Con un po’ di ritardo sulla tabella di marcia – di cui ci scusiamo come membri dell’associazione DEFT – ecco finalmente la prima beta pubblica di DEFT Linux 8 con DART 2.0 stable, ottimizzata per sistemi a 64bit! 🙂
Qui di seguito le novita’ della distribuzione DEFT 8:
- Kernel GNU Linux a 64 bit v. 3.5.0-30 – e’ ora possibile superare il limite dei 4GB di RAM;
- The SleuthKit 4 (la versione stabile di DEFT includera’ The SleuthKit 4.1) e Autopsy 2 – in arrivo anche Autopsy 3 su Linux (solo per Law Enforcement);
- Digital Forensics Framework 1.3;
- Supporto per Libewf e AFFlib;
- Xmount e mount_ewf;
- Guymager 0.7.1, Cyclone 0.2 ed Esximager;
- Recoll 1.19.5, software per indicizzazione;
- Bulk extractor 1.3.1 con Bulk extractor GUI 1.3;
- Dumpy 0.2, uno strumento di parsing per estrarre dati strutturati dai dump (utile in particolare per quelli “anonimi”) – un ringraziamento particolare a Gianni Amato (guelfoweb) per l’esclusiva!
- Skype extractor;
- Log2timeline 0.65;
- iPBA 2 e Lib iMobile device 1.1.5 (pieno supporto per iOS 6.*);
- Fastboot – re-flash Android partition tool;
- Google Chrome Open Source INTelligence browser e TOR;
- Maltego Radium (ci scusiamo ma c’e’ ancora un problema per la risoluzione del quale stiamo collaborando con il supporto Paterva);
- Xplico 1.0.1 e CapAnalysis.
Rammentiamo che questa e’ una public beta release, gia’ ampiamente testata e sistemata internamente ma per la quale vi chiediamo la collaborazione nel caso in cui troviate bug, scrivendoci a [email protected]. Contiamo di rilasciare la ISO finale, con incluso DART 2 e la Virtual Appliance, entro la meta’ di luglio.
Potete scaricare DEFT 8 public beta [link rimosso perché obsoleto] dal link diretto per il download e verificarne l’MD5 con il valore seguente: 7a7613d4673e949f9871347efab6e15e.
DART 2.0 (la suite di strumenti per informatica forense utilizzabile su sistemi Windows) e’ stato completamente riscritto con le seguenti novità :
- Motore di ricerca delle applicazioni stile Spotlight;
- Nuovo motore di reporting e auditing;
- Possibilita’ di eseguire le applicazioni come Amministratore, quando e se necessario;
- Possibilita’ di spostarsi direttmaente nel path dell’applicazione;
- Possibilita’ di copiare nella clipboard l’hash di dart.xml.
Potete scaricare DART 2.0 dal link diretto per il download e verificarne l’integrità con il seguente MD5: 630291049bc52cbd7e5c7e56e669078a.
DART 2.0 contiene le seguenti applicazioni:
TCHunt 1.5 (GUI), TCHunt 1.6 (CLI), FTK Imager Lite, FTK Imager CLI (Win, Linux, Mac), CamStudio, ConCon Retriever, Cygwin coreutils, dcfldd, dcfldd (per Windows), Belkasoft Ram Capturer 32/64, Search my files, FAU x86/x64, FAU x86 e x64, HDDRawCopy, fmem, FastCopy 32/64, trid / trid Linux, TrIDnet, md5deep e hashdeep for Windows, HxD, MouseJiggle, MediaPlayerClassic (x86/x64), NetSetMan, Access PassView, AlternateStreamView, AppCrashView, AsterWin IE, AdapterWatch, BlueScreenView, BluetoothView, BrowsingHistoryView, BulletsPassView, ChromeCacheView, ChromeCookiesView, ChromeHistoryView, ChromePass, LastActivityView, CurrPorts, CurrProcess, DevManView, Dialupass, DiskCountersView, DiskSmartView, DriveLetterView, Enterprise Manager PassView, ESEDatabaseView, ExifDataView, FavoritesView, FirefoxDownloadsView, FlashCookiesView, FoldersReport, HashMyFiles, HTTPNetworkSniffer, IECacheView, IECookiesView, IEHistoryView, InsideClipboard, InstalledCodec, IE PassView, JumpListsView, LiveContactsView, LSASecretsDump, LSASecretsView, Mail PassView, MIMEView, MozillaCacheView, MozillaHistoryView, MessenPass, MUICacheView, MyEventViewer, MyLastSearch, MozillaCookiesView, NetBScanner, NetResView, NetworkInterfacesView, Network Password Recovery, NetRouteView, NetworkTrafficView, NTFSLinksView, OpenedFilesView, OperaCacheView, OperaPassView, OutlookAddressBookView, OutlookAttachView, OutlookStatView, Password Security Scanner, SniffPass, PasswordFox, PCAnywhere PassView, ProcessActivityView, ProcessThreadsView, Protected Storage PassView, PstPassword, RecentFilesView, RegScanner, Remote Desktop PassView, RouterPassView, SafariCacheView, SafariHistoryView, SearchMyFiles, ServiWin, ShellBagsView, SkypeLogView, SmartSniff, SocketSniff, URLStringGrabber, USBDeview, UserProfilesView, UserAssistView, VideoCacheView, VNCPassView, WebBrowserPassView, WebCookiesSniffer, WhatInStartup, WifiInfoView, WinPrefetchView, Win9x PassView, WinLister, WirelessKeyView, WirelessNetView, Wireless Network Watcher, BFT, Pzen Dump, Orion Browser Dumper, Phrozen Password Revealer, On-screen keyboard, Notepad++ (with ToolBucket, XMLtools, CompareUni, Hexeditor Uni e LightExplorerUni), XnView, VLC Portable, SumatraPDF, 7zip, ClamWin, Eraser Portable, InfraRecorder, QCC FragView, QCC Gigaview, QCC VideoTriage, Browser History Spy, SecurityXploded SpyDLLRemover, SecurityXploded PasswordSuite, Proc Net Monitor, eCryptfs Parser (Win e Lin), MDD, Quick Hask (win e lin), RHash, The Sleuth Kit (win32), SQLite Database Browser, USB History Dump, SSDeep, Nigilant32, AlexNolan DriveMan, ICESword, ash368 Lime Juicer, ash368 LimeWire Library Parser v4 e v5, ash368 VW7, ash368 Props, ash368 Thumo, testdisk/photorec Win/Lin/Mac x86/x64, EMFSpoolViewer, System Scaner, Teracopy Portable, CyberMarshal eMule Reader, CyberMarshal Mac Memory Reader, CyberMarshal Windows Memory Reader, Database Browser, DeepBurner, Mail-Cure for Outlook Express, MetMedic, FastStone Viewer, Windows Forensic Toolchest, Gaijin FileInfo, Gaijin Historian, Gaijin StreamFinder, Gaijin Emule MET viewer, Gaijin Registry Report, Gaijin USB WriteProtector, Gaijin WipeDisk, Gaijin ConTools, Gaijin Spartacus, Gsplit, GMER, HWiNFO 32 + HWINFO Dos, JPEGsnoop, Jam-Software Treesize, Jam-Software UltraSearch, Advanced Password Recovery, Universal Extractor, Mandiant IOC Finder, Mandiant Memoryze Mac, Mandiant Memoryze, Harvester, md5summer, Mitec Internet History Browser, Mitec Instant Messaging History Browser, Mitec Mail Viewer, MiTec Structured Storage Viewer, Mitec Windows File Analyzer, Mitec Windows Registry Rescue, Neuber PC On/Off Time, Neuber Svchost Process Analyzer, TurnedOnTimesView, TcpLogView, AviScreen, WinAudit Unicode, Screeny, FileAlyzer 2, FileAlyzer e FoldAlyzer, Sanderson OLEDeconstruct, Sanderson Forensic Copy, Sanderson List Codecs, Sanderson Forensic Image Viewer, OTFE Volume File Finder, SDHash, ShadowExplorer, FSV Thumbs Extractor, Lnkexaminer, Vidpreview, sleuthkit win32, LAN Search Pro 32, Network Scanner 32, Don’t Sleep, Photostudio, ltfviewer, index.dat Analyzer, ProDiscover Basic Free, ZeroView, TightVNC, ScoopyNG, Tuluka, Undelete 360, SPLViewer, Universal Viewer Free, GRR client Win32/64 OSX, tr3secure, Registry Decoder Live, RegRipper Plugin, RegRipper + RegRipperXP, simple-file-parser, mac-ir, RootRepeal, BlackBag IOReg Info, BlackBag PMAP Info, Mandiant Heap Inspector 32/64, DNSQuerySniffer, pre-search, linux_86, solaris 2.7
Enjoy it! 🙂
