...i don't think that the F.I.R.E matches all needs for an investigation of Windows . I am not to close with Forensics of Windows plattforms bit i am learning... On attempt might be the registry. A very important database which you can't analyse with F.I.R.E., or am i wrong ? Please correct me. By the way does anybody know a tool for doing that under linux ? At the moment i am doing a:\redump.exe | cryptcat and lesses/grep the acsii dump-file on my forensics notebook. But this means, that the System is alive and runnning! And that no trojan hides registry-trees (hives). looking forward Holger "tetsujin" <tetsujinat_private> 21.08.2003 02:03 An: "'JJ'" <jjhorner@SAFe-mail.net>, forensicsat_private Kopie: (Blindkopie: Holger Wöhle/PSD/Eschborn/Arcor) Thema: RE: Windows forensics with Linux analysis machine All you'll ever need. http://www.meliorinc.com/html/fire_cd.html Enjoy -----Original Message----- From: JJ [mailto:jjhorner@SAFe-mail.net] Sent: Wednesday, August 20, 2003 3:30 PM To: forensicsat_private Subject: Windows forensics with Linux analysis machine All, I'm looking for good tools that will allow me to do a full investigation of a Windows image using linux. I'm looking at Autopsy and Sleuthkit now. Are there any other tools that will allow me to do the full investigation (view registry structures, undelete files, etc) under linux? Thanks, JJ --------------------- J. J. Horner CISSP,CCNA,CHSS,CHP ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Fri Aug 22 2003 - 17:59:33 PDT