Search Results for "sleuthkit"

GRR Rapid Response is an incident response framework focused on remote live forensics. It consists of a python client (agent) that is installed on target systems, and python server infrastructure that can manage and talk to clients. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely. GRR client is deployed on systems that one might want to investigate. On every such system, once...

Mariposa Rescue Disk comes with a lot of applications like Gparted, parted, testdisk, ext4magic, extundelete, foremost, fsarchiver, gddrescue, Magicrescue, autopsy, bruteforce-luks, chkrootkit, ddrescueview, ddrutility, dmraid, myrescue, safecopy, sleuthkit and many more. The system will start a console and log in as a user. The default keyboard is English US, which you can change easily. By typing "startx" you can enter the Window Manager XFCE4. We recommend to boot Mariposa Rescue Disk using Ventoy (https://www.ventoy.net), which is supported since version 2.x. However, any other method would work as well. ...

Linux Engineer Toolkit (LengToolkit) Live is a specialized, recovery-oriented Linux distribution designed for system engineers and IT professionals. Operating exclusively in Live mode, it provides a robust environment to rescue failing systems, recover lost data, and manage disk infrastructures without the need for installation.

Forensic (but not only) graphical frontend to work with binary images (RAW) of media in GNU/Linux. These images are universal and can be installed using both standard operating systems and popular forensic software such as Encase, Sleuthkit/Autopsy, etc. in all operating systems). The idea of the project is to implement a fast, convenient and safe making of legal copies and manipulating with images, by means of GNU/Linux, without the need for expensive hardware write lock on the media, it is necessary in the existing solutions under Windows. Also the program can be used as a last chance to rescue data from a dying media by software.

Recover data from a partition or dd image from a console using python and sleuthkit

The Sleuth Kit is a C++ library and collection of open source file system forensics tools that allow you to, among other things, view allocated and deleted data from NTFS, FAT, FFS, EXT2, Ext3, HFS+, and ISO9660 images.

A GUI for beginner users that are inexperienced to mactime tool which was built into The SleuthKit.

...Installation Simply un-tar the folder to the location of your choosing (ex: tar -xvf flsmac.tar). Usage ./flsmac.pl Optional Parameters -h Displays help file [image_name] Send the file name as input image Requirements SleuthKit and perl must be installed SleuthKit is available from: http://www.sleuthkit.org/sleuthkit/download.php Limitations - Has to create a temporary file to catch the output of FLS at /tmp/flsmactmp which is deleted after mactime execution. - Only includes what the author of flsmac deemed the "most commonly" used commands - although more can be easily added. ...

sleuthkit-sharp is a .NET wrapper for The Sleuth Kit. It provides classes and methods that covers most much of Sleuth Kit's API. It supports Windows, Mac, and Linux.