Computer Forensics Software

TCTUTILs and Autopsy will be presented at SANSFIRE
Some examples from The Forensic Challenge (submission)
An example for Scan #15 of the Honeynet Project.

TCTUTILs

TCTUTILs is a collection of utilities that adds functionality to The Coroners Toolkit (TCT).

tctutils-1.01.tar.gz (sig) readme (5/29/01)
tctutils-1.00.tar.gz (sig) readme (3/19/01)

Features:

List directory inode contents to view file, device, and directory names. This also allows deleted file names to be viewed and with some platforms an entire file that was recently deleted can be easily recovered.
Get Modified, Accessed, and Created time data on deleted files (not possible on all systems) and merge the data into the mactimes output from TCT.
Find the names of files and directories that are using a given inode. On some systems, deleted file names will also be given.
Find the inode that is using a given block. On some systems, the inode may not even be allocated.
Display the contents of a given block in several formats
Display the details of an inode (including all block numbers)
Calculate the original block number from a block in an image created by the unrm utility in TCT (New to v1.01).

Requirements:

TCT 1.06 (or greater)

Platforms:

OpenBSD (tested on 2.8)
Linux (tested on Debian 2.2)
Solaris (tested on 2.7)

Autopsy Forensic Browser

The Autopsy Forensic Browser is an HTML based front-end interface to TCT and TCTUTILs. It allows an investigator to browse forensic images (an image generated from using dd(1)) from a file, inode, or block level abstraction. It also provides a convenient interface for searching for key words on an image.

screen shots from the Forensics Challenge
autopsy-1.01.tar.gz (sig) readme (5/29/01)
autopsy-1.00.tar.gz (sig) readme (3/19/01)

Features:

Browse a forensic image from the file/directory level using a "File Manager" style interface.
By utilizing the functions from TCTUTILs, recently deleted file names are displayed.
View file contents in raw, as ASCII, or by running it through strings(1).
Browse a forensic image from the inode level
Browse a forensic image from the block level
View block contents in raw, ASCII, or hexdump
Search a forensic image at the block level for specified strings
Generate "autopsy reports" on files, blocks, or inodes that also include MD5 hash values.

Requirements:

TCT 1.06 (or greater)
TCTUTILs 1.01

Last Updated: May 29, 2001
carrier@cerias.purdue.edu
This software is not a result of Purdue University or CERIAS funded research