Linux and Data Forensics? 14
An anonymous reader asks: "Data Forensics has been discussed in the past. I am entering the field soon and aside from rifling through Slashdot and Google and reading some technical data on the software that I am going to be using I haven't had much time to learn everything about the position (I will be officially trained when I move over to the role). I am wondering, though, if Linux has played a strong role in the courtroom when it comes to validating evidence that has been used in a lawsuit case. Those in the field who are reading this, have you used open-source software to prove facts to the court? I don't mean using dd to make an image of a disk but rather a suite of tools whose purpose is to analyze data, indicate relationships, create hash tables, et cetera. That being said, if that software is not available (the programmer side of me asks), is there enough interest in the community to create a package that rivals and is as accountable and recognizable as commercial products?"
Well, (Score:2, Informative)
Umm... (Score:3, Funny)
As always, google is your friend (Score:5, Informative)
As always, google is your friend.
My learning disabled kid brother doesn't know what data forensics is, but he knows how to use google.
Use it.
http://www.google.com/search?q=knoppix+validation
http://www.google.com/search?q=linux+forensics&so
PDF - KNOPPIX Bootable CD Validation Study for Live Forensic Preview
Linux-Forensics.com Home of the Penguin Sleuth Bootable CD [linux-forensics.com]
Knoppix security tools distribution Knoppix STD (security tools distribution) [knoppix-std.org]
From Australian DoD page:http://www.dsd.gov.au/library/software/flag/ [dsd.gov.au]
FLAG uses the SleuthKit tool from www.sleuthkit.org [sleuthkit.org] to analyse dd images. By putting inode information in the database it is possible to cross-correlate file properties, and simplify the forensic analysis process.
Moderately Useful Point Supporting Linux (Score:5, Informative)
I've looked at:
Penguinsleuth
It's mostly a standard Knoppix CD with some forensics tools added
SystemRescueCD
From one of the partimage team members, it's gentoo-based and with a sweet array of boot options, including a boot option for an nt password & registry editor. Oh yeah... partimage is kinda nice for a Ghost-like imaging option.
Questions Like This Disturb Me (Score:1, Interesting)
I expect those in Data Forensics to be bright, inquisitive people who are willing to quickly learn new things.
I expect that the role requires it.
So, when someone asks "Linux and Data Forensics" without taking a few minutes to think about the problem, it disturbs me.
Perhaps that person would be better suited for a less imaginative job.
Off the top of my head, I could figure out several tools useful in data forensics. Copy the original drive block-by-block to a new drive. Mount the copy as read
Re:Questions Like This Disturb Me (Score:4, Insightful)
The original question stated "I don't mean using dd to make an image of a disk but rather a suite of tools whose purpose is to analyze data, indicate relationships, create hash tables, et cetera.". But you start off attcking the inquirer, demonstrate a use he specifically mentioned, and then answer his "suite of tools" question with "well, I guess you can whip something up with perl & grep".
No one is making anyone read slashdot... bitching about the quality of the posts is pointless AND counter-productive. You obviously don't have a unique perspective into computer forensics, so why don't you just step back and maybe learn something from an informed poster? And I'm not attacking just dasunt, but anyone who insists on bitching about the slashdot and it's content. And yes, I chose to post (off topic, but hopefully informative) instead of just moderating dasunt down.
Re:Questions Like This Disturb Me (Score:4, Informative)
What Cliff understands and you don't is that effectiveness is only half the requirement for forensics tools. Such tools also have to be accepted by the court, either through legal precedent or through expert testimony. Expert testimony involves either paying someone with degrees and credentials out the ass to back up your forensic methods (not cheap) or qualifying you the examiner as an expert witness (may not work, also takes time which leads to more legal fees, not cheap).
More importantly, a forensic kit needs to include the ability to quickly view multiple file types. One investigation can easily involve stacks of floppies, CD's, and SD cards as well as a laptop hard drive and desktop hard drive. Scripted searches are great, but those results need to be easily indexed and viewed through a multi-format file viewer or you won't be able to generate timely analyses.
Don't get me wrong. I'd love to see linux forensics tools admitted in court, but what you're talking about is writing your own toolkit from scratch, not pencil whipping a few scripts. Why would you go to that much trouble when you could just use encase or FTK and know that your evidence will be admitted?
Circumventing security (Score:1)
Sleuth Kit/Autopsy (Score:5, Informative)
THe Sleuth Kit and the Autopsy frontend are outstanding tools. Use a Knoppix or FIRE CD plus an external hard drive for acquisitions.
However, I would HIGHLY HIGHLY recommend that you take some training. SANS has a track for forensics that is pretty damn good. At the very least, it'll get you comfortable with the tools and tactics.
Re:Sleuth Kit/Autopsy (Score:1)
Any suggestions on how to get in?
Yahoo Groups (Score:4, Informative)
As far as tools are concerned, the Sleuthkit (http://www.sleuthkit.org) is the (IMO) best tool for the job and since it is already open source, modifications can be made and submitted back to the community for use.
I have spent the last few month immersing myself in this field and I've been learning something new everyday. Particularly about the guts of various file systems. Loads of fun
-Matt