Difference between revisions of "Tools Using TSK or Autopsy"

From SleuthKitWiki
Jump to: navigation, search
m
(Removing spam)
Line 16: Line 16:
 
* [http://www.iritaly-livecd.org IRItaly Live CD Project ('''Gentoo''' based)]
 
* [http://www.iritaly-livecd.org IRItaly Live CD Project ('''Gentoo''' based)]
 
* [http://www.forlex.it/index.php?option=com_content&view=section&layout=blog&id=7&Itemid=41&lang=it ForLEx Live CD - Forensic Linux Examination ('''Debian''' based)]
 
* [http://www.forlex.it/index.php?option=com_content&view=section&layout=blog&id=7&Itemid=41&lang=it ForLEx Live CD - Forensic Linux Examination ('''Debian''' based)]
−
 
−
 
−
'''Source(s):'''  [http://downloadranking.com/support.php  Tools Using TSK]
 
−
 
  
 
=Tools that Integrate The Sleuth Kit=
 
=Tools that Integrate The Sleuth Kit=
Line 34: Line 30:
 
* [http://sfdumper.sourceforge.net/ Selective File Dumper]
 
* [http://sfdumper.sourceforge.net/ Selective File Dumper]
 
* [http://www.cerias.purdue.edu/homes/forensics/timeline.php Zeitline]
 
* [http://www.cerias.purdue.edu/homes/forensics/timeline.php Zeitline]
−
* [http://papersmart.net Papersmart]
 
−
 
−
 
−
'''Source(s):'''  [http://downloadranking.com/support.php  Tools Using TSK]
 
  
  
Line 51: Line 43:
 
* Qt bindings for TSK: [https://github.com/rpoisel/qttsk qttsk] provides the user with a graphical frontend to fls and icat. In the future mmls will also be supported.  
 
* Qt bindings for TSK: [https://github.com/rpoisel/qttsk qttsk] provides the user with a graphical frontend to fls and icat. In the future mmls will also be supported.  
 
* Unicode: (NOTE: This patch is no longer needed as of version 2.03) [http://www.t-dori.net/forensics/ Patches] for the NTFS code in The Sleuth Kit to show Unicode names. By TAKAHASHI Motonobu (monyo at home dot monyo dot com) and tessy (tessy at tessy dot jp).
 
* Unicode: (NOTE: This patch is no longer needed as of version 2.03) [http://www.t-dori.net/forensics/ Patches] for the NTFS code in The Sleuth Kit to show Unicode names. By TAKAHASHI Motonobu (monyo at home dot monyo dot com) and tessy (tessy at tessy dot jp).
−
 
−
 
−
'''Source(s):'''  [http://downloadranking.com/support.php  Tools Using TSK]
 
−
 
  
 
= Sleuth Kit Packages=
 
= Sleuth Kit Packages=
Line 69: Line 57:
 
* Debian: [http://packages.debian.org/stable/admin/sleuthkit Debian Packages (stable)]
 
* Debian: [http://packages.debian.org/stable/admin/sleuthkit Debian Packages (stable)]
 
* Slackware: [http://www.linuxpackages.net/search_view.php?by=name&name=sleuthkit Slackware Packages]
 
* Slackware: [http://www.linuxpackages.net/search_view.php?by=name&name=sleuthkit Slackware Packages]
−
 
−
 
−
'''Source(s):'''  [http://downloadranking.com/support.php  Tools Using TSK]
 
−
 
  
 
=Autopsy Packages=
 
=Autopsy Packages=
Line 85: Line 69:
 
* Slackware: [http://www.linuxpackages.net/search_view.php?by=name&name=autopsy Slackware Packages]
 
* Slackware: [http://www.linuxpackages.net/search_view.php?by=name&name=autopsy Slackware Packages]
 
* Ubuntu: [http://www.bestessay.net www.bestessay.com]
 
* Ubuntu: [http://www.bestessay.net www.bestessay.com]
−
 
−
 
−
'''Source(s):'''  [http://downloadranking.com/support.php  Tools Using TSK]
 

Revision as of 08:35, 8 January 2014

Bootable CDs with The Sleuth Kit & Autopsy

(in alphabetical order)

Tools that Integrate The Sleuth Kit

(in alphabetical order)


Add-ons / Patches for The Sleuth Kit and Autopsy

The following were written by Sleuth Kit users and provide additional capabilities. Note that a patch may not work with the current version.
(in alphabetical order)

  • Comeforth: Script that uses TSK tools to process raw data. It is similar to lazarus, but Dan Higgens says that it provides a bit more flexibility for processing very large data sets.
  • FUNDL - File Undeleter: Script that uses TSK tools (fls and icat), for recovering the deleted files - Windows version Script.
  • foremost: Patch to use foremost with Autopsy. By Pepijn Vissers (vissers at fox-it dot com).
  • Forensic Hash Database: Patch to use hfind and sorter with the Forensic Hash Database. By Matthias Hofherr (matthias at mhofherr dot de).
  • Index Search: Patch to let Autopsy and The Sleuth Kit index the ASCII words in an image. This provides faster keyword searches in Autopsy than by just extracting the strings. By Paul Bakker ( bakker at fox-it dot com).
  • Recoup Directory Contents: Script to run fls and icat on a directory to export the files and create the needed subdirectories. By Dave Henkewick (dave at hoax dot ca).
  • Qt bindings for TSK: qttsk provides the user with a graphical frontend to fls and icat. In the future mmls will also be supported.
  • Unicode: (NOTE: This patch is no longer needed as of version 2.03) Patches for the NTFS code in The Sleuth Kit to show Unicode names. By TAKAHASHI Motonobu (monyo at home dot monyo dot com) and tessy (tessy at tessy dot jp).

Sleuth Kit Packages

The following packages have been contributed by Sleuth Kit users and/or distribution developers. NOTE: They have not been validated, reviewed, or tested by the original developers and have no warranties of any kind. Some packages may not be of the latest release, so check the version first.

Autopsy Packages

The following packages have been contributed by Autopsy users. NOTE: They have not been validated, reviewed, or tested by the original developers of Autopsy and have no warranties of any kind. Some packages may not be of the latest release, so check the version first.

Retrieved from "https://wiki.sleuthkit.org/index.php?title=Tools_Using_TSK_or_Autopsy&oldid=11313"