Linux forensics - Introduction

Discussion in 'all things UNIX' started by Mrkvonic, Feb 22, 2009.

Thread Status:
Not open for further replies.
  1. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,697
    Hi all,


    This is the first of several articles covering Linux forensics, including several in-depth reviews of dedicated investigation, rescue & recovery distros. This introduction article is about the basic forensics tools. In the second part, we will talk about the Helix forensics live CD distribution.

    If you're interested:

    http://www.dedoimedo.com/computers/forensics-intro.html

    Excerpt:

    Comments and suggestions are welcome.

    Cheers,
    Mrk
     
  2. steve161

    steve161 Registered Member

    Joined:
    Nov 22, 2006
    Posts:
    681
    Location:
    New York
    Very nice Mrk. This is something I am going to do with 8.04 in the next few days. Will the iso always, within reason, be compressed to fit on one cd and, if not, will it prompt to insert a second cd or to try with something with more storage?

    You're a comedian.
     
  3. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,697
    Hello,

    You create an image and then burn it. In my experience, it usually goes beyond 700MB, if you include build utilities and a few more goodies. With a solid load of apps included, you'll prolly get a 1.2-1.5GB image, which you can then burn to DVD!

    There's no prompt while creating the image...

    As to comedian thingie, thanks ...

    Mrk
     
  4. zapjb

    zapjb Registered Member

    Joined:
    Nov 15, 2005
    Posts:
    3,518
    Location:
    USA - Back in a real State in time for a real Pres
    I really enjoyed using remasterme on my old desktop which was PCLinuxOS & XP. I'm glad to know it's available in many other distros as well.
     
  5. gkweb

    gkweb Expert Firewall Tester

    Joined:
    Aug 29, 2003
    Posts:
    1,932
    Location:
    FRANCE, Rouen (76)
    Hello,

    Interesting topic. I have various bootable CD depending on the situation (TrueImage, custom BartPE, or a Linux Live CD) and I am interested to see how other rescue boot CDs will compare.

    Until now, I could fix everything with a BartPE, until recently on a laptop where it bluescreened every time... having a boot CD based on Linux is truly an advantage.

    Can't wait for the upcoming articles.

    Regards,
    gkweb.
     
  6. tlu

    tlu Guest

    Mrk,

    very good compilation! I'm looking forward for the upcoming articles.
     
  7. NGRhodes

    NGRhodes Registered Member

    Joined:
    Jun 23, 2003
    Posts:
    2,331
    Location:
    West Yorkshire, UK
    Don't forget to test out your recovery cds and that the tools on them work (eg the environment boots detecting hardware correctly and the tools don't crash).
    I'm looking forward to the rest of the series.
     
Loading...
Thread Status:
Not open for further replies.