Forensics CD Toolkit for FreeBSD

[Barney Wolff]

On Sun, Aug 03, 2003 at 09:20:45AM -0600, Joe Warner wrote:
> 
> I'd like to build a toolkit CD specifically for conducting
> forensics on FreeBSD.  I'm not talking about a bootable
> CD but rather one that I could pop into a CD ROM drive
> and run trusted commands like ps, netstat, ls, etc., from.

1.  It would be fairly rare for the bin's from iso-2 (the bootable
live filesystem) from a release not to work on the corresponding
-stable.

2.  However you should certainly be booting from the cd, for reasons
already noted.

3.  make release will enable you to create the equivalent of iso-2
for your -stable, if you really insist.

4.  You should investigate The Coroner's Toolkit, available (free)
from porcupine.org to really do forensics work.  It comes from
Dan Farmer & Wiese Venema, who need no endorsement from me.
I've used it (on Solaris) with very gratifying results.

-- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.