[gentoo-dev] app-forensics category and forensics herd proposal

[Daniel]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


In response to bug 42498 I propose setting up an app-forensics category and 
forensics herd. This will contain all applications that aid the investigation 
of intrusions and general stuff that would be used by law enforcement 
agencies.

Applications so far identified for this and their current maintainers:

app-admin/autopsy - me
app-admin/sleuthkit - me
app-admin/aide - bug wrangers
dev-util/examiner - nobody
app-admin/foremost - Martin Schlemmer - mholzer
sys-apps/air - me
app-admin/chkrootkit - Aaron Walker  - Ka0TTiC
app-admin/rkhunter -  Aaron Walker  - Ka0TTiC

And a few more that ebuilds haven't quite been made for:

http://sourceforge.net/projects/pyflag - FLAG was designed to simplify the 
process of log file analysis and forensic investigations. FLAG facilitates 
efficient analysis of large quantities of data within an interactive 
environment. PyFlag is the reimplementation of FLAG in Python.

http://www.outguess.org/detection.php Stegdetect (bug 35542) - Stegdetect is 
an automated tool for detecting steganographic content in images. It is 
capable of detecting several different steganographic methods to embed hidden 
information in JPEG images.

http://sourceforge.net/projects/ol2mbox/
Outlook to mbox converter (used for litigation support, etc., but also useful 
for anyone.)  Note that this guy MIGHT have been threatened by microsoft as 
some of the content from his page has mysteriously disappeared that contained 
newer versions and they once mentioned legal issues.  The program works 
fairly well, though.

http://sourceforge.net/projects/regviewer/
RegViewer is GTK 2.2 based GUI Windows registry file navigator. It is platform 
independent allowing for examination of Windows registry files from any 
platform. Particularly useful when conducting forensics of Windows files from 
*nix systems. 

http://freshmeat.net/projects/ftimes/
FTimes is a system baselining and evidence collection tool. Its primary 
purpose is to gather and/or develop information about specified directories 
and files in a manner conducive to intrusion analysis. It was designed to 
support the following initiatives: content integrity monitoring, incident 
response, intrusion analysis, and computer forensics. 

http://freshmeat.net/projects/rda/
RDA is a computer forensics tool to remotely acquire data. Usually disk 
cloning or disk/partition imaging means one has to move the disk onto another 
system, and things are more complicated if its a laptop disk. The alternative 
provided by rda is to boot the data source machine with a minimal Linux 
system from a floppy or CD, and simply run rda. Some of the options provided 
are data transfer verification with MD5 and/or CRC32 checksums, skipping read 
errors, and spanning over multiple files. 

http://software.freshmeat.net/projects/fohad/
The Forensic Hash Database is a project to combine the various hashsum sources 
like The KnownGoods Database, Hashkeeper, NIST NSRL, and Dan Farmer's hashsum 
archive into a single meta database. Integration into the forensic analysis 
toolkit The Sleuth Kit is provided through a patch.

http://sourceforge.net/search/?type_of_search=soft&exact=0&words=forensic
lists some others that I haven't included here.

Aaron Walker  -(Ka0TTiC) has voluteered to join me (easily convinced in a 
state of sleep deprivation). 

Other voluteers? Anyone else? other packages worthy of consideration?

- -- 
Daniel Black <dragonheart@g.o>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBQm8chhpKunZncJcRAiEdAJ9EfpLGkNjUborCM1kNmkbnH96Z5wCgi99O
bobmWG1bxd3b+O8UnsY6IwE=
=tetz
-----END PGP SIGNATURE-----

--
gentoo-dev@g.o mailing list