Where can I find Forensics Software?

abefroman · 07-29-2005, 09:22 PM

Where can I find Forensics Software that will run in my linux computer?

Capt_Caveman · 07-29-2005, 10:11 PM

Again take a look at the security references thread. There are also a number of forensic cd-rom based linux distros that include forensic tools like TCT and Autopsy/TSK . Distrowatch has several, like FIRE and Knoppix-STD.

abefroman · 07-30-2005, 12:49 PM

Which disto is the best for forensics?

Which one do you use?

Capt_Caveman · 07-30-2005, 04:56 PM

I usually carry a Knoppix-STD cd with me most of the time, but that's just because it's got more multipurpose tools (like networking stuff). Something like FIRE or Helix would be more forensics oriented. I've used FIRE, but they've been a bit slow in releasing new versions recently.

abefroman · 07-31-2005, 10:21 AM

I tried running Helix but once X starts it just flashes a blurry image. I can press ctrl+alt+F2 and get to the shell prompt, how do I get it to recognize my onboard video properly?

floppywhopper · 08-01-2005, 02:30 AM

Penguin Sleuth Kit

http://luge.cc.emory.edu/psl.html

floppy

ddaas · 08-03-2005, 08:10 AM

Good tools for forensic research are TSK - http://www.sleuthkit.org/sleuthkit/index.php and The Coroner's Toolkit (TCT) - http://www.porcupine.org/forensics/tct.html

A good livecd for rescue is Kannotix. There is also F.I.R.E - http://fire.dmzs.com/