RE: Windows forensics with Linux analysis machine

[[EMAIL PROTECTED]]

...i don't think that the F.I.R.E matches all needs for an investigation of
Windows .
I am not to close with Forensics of Windows plattforms bit i am learning...
On attempt might be the registry. A very important database which you can't
analyse with F.I.R.E., or am i wrong ?
Please correct me.

By the way does anybody know a tool for doing that under linux ?
At the moment i am doing a:\redump.exe | cryptcat and lesses/grep the acsii
dump-file on my forensics notebook.
But this means, that the System is alive and runnning! And that no trojan hides
registry-trees (hives).

looking forward
Holger





"tetsujin" <[EMAIL PROTECTED]>
21.08.2003 02:03
An:     "'JJ'" <[EMAIL PROTECTED]>, [EMAIL PROTECTED]
Kopie:  (Blindkopie: Holger Wöhle/PSD/Eschborn/Arcor)
Thema:  RE: Windows forensics with Linux analysis machine


All you'll ever need.

http://www.meliorinc.com/html/fire_cd.html

Enjoy


-----Original Message-----
From: JJ [mailto:[EMAIL PROTECTED]
Sent: Wednesday, August 20, 2003 3:30 PM
To: [EMAIL PROTECTED]
Subject: Windows forensics with Linux analysis machine

All,

I'm looking for good tools that will allow me to do a full investigation of
a Windows image using linux.  I'm looking at Autopsy and Sleuthkit now.  Are
there any other tools that will allow me to do the full investigation (view
registry structures, undelete files, etc) under linux?

Thanks,
JJ

---------------------
J. J. Horner
CISSP,CCNA,CHSS,CHP

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com




-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com




-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com