The Coroner's Toolkit (TCT)

source code | features | warning | requirements | mailing list

TCT is a collection of programs that can be used for a post-mortem analysis of a UNIX system after break-in. The software was presented first during a free Computer Forensics Analysis class in August 1999. Copies of class handouts can be found at http://www.porcupine.org/forensics/handouts.html.

Source code

Features

 Notable TCT components are the grave-robber tool that captures information, the ils and mactime tools that display access patterns of files dead or alive, the unrm and lazarus tools that recover deleted files, and the keyfind tool that recovers cryptographic keys from a running process or from files.

Warning

 This software is not for the faint of heart. It is relatively unpolished compared to the software that Dan and Wietse usually release. TCT can spend a lot of time collecting data. And although TCT collects lots of data, many analysis tools still need to be written.

Requirements

 Shortly before release, TCT was tested with the following systems:

TCT requires Perl 5.004 or later, although Perl 5.000 is probably sufficient if you only use the data collection software, and do the analysis on a different machine.

Mailing list

We've created a mailing list tct-users@porcupine.org to discuss the toolkit and methods used to forensically analyze Unix systems. This list accepts postings from subscribers only.