RE: forensic evidence collection tools?
Title: RE: forensic evidence collection tools? Paul, I work on and contribute to the ftimes project which does very well to collect all file system information. It can also search for a unique pattern (pcre) across a file system, which I've used to identify trojan files. It can be found here: http://ftimes.sourceforge.net/FTimes/index.shtml If you're trying to do incident response, I would recommend webjob. I presented it at the ghnlug last week ... not sure if you were there, but webjob was designed to perform incident response on a large number of systems. I've used it quite effectively to harvest information from a bunch of windows machines. WebJob has many advantages including aggregating the data at a central server. It can be found here: http://webjob.sourceforge.net/WebJob/index.shtml If you're looking for a quick list of forensic tools, this is a good spot: http://www.opensourceforensics.org/ >From time-to-time I guest teach an undergrad commputer forensics course, I'd be glad to talk more about forensics if you would like. Andy -Original Message- From: [EMAIL PROTECTED] on behalf of Paul Lussier Sent: Thu 2/23/2006 2:30 PM To: gnhlug-discuss@mail.gnhlug.org Subject: forensic evidence collection tools? Hi all, I'm trying to debug a problem on a set of systems. Is there something I run, say from a usb key or a Knoppix CD which will collect "all interesting information" and deposit it somewhere else? -- Seeya, Paul ___ gnhlug-discuss mailing list gnhlug-discuss@mail.gnhlug.org http://mail.gnhlug.org/mailman/listinfo/gnhlug-discuss
Re: forensic evidence collection tools?
Paul, I work on and contribute to the ftimes project which does very well to collect all file system information. It can also search for a unique pattern (pcre) across a file system, which I've used to identify trojan files. It can be found here: http://ftimes.sourceforge.net/FTimes/index.shtml If you're trying to do incident response, I would recommend webjob. I presented it at the ghnlug last week ... not sure if you were there, but webjob was designed to perform incident response on a large number of systems. I've used it quite effectively to harvest information from a bunch of windows machines. WebJob has many advantages including aggregating the data at a central server. It can be found here: http://webjob.sourceforge.net/WebJob/index.shtml If you're looking for a quick list of forensic tools, this is a good spot: http://www.opensourceforensics.org/ >From time-to-time I guest teach an undergrad commputer forensics course, I'd be glad to talk more about forensics if you would like. Andy On Thu, 2006-02-23 at 14:30 -0500, Paul Lussier wrote: > Hi all, > > I'm trying to debug a problem on a set of systems. Is there something > I run, say from a usb key or a Knoppix CD which will collect "all > interesting information" and deposit it somewhere else? ___ gnhlug-discuss mailing list gnhlug-discuss@mail.gnhlug.org http://mail.gnhlug.org/mailman/listinfo/gnhlug-discuss
RE: forensic evidence collection tools?
Title: RE: forensic evidence collection tools? Sorry for the repost. I'm having issues with evolution ... it keeps crashing and sometimes messages get resent from my out box. andy -Original Message- From: [EMAIL PROTECTED] on behalf of Bair,Paul A. Sent: Thu 2/23/2006 3:09 PM To: Paul Lussier Cc: gnhlug-discuss@mail.gnhlug.org Subject: Re: forensic evidence collection tools? Paul, I work on and contribute to the ftimes project which does very well to collect all file system information. It can also search for a unique pattern (pcre) across a file system, which I've used to identify trojan files. It can be found here: http://ftimes.sourceforge.net/FTimes/index.shtml If you're trying to do incident response, I would recommend webjob. I presented it at the ghnlug last week ... not sure if you were there, but webjob was designed to perform incident response on a large number of systems. I've used it quite effectively to harvest information from a bunch of windows machines. WebJob has many advantages including aggregating the data at a central server. It can be found here: http://webjob.sourceforge.net/WebJob/index.shtml If you're looking for a quick list of forensic tools, this is a good spot: http://www.opensourceforensics.org/ >From time-to-time I guest teach an undergrad commputer forensics course, I'd be glad to talk more about forensics if you would like. Andy On Thu, 2006-02-23 at 14:30 -0500, Paul Lussier wrote: > Hi all, > > I'm trying to debug a problem on a set of systems. Is there something > I run, say from a usb key or a Knoppix CD which will collect "all > interesting information" and deposit it somewhere else? ___ gnhlug-discuss mailing list gnhlug-discuss@mail.gnhlug.org http://mail.gnhlug.org/mailman/listinfo/gnhlug-discuss
Re: forensic evidence collection tools?
Andy, Thanks for the response, these look like some good links. I'll follow up on them Monday when I get back to work. Though I am generally interested in forensics, the reason for my post had more to do with getting annoyed by our "support" group failing to get the logs off a system properly, or not knowing what to get. We've bandied about the idea of writing a 'get-me-all-interesting-stuff' script and telling support to "just run that", but I figured I ought to ask about what's out there before re-inventing the wheel, but with several corners on it :) Thanks, after looking at this stuff when I have more time on Monday, I'm sure I'll be back with questions. -- Seeya, Paul ___ gnhlug-discuss mailing list gnhlug-discuss@mail.gnhlug.org http://mail.gnhlug.org/mailman/listinfo/gnhlug-discuss
