−
sudo zypper ar -f <nowiki>http://download.opensuse.org/repositories/security/openSUSE_12.1</nowiki> security
+
| width="40%" style="vertical-align:top" |
−
sudo zypper ar -f <nowiki>http://download.opensuse.org/repositories/devel:/languages:/perl</nowiki>/openSUSE_12.1 perl
+
−
sudo zypper ar -f <nowiki>http://download.opensuse.org/repositories/devel:/languages:/python/openSUSE_12.1</nowiki> python
+
−
+
−
zypper lr  <nowiki>          </nowiki>  # used to verify you have the repos installed
+
  
−
==fedora==
+
<div style="margin-top:0.5em; border:2px solid #00ff00; padding:0.5em 0.5em 0.5em 0.5em; background-color:#ffeeff; align:center; border:1px solid #ffccff;">
 +
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">  Featured Article </h2>
 +
;[[Forensic Linux Live CD issues]]
 +
:Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. [[Forensic Linux Live CD issues|Read More...]]
  
−
[https://forensics.cert.org/ CERT] maintains a fedora security repository with a large number of DFIR applications.
+
|}
  
−
==debian==
 
  
−
You can search for debian packages at [http://packages.debian.org/search debian's search page]
+
<!-- This begins the two-column section -->
  
−
==ubuntu==
+
{| width="100%"
 +
|-
 +
| width="60%" style="vertical-align:top" |
  
−
==altlinux==
+
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#eeeeff; align:right; border:1px solid #ddccff;">
  
−
[http://packages.altlinux.org/ ALT Linux packages] (interesting things from autoimports tend to be integrated into main repository)
+
<h2 style="margin:0; background-color:#ccccff; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">Topics</h2>
  
−
=Computer Forensic Tools=
+
* '''[[File Analysis]]''':
−
Below is a list of computer forensic tools. For each tool the repository it can be found in and the version in the repository is shown.
+
** '''[[:Category:File Formats|File Formats]]''': [[PDF]], [[DOC]], [[DOCX]], [[JPEG]], [[GIF]], [[BMP]], [[LNK]], [[MP3]], [[AAC]], [[Thumbs.db]], ...
 +
** '''[[Forensic file formats]]''': [[AFF]], [[gfzip]], [[sgzip]], ...
 +
* '''[[File Systems]]''': [[FAT]], [[NTFS]], [[ext2]]/[[ext3]], [[ufs]], [[ffs]], [[reiserfs]], ...
 +
** '''[[File Systems#Cryptographic_File_Systems|Cryptographic File Systems]]''': [[File Vault]], [[EFS]], [[CFS]], [[NCryptfs]], [[TCFS]], [[SFS]], ...
 +
* '''[[Hardware]]''':
 +
** '''[[Bus]]ses''': [[IDE]], [[SCSI]], [[Firewire]], [[USB]], ...
 +
** '''[[Data storage media|Media]]''': [[RAM]], [[Hard Drive]]s, [[Memory Card]]s, [[SmartCard]]s, [[RFID]] Tags...
 +
** '''[[Personal Digital Devices]]''': [[PDAs]], [[Cellphones]], [[SmartPhones]], [[Audio Devices]], ...
 +
** '''[[Other Devices]]''': [[Printers]], [[Scanners]], ...
 +
** '''[[Write Blockers]]''': ...
 +
* '''Recovering data''': [[Recovering bad data|bad data]], [[Recovering deleted data|deleted data]], [[Recovering Overwritten Data|overwritten data]], [[Sanitization Standards]]
 +
* [[Encryption]]
 +
* [[GPS]]
 +
* [[Forensic_corpora|Forensic Corpora]]
 +
* [[Network forensics]]: [[OS fingerprinting]], [[Hidden channels]], [[Proxy server|Proxy servers]]
 +
* [[Steganography]], [[Steganalysis]]
 +
* '''[[Metadata]]:''' [[MAC times]], [[ACLs]], [[Email Headers]], [[Exif]], [[ID3]], [[OLE-2]], ...
 +
* '''[[Legal issues]]:''' [[Caselaw|Case law]]
 +
* '''Further information:''' [[Books]], [[Papers]], [[Reports]], [[Journals]], [[Websites]], [[Blogs]], [[Mailing lists]], [[Organizations]], [[Vendors]], [[Conferences]]
 +
</div>
  
−
As an example, aimage is in the openSUSE security repository and it is version 3.2.5
 
  
−
==Imaging Tools==
 
  
−
{|border="1" cellpadding="2" cellspacing="0" {{repository table}}
+
| width="40%" style="vertical-align:top" |
−
|-
+
−
|rowspan=1| '''Tool'''
+
−
|'''openSUSE'''
+
−
|'''fedora'''
+
−
|'''debian'''
+
−
|'''ubuntu'''
+
−
|'''comment'''
+
−
|'''General Remarks'''
+
  
−
|-
+
<!-- Tools -->
−
|rowspan=1| [http://www.e-fense.com/helix/ adepto]
+
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#e0ffe0; align:right; border:1px solid #ddccff;">
−
|N/A <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|N/A              <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|  <!-- comment -->
+
−
|adepto is included in the helix boot cd<!-- General Remarks -->
+
  
−
|-
+
<h2 style="margin:0; background-color:#ccffcc; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">[[Tools]]</h2>
−
|rowspan=1| [[aimage]]
+
−
|security/3.2.5 <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|squeeze/3.2.4  <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|a imaging tool to create aff format images  <!-- comment -->
+
−
|aimage has been EOL'ed.  guymager or ftkimager (windows/mac) are recommended for creating aff images. <!-- General Remarks -->
+
  
−
|-
+
* '''[[:Category:Disk Imaging|Disk Imaging]]''': [[dd]], [[dc3dd]], [[dcfldd]], [[dd_rescue]], [[sdd]], [[aimage]], [[Blackbag]], ...
−
|rowspan=1| [[AIR]]
+
* '''[[Tools:Data Recovery|Data Recovery]]''': ...
−
|N/A <!-- opensuse -->
+
* '''[[Tools#Disk_Analysis_Tools|Disk Analysis]]''': [[EnCase]], [[SMART]], [[Sleuthkit]], [[foremost]], [[Scalpel]], [[frag_find]]...
−
|?              <!-- fedora-->
+
* '''[[Tools#Forensics_Live_CDs|Live CDs]]''': [[DEFT Linux]], [[Helix]] ([[Helix3 Pro|Pro]]), [[FCCU Gnu/Linux Boot CD]], [[Knoppix STD]], ...
−
|N/A              <!-- debian-->
+
* '''[[Tools:Document Metadata Extraction|Metadata Extraction]]''': [[wvWare]], [[jhead]], [[Hachoir | hachoir-metadata]], [[Photo Investigator]]...
−
|?              <!-- ubuntu-->
+
* '''[[Tools:File Analysis|File Analysis]]''': [[file]], [[ldd]], [[ltrace]], [[strace]], [[strings]], ...
−
|Automated Image and Restore  <!-- comment -->
+
* '''[[Tools:Network_Forensics|Network Forensics]]''': [[Snort]],  [[Wireshark]], [[Kismet]],  [[NetworkMiner]]...
−
|a GUI front-end to dd and dc3dd designed for easily creating forensic bit images <!-- General Remarks -->
+
* '''[[:Category:Anti-forensics tools|Anti-Forensics]]''': [[Slacker]], [[Timestomp]], [[wipe]], [[shred]], ...
 +
* '''[[Tools#Other_Tools|Other Tools]]''': [[biew]], [[hexdump]], ...
 +
</div>
  
−
|-
+
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#c0ffff; align:right; border:1px solid #ddccff;">
−
|rowspan=1| [[dc3dd]]
+
−
|security*/7.1.614 <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|sid/7.1.614    <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|DoD Cyber Crime Center DD  <!-- comment -->
+
−
|This tool was formerly known as dcfldd. When released as dc3dd it was totally rewritten. <!-- General Remarks -->
+
  
−
|-
+
<h2 style="margin:0; background-color:#99ffff; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;">[[:Category:Top-Level|Categories]]</h2>
−
|rowspan=1| [[ddrescue]]
+
−
|Base/1.14 <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|squeeze/1.14 sid/1.23 <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|Also known as GNU ddrescue<!-- comment -->
+
−
|This tool is different than dd_rescue.
+
  
−
|-
+
The contents of this wiki are organized into various [[:Category:Top-Level|categories]]:
−
|rowspan=1| [[dd_rescue]]
+
−
|N/A <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|N/A              <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|<!-- comment -->
+
−
|This tool is different than GNU ddrescue.
+
  
−
|-
+
* [[:Category:Tools|Tools]]
−
|rowspan=1| [[libewf|ewfacquire]]
+
* [[:Category:Disk file systems|Disk file systems]]
−
|security*/20100226 <!-- opensuse -->
+
* [[:Category:File Formats|File Formats]]
−
|?              <!-- fedora-->
+
* [[:Category:Howtos|Howtos]]
−
|squeeze/20100226              <!-- debian-->
+
* [[:Category:Licenses|Licenses]]
−
|?              <!-- ubuntu-->
+
* [[:Category:Operating systems|Operating systems]]
−
|a imaging tool to create ewf format images  <!-- comment -->
+
* [[:Category:People|People]]
−
|ewfacquire is part of ewftools in some distributions.<!-- General Remarks -->
+
* [[:Category:Bibliographies|Bibliographies]]
  
−
|-
+
</div>
−
|rowspan=1| [[IXimager]]
+
    
−
|N/A <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|N/A            <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|A law enforcement only imager<!-- comment -->
+
−
|used in conjunction with ILook Investigator
+
−
 
+
−
|-
+
−
|rowspan=1| [[LinEn]]
+
−
|N/A <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|N/A              <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|a proprietary imaging tool to create ewf format images   <!-- comment -->
+
−
|included on the Helix boot CD<!-- General Remarks -->
+
−
 
+
−
|-
+
−
|rowspan=1| [[guymager]]
+
−
|N/A<!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|Squeeze/0.4.2 Sid/0.5.9-3              <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|a imaging tool to create aff format images  <!-- comment -->
+
−
|Guymager is an open source forensic imager. It focuses on user friendliness and high speed.  <!-- General Remarks -->
+
−
 
+
−
|-
+
−
|rowspan=1| [http://sourceforge.net/projects/rdd rdd]
+
−
|N/A <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|2.0.7-2              <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|a dd-like tool, with forensic imaging features  <!-- comment -->
+
−
|Rdd is robust with respect to read errors<!-- General Remarks -->
+
−
 
+
−
|-
+
−
|rowspan=1| [ftp://ftp.berlios.de/pub/sdd/ sdd]
+
−
|Archiving:Backup/1.52 <!-- opensuse -->
+
−
|?              <!-- fedora-->
+
−
|lenny/1.52 deprecated              <!-- debian-->
+
−
|?              <!-- ubuntu-->
+
−
|a dd-like tool<!-- comment -->
+
−
|Designed to work well when IBS != OBS.  Working with tape is an example.<!-- General Remarks -->
+
  
 
|}
 
|}
  
−
*package will appear in the base release with the next full distribution release.
+
<div style="margin-top:0.5em; padding:0.5em 0.5em 0.5em 0.5em; background-color:#faf0ff; align:right; border:1px solid #ddccff;">
 +
'''You can help!'''  We have a list of [[:Category:Articles_that_need_to_be_expanded|articles that need to be expanded]]. If you know anything about any of these topics, please feel free to chip in.
 +
</div>
 +
  
−
==File Inventory Tools==
 
  
−
{|border="1" cellpadding="2" cellspacing="0" {{repository table}}
 
−
|-
 
−
|rowspan=1| '''Tool'''
 
−
|'''openSUSE'''
 
−
|'''fedora'''
 
−
|'''debian'''
 
−
|'''ubuntu'''
 
−
|'''comment'''
 
−
|'''General Remarks'''
 
−
 
−
|-
 
−
|rowspan=1| [[exiftool]]
 
−
|base/v8.65 <!-- opensuse -->
 
−
|?              <!-- fedora-->
 
−
|squeeze/v8.15 sid/v8.60              <!-- debian-->
 
−
|?              <!-- ubuntu-->
 
−
|  <!-- comment -->
 
−
|exiftool has superior metadata reporting capability -->
 
−
 
−
|-
 
−
|rowspan=1| [[fiwalk]]
 
−
|security*/v0.6.15 <!-- opensuse -->
 
−
|?              <!-- fedora-->
 
−
|N/A              <!-- debian-->
 
−
|?              <!-- ubuntu-->
 
−
|  <!-- comment -->
 
−
|fiwalk is a robust $MFT walker<!-- General Remarks -->
 
−
 
−
 
−
|}
 
  
−
*package will appear in the base release with the next full distribution release.
+
__NOTOC__

Revision as of 12:13, 21 April 2014

This is the Forensics Wiki, a Creative Commons-licensed wiki devoted to information about digital forensics (also known as computer forensics). We currently list a total of 705 pages.

Much of computer forensics is focused on the tools and techniques used by investigators, but there are also a number of important papers, people, and organizations involved. Many of those organizations sponsor conferences throughout the year and around the world. You may also wish to examine the popular journals and some special reports.


WIKI NEWS

2013-05-15: You can now subscribe to Forensics Wiki Recent Changes with the ForensicsWiki FeedBurner Feed

Featured Forensic Research

May 2014

Hurley, Ryan, Prusty, Swagatika, Soroush, Hamed, Walls, Robert J., Albrecht, Jeannie, Cecchet, Emmanuel, Levine, Brian Neil, Liberatore, Marc, Lynn, Brian, Wolak, Janis - Measurement and Analysis of Child Pornography Trafficking on P2P Networks
Proceedings of the 22Nd International Conference on World Wide Web pp. 631--642, Republic and Canton of Geneva, Switzerland,2013
http://dl.acm.org/citation.cfm?id=2488388.2488444
Bibtex
Author : Hurley, Ryan, Prusty, Swagatika, Soroush, Hamed, Walls, Robert J., Albrecht, Jeannie, Cecchet, Emmanuel, Levine, Brian Neil, Liberatore, Marc, Lynn, Brian, Wolak, Janis
Title : Measurement and Analysis of Child Pornography Trafficking on P2P Networks
In : Proceedings of the 22Nd International Conference on World Wide Web -
Address : Republic and Canton of Geneva, Switzerland
Date : 2013

Peer-to-peer networks are the most popular mechanism for the criminal acquisition and distribution of child pornography (CP). In this paper, we examine observations of peers sharing known CP on the eMule and Gnutella networks, which were collected by law enforcement using forensic tools that we developed. We characterize a year's worth of network activity and evaluate different strategies for prioritizing investigators' limited resources. The highest impact research in criminal forensics works within, and is evaluated under, the constraints and goals of investigations. We follow that principle, rather than presenting a set of isolated, exploratory characterizations of users.

First, we focus on strategies for reducing the number of CP files available on the network by removing a minimal number of peers. We present a metric for peer removal that is more effective than simply selecting peers with the largest libraries or the most days online. Second, we characterize six aggressive peer subgroups, including: peers using Tor, peers that bridge multiple p2p networks, and the top 10% of peers contributing to file availability. We find that these subgroups are more active in their trafficking, having more known CP and more uptime, than the average peer. Finally, while in theory Tor presents a challenge to investigators, we observe that in practice offenders use Tor inconsistently. Over 90% of regular Tor users send traffic from a non-Tor IP at least once after first using Tor. (See also Past Selected Articles)

Featured Article

Forensic Linux Live CD issues
Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. Read More...


Topics


You can help! We have a list of articles that need to be expanded. If you know anything about any of these topics, please feel free to chip in.