Software Engineering Institute

LIFTeR: All Announcements

September 20, 2023: The following changes have been made:

pfring-8.7.0-8521.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.7.0.8521-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4399.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-27.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-366 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-366 for EL9

September 13, 2023: The following changes have been made:

snort-3.1.70.0-1.{fc36,fc37,fc38,el8}.x86_64.rpm and snort-3.1.70.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
zeek{,-btest,-btest-data,-client,-core,ctl,-devel,-spicy-devel,-zkg}-6.0.1-1.{fc36,fc37,fc38,el7,el8}.x86_64.rpm, libbroker-devel-6.0.1-1.{fc36,fc37,fc38,el7,el8}.x86_64.rpm, zeek{,-btest,-btest-data,-client,-core,ctl,-devel,-spicy-devel,-zkg}-6.0.1-1.el9.{x86_64,aarch64}.rpm, libbroker-devel-6.0.1-1.el9.{x86_64,aarch64}.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
pfring-8.7.0-8509.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. This package was installed for CentOS 7 for the x86_64 architecture.
pfring-dkms-8.7.0.8509-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. This package was installed for CentOS 7 for the x86_64 architecture.
ndpi-4.7.0-4389.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. This package was installed for CentOS 7 for the x86_64 architecture.
pfring-8.7.0-8510.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
pfring-dkms-8.7.0.8510-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
ndpi-4.7.0-4390.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
lime-kernel-modules-fc38-x86_64-1.9.1-14.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.14-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.14.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.14-200 for FC38
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-26.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-362 for EL9
- 5.14.0-364 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-362 for EL9
- 5.14.0-364 for EL9

September 6, 2023: The following changes have been made:

bellsoft-jdk17.0.8.1+1-linux-{amd64,aarch64}-full.rpm - Bellsoft Java was installed for Fedora 36, 37, and 38, CentOS/RHEL 7 and 8 Stream, and Amazon Linux 2 for the x86_64 architecture, and the CentOS 9 Stream reposotiries for the x86_64 and aarch64 architectures..
sleuthkit{,-devel,-libs}-4.12.1-100.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and sleuthkit{,-devel,-libs}-4.12.1-100.el9.{x86_64,aarch64}.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
autopsy-4.21.0-1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and autopsy-4.21.0-1.el9.{x86_64,aarch64}.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:
1. This version uses Java 8 from Bellsoft.
2. This release corrects errors in the /usr/bin/autopsy script where the hardware platform was incorrectly determined.
3. This release fixes a problem with the Java JAR file from the Sleuthkit for the AARCH64 hardware platform. This means that autopsy does work in CentOS 9 for the AARCH64 architecture.
4. If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
  [ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
  sudo systemctl start xrdp
pfring-8.7.0-8483.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. This package was installed for CentOS 7 for the x86_64 architecture.
pfring-dkms-8.7.0.8483-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. This package was installed for CentOS 7 for the x86_64 architecture.
ndpi-4.7.0-4368.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. This package was installed for CentOS 7 for the x86_64 architecture.
pfring-8.7.0-8487.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
pfring-dkms-8.7.0.8487-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
ndpi-4.7.0-4372.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
lime-kernel-modules-fc38-x86_64-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.13-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.13-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.13-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.13-100 for FC37
lime-kernel-modules-el8-x86_64-1.9.1-43.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-513 for EL8
fmem-kernel-modules-el8-x86_64-1.6-1.43.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-513 for EL8

August 30, 2023: The following changes have been made:

Volatility3-windows-symbols-20230821-2.noarch.rpm - Volatility 3 windows symbols and Volatility 3 windows symbos from JPCERT. This package consists of both of these sets of windows symbols combined. This package is installed in the Fedora 36, 37, and 38, CentOS 7, 8 Stream and 9 Stream, and Amazon Linx 2 repositories for the x86_64 architecture and the CentOS 9 Stream repository for the aarch64 architecture. Please note that the correct way to install this package is the following: sudo rpm -ev Volatility3-windows-symbols --nodeps sudo dnf install Volatility3-windows-symbols --refresh -y
Volatility3-linux-symbols-20191016-3.noarch.rpm - Volatility 3 linux symbols are a package that contains kernel symbol table information for some versions of the Linux kernel. This package is installed in the Fedora 36, 37, and 38, CentOS 7, 8 Stream and 9 Stream, and Amazon Linx 2 repositories for the x86_64 architecture and the CentOS 9 Stream repository for the aarch64 architecture. The change made in this package are to remove unneeded files after installation and package removal. Please note that the correct way to install this package is the following: sudo rpm -ev Volatility3-linux-symbols --nodeps sudo dnf install Volatility3-linux-symbols --refresh -y
Volatility3-mac-symbols-20200601-3.noarch.rpm - Volatility 3 linux symbols are a package that contains kernel symbol table information for some versions of Mac OS. This package is installed in the Fedora 36, 37, and 38, CentOS 7, 8 Stream and 9 Stream, and Amazon Linx 2 repositories for the x86_64 architecture and the CentOS 9 Stream repository for the aarch64 architecture. The change made in this package are to remove unneeded files after installation and package removal. Please note that the correct way to install this package is the following: sudo rpm -ev Volatility3-mac-symbols --nodeps sudo dnf install Volatility3-mac-symbols --refresh -y
snort-3.1.69.0-1.{fc36,fc37,fc38,el8}.x86_64.rpm and snort-3.1.69.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
ghidra-10.3.3-PUBLIC_20230829.1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and ghidra-10.3.3-PUBLIC_20230829.1.el9.{x86_64,aarch64}.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
pfring-8.5.0-8460.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8460-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4354.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-12.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.12-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.12-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-12.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.12-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.12-100 for FC37
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-25.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-361 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-361 for EL9
lime-kernel-modules-el8-x86_64-1.9.1-42.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-512 for EL8
fmem-kernel-modules-el8-x86_64-1.6-1.42.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-512 for EL8

August 23, 2023: The following changes have been made:

avml-0.12.0-1.{fc36,fc37,fc38,el9}.x86_64.rpm - AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed. AVML can produce a memory image suitable for processing with Volatility 2 or Volatility 3 once the appropriate profiles have been created.
Volatility3-2.5.0-1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and Volatility3-2.5.0-1.el9.{aarch64,x86_64}.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. The full documentation for this version of Volatility can be found here. This release is current as of 2023-08-21.
Volatility3-windows-symbols-20230821-1.noarch.rpm - Volatility 3 windows symbols and Volatility 3 windows symbos from JPCERT. This package consists of both of these sets of windows symbols combined. This package is installed in the Fedora 36, 37, and 38, CentOS 7, 8 Stream and 9 Stream, and Amazon Linx 2 repositories for the x86_64 architecture and the CentOS 9 Stream repository for the aarch64 architecture.
Volatility3-linux-symbols-20191016-2.noarch.rpm - Volatility 3 linux symbols are a package that contains kernel symbol table information for some versions of the Linux kernel. This package is installed in the Fedora 36, 37, and 38, CentOS 7, 8 Stream and 9 Stream, and Amazon Linx 2 repositories for the x86_64 architecture and the CentOS 9 Stream repository for the aarch64 architecture. The change made in this package are to remove unneeded files after installation and package removal.
Volatility3-mac-symbols-20200601-2.noarch.rpm - Volatility 3 linux symbols are a package that contains kernel symbol table information for some versions of Mac OS. This package is installed in the Fedora 36, 37, and 38, CentOS 7, 8 Stream and 9 Stream, and Amazon Linx 2 repositories for the x86_64 architecture and the CentOS 9 Stream repository for the aarch64 architecture. The change made in this package are to remove unneeded files after installation and package removal.
pfring-8.5.0-8444.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8444-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4338.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-11.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.10-200 for FC38
- 6.4.11-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.10-200 for FC38
- 6.4.11-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-11.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.10-100 for FC37
- 6.4.11-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.10-100 for FC37
- 6.4.11-100 for FC37
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-24.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-354 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-354 for EL9
lime-kernel-modules-el8-x86_64-1.9.1-41.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-508 for EL8
- 4.18.0-509 for EL8
- 4.18.0-511 for EL8
fmem-kernel-modules-el8-x86_64-1.6-1.41.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-508 for EL8
- 4.18.0-509 for EL8
- 4.18.0-511 for EL8

August 16, 2023: The following changes have been made:

zeek{,-btest,-btest-data,-client,-core,ctl,-devel,-spicy-devel,-zkg}-6.0.0-1.{fc36,fc37,fc38,el7,el8}.x86_64.rpm, libbroker-devel-6.0.0-1.{fc36,fc37,fc38,el7,el8}.x86_64.rpm, zeek{,-btest,-btest-data,-client,-core,ctl,-devel,-spicy-devel,-zkg}-6.0.0-1.el9.{x86_64,aarch64}.rpm, libbroker-devel-6.0.0-1.el9.{x86_64,aarch64}.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
pfring-8.5.0-8442.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8442-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4337.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-10.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.9-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.9-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-10.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.9-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.9-100 for FC37
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-23.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-352 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-352 for EL9
lime-kernel-modules-el7-x86_64-1.9.1-91.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.95.1 for EL7
fmem-kernel-modules-el7-x86_64-1.6-1.91.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.95.1 for EL7

August 9, 2023: The following changes have been made:

maryam-2.5.2.post2-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm and maryam-2.5.2.post2-1.el9.{x86_64,aarch64}.rpm - OWASP Maryam is a modular/optional open-source framework based on OSINT and data gathering. Maryam is written in the Python programming language and has been designed to provide a powerful environment to harvest data from open sources and search engines and collect data quickly and thoroughly. See here for documentation on the modules provided for Maryam. Note that Maryam is not available for CentOS/RHEL 7 at this time.
pfring-8.5.0-8433.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8433-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4328.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-9.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.7-200 for FC38
- 6.4.8-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.7-200 for FC38
- 6.4.8-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-9.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.7-100 for FC37
- 6.4.8-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.7-100 for FC37
- 6.4.8-100 for FC37
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-22.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-347 for EL9
- 5.14.0-350 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-347 for EL9
- 5.14.0-350 for EL9

August 2, 2023: The following changes have been made:

libfsext{,-devel,-python3,-tools}-20230603-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm, libfsext{,-devel,-python3,-tools}-20230603-1.el9.{aarch64,x86_64}.rpm, and libfsext{,-devel,-python36,-tools}-20230603-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
dtfabric-20230520-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm and dtfabric-20230520-1.el9.{x86_64,aarch64}.rpm - Dtfabric is a project to manage data types and structures, as used in the libyal projects.
dfimagetools-tools-20230526-1.{fc36,fc37,fc38,el8,el9,amzn2}.noarch.rpm and python3-dfimagetools-20230526-1.{fc36,fc37,fc38,el8,el9,amzn2}.noarch.rpm - DFImageTools is a collection of tools to process storage media images.
python3-dfdatetime-20230506-1.{fc36,fc37,fc38,el8,el9,amzn2}.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
python3-acstore-20230519-1.{fc36,fc37,fc38,el8,el9,amzn2}.noarch.rpm - ACStore is a library that provides a stand-alone implementation to read and write Attribute Container stores, such as Plaso storage files.
python3-dfvfs-20230531-1.{fc36,fc37,fc38,el8,el9,amzn2}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libfsntfs{,-devel,-python3,-tools}-20230606-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm, libfsntfs{,-devel,-python3,-tools}-20230606-1.el9.{x86_64,aarch64}.rpm, and libfsntfs{,-devel,-python36,-tools}-20230606-1.el7.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
python3-artifacts-20230723-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm, artifacts-data-20230723-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm , python3-artifacts-20230723-1.el9.{x86_64,aarch64}.rpm, and artifacts-data-20230723-1.el9.{x86_64,aarch64}.rpm - Artifacts is a free, community-sourced,
libfsapfs{,-devel,-python3,-tools}-20230617-1.{fc36,fc37,fc38,el8,amzn2,el8}.x86_64.rpm, libfsapfs{,-devel,-python3,-tools}-20230617-1.el9.{x86_64,aarch64}.rpm, and libfsapfs{,-devel,-python36,-tools}-20230617-1.el7.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
libvsbsdl{,-devel,-python3,-static,-tools}-20230506-1.{fc36,fc37,fc38,el8,amzn2,el8}.x86_64.rpm, libvsbsdl{,-devel,-python3,-static,-tools}-20230506-1.el9.{x86_64,aarch64}.rpm, and libvsbsdl{,-devel,-python36,-static,-tools}-20230506-1.el7.x86_64.rpm - libvsbsdl is a library to access the BSD disk label volume system format.
libvsapm{,-devel,-python3,-static,-tools}-20230506-1.{fc36,fc37,fc38,el8,amzn2,el8}.x86_64.rpm, libvsapm{,-devel,-python3,-static,-tools}-20230506-1.el9.{x86_64,aarch64}.rpm, and libvsapm{,-devel,-python36,-static,-tools}-20230506-1.el7.x86_64.rpm - libvsapm is a library to access the Apple Partition Map (APM) volume system format.
libgzipf{,-devel,-python3,-static,-tools}-20230114-1.{fc36,fc37,fc38,el8,amzn2,el8}.x86_64.rpm, libgzipf{,-devel,-python3,-static,-tools}-20230114-1.el9.{x86_64,aarch64}.rpm, and libgzipf{,-devel,-python36,-static,-tools}-20230114-1.el7.x86_64.rpm - libgzipf is a library to access the GZIP file format.
libcaes{,-devel,-python3,-static}-20230406-1.{fc36,fc37,fc38,el8,amzn2,el8}.x86_64.rpm, libcaes{,-devel,-python3,-static}-20230406-1.el9.{x86_64,aarch64}.rpm, and libcaes{,-devel,-python36,-static}-20230406-1.el7.x86_64.rpm - libcaes is a library to support cross-platform AES encryption.
plaso-20230717-1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and plaso-20230717-1.el9.{x86_64,aarch64}.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. This release removes the version restriction on the pyparsing package.
python3-certifi-2023.7.22-1.{el8,amzn2}.noarch.rpm and python36-certifi-2023.7.22-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
CERT-Forensics-Tools-1.0-104.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and CERT-Forensics-Tools-1.0-104.el9.{aarch64,x86_64}.rpm - The following tools were added:
- libvsbsdl-tools - tools to access BSD disk label volume system format.
- libvsapm-tools - tools to access the Apple File System (APFS).
- libgzipf-tools - tools to access the GZIP file format.
pfring-8.5.0-8415.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. This package was installed for CentOS 7 for the x86_64 architecture.
pfring-dkms-8.5.0.8415-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. This package was installed for CentOS 7 for the x86_64 architecture.
ndpi-4.7.0-4321.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. This package was installed for CentOS 7 for the x86_64 architecture.
pfring-8.5.0-8418.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
pfring-dkms-8.5.0.8418-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
ndpi-4.7.0-4324.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. This package was installed for CentOS 8 Stream and 9 Stream for the x86_64 architecture.
snort-3.1.67.0-1.{fc36,fc37,fc38,el8}.x86_64.rpm and snort-3.1.67.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
lime-kernel-modules-fc38-x86_64-1.9.1-8.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.6-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.6-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-8.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.6-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.6-100 for FC37
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-21.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-344 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-344 for EL9

July 26, 2023: The following changes have been made:

snort-3.1.66.0-1.{fc36,fc37,fc38,el8}.x86_64.rpm and snort-3.1.66.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
yaf{,-devel}-3.0.0.alpha3-1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and yaf{,-devel}-3.0.0.alpha3-1.el9.{aarch64,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Note that for CentOS 7, 8, and 9 x86_64 systems, yaf has been built to use PF_Ring. See here for the list of changes. These packages are installed in the forensics-test repository. Please address any comments on these packages to netsa-help@cert.org.
bellsoft-jdk8u382+6-linux-amd64-full.rpm - Bellsoft Java was installed for Fedora 36, 37, and 38, CentOS/RHEL 7, 8, and 9, and Amazon Linux 2 for the x86_64 architecture. Bellsoft Java 8 is the recommended version of Java for Autopsy.
bellsoft-jdk8u382+6-linux-aarch64.rpm - Bellsoft Java was installed for CentOS/RHEL 9 for the aarch64 architecture. Bellsoft Java 8 is the recommended version of Java for Autopsy.
autopsy-4.20.0-2.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and autopsy-4.20.0-2.el9.{x86_64,aarch64}.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:
1. This version uses Java 8 from Bellsoft.
2. This release corrects errors in the /usr/bin/autopsy script where the hardware platform was incorrectly determined.
3. This release fixes a problem with the Java JAR file from the Sleuthkit for the AARCH64 hardware platform. This means that autopsy does work in CentOS 9 for the AARCH64 architecture.
4. If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
  [ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
  sudo systemctl start xrdp
pfring-8.5.0-{8401,8410}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.{8401,8410}-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-{4311,4318}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-7.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.4-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.4-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-7.noarch.rpm - Support for the following kernels were added for LiME:
- 6.4.4-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.4.4-100 for FC37
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-20.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-340 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-340 for EL9

July 12, 2023: The following changes have been made:

fakenet-3.0a-1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and fakenet-3.0a-1.el9.{x86_64,aarch64}.rpm - Fakenet is a next generation dynamic network analysis tool for malware analysts and penetration testers. It is open source and designed for the latest versions of Windows (and Linux, for certain modes of operation). FakeNet-NG is based on the excellent Fakenet tool developed by Andrew Honig and Michael Sikorski. The tool allows you to intercept and redirect all or specific network traffic while simulating legitimate network services. Using FakeNet-NG, malware analysts can quickly identify malware's functionality and capture network signatures. Penetration testers and bug hunters will find FakeNet-NG's configurable interception engine and modular framework highly useful when testing application's specific functionality and prototyping PoCs.
ghidra-10.3.2-PUBLIC_20230711.1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and ghidra-10.3.2-PUBLIC_20230711.1.el9.{x86_64,aarch64}.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
pfring-8.5.0-8381.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8381-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4291.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-6.noarch.rpm - Support for the following kernels were added for LiME:
- 6.3.12-200 for FC38
- 6.3.11-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.3.12-200 for FC38
- 6.3.11-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-6.noarch.rpm - Support for the following kernels were added for LiME:
- 6.3.12-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.3.12-100 for FC37
lime-kernel-modules-el8-x86_64-1.9.1-40.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-500 for EL8
fmem-kernel-modules-el8-x86_64-1.6-1.40.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-500 for EL8

July 5, 2023: The following changes have been made:

snort-3.1.65.0-1.{fc36,fc37,fc38,el8}.x86_64.rpm and snort-3.1.65.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
pfring-8.5.0-8373.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8373-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4284.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-19.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-333 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-333 for EL9

June 28, 2023: The following changes have been made:

maryam-2.5.2-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm and maryam-2.5.2-1.el9.{x86_64,aarch64}.rpm - OWASP Maryam is a modular/optional open-source framework based on OSINT and data gathering. Maryam is written in the Python programming language and has been designed to provide a powerful environment to harvest data from open sources and search engines and collect data quickly and thoroughly. See here for documentation on the modules provided for Maryam. Note that Maryam is not available for CentOS/RHEL 7 at this time.
avml-0.11.4-1.{fc36,fc37,fc38}.x86_64.rpm and avml-0.11.4-1.el9.{x86_64,aarch64}.rpm - AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed. AVML can produce a memory image suitable for processing with Volatility 2 or Volatility 3 once the appropriate profiles have been created.
libpst{,-devel,-devel-doc,-doc,-libs}-0.6.72-4.{el7,el8}.x86_64.rpm, python3-libpst-0.6.72-4.el8.x86_64.rpm, and python36-libpst-0.6.72-4.el7.x86_64.rpm - The libpst utilities convert Outlook .pst files to other formats. See here for the list of changes.
python{2,36}-ssdeep-3.2-1.el7.x86_64.rpm - Python-SSDeep is a Python wrapper for SSDeep fuzzy hashing library. This package was built to support the packaging of Volatility-community-plugins.
yaf{,-devel}-2.14.0-1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and yaf{,-devel}-2.14.0-1.el9.{x86_64,aarch64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Note that for CentOS 7, 8, and 9 for the x86_64 architecture, yaf has been built to use PF_Ring.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.21.0-1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.21.0-1.el9.{x86_64,aarch64}.rpm - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. See here for a list of changes in this version.
analysis-pipeline-5.11.4-5.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and analysis-pipeline-5.11.4-5.el9.{x86_64,aarch64}.rpm - The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM). This package was rebuilt for silk 3.21.0.
prism-1.2-10.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm - The prism trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool. The script can be used directly, or might be used as a component in other more specialized scripts. In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup. This package was rebuilt to use silk 3.21.0.
super_mediator-1.9.1-2.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and super_mediator-1.9.1-2.el9.{x86_64,aarch64}.rpm - Super_mediator is an IPFIX mediator for use with the YAF and SiLK tools. It collects and filters YAF output data to various IPFIX collecting processes and/or csv files. See here for the list of changes. This package was rebuilt to use silk 3.21.0.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.21.0-2.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.21.0-2.el9.{x86_64,aarch64}.rpm - This release of the SiLK tools can be found in an optional repository that is now part of cert-forensics-tools-release named forensics-sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo. This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.21.0-101.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.21.0-101.el9.{x86_64,aarch64}.rpm - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. These packages are installed in the forensics-test repository. These packages were rebuilt to use libfixbuf 3.0.0.alpha2. Please address any comments on these packages to netsa-help@cert.org.
analysis-pipeline-5.11.4-6.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and analysis-pipeline-5.11.4-6.el9.{aarch64,x86_64}.rpm - The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM). This package is installed in the forensics-test repository. This package was rebuilt to use libfixbuf 3.0.0.alpha2 and silk 3.21.0. Please address any comments on these packages to netsa-help@cert.org.
pfring-8.5.0-8365.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8365-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4280.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-18.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-331 for EL9
- 5.14.0-330 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-331 for EL9
- 5.14.0-330 for EL9
lime-kernel-modules-el8-x86_64-1.9.1-39.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-499 for EL8
fmem-kernel-modules-el8-x86_64-1.6-1.39.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-499 for EL8
lime-kernel-modules-el7-x86_64-1.9.1-90.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.92.1 for EL7
fmem-kernel-modules-el7-x86_64-1.6-1.90.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.92.1 for EL7

June 21, 2023: The following changes have been made:

ghidra-10.3.1-PUBLIC_20230614.1.{fc36,fc37,fc38,el7,el8,amzn2}.x86_64.rpm and ghidra-10.3.1-PUBLIC_20230614.1.el9.{x86_64,aarch64}.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
daq{,-devel,-modules}-3.0.12-1.{fc36,fc37,fc38,el8}.x86_64.rpm and daq{,-devel,-modules}-3.0.12-1.el9.{aarch64,x86_64}.rpm - The Data Acquisition Library (Daq) is a library used by snort.
snort-3.1.64.0-1.{fc36,fc37,fc38,el8}.x86_64.rpm and snort-3.1.64.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
pfring-8.5.0-8343.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8343-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4265.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-5.noarch.rpm - Support for the following kernels were added for LiME:
- 6.3.8-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.5.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.3.8-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-5.noarch.rpm - Support for the following kernels were added for LiME:
- 6.3.8-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.5.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.3.8-100 for FC37
lime-kernel-modules-el8-x86_64-1.9.1-38.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-497 for EL8
fmem-kernel-modules-el8-x86_64-1.6-1.38.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-497 for EL8

June 14, 2023: The following changes have been made:

unrar-6.2.2-1.{fc36,fc37,fc38,el8,el9,amzn2}.x86_64.rpm - Unrar is a powerful archive manager. It can backup your data and reduce the size of email attachments, decompress RAR, ZIP and other files downloaded from Internet and create new archives in RAR and ZIP file format. See here for a list of changes in this version.
rar-6.2.2-1.{fc36,fc37,fc38,el8,el9,amzn2}.x86_64.rpm - Rar is a powerful archive manager. It can backup your data and reduce the size of email attachments, decompress RAR, ZIP and other files downloaded from Internet and create new archives in RAR and ZIP file format. See here for a list of changes in this version.
python3-artifacts-20230413-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm, artifacts-data-20230413-1.{fc36,fc37,fc38,el8,amzn2}.x86_64.rpm , python3-artifacts-20230413-1.el9.{x86_64,aarch64}.rpm, and artifacts-data-20230413-1.el9.{x86_64,aarch64}.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
pfring-8.5.0-8320.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8320-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4252.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
pfring-8.5.0-8321.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8321-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4253.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-4.noarch.rpm - Support for the following kernels were added for LiME:
- 6.3.7-200 for FC38
- 6.3.6-200 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.4.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.3.7-200 for FC38
- 6.3.6-200 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-4.noarch.rpm - Support for the following kernels were added for LiME:
- 6.3.7-100 for FC37
- 6.3.6-100 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.4.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.3.7-100 for FC37
- 6.3.6-100 for FC37
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-17.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-325 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-325 for EL9
lime-kernel-modules-el8-x86_64-1.9.1-37.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-494 for EL8
- 4.18.0-496 for EL8
fmem-kernel-modules-el8-x86_64-1.6-1.37.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-494 for EL8
- 4.18.0-496 for EL8

June 7, 2023: The following changes have been made:

snort-3.1.63.0-1.{fc36,fc37,fc38,el8}.x86_64.rpm and snort-3.1.63.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
python3-xlsxwriter-3.1.2-1.{el9,amzn2}.noarch.rpm python36-xlsxwriter-3.1.2-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
pfring-8.5.0-8314.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.5.0.8314-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.7.0-4246.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc38-x86_64-1.9.1-3.noarch.rpm - Support for the following kernels were added for LiME:
- 6.3.5-200 for FC38
- 6.3.4-201 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.3.5-200 for FC38
- 6.3.4-201 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-3.noarch.rpm - Support for the following kernels were added for LiME:
- 6.3.5-100 for FC37
- 6.3.4-101 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.3.5-100 for FC37
- 6.3.4-101 for FC37
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-16.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-319 for EL9
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-319 for EL9

May 31, 2023: The following changes have been made:

libmaxminddb{,-devel}-1.7.1-1.amzn2.x86_64.rpm - Libmaxminddb provides a C library for reading MaxMind DB files, including the GeoIP2 databases from MaxMind.
bellsoft-jdk8u372+7-linux-amd64-full.rpm - Bellsoft Java was installed for Fedora 34, 35, and 36, CentOS/RHEL 7, 8, and 9, and Amazon Linux 2 for the x86_64 architecture. Bellsoft Java 8 is the recommended version of Java for Autopsy.
bellsoft-jdk8u372+7-linux-aarch64.rpm - Bellsoft Java was installed for CentOS/RHEL 9 for the aarch64 architecture. Bellsoft Java 8 is the recommended version of Java for Autopsy.
libvhdi{,-devel,-python3,-tools}-20221124-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libvhdi{,-devel,-python3,-tools}-20221124-1.el9.{x86_64,aarch64}.rpm, and libvhdi{,-devel,-python36,-tools}-20221124-1.el7.x86_64.rpm - Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
libvmdk{,-devel,-python3,-tools}-20221124-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libvmdk{,-devel,-python3,-tools}-20221124-1.el9.{x86_64,aarch64}.rpm, and libvmdk{,-devel,-python36,-tools}-20221124-1.el7.x86_64.rpm - Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
sleuthkit{,-devel,-libs}-4.12.0-100.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and sleuthkit{,-devel,-libs}-4.12.0-100.el9.{x86_64,aarch64}.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
libbde{,-devel,-python3,-tools}-20221031-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libbde{,-devel,-python3,-tools}-20221031-1.el9.{x86_64,aarch64}.rpm, and libbde{,-devel,-python36,-tools}-20221031-1.el7.x86_64.rpm - Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
libevt{,-devel,-python3,-tools}-20221022-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libevt{,-devel,-python3,-tools}-20221022-1.el9.{x86_64,aarch64}.rpm, and libevt{,-devel,-python36,-tools}-20221022-1.el7.x86_64.rpm - Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
libevtx{,-devel,-python3,-tools}-20221101-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libevtx{,-devel,-python3,-tools}-20221101-1.el9.{aarch64,x86_64}.rpm, and libevtx{,-devel,-python36,-tools}-20221101-1.el7.x86_64.rpm - Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
liblnk{,-devel,-python3,-tools}-20230205-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, liblnk{,-devel,-python3,-tools}-20230205-1.el9.{x86_64,aarch64}.rpm, and liblnk{,-devel,-python36,-tools}-20230205-1.el7.x86_64.rpm - Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
libmsiecf{,-devel,-python3,-tools}-20221024-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libmsiecf{,-devel,-python3,-tools}-20221024-1.el9.{x86_64,aarch64}.rpm, and libmsiecf{,-devel,-python36,-tools}-20221024-1.el7.x86_64.rpm - Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
libolecf{,-devel,-python3,-tools}-20221024-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libolecf{,-devel,-python3,-tools}-20221024-1.el9.{x86_64,aarch64}.rpm, and libolecf{,-devel,-python36,-tools}-20221024-1.el7.x86_64.rpm - Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
libbfio{,-devel,-python3}-20221025-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libbfio{,-devel,-python3}-20221025-1.el9.{x86_64,aarch64}.rpm, and libbfio{,-devel,-python36}-20221025-1.el7.x86_64.rpm - Libbfio is a library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff. It is used to chain I/O to support file-in-file access.
libpff{,-devel,-python3,-tools}-20211114-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libpff{,-devel,-python3,-tools}-20211114-1.el9.{x86_64,aarch64}.rpm, and libpff{,-devel,-python36,-tools}-20211114-1.el7.x86_64.rpm - Libpff is a library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.
libqcow{,-devel,-python3,-tools}-20221124-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libqcow{,-devel,-python3,-tools}-20221124-1.el9.{x86_64,aarch64}.rpm, and libqcow{,-devel,-python36,-tools}-20221124-1.el7.x86_64.rpm - Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
libregf{,-devel,-python3,-tools}-20230319-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libregf{,-devel,-python3,-tools}-20230319-1.el9.{x86_64,aarch64}.rpm, and libregf{,-devel,-python36,-tools}-20230319-1.el7.x86_64.rpm - Libregf contains libraries and tools to access the Windows Registry File files.
libsmdev{,-devel,-python3,-tools}-20221028-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libsmdev{,-devel,-python3,-tools}-20221028-1.el9.{x86_64,aarch64}.rpm, and libsmdev{,-devel,-python36,-tools}-20221028-1.el7.x86_64.rpm - Libsmdev is a library and tools used to access storage media devices.
libsmraw{,-devel,-python3,-tools}-20230320-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, and libsmraw{,-devel,-python3,-tools}-20230320-1.el9.{x86_64,aarch64}.rpm, and libsmraw{,-devel,-python36,-tools}-20230320-1.el7.x86_64.rpm - Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
libvshadow{,-devel,-python3,-tools}-20221030-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libvshadow{,-devel,-python3,-tools}-20221030-1.el9.{x86_64,aarch64}.rpm, and libvshadow{,-devel,-python36,-tools}-20221030-1.el7.x86_64.rpm - Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
msghack-0.21-19.0.20220203.el8.noarch.rpm - Msghack is a program that is used used to alter .po files in ways no sane mind would.
gettext{,-devel,-envsubst,-libs,-runtime}-0.21-19.0.20220203.el8.x86_64.rpm, gettext-common-devel-0.21-19.0.20220203.el8.noarch.rpm, and emacs-gettext-0.21-19.0.20220203.el8.noarch.rpm - Gettext is a set of utilities that provides a framework within which other free packages may produce multi-lingual messages.
autoconf-2.71-3.{fc35,el8,el9}.noarch.rpm Autoconf is an extensible package of M4 macros that produce shell scripts to automatically configure software source code packages.
libmdmp{,-devel,-tools}-20230321-1.{fc35,fc36,el8}.x86_64.rpm and libmdmp{,-devel,-tools}-20230321-1.el9.{x86_64,aarch64}.rpm - Libmdmp is a library to access the Windows Minidump (MDMP) format. Note that this project currently only focuses on the analysis of the format.
libhibr{,-devel,-tools}-20230321-1.{fc35,fc36,el8}.x86_64.rpm and libhibr{,-devel,-tools}-20230321-1.el9.{x86_64,aarch64}.rpm - libhibr is a lbrary and tools to access the Windows Hibernation File (hiberfil.sys) format. Note that this project currently only focuses on the analysis of the format.
libmodi{,-devel,-python3,-tools}-20221023-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libmodi{,-devel,-python3,-tools}-20221023-1.el9.{x86_64,aarch64}.rpm, and libmodi{,-devel,-python36,-tools}-20221023-1.el7.x86_64.rpm - Libmodi is a library and tools to access the Mac OS disk image formats.
libnk2{,-devel,-python3,-tools}-20221122-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libnk2{,-devel,-python3,-tools}-20221122-1.el9.{x86_64,aarch64}.rpm, and libnk2{,-devel,-python36,-tools}-20221122-1.el7.x86_64.rpm Libnk2 is a library and tools to access Microsoft Outlook Nickfile (NK2) format files.
libphdi{,-devel,-python3,-tools}-20221025-1.{fc35,fc36,el8,amzn2}.x86_64.rpm , and libphdi{,-devel,-python3,-tools}-20221025-1.el9.{x86_64,aarch64}.rpm, and libphdi{,-devel,-python36,-tools}-20221025-1.el7.x86_64.rpm - Libphdi is a library to access the Parallels Hard Disk image format.
libexe{,-devel,-python3,-tools}-20230318-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libexe{,-devel,-python3,-tools}-20230318-1.el9.{x86_64,aarch64}.rpm, and libexe{,-devel,-python36,-tools}-20230318-1.el7.x86_64.rpm - Libexe is a library and tools to access the executable (EXE) format.
libwtcdb{,-devel,-tools}-20230129-1.{fc35,fc36,el8}.x86_64.rpm and libwtcdb{,-devel,-tools}-20230129-1.el9.{x86_64,aarch64}.rpm - Libwtcdb is a library and tools to access the Windows (Vista/7) Explorer thumbnail cache database format (thumbcache.db).
libfplist{,-devel}-20220116-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and libfplist{,-devel}-20220116-1.el9.{x86_64,aarch64}.rpm - Libfplist is a library for plist formats. Note: this is a library only - there are no tools provided by these packages.
libfwevt{,-devel}-20230410-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and libfwevt{,-devel}-20230410-1.el9.{x86_64,aarch64}.rpm - Libfwevt is a library for Windows XML Event Log (EVTX) data types. Note: this is a library only - there are no tools provided by these packages.
libfdata{,-devel,-static}-20220111-1.{el7,amzn2}.x86_64.rpm - Libfdata is a library to provide generic file data functions.
libagdb{,-devel,-tools}-20230319-1.{fc35,fc36,el8}.x86_64.rpm and libagdb{,-devel,-tools}-20230319-1.el9.{x86_64,aarch64}.rpm - Libagdb is a library to access the SuperFetch database format.
libagdb{,-devel,-tools}-20201023-1.{el7,amzn2}.x86_64.rpm - Libagdb is a library to access the SuperFetch database format.
libcreg{,-devel,-python3,-tools}-20221022-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libcreg{,-devel,-python3,-tools}-20221022-1.el9.{x86_64,aarch64}.rpm, and libcreg{,-devel,-python36,-tools}-20221022-1.el7.x86_64.rpm - Libcreg is a library and tools to access the Windows 9x/Me Registry File (CREG) format.
libwrc{,-devel,-python3,-tools}-20230318-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libwrc{,-devel,-python3,-tools}-20230318-1.el9.{x86_64,aarch64}.rpm, libwrc{,-devel,-python36,-tools}-20230318-1.el7.x86_64.rpm - Libwrc is a library and tools to access the Windows Resource Compiler (WRC) format.
libvsgpt{,-devel,-python3,-tools}-20221029-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, and libvsgpt{,-devel,-python3,-tools}-20221029-1.el9.{x86_64,aarch64}.rpm, and libvsgpt{,-devel,-python36,-tools}-20221029-1.el7.x86_64.rpm - Libvsgpt is a library and tools used to access the GUID Partition Table (GPT) volume system.
winevtrc-20220106-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and winevtrc-20220106-1.el9.{x86_64,aarch64}.rpm - Winevt-kb is a project to build a Windows Event Log knowledge base. winevtrc is the Python module part of winevt-kb to allow reuse of Windows Event Log resources. Note that this package also provides winevt-kb.
dtfabric-20221218-1.{fc35,fc36,el8,amzn2}.x86_64.rpm and dtfabric-20221218-1.el9.{x86_64,aarch64}.rpm - Dtfabric is a project to manage data types and structures, as used in the libyal projects.
libhmac{,-devel,-python3,-static,-tools}-20230407-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libhmac{,-devel,-python36,-static,-tools}-20230407-1.el7.x86_64.rpm and libhmac{,-devel,-python3,-static,-tools}-20230407-1.el9.{x86_64,aarch64}.rpm - Libhmac is a library to support various Hash-based Message Authentication Codes (HMAC).
dfimagetools-tools-20220312-1.{fc35,fc36,el7,el8,el9,amzn2}.noarch.rpm, python3-dfimagetools-20220312-1.{fc35,fc36,el8,el9,amzn2}.noarch.rpm, and python36-dfimagetools-20220312-1.el7.noarch.rpm - DFImageTools is a collection of tools to process storage media images.
libfcrypto{,-devel,-python3,-static}-20221230-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libfcrypto{,-devel,-python36,-static}-20221230-1.el7.x86_64.rpm, and libfcrypto{,-devel,-python3,-static}-20221230-1.el9.{x86_64,aarch64}.rpm - Libfcrypto is a library for encryption formats.
winregrc-20230205-1.{fc35,fc36,el8,amzn2}.x86_64.rpm and winregrc-20230205-1.el9.{x86_64,aarch64}.rpm - Winreg-kb winreg-kb is a project to build a Windows Registry Knowledge Base. winregrc is a Python module part of winreg-kb to allow reuse of Windows Registry Resources. Note that this package also provides winreg-kb.
dfwinreg-20221218-1.{fc35,fc36,el8,amzn2}.x86_64.rpm and dfwinreg-20221218-1.el9.{x86_64,aarch64}.rpm - DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects. The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
2hash-0.2-2.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and 2hash-0.2-2.el9.{x86_64,aarch64}.rpm - 2hash is a tool to calculate the md5 and sha1 hashes of a file in a single read. If you’re regularly checking/calculating hashes of large files this’ll save you a lot of disk I/O.
libfixbuf{,-devel,-ipfixDump}-2.4.2-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and libfixbuf{,-devel,-ipfixDump}-2.4.2-1.el9.{x86_64,aarch64}.rpm - Libfixbuf is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101). See here for the list of changes.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-3.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-3.el9.{x86_64,aarch64}.rpm - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. See here for a list of changes in this version. This package was rebuilt for libfixbuf-2.4.2.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-4.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-4.el9.{x86_64,aarch64}.rpm - This release of the SiLK tools can be found in an optional repository that is now part of cert-forensics-tools-release named forensics-sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo. This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root. This package was rebuilt for libfixbuf-2.4.2.
libschemaTools{,-devel}-1.4-3.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and libschemaTools{,-devel}-1.4-3.el9.{x86_64,aarch64}.rpm - libschemaTools is a library that provides a standard representation of data records. It is built on fixbuf, using IPFIX information elements. It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source. SchemaTools removes the need for the processing application to know the details of how to retrieve data, and to know the structure of the records. This package was rebuilt for libfixbuf-2.4.2.
analysis-pipeline-5.11.4-3.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and analysis-pipeline-5.11.4-3.el9.{x86_64,aarch64}.rpm - The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM). This package was rebuilt for libfixbuf-2.4.2.
analyzeMFT-3.0.1-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and analyzeMFT-3.0.1-1.el9.{x86_64,aarch64}.rpm - AnalyzeMFT is a tool that fully parses the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats. See here for the changes since the previously installed version 2.0.19.1. Note: This version uses Python 3.
autopsy-4.20.0-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and autopsy-4.20.0-1.el9.{x86_64,aarch64}.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:
1. This version uses Java 8 from Bellsoft.
2. This version was tested on Fedora 32 through 35 and CentOS 7 and 8 for the x86_64 architectures using an E01 dataset that contains a 7-Zip file that contains two JPEG images, one of which has EXIF metadata. Those archives were correctly parsed and the EXIF data verified.
3. If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
  [ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
  sudo systemctl start xrdp
exfat-utils-1.4.0-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and exfat-utils-1.4.0-1.el9.{x86_64,aarch64}.rpm - The EXfat-utils are a set of utilities for creating, checking, dumping and labeling exFAT file systems. This version was rebuilt to remove the obsoletes directives for exfatprogs and fuse-exfat. This means that the installer must select the appropriate version for their system if not installing with the CERT-Forensics-Tools meta package.
unrar-6.2.1-1.{fc35,fc36,el8,el9,amzn2}.x86_64.rpm - Unrar is a powerful archive manager. It can backup your data and reduce the size of email attachments, decompress RAR, ZIP and other files downloaded from Internet and create new archives in RAR and ZIP file format. See here for a list of changes in this version.
rar-6.2.1-1.{fc35,fc36,el8,el9,amzn2}.x86_64.rpm - Rar is a powerful archive manager. It can backup your data and reduce the size of email attachments, decompress RAR, ZIP and other files downloaded from Internet and create new archives in RAR and ZIP file format. See here for a list of changes in this version.
perl-Parse-Win32Registry-1.1-1.{fc35,fc36,el7,el8,el9,amzn2}.noarch.rpm - perl-Parse-Win32Registry is a module for parsing Windows Registry files, allowing you to read the keys and values of a registry file without going through the Windows API. It provides an object-oriented interface to the keys and values in a registry file. Registry files are structured as trees of keys, with each key containing further subkeys or values. The module is intended to be cross-platform, and run on those platforms where Perl will run. It supports both Windows NT registry files (Windows NT, 2000, XP, 2003, Vista, 7) and Windows 95 registry files (Windows 95, 98, Millennium Edition). It is intended to be used to parse offline registry files. If a registry file is currently in use, you will not be able to open it. However, you can save part or all of a currently loaded registry file using the Windows reg command if you have the appropriate administrative access.
fuse-python{2,3}-1.0.5-1.{fc35,fc36,el8,amzn2}.x86_64.rpm and fuse-python3-1.0.5-1.el9.{x86_64,aarch64}.rpm - Fuse-Python is a Python interface to libfuse, a simple interface for userspace programs to export a virtual filesystem to the Linux kernel.
vmfs6-tools-0.2.1-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm, libvmfs6-devel-0.2.1-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm, vmfs6-tools-0.2.1-1.el9.{x86_64,aarch64}.rpm, and libvmfs6-devel-0.2.1-1.el9.{x86_64,aarch64}.rpm - VMFS6-tools is a collection of command-line tools for operating on VMware's VMFS file system. Included in this release is limited VMFS version 6 support. Note: The tools in the vmfs6-tools package are named debugvmfs6, fsck.vmfs6, vmfs6-fuse, vmfs6-lvm.
libscca{,-devel,-python3,-tools}-20221027-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libscca{,-devel,-python3,-tools}-20221027-1.el9.{x86_64,aarch64}.rpm, and libscca{,-devel,-python36,-tools}-20221027-1.el7.x86_64.rpm - Libscca is a library to access the Windows Prefetch File (SCCA) format.
libfwnt{,-devel,-python3}-20220922-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libfwnt{,-devel,-python3}-20220922-1.el9.{x86_64,aarch64}.rpm, and libfwnt{,-devel,-python36}-20220922-1.el7.x86_64.rpm - LibFWNT is a library for Windows NT data types.
libfwps{,-devel,-python3}-20230202-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libfwps{,-devel,-python3}-20230202-1.el9.{x86_64,aarch64}.rpm, and libfwps{,-devel,-python36}-20230202-1.el7.x86_64.rpm - LibFWPS is a library for Windows Property Store data types.
python3-dfdatetime-20230225-1.{fc35,fc36,el8,el9,amzn2}.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
python{2,3}-future-0.18.3-4.1.el8.noarch.rpm - Python-Future is the missing compatibility layer between Python 2 and Python 3. It allows you to use a single, clean Python 3.x-compatible codebase to support both Python 2 and Python 3 with minimal overhead. This package was built to support the packaging of Python-PEFile which in turn is needed to support the packaging of Volatility-community-plugins.
python3-pefile-2023.2.7-1.{fc35,fc36,el9}.noarch.rpm - PEFile is a Portable Executable reader module.
opensearch-py-2.2.0-1.{fc35,fc36,el7,el8,el9,amzn2}.noarch.rpm - OpenSearch-PY is a Python client for OpenSearch.
python3-acstore-20230325-1.{fc35,fc36,el8,el9,amzn2}.noarch.rpm - ACStore is a library that provides a stand-alone implementation to read and write Attribute Container stores, such as Plaso storage files.
python3-flor-1.1.3-1.{fc35,fc36,el8,el9,amzn2}.noarch.rpm and python36-flor-1.1.3-1.el7.noarch.rpm - Flor implements a Bloom filter class that is fully compatible with the Go Bloom filter implementation.
plaso-20230311-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and plaso-20230311-1.el9.{x86_64,aarch64}.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. This release removes the version restriction on the pyparsing package.
libvslvm{,-devel,-python3,-tools}-20221025-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libvslvm{,-devel,-python3,-tools}-20221025-1.el9.{x86_64,aarch64}.rpm, and libvslvm{,-devel,-python36,-tools}-20221025-1.el7.x86_64.rpm - Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
python3-dfvfs-20230408-1.{fc35,fc36,el8,el9,amzn2}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libfsntfs{,-devel,-python3,-tools}-20230427-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libfsntfs{,-devel,-python3,-tools}-20230427-1.el9.{x86_64,aarch64}.rpm, and libfsntfs{,-devel,-python36,-tools}-20230427-1.el7.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
libsigscan{,-devel,-python3,-tools}-20230109-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libsigscan{,-devel,-python3,-tools}-20230109-1.el9.{x86_64,aarch64}.rpm, and libsigscan{,-devel,-python36,-tools}-20230109-1.el7.x86_64.rpm - Libsigscan is a library and tools used to binary signature scanning.
pytsk3-20230125-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and pytsk3-20230125-1.el9.{x86_64,aarch64}.rpm - Pytsk is Python bindings for The Sleuth Kit.
libfwsi{,-devel,-python3}-20230114-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libfwsi{,-devel,-python3}-20230114-1.el9.{x86_64,aarch64}.rpm, and libfwsi{,-devel,-python36}-20230114-1.el7.x86_64.rpm - Libfwsi is a library to access the Windows Shell Item format.
python3-artifacts-20221219-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, artifacts-data-20221219-1.{fc35,fc36,el8,amzn2}.x86_64.rpm , python3-artifacts-20221219-1.el9.{x86_64,aarch64}.rpm, and artifacts-data-20221219-1.el9.{x86_64,aarch64}.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
super_mediator-1.9.1-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and super_mediator-1.9.1-1.el9.{x86_64,aarch64}.rpm - Super_mediator is an IPFIX mediator for use with the YAF and SiLK tools. It collects and filters YAF output data to various IPFIX collecting processes and/or csv files. See here for the list of changes.
acr-2.1.1-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm - ACR tries to replace autoconf functionality generating a full-compatible 'configure' script (runtime flags). But using shell-script instead of m4. This means that ACR is faster, smaller and easy to use.
yaf{,-devel}-2.13.0-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and yaf{,-devel}-2.13.0-1.el9.{x86_64,aarch64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Note that for CentOS 7, 8, and 9 for the x86_64 architecture, yaf has been built to use PF_Ring.
libluksde{,-devel,-python3,-tools}-20221103-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libluksde{,-devel,-python3,-tools}-20221103-1.el9.{x86_64,aarch64}.rpm, and libluksde{,-devel,-python36,-tools}-20221103-1.el7.x86_64.rpm - Libluksde is a library and tools used to access LUKS Disk Encryption encrypted volumes.
libfsapfs{,-devel,-python3,-tools}-20221102-1.{fc35,fc36,el8,amzn2,el8}.x86_64.rpm, libfsapfs{,-devel,-python3,-tools}-20221102-1.el9.{x86_64,aarch64}.rpm, and libfsapfs{,-devel,-python36,-tools}-20221102-1.el7.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
jdk-20_linux-{x64,aarch64}_bin.rpm - Java Platform Standard Edition Development Kit is Release 20 of the Java development kit. This package was installed in support of Ghidra.
ghidra-10.3-PUBLIC_20230510.1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and ghidra-10.3-PUBLIC_20230510.1.el9.{x86_64,aarch64}.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
apfs-fuse-20230103-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and apfs-fuse-20230103-1.el9.{x86_64,aarch64}.rpm - APFS-Fuse is a read-only FUSE driver for the new Apple File System. Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental. It may not be able to read all files, it may return wrong data, or it may simply crash. Use at your own risk. But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far). Thus, the driver may return compressed files instead of uncompressed ones.
zeek{,-btest,-btest-data,-client,-core,ctl,-devel,-spicy-devel,-zkg}-5.0.9-1.{fc35,fc36,el7,el8}.x86_64.rpm, libbroker-devel-5.0.9-1.{fc35,fc36,el7,el8}.x86_64.rpm , zeek{,-btest,-btest-data,-client,-core,ctl,-devel,-spicy-devel,-zkg}-5.0.9-1.el9.{x86_64,aarch64}.rpm, and libbroker-devel-5.0.9-1.el9.{x86_64,aarch64}.rpm for CentOS 9 Stream - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
bulk_extractor-2.0.3-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and bulk_extractor-2.0.3-1.el9.{aarch64,x86_64}.rpm - Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. Bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important.
mac_apt-1.5.0.dev-3.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and mac_apt-1.5.0.dev-3.el9.{x86_64,aarch64}.rpm - Mac_apt is a DFIR (Digital Forensics and Incident Response) tool to process Mac computer full disk images (or live machines) and extract data/metadata useful for forensic investigation. It is a python based framework, which has plugins to process individual artifacts (such as Safari internet history, Network interfaces, Recently accessed files & volumes, etc.). This package is based on the 2023-03-12 version of the code.
musl-{clang,devel,filesystem,gcc,libc,libc-static}-1.2.3-1.{el7,el8,amzn2}.x86_64.rpm and musl-{clang,devel,filesystem,gcc,libc,libc-static}-1.2.3-1.el9.{x86_64,aarch64}.rpm - MUSL is a fully featured lightweight standard C library for Linux. This package was built to support AVML.
avml-0.11.3-1.{fc35,fc36}.x86_64.rpm and avml-0.11.3-1.el9.{x86_64,aarch64}.rpm - AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed. AVML can produce a memory image suitable for processing with Volatility 2 or Volatility 3 once the appropriate profiles have been created.
Volatility3-2.4.2-2.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and Volatility3-2.4.2-2.el9.{aarch64,x86_64}.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. The full documentation for this version of Volatility can be found here. This release is patched as of 2023-03-09.
daq{,-devel,-modules}-3.0.11-1.{fc35,fc36,el8}.x86_64.rpm and daq{,-devel,-modules}-3.0.11-1.el9.{aarch64,x86_64}.rpm - The Data Acquisition Library (Daq) is a library used by snort.
snort-3.1.62.0-1.{fc35,fc36,el8}.x86_64.rpm and snort-3.1.62.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
maryam-2.5.1-2.{fc35,fc36,el8,amzn2}.x86_64.rpm and maryam-2.5.1-2.el9.{x86_64,aarch64}.rpm - OWASP Maryam is a modular/optional open-source framework based on OSINT and data gathering. Maryam is written in the Python programming language and has been designed to provide a powerful environment to harvest data from open sources and search engines and collect data quickly and thoroughly. See here for documentation on the modules provided for Maryam. Note that Maryam is not available for CentOS/RHEL 7 at this time.
EVTXtract-0.2.4-4.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and EVTXtract-0.2.4-4.el9.{aarch64,x86_64}.rpm - EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
zui-1.0.1.x86_64.rpm - Zui (formerly known as Brim) is an open source desktop application for security and network specialists, and was installed for Fedora 34, 35, and 36, CentOS/RHEL 7, 8, and 9, and Amazon Linux 2 repositories for the x86_64 architecture. Zui makes it easy to search and analyze data from:
- packet captures, like those created by Wireshark, and
- structured logs, especially from the Zeek network analysis framework.
Zui is especially useful to security and network operators that need to handle large packet captures, especially those that are cumbersome for Wireshark, tshark, or other packet analyzers.
mmc-utils-0.1-2.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and mmc-utils-0.1-2.el9.{aarch64,x86_64}.rpm - MMC-Utils is a tool for configuring MMC storage devices from userspace. This version is patched as of 2023-03-12.
libfixbuf{,-devel,-tools}-3.0.0.alpha2-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and libfixbuf{,-devel,-tools}-3.0.0.alpha2-1.el9.{aarch64,x86_64}.rpm - Libfixbuf is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101). See here for the list of changes. These packages are installed in the forensics-test repository. Please address any comments on these packages to netsa-help@cert.org.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-103.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-103.el9.{aarch64,x86_64}.rpm - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. These packages are installed in the forensics-test repository. These packages were rebuilt to use libfixbuf 3.0.0.alpha2. Please address any comments on these packages to netsa-help@cert.org.
libschemaTools{,-devel}-1.4-4.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and libschemaTools{,-devel}-1.4-4.el9.{aarch64,x86_64}.rpm - libschemaTools is a library that provides a standard representation of data records. It is built on fixbuf, using IPFIX information elements. It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source. SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records. These packages are installed in the forensics-test repository. These packages were rebuilt to use libfixbuf 3.0.0.alpha2. Please address any comments on these packages to netsa-help@cert.org.
analysis-pipeline-5.11.4-4.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and analysis-pipeline-5.11.4-4.el9.{aarch64,x86_64}.rpm - The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM). This package is installed in the forensics-test repository. This package was rebuilt to use libfixbuf 3.0.0.alpha2. Please address any comments on these packages to netsa-help@cert.org.
super_mediator-2.0.0.alpha2-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and super_mediator-2.0.0.alpha2-1.el9.{aarch64,x86_64}.rpm - Super_mediator is an IPFIX mediator for use with the YAF and SiLK tools. It collects and filters YAF output data to various IPFIX collecting processes and/or csv files. See here for the list of changes. This package is installed in the forensics-test repository. This package was rebuilt to use libfixbuf 3.0.0.alpha1 and silk 3.19.2. Please address any comments on these packages to netsa-help@cert.org.
yaf{,-devel}-3.0.0.alpha2-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and yaf{,-devel}-3.0.0.alpha2-1.el9.{aarch64,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Note that for CentOS 7 and 8 systems, yaf has been built to use PF_Ring. See here for the list of changes. These packages are installed in the forensics-test repository. These packages were rebuilt to use libfixbuf 3.0.0.alpha2. Please address any comments on these packages to netsa-help@cert.org.
libesedb{,-devel,-python3,-tools}-20230318-1.{fc35,fc36,el8,amzn2}.x86_64.rpm, libesedb{,-devel,-python36,-tools}-20230318-1.el7.x86_64.rpm, and libesedb{,-devel,-python3,-tools}-20230318-1.el9.{x86_64,aarch64}.rpm - Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
hindsight-2023.03-1.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and hindsight-2023.03-1.el9.{x86_64,aarch64}.rpm - Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications. Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.
CERT-Forensics-Tools-1.0-103.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and CERT-Forensics-Tools-1.0-103.el9.{aarch64,x86_64}.rpm - The following changes were made:
- winregrc replaces winreg-kb
- winevtrc replaces winevt-kb
- libfixbuf-ipfixDump was added
- zeek was removed for Fedora 38 for now
- mmc-utils was removed for Fedora 38
libvsmbr{,-devel,-python3,-tools}-20230318-1.{fc35,fc36,el8}.x86_64.rpm and libvsmbr{,-devel,-python3,-tools}-20230318-1.el9.{aarch64,x86_64}.rpm - Libvsmbr is a library and tools to access the Master Boot Record (MBR) volume system.
python3-oletools-0.60.1-2.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm , python-oletools-doc-0.60.1-2.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm, python3-oletools-0.60.1-2.el9.{aarch64,x86_64}.rpm, and python-oletools-doc-0.60.1-2.el9.{aarch64,x86_64}.rpm - Python-Oletools is a package of python tools from Philippe Lagadec to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the olefile parser.
wdpassport-utils-0.2-4.{fc35,fc36,el7,el8,amzn2}.x86_64.rpm and wdpassport-utils-0.2-4.el9.{aarch64,x86_64}.rpm - WDPassPort-Utils is a utility used to lock, unlock, and reset passwords on Western Digital's Passport drives. This version was rebuilt to correctly set the permissions on the python executable.
GeoIP{,-devel}-1.6.12-5.el9.{x86_64,aarch64}.rpm - GeoIP is a library for country/city/organization to IP address or hostname mapping.
pfring-8.5.0-{8169,8194,8197,8211,8232,8235,8241,8253,8265,8279,8305}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. These packages wer installed in the CentOS/RHEL 7 and 8 Stream.
pfring-dkms-8.5.0.{8169,8194,8197,8211,8232,8235,8241,8253,8265,8279,8305}-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. These packages were installed in the CentOS/RHEL 7 and 8 Stream.
ndpi-4.7.0-{4142,4160,4163,4175,4183,4187,4190,4196,4206,4218,4230,4241}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. These packages were installed in the CentOS/RHEL 7 and 8 Stream.
pfring-8.5.0-{8225,8232,8235,8241,8253,8265,8279,8305}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. These packages were installed in the CentOS/RHEL 9 Stream.
pfring-dkms-8.5.0.{8225,8232,8235,8241,8253,8265,8279,8305}-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. These packages were installed in the CentOS/RHEL 9 Stream.
ndpi-4.7.0-{4183,4187,4190,4196,4206,4218,4230,4241}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. These packages were installed in the CentOS/RHEL 9 Stream.
pfring-8.5.0-{8169,8194,8197,8211,8225}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8. These packages were installed in the Amazon Linux 2 repositories for the x86_64 architecture.
pfring-dkms-8.5.0.{8169,8194,8197,8211,8225}-dkms.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module. These packages were installed in the Amazon Linux 2 repositories for the x86_64 architecture.
ndpi-4.7.0-{4142,4160,4163,4175,4183}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection. These packages were installed in the Amazon Linux 2 repositories for the x86_64 architecture.
fmem-kernel-modules-1.6-1.25.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for the Fedora 37 x86_64 architecture was added.
lime-kernel-modules-1.1.r17-25.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for the Fedora 37 x86_64 architecture was added.

Fedora 37 - The repository now supports Fedora 37 for the x86_64 CPU architecture. Here is the list of tools provided for Fedora 37:

2hash
acr
acstore
analysis-pipeline
analyzeMFT
apfs-fuse
artifacts
ataraw
autopsy
avml
bencode
bulk_extractor
cert-forensics-tools-release
CERT-Forensics-Tools
crunch
cryptcat
daq
dcp
ddrescueview
ddrutility
dfdatetime
dfimagetools
dfvfs
dfwinreg
docker-forensics-toolkit
DropboxReader
dtfabric
eindeutig
epub
EVTXtract
exfat-utils
fatback
fcrackzip
flor
fmem-kernel-modules
fred
fundl
fuse-python
galleta
ghidra
grokevt

guymager
hachoir
hindsight
jafat
KStrike
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf
libexe
libfcrypto
libfixbuf
libfplist
libfsapfs
libfsext
libfsfat
libfshfs
libfsntfs
libfsxfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
libhmac
libipa
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf

libpff
libphdi
libqcow
libregf
libscca
libschemaTools
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvsgpt
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
mac_apt
maryam
missidentify
mmc-utils
mount_ewf
mtftar
netsa-python
netsa-rayon
opensearch-py
packetexaminer
pasco
pefile
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
prism
pstotext
ptfinder
ptk
pyfixbuf
python-oletools
pytsk3

qtmltfs-noscripts
qtmltfs
rar
reglookup
regripper-plugins
regripper
rekall-forensics
rifiuti2
rifiuti
scrounge-ntfs
sfdumper
silk-ipa
silk-ipset
silk
sleuthkit
snarf
snort-openappid
snort-sample-rules
snort
stegdetect
super_mediator
tln_tools
umit
unrar
untex
VeraCrypt
videosnarf
vmfs-tools
vmfs6-tools
Volatility3-linux-symbols
Volatility3-mac-symbols
Volatility3-windows-symbols
Volatility3
Volatility
wdpassport-utils
winevtrc
winregrc
xplico
xva-img
yaf
zeek

fmem-kernel-modules-1.6-1.26.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for the Fedora 38 x86_64 architecture was added.
lime-kernel-modules-1.1.r17-26.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for the Fedora 38 x86_64 architecture was added.

Fedora 38 - The repository now supports Fedora 38 for the x86_64 CPU architecture. Here is the list of tools provided for Fedora 38:

grokevt
guymager
hachoir
hindsight
jafat
KStrike
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf
libexe
libfcrypto
libfixbuf
libfplist
libfsapfs
libfsext
libfsfat
libfshfs
libfsntfs
libfsxfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
libhmac
libipa
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw

libolecf
libpff
libphdi
libqcow
libregf
libscca
libschemaTools
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvsgpt
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
mac_apt
maryam
missidentify
mount_ewf
mtftar
netsa-python
netsa-rayon
opensearch-py
packetexaminer
pasco
pefile
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
prism
pstotext
ptfinder
ptk
pyfixbuf
python-oletools
pytsk3

lime-kernel-modules-fc38-x86_64-1.9.1-2.noarch.rpm - Support for the following kernels were added for LiME:
- 6.2.15-300 for FC38
- 6.2.14-300 for FC38
- 6.2.13-300 for FC38
fmem-kernel-modules-fc38-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.2.15-300 for FC38
- 6.2.14-300 for FC38
- 6.2.13-300 for FC38
lime-kernel-modules-fc37-x86_64-1.9.1-2.noarch.rpm - Support for the following kernels were added for LiME:
- 6.2.15-200 for FC37
- 6.2.14-200 for FC37
- 6.2.13-200 for FC37
- 6.2.12-200 for FC37
- 6.2.11-200 for FC37
- 6.2.10-200 for FC37
- 6.2.9-200 for FC37
- 6.2.8-200 for FC37
- 6.2.7-200 for FC37
- 6.1.18-200 for FC37
fmem-kernel-modules-fc37-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.2.15-200 for FC37
- 6.2.14-200 for FC37
- 6.2.13-200 for FC37
- 6.2.12-200 for FC37
- 6.2.11-200 for FC37
- 6.2.10-200 for FC37
- 6.2.9-200 for FC37
- 6.2.8-200 for FC37
- 6.2.7-200 for FC37
- 6.1.18-200 for FC37
lime-kernel-modules-fc36-x86_64-1.9.1-18.noarch.rpm - Support for the following kernels were added for LiME:
- 6.2.15-100 for FC36
- 6.2.14-100 for FC36
- 6.2.13-100 for FC36
- 6.2.12-100 for FC36
- 6.2.11-100 for FC36
- 6.2.10-100 for FC36
- 6.2.9-100 for FC36
- 6.2.8-100 for FC36
- 6.2.7-100 for FC36
- 6.1.18-100 for FC36
- 6.1.15-100 for FC36
- 6.1.14-100 for FC36
- 6.1.13-100 for FC36
- 6.1.12-100 for FC36
- 6.1.11-100 for FC36
- 6.1.10-100 for FC36
- 6.1.9-100 for FC36
- 6.1.8-100 for FC36
- 6.1.7-100 for FC36
- 6.1.6-100 for FC36
- 6.1.5-100 for FC36
- 6.0.18-200 for FC36
- 6.0.17-200 for FC36
- 6.0.16-200 for FC36
- 6.0.15-200 for FC36
- 6.0.14-200 for FC36
- 6.0.12-200 for FC36
- 6.0.11-200 for FC36
- 6.0.10-200 for FC36
- 6.0.9-200 for FC36
- 6.0.8-200 for FC36
- 6.0.7-200 for FC36
- 6.0.5-200 for FC36
- 5.19.16-200 for FC36
- 5.19.15-201 for FC36
- 5.19.14-200 for FC36
- 5.19.13-200 for FC36
- 5.19.12-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.18.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.2.15-100 for FC36
- 6.2.14-100 for FC36
- 6.2.13-100 for FC36
- 6.2.12-100 for FC36
- 6.2.11-100 for FC36
- 6.2.10-100 for FC36
- 6.2.9-100 for FC36
- 6.2.8-100 for FC36
- 6.2.7-100 for FC36
- 6.1.18-100 for FC36
- 6.1.15-100 for FC36
- 6.1.14-100 for FC36
- 6.1.13-100 for FC36
- 6.1.12-100 for FC36
- 6.1.11-100 for FC36
- 6.1.10-100 for FC36
- 6.1.9-100 for FC36
- 6.1.8-100 for FC36
- 6.1.7-100 for FC36
- 6.1.6-100 for FC36
- 6.1.5-100 for FC36
- 6.0.18-200 for FC36
- 6.0.17-200 for FC36
- 6.0.16-200 for FC36
- 6.0.15-200 for FC36
- 6.0.14-200 for FC36
- 6.0.12-200 for FC36
- 6.0.11-200 for FC36
- 6.0.10-200 for FC36
- 6.0.9-200 for FC36
- 6.0.8-200 for FC36
- 6.0.7-200 for FC36
- 6.0.5-200 for FC36
- 5.19.16-200 for FC36
- 5.19.15-201 for FC36
- 5.19.14-200 for FC36
- 5.19.13-200 for FC36
- 5.19.12-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-42.noarch.rpm - Support for the following kernels were added for LiME:
- 6.0.12-100 for FC35
- 6.0.11-100 for FC35
- 6.0.10-100 for FC35
- 6.0.9-100 for FC35
- 6.0.8-100 for FC35
- 6.0.7-100 for FC35
- 6.0.5-100 for FC35
- 5.19.16-100 for FC35
- 5.19.15-101 for FC35
- 5.19.14-100 for FC35
- 5.19.13-100 for FC35
- 5.19.12-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.42.noarch.rpm - Support for the following kernels were added for Fmem:
- 6.0.12-100 for FC35
- 6.0.11-100 for FC35
- 6.0.10-100 for FC35
- 6.0.9-100 for FC35
- 6.0.8-100 for FC35
- 6.0.7-100 for FC35
- 6.0.5-100 for FC35
- 5.19.16-100 for FC35
- 5.19.15-101 for FC35
- 5.19.14-100 for FC35
- 5.19.13-100 for FC35
- 5.19.12-100 for FC35
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-167 for EL9
- 5.14.0-168 for EL9
- 5.14.0-171 for EL9
- 5.14.0-174 for EL9
- 5.14.0-176 for EL9
- 5.14.0-177 for EL9
- 5.14.0-183 for EL9
- 5.14.0-191 for EL9
- 5.14.0-196 for EL9
- 5.14.0-197 for EL9
- 5.14.0-200 for EL9
- 5.14.0-202 for EL9
- 5.14.0-205 for EL9
- 5.14.0-206 for EL9
- 5.14.0-210 for EL9
- 5.14.0-214 for EL9
- 5.14.0-226 for EL9
- 5.14.0-229 for EL9
- 5.14.0-234 for EL9
- 5.14.0-239 for EL9
- 5.14.0-247 for EL9
- 5.14.0-252 for EL9
- 5.14.0-267 for EL9
- 5.14.0-274 for EL9
- 5.14.0-282 for EL9
- 5.14.0-283 for EL9
- 5.14.0-285 for EL9
- 5.14.0-289 for EL9
- 5.14.0-293 for EL9
- 5.14.0-295 for EL9
- 5.14.0-299 for EL9
- 5.14.0-302 for EL9
- 5.14.0-305 for EL9
- 5.14.0-307 for EL9
- 5.14.0-311 for EL9
- 5.14.0-312 for EL9
- 5.14.0-313 for EL9
- 5.14.0-315 for EL9
- 5.14.0-316 for EL9
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-15.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-167 for EL9
- 5.14.0-168 for EL9
- 5.14.0-171 for EL9
- 5.14.0-174 for EL9
- 5.14.0-176 for EL9
- 5.14.0-177 for EL9
- 5.14.0-183 for EL9
- 5.14.0-191 for EL9
- 5.14.0-196 for EL9
- 5.14.0-197 for EL9
- 5.14.0-200 for EL9
- 5.14.0-202 for EL9
- 5.14.0-205 for EL9
- 5.14.0-206 for EL9
- 5.14.0-210 for EL9
- 5.14.0-214 for EL9
- 5.14.0-226 for EL9
- 5.14.0-229 for EL9
- 5.14.0-234 for EL9
- 5.14.0-239 for EL9
- 5.14.0-247 for EL9
- 5.14.0-252 for EL9
- 5.14.0-267 for EL9
- 5.14.0-274 for EL9
- 5.14.0-282 for EL9
- 5.14.0-283 for EL9
- 5.14.0-285 for EL9
- 5.14.0-289 for EL9
- 5.14.0-293 for EL9
- 5.14.0-295 for EL9
- 5.14.0-299 for EL9
- 5.14.0-302 for EL9
- 5.14.0-305 for EL9
- 5.14.0-307 for EL9
- 5.14.0-311 for EL9
- 5.14.0-312 for EL9
- 5.14.0-313 for EL9
- 5.14.0-315 for EL9
- 5.14.0-316 for EL9
fmem-kernel-modules-el8-x86_64-1.6-1.36.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-408 for EL8
- 4.18.0-448 for EL8
- 4.18.0-481 for EL8
- 4.18.0-483 for EL8
- 4.18.0-485 for EL8
- 4.18.0-486 for EL8
- 4.18.0-488 for EL8
- 4.18.0-489 for EL8
- 4.18.0-490 for EL8
- 4.18.0-492 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-36.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-408 for EL8
- 4.18.0-448 for EL8
- 4.18.0-481 for EL8
- 4.18.0-483 for EL8
- 4.18.0-485 for EL8
- 4.18.0-486 for EL8
- 4.18.0-488 for EL8
- 4.18.0-489 for EL8
- 4.18.0-490 for EL8
- 4.18.0-492 for EL8
fmem-kernel-modules-el7-x86_64-1.6-1.89.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.90.1 for EL7
- 3.10.0-1160.88.1 for EL7
- 3.10.0-1160.83.1 for EL7
- 3.10.0-1160.81.1 for EL7
- 3.10.0-1160.80.1 for EL7
lime-kernel-modules-el7-x86_64-1.9.1-89.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.90.1 for EL7
- 3.10.0-1160.88.1 for EL7
- 3.10.0-1160.83.1 for EL7
- 3.10.0-1160.81.1 for EL7
- 3.10.0-1160.80.1 for EL7
fmem-kernel-modules-1.6-1.27.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for the CentOS/RHEL 9 aarch64 architecture was added.
lime-kernel-modules-1.1.r17-27.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for the CentOS/RHEL 9 aarch64 architecture was added.

September 28, 2022: The following changes have been made:

Volatility3-2.4.0-1.{fc34,fc35,fc36,el7,el8,amzn2}.x86_64.rpm and Volatility3-2.4.0-1.el9.{aarch64,x86_64}.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. The full documentation for this version of Volatility can be found here. This release is patched as of 2022-09-23.
python3-certifi-2022.9.24.1-1.{el8,amzn2}.noarch.rpm and python36-2022.9.24.1.8-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
python3-dfdatetime-20220925-1.{fc34,fc35,fc36,el8,el9,amzn2}.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
libevtx{,-devel,-python3,-tools}-20220724-1.{fc34,fc35,fc36,el8,amzn2}.x86_64.rpm, libevtx{,-devel,-python3,-tools}-20220724-1.el9.{aarch64,x86_64}.rpm, and libevtx{,-devel,-python36,-tools}-20220724-1.el7.x86_64.rpm - Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
libfsext{,-devel,-python3,-tools}-20220829-1.{fc34,fc35,fc36,el8,amzn2}.x86_64.rpm, libfsext{,-devel,-python3,-tools}-20220829-1.el9.{aarch64,x86_64}.rpm, and libfsext{,-devel,-python36,-tools}-20220829-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
libfsfat{,-devel,-python3,-tools}-20220925-1.{fc34,fc35,fc36,el8,amzn2}.x86_64.rpm, libfsfat{,-devel,-python3,-tools}-20220925-1.el9.{aarch64,x86_64}.rpm, and libfsfat{,-devel,-python36,-tools}-20220925-1.el7.x86_64.rpm - Libfsfat is a library and tools to access the file Allocation Table (FAT) file system format.
libfshfs{,-devel,-python3,-tools}-20220831-1.{fc34,fc35,fc36,el8,amzn2}.x86_64.rpm, libfshfs{,-devel,-python3,-tools}-20220831-1.el9.{aarch64,x86_64}.rpm, and libfshfs{,-devel,-python36,-tools}-20220831-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS).
libfsxfs{,-devel,-python3,-static,-tools}-20220829-1.{fc34,fc35,fc36,el8,amzn2}.x86_64.rpm, libfsxfs{,-devel,-python3,-static,-tools}-20220829-1.el9.{aarch64,x86_64}.rpm, and libfsxfs{,-devel,-python36,-static,-tools}-20220829-1.el7.x86_64.rpm - Libfsxfs contains library and tools to access the SGI X File System (XFS).
libfvde{,-devel,-python3,-tools}-20220915-1.{fc34,fc35,fc36,el7,el8,amzn2}.x86_64.rpm, libfvde{,-devel,-python3,-tools}-20220915-1.el9.{aarch64,x86_64}.rpm, and libfvde{,-devel,-python36,-tools}-20220915-1.el7.x86_64.rpm - Libfvde is a library and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
python3-dfvfs-20220917-1.{fc34,fc35,fc36,el8,el9,amzn2}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python3-lz4-4.0.2-1.el9.{aarch64,x86_64}.rpm - LZ4 contains the python bindings for the lz4 compression library.
python{2,36}-psutil-5.9.2-1.el7.x86_64.rpm - Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network) in Python.
snort-3.1.42.0-1.{fc34,fc35,fc36,el8}.x86_64.rpm and snort-3.1.42.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol3analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
pfring-8.3.0-7842.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7842-7842.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3965.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-17.noarch.rpm - Support for the following kernels were added for LiME:
- 5.19.11-200 for FC36
- 5.19.10-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.17.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.19.11-200 for FC36
- 5.19.10-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-41.noarch.rpm - Support for the following kernels were added for LiME:
- 5.19.11-100 for FC35
- 5.19.10-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.41.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.19.11-100 for FC35
- 5.19.10-100 for FC35

September 21, 2022: The following changes have been made:

snort-3.1.41.0-1.{fc34,fc35,fc36,el8}.x86_64.rpm and snort-3.1.41.0-1.el9.{x86_64,aarch64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
flex{,-devel,-doc}-2.6.1-9.el7.x86_64.rpm - Flex is a tool for generating scanners: programs which recognize lexical patterns in text. This was built to support building zeek.
zeek{,-btest,-btest-data,-client,-core,ctl,-devel,-spicy-devel,-zkg}-5.0.1-1.x86_64.rpm libbroker-devel-5.0.1-1.x86_64.rpm for Fedora 34-36 and CentLS/RHEL 7, 8 Stream and 9 Stream, and zeek{,-btest,-btest-data,-client,-core,ctl,-devel,-spicy-devel,-zkg}-5.0.1-1.aarch64.rpm and libbroker-devel-5.0.1-1.aarch64.rpm for CentOS 9 Stream - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
pfring-8.3.0-7809.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7809-7809.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3946.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-16.noarch.rpm - Support for the following kernels were added for LiME:
- 5.19.9-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.16.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.19.9-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-40.noarch.rpm - Support for the following kernels were added for LiME:
- 5.19.9-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.40.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.19.9-100 for FC35
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-162 for EL9
- 5.14.0-163 for EL9
- 5.14.0-165 for EL9
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-162 for EL9
- 5.14.0-163 for EL9
- 5.14.0-165 for EL9

September 14, 2022: The following changes have been made:

yara{,-devel,-doc}-4.2.3-1.el8.x86_64.rpm Yara is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic. These packages provide the missing yara-devel.
python{2,3}-yara-4.2.3-1.x86_64.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.
pfring-8.3.0-7793.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7793-7793.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3933.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-15.noarch.rpm - Support for the following kernels were added for LiME:
- 5.19.8-200 for FC36
- 5.19.7-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.15.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.19.8-200 for FC36
- 5.19.7-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-39.noarch.rpm - Support for the following kernels were added for LiME:
- 5.19.8-100 for FC35
- 5.19.7-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.39.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.19.8-100 for FC35
- 5.19.7-100 for FC35

September 7, 2022: The following changes have been made:

Volatility3-2.3.1-1.{fc34,fc35,fc36,el7,el8,amzn2}.x86_64.rpm and Volatility3-2.3.1-1.el9.{aarch64,x86_64}.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. The full documentation for this version of Volatility can be found here. This release is patched as of 2022-08-31.
pfring-8.3.0-7784.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7784-7784.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3927.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-14.noarch.rpm - Support for the following kernels were added for LiME:
- 5.19.6-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.14.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.19.6-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-38.noarch.rpm - Support for the following kernels were added for LiME:
- 5.19.6-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.38.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.19.6-100 for FC35
fmem-kernel-modules-el9-{x86_64,aarch64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-160 for EL9
lime-kernel-modules-el9-{x86_64,aarch64}-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-160 for EL9

August 31, 2022: The following changes have been made:

snort-3.1.40.0-1.{fc34,fc35,fc36,el8,el9}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
pfring-8.3.0-7766.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7766-7766.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3910.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.19-200 for FC36
- 5.19.4-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.19-200 for FC36
- 5.19.4-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-37.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.19-100 for FC35
- 5.19.4-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.37.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.19-100 for FC35
- 5.19.4-100 for FC35

August 24, 2022: The following changes have been made:

pfring-8.3.0-7752.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7752-7752.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3900.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-12.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.18-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.18-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-36.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.18-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.36.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.18-100 for FC35
fmem-kernel-modules-el9-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem for both the x86_64 and aarch64 architectures:
- 5.14.0-145 for EL9
- 5.14.0-148 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-12.noarch.rpm - Support for the following kernels were added for LiME for both the x86_64 and aarch64 architectures:
- 5.14.0-145 for EL9
- 5.14.0-148 for EL9

CentOS 9 Stream - The repository now supports CentOS 9 Stream for the aarch64 CPU architecture. Here is the list of tools provided for CentOS 9 Stream:

2hash
adns
aeskeyfind
analysis-pipeline
analyzeMFT
antiword
apfs-fuse
artifacts
ataraw
autopsy
bulk_extractor
CERT-Forensics-Tools
cert-forensics-tools-release
cffi
coreutilsshim
crunch
cryptcat
daq
dc3dd
dcfldd
ddrutility
dfdatetime
dfvfs
dfwinreg
docker-forensics-toolkit
dtfabric
eindeutig
EVTXtract
exfat-utils
fatback
fcrackzip
flatbuffers
fmem-kernel-modules
foremost
fundl
galleta
ghidra
guymager
hachoir
hindsight
jafat

KStrike
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf
libexe
libfixbuf
libfplist
libfsapfs
libfsext
libfshfs
libfsntfs
libfsxfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
libiconv
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf
libpff
libphdi
libpst
libqcow
libregf
libsafec
libscca
libschemaTools

libsigscan
libsmdev
libsmraw
libtomcrypt
libtommath
libvhdi
libvmdk
libvsgpt
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
lz4
mac_apt
mac-robber
md5deep
missidentify
mmc-utils
mtftar
musl
opensearch-py
packetexaminer
pasco
pefile
perl-Carp-Assert
perl-Data-Hexify
perl-DateTime-Format-WindowsFileTime
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
pstotext
ptfinder
pyfixbuf
pyparsing
python-construct
python-crypto
python-nose
python-oletools

python-semantic_version
pytsk3
pyxattr
redis
rekall-forensics
rifiuti2
rifiuti
scalpel
scrounge-ntfs
silk
silk-ipa
silk-ipset
sleuthkit
snarf
snort
splunkshim
stegdetect
super_mediator
tcpflow
tcpxtract
tln_tools
ucl
untex
upx
VeraCrypt
vmfs6-tools
vmfs-tools
Volatility3
Volatility3-linux-symbols
Volatility3-mac-symbols
Volatility3-windows-symbols
Volatility
wdpassport-utils
winevt-kb
winreg-kb
xlsxwriter
xmount
xplico
xva-img
yaf
zeek
zeromq3

August 17, 2022: The following changes have been made:

python3-dfdatetime-20220810-1.{fc34,fc35,fc36,el8,el9,amzn2}.noarch.rpm and python36-dfdatetime-20220810-1.el7.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
libbde{,-devel,-python3,-tools}-20220807-1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm and libbde{,-devel,-python36,-tools}-20220121-1.el7.x86_64.rpm - Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
libluksde{,-devel,-python3,-tools}-20220807-1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm and libluksde{,-devel,-python36,-tools}-20220121-1.el7.x86_64.rpm - Libluksde is a library and tools used to access LUKS Disk Encryption encrypted volumes.
libfvde{,-devel,-python3,-tools}-20220807-1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm and libfvde{,-devel,-python36,-tools}-20220125-1.el7.x86_64.rpm - Libfvde is a library and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
libesedb{,-devel,-python3,-tools}-20220806-1.{fc34,fc35,fc36,el8,el9,amzn2}.x86_64.rpm and libesedb{,-devel,-python36,-tools}-20210424-1.el7.x86_64.rpm - Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ghidra-10.1.5_PUBLIC_20220726.1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
pfring-8.3.0-7745.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7745-7745.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3899.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
daq{,-devel,-modules}-3.0.9-1.{fc34,fc35,fc36,el8,el9}.x86_64.rpm - The Data Acquisition Library (Daq) is a library used by snort.
snort-3.1.39.0-1.{fc34,fc35,fc36,el8,el9}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
lime-kernel-modules-fc36-x86_64-1.9.1-11.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.17-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.17-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-35.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.17-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.35.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.17-100 for FC35
fmem-kernel-modules-el7-x86_64-1.6-1.88.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.76.1 for EL7
lime-kernel-modules-el7-x86_64-1.9.1-88.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.76.1 for EL7

August 10, 2022: The following changes have been made:

plaso-20220724-1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. This release removes the version restriction on the pyparsing package. Note: For CentOS/RHEL 7, 8, and 9, and Amazon Linux 2, Plaso now runs in Python Virtual Environment.
hindsight-2021.12-2.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications. Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline. This version was rebuilt to use the latest libcffi library on CentOS/RHEL 7.
bellsoft-jdk8u345+1-linux-amd64-full.rpm - Bellsoft Java was installed for Fedora 34, 35, and 36, CentOS/RHEL 7, 8, and 9, and Amazon Linux 2. Bellsoft Java 8 is the recommended version of Java for Autopsy.
pfring-8.3.0-7737.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7737-7737.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3892.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-10.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.16-200 for FC36
- 5.18.15-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.16-200 for FC36
- 5.18.15-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-34.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.16-100 for FC35
- 5.18.15-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.34.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.16-100 for FC35
- 5.18.15-100 for FC35
fmem-kernel-modules-el9-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-142 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-11.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-142 for EL9

August 3, 2022: The following changes have been made:

snort-3.1.38.0-1.{fc34,fc35,fc36,el8,el9}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
pfring-8.3.0-7710.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7710-7710.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3877.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.

July 27, 2022: The following changes have been made:

bellsoft-1.8.0.342.0.7-linux-amd64-full.rpm - Bellsoft Java was installed for Fedora 34, 35, and 36, CentOS/RHEL 7, 8, and 9, and Amazon Linux 2. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
pfring-8.3.0-7689.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7689-7689.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3865.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-9.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.13-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.13-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-33.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.13-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.33.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.13-100 for FC35
fmem-kernel-modules-el9-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-134 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-10.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-134 for EL9

July 20, 2022: The following changes have been made:

libfshfs{,-devel,-python3,-tools}-20220709-1.{fc34,fc35,el8,el9,amzn2}.x86_64.rpm and libfshfs{,-devel,-python36,-tools}-20220709-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS).
libfsxfs{,-devel,-python3,-static,-tools}-20220706-1.{fc34,fc35,fc36,el8,el9,amzn2}.x86_64.rpm and libfsxfs{,-devel,-python36,-static,-tools}-20220706-1.el7.x86_64.rpm - Libfsxfs contains library and tools to access the SGI X File System (XFS).
python3-artifacts-20220615-1.{fc34,fc35,fc36,el8,el9,amzn2}.x86_64.rpm, python36-artifacts-20220615-1.el7.x86_64.rpm, and artifacts-data-20220615-1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
libfsapfs{,-devel,-python3,-tools}-20220709-1.{fc34,fc35,el8,el9,amzn2,el8}.x86_64.rpm and libfsapfs{,-devel,-python36,-tools}-20220709-1.el7.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
python3-redis-4.3.4-1.el9.noarch.rpm and python36-redis-4.3.4-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
python3-certifi-2022.6.15.1-1.{el8,amzn2}.noarch.rpm and python36-2022.6.15.1.8-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
python{2,3}-cffi-1.15.1-1.{el8,el9,amzn2}.x86_64.rpm and cffi-doc-1.15.1-1.{el8,el9,amzn2}.noarch.rpm - Python-CFFI is a C Foreign Function Interface for Python. Interact with almost any C code from Python, based on C-like declarations that you can often copy-paste from header files or documentation.
python3-requests-2.28.1-1.amzn2.x86_64.rpm - Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings. Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web. It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
pfring-8.3.0-7652.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7652-7652.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3846.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Volatility3-2.3.0-1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. The full documentation for this version of Volatility can be found here. This release is patched as of 2022-07-19.
CERT-Forensics-Tools-1.0-102.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - The following changes were made:
- ssldump removed for CentOS/RHEL 8 and CentOS-8 Stream
- cutter-re removed for CentOS/RHEL 8 and CentOS-8 Stream
lime-kernel-modules-fc36-x86_64-1.9.1-8.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.11-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.11-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-32.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.11-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.32.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.11-100 for FC35
fmem-kernel-modules-el9-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-127 for EL9
- 5.14.0-130 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-9.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-127 for EL9
- 5.14.0-130 for EL9

July 9, 2022: The following changes have been made:

snort-3.1.32.0-1.{fc34,fc35,fc36,el8,el9}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
Volatility3-2.2.0-2.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is patched as of 2022-07-01.
pfring-8.3.0-7626.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.3.0.7626-7626.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.5.0-3829.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-7.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.10-200 for FC36
- 5.18.9-200 for FC36
- 5.18.7-200 for FC36
- 5.18.6-200 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.10-200 for FC36
- 5.18.9-200 for FC36
- 5.18.7-200 for FC36
- 5.18.6-200 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-31.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.10-100 for FC35
- 5.18.9-100 for FC35
- 5.18.7-100 for FC35
- 5.18.6-100 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.31.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.10-100 for FC35
- 5.18.9-100 for FC35
- 5.18.7-100 for FC35
- 5.18.6-100 for FC35
fmem-kernel-modules-el9-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-115 for EL9
- 5.14.0-118 for EL9
- 5.14.0-119 for EL9
- 5.14.0-120 for EL9
- 5.14.0-124 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-8.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-115 for EL9
- 5.14.0-118 for EL9
- 5.14.0-119 for EL9
- 5.14.0-120 for EL9
- 5.14.0-124 for EL9
fmem-kernel-modules-el7-x86_64-1.6-1.87.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.71.1 for EL7
lime-kernel-modules-el7-x86_64-1.9.1-87.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.71.1 for EL7

June 21, 2022: The following changes have been made:

pfring-8.1.0-7555.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7555-7555.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3772.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-6.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.5-200 for FC36
- 5.17.14-300 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.5-200 for FC36
- 5.17.14-300 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-30.noarch.rpm - Support for the following kernels were added for LiME:
- 5.18.5-100 for FC35
- 5.18.4-101 for FC35
- 5.17.14-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.30.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.18.5-100 for FC35
- 5.18.4-101 for FC35
- 5.17.14-200 for FC35
fmem-kernel-modules-el9-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-109 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-7.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-109 for EL9

June 15, 2022: The following changes have been made:

super_mediator-1.9.0-1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Super_mediator is an IPFIX mediator for use with the YAF and SiLK tools. It collects and filters YAF output data to various IPFIX collecting processes and/or csv files. See here for the list of changes.
python3-artifacts-20220608-1.{fc34,fc35,fc36,el8,el9,amzn2}.x86_64.rpm, python36-artifacts-20220608-1.el7.x86_64.rpm, and artifacts-data-20220608-1.{fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
python3-requests-2.28.0-1.amzn2.x86_64.rpm - Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings. Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web. It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
pfring-8.1.0-7543.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7543-7543.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3760.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-5.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.13-300 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.5.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.13-300 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-29.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.13-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.29.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.13-200 for FC35

June 8, 2022: The following changes have been made:

python3-elasticsearch-7.17.4-1.{fc34,el8,amzn2}.x86_64.rpm and python36-elasticsearch-7.17.4-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python3-redis-4.3.3-1.el9.noarch.rpm and python36-redis-4.3.3-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
bellsoft-jdk8u333+2-linux-amd64-full.rpm - Bellsoft Java was installed for Fedora 34, 35, and 36, CentOS/RHEL 7, 8, and 9, and Amazon Linux 2. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
Brim-0.30.0.rpm - Brim is an open source desktop application for security and network specialists, and was installed for Fedora 34, 35, and 36, CentOS/RHEL 7, 8, and 9, and Amazon Linux 2. Brim makes it easy to search and analyze data from:
- packet captures, like those created by Wireshark, and
- structured logs, especially from the Zeek network analysis framework.
Brim is especially useful to security and network operators that need to handle large packet captures, especially those that are cumbersome for Wireshark, tshark, or other packet analyzers.
daq{,-devel,-modules}-3.0.8-1.{fc34,fc35,fc36,el8,el9}.x86_64.rpm - The Data Acquisition Library (Daq) is a library used by snort.
snort-3.1.31.0-1.{fc34,fc35,fc36,el8,el9}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
pfring-8.1.0-7528.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7528-7528.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3750.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-4.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.12-300 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.4.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.12-300 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-28.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.12-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.28.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.12-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.52.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.12-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-52.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.12-100 for FC34
fmem-kernel-modules-el9-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-105 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-6.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-105 for EL9
fmem-kernel-modules-el8-x86_64-1.6-1.35.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-394 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-35.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-394 for EL8

June 1, 2022: The following changes have been made:

Volatility3-2.2.0-1.{fc33,fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is patched as of 2022-05-27.
ghidra-10.1.4_PUBLIC_20220125.1.{fc33,fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
libfsxfs{,-devel,-python3,-static,-tools}-20220528-1.{fc33,fc34,fc35,fc36,el8,el9,amzn2}.x86_64.rpm and libfsxfs{,-devel,-python36,-static,-tools}-20220528-1.el7.x86_64.rpm - Libfsxfs contains library and tools to access the SGI X File System (XFS).
libfsext{,-devel,-python3,-tools}-20220529-1.{fc33,fc34,fc35,fc36,el8,el9,amzn2}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20220529-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
python3-pefile-2022.5.30-1.{fc33,fc34,fc35,fc36,el9}.noarch.rpm - PEFile is a Portable Executable reader module.
opensearch-py-2.0.0-1.{fc33,fc34,fc35,fc36,el7,el8,el9,amzn2}.noarch.rpm - OpenSearch-PY is a Python client for OpenSearch.
python3-lz4-4.0.1-1.el9.x86_64.rpm and python36-lz4-4.0.1-1.el7.x86_64.rpm - LZ4 contains the python bindings for the lz4 compression library.
pfring-8.1.0-7509.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7509-7509.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3733.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-3.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.11-300 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.11-300 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-27.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.11-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.27.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.11-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.51.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.11-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-51.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.11-100 for FC34
fmem-kernel-modules-el9-x86_64-1.6-1.5.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-101 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-5.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-101 for EL9
fmem-kernel-modules-el8-x86_64-1.6-1.34.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-383 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-34.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-383 for EL8
Fedora 33 - Updates to Fedora 33 for the x86_64 CPU architecture have ceased.

May 25, 2022: The following changes have been made:

python3-oletools-0.60.1-1.{fc33,fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm and python-oletools-doc-0.60.1-1.{fc33,fc34,fc35,fc36,el7,el8,el8,amzn2}.x86_64.rpm - Python-Oletools is a package of python tools from Philippe Lagadec to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging. It is based on the olefile parser.
mmc-utils-0.1-1.{fc33,fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - MMC-Utils is a tool for configuring MMC storage devices from userspace.
daq{,-devel,-modules}-3.0.7-1.{fc34,fc35,fc36,el8,el9}.x86_64.rpm - The Data Acquisition Library (Daq) is a library used by snort.
snort-3.1.30.0-1.{fc33,fc34,fc35,fc36,el8,el9}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
CERT-Forensics-Tools-1.0-101.{fc33,fc34,fc35,fc36,el7,el8,el9,amzn2}.x86_64.rpm - The following packages were added:
- python3-oletools
- python-oletools-doc
- mmc-utils
python3-certifi-2022.5.18.1-1.{fc33,el8}.noarch.rpm and python36-2022.5.18.1.8-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
python{2,36}-psutil-5.9.1-1.el7.x86_64.rpm - Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network) in Python.
python36-pyparsing-3.0.9-1.el7.noarch.rpm, python3-pyparsing-3.0.9-1.{el8,amzn2}.noarch.rpm, and pyparsing-doc-3.0.9-1.{el7,el8,amzn2}.noarch.rpm - Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
pfring-8.1.0-7470.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7470-7470.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3698.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc36-x86_64-1.9.1-2.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.8-300 for FC36
- 5.17.9-300 for FC36
fmem-kernel-modules-fc36-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.8-300 for FC36
- 5.17.9-300 for FC36
lime-kernel-modules-fc35-x86_64-1.9.1-26.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.8-200 for FC35
- 5.17.9-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.26.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.8-200 for FC35
- 5.17.9-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.50.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.8-100 for FC34
- 5.17.9-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-50.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.8-100 for FC34
- 5.17.9-100 for FC34
fmem-kernel-modules-el9-x86_64-1.6-1.4.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-80 for EL9
- 5.14.0-83 for EL9
- 5.14.0-85 for EL9
- 5.14.0-86 for EL9
- 5.14.0-92 for EL9
- 5.14.0-96 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-4.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-80 for EL9
- 5.14.0-83 for EL9
- 5.14.0-85 for EL9
- 5.14.0-86 for EL9
- 5.14.0-92 for EL9
- 5.14.0-96 for EL9
fmem-kernel-modules-el7-x86_64-1.6-1.86.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.66.1 for EL7
lime-kernel-modules-el7-x86_64-1.9.1-86.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.66.1 for EL7

May 18, 2022: The following changes have been made:

zeek{,-btest,-btest-data,-core,ctl,-devel,-libcaf-devel,-zkg}-4.2.1-1.x86_64.rpm, and libbroker-devel-4.2.1-1.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
sleuthkit{,-devel,-libs}-4.11.1-2.1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data. The only change was to update the revision number due to the relase of revision 2 for Fedora 36.
pfring-8.1.0-7454.{el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-8.1.0-7443.el7.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7454-7454.{el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
pfring-dkms-8.1.0.7443-7443.el7.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3695.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-25.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.7-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.25.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.7-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.49.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.7-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-49.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.7-100 for FC34

Fedora 36 - The repository now supports Fedora 36 for the x86_64 CPU architecture. Here is the list of tools provided for Fedora 36:

2hash
acr
analysis-pipeline
analyzeMFT
apfs-fuse
artifacts
ataraw
autopsy
avml
bencode
bulk_extractor
cert-forensics-tools-release
CERT-Forensics-Tools
crunch
cryptcat
daq
dcp
ddrescueview
ddrutility
dfdatetime
dfvfs
dfwinreg
docker-forensics-toolkit
DropboxReader
dtfabric
eindeutig
epub
EVTXtract
exfat-utils
fatback
fcrackzip
fmem-kernel-modules
fred
fundl
fuse-python
galleta
ghidra
grokevt
guymager

hachoir
hindsight
jafat
KStrike
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf
libexe
libfixbuf
libfplist
libfsapfs
libfsext
libfshfs
libfsntfs
libfsxfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
libipa
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf
libpff
libphdi

libqcow
libregf
libscca
libschemaTools
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvsgpt
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
mac_apt
maryam
missidentify
mount_ewf
mtftar
netsa-python
netsa-rayon
opensearch-py
packetexaminer
pasco
pefile
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
prism
pstotext
ptfinder
ptk
pyfixbuf
pytsk3
qtmltfs-noscripts
qtmltfs
rar

reglookup
regripper-plugins
regripper
rekall-forensics
rifiuti2
rifiuti
scrounge-ntfs
sfdumper
silk-ipa
silk-ipset
silk
sleuthkit
snarf
snort-openappid
snort-sample-rules
snort
stegdetect
super_mediator
tln_tools
umit
unrar
untex
VeraCrypt
videosnarf
vmfs-tools
vmfs6-tools
Volatility3-linux-symbols
Volatility3-mac-symbols
Volatility3-windows-symbols
Volatility3
Volatility
wdpassport-utils
winevt-kb
winreg-kb
xplico
xva-img
yaf
zeek

fmem-kernel-modules-1.6-1.24.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for the Fedora 36 x86_64 architecture was added.
lime-kernel-modules-1.1.r17-24.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for the Fedora 36 x86_64 architecture was added.

May 11, 2022: The following changes have been made:

python3-redis-4.3.0-1.{fc33,el9}.noarch.rpm and python36-redis-4.3.0-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
pfring-8.1.0-7424.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7424-7424.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3689.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-24.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.6-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.24.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.6-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.48.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.6-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-48.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.6-100 for FC34

May 4, 2022: The following changes have been made:

Volatility3-2.1.0-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is patched as of 2022-04-28.
python3-elasticsearch-7.17.3-1.{fc33,fc34,el8,amzn2}.x86_64.rpm and python36-elasticsearch-7.17.3-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python3-artifacts-20220429-1.{fc33,fc34,fc35,el8,el9,amzn2}.x86_64.rpm, python36-artifacts-20220429-1.el7.x86_64.rpm, and artifacts-data-20220429-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
libfsapfs{,-devel,-python3,-tools}-20220501-1.{fc33,fc34,fc35,el8,el9,amzn2,el8}.x86_64.rpm and libfsapfs{,-devel,-python36,-tools}-20220501-1.el7.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
plaso-20220428-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. This release removes the version restriction on the pyparsing package. Note: For CentOS/RHEL 7, 8, and 9, and Amazon Linux 2, Plaso now runs in Python Virtual Environment.
pfring-8.1.0-7410.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7410-7410.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3676.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-23.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.5-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.23.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.5-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.47.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.5-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-47.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.5-100 for FC34

April 27, 2022: The following changes have been made:

bellsoft-jdk8u332+9-linux-amd64-full.rpm - Bellsoft Java was installed for Fedora 33, 34, and 35, CentOS/RHEL 7, 8, and 9, and Amazon Linux 2. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
libfshfs{,-devel,-python3,-tools}-20220427-1.{fc33,fc34,fc35,el8,el9,amzn2}.x86_64.rpm and libfshfs{,-devel,-python36,-tools}-20220427-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS).
pfring-8.1.0-7398.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7398-7398.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3666.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-22.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.4-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.22.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.4-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.46.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.17.4-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-46.noarch.rpm - Support for the following kernels were added for LiME:
- 5.17.4-100 for FC34

April 20, 2022: The following changes have been made:

python3-dfvfs-20220418-1.{fc33,fc34,fc35,el8,el9,amzn2}.noarch.rpm and python36-dfvfs-20220418-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libfshfs{,-devel,-python3,-tools}-20220418-1.{fc33,fc34,fc35,el8,el9,amzn2}.x86_64.rpm and libfshfs{,-devel,-python36,-tools}-20220418-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS).
python3-elasticsearch-7.17.2-1.{fc33,fc34,el8,amzn2}.x86_64.rpm and python36-elasticsearch-7.17.2-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
pfring-8.1.0-7382.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7382-7382.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3653.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-21.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.20-200 for FC35
- 5.16.19-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.21.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.20-200 for FC35
- 5.16.19-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.45.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.20-100 for FC34
- 5.16.19-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-45.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.20-100 for FC34
- 5.16.19-100 for FC34
fmem-kernel-modules-el9-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-77 for EL9
- 5.14.0-78 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-3.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-77 for EL9
- 5.14.0-78 for EL9

April 13, 2022: The following changes have been made:

Volatility3-2.0.3-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is patched as of 2022-03-03.
libschemaTools{,-devel}-1.4-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - libschemaTools is a library that provides a standard representation of data records. It is built on fixbuf, using IPFIX information elements. It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source. SchemaTools removes the need for the processing application to know the details of how to retrieve data, and to know the structure of the records.
analysis-pipeline-5.11.4-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
pfring-8.1.0-7374.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.1.0.7374-7374.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.3.0-3645.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
libfixbuf{,-devel,-tools}-3.0.0.alpha1-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - Libfixbuf is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101). See here for the list of changes. These packages are installed in the forensics-test repository. Please address any comments on these packages to netsa-help@cert.org.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-101.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. These packages are installed in the forensics-test repository. These packages were rebuilt to use libfixbuf 3.0.0.alpha1. Please address any comments on these packages to netsa-help@cert.org.
libschemaTools{,-devel}-1.4-2.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - libschemaTools is a library that provides a standard representation of data records. It is built on fixbuf, using IPFIX information elements. It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source. SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records. These packages are installed in the forensics-test repository. These packages were rebuilt to use libfixbuf 3.0.0.alpha1. Please address any comments on these packages to netsa-help@cert.org.
python3-pyfixbuf-0.9.0-2.{fc33,fc34,fc35,el8,el9,amzn2}.x86_64.rpm and python36-pyfixbuf-0.9.0-2.el7.x86_64.rpm - Pyfixbuf is a Python API for libfixbuf, an implementation of the IPFIX protocol used for building, collecting, and exporting processes. Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX. Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.). These packages are installed in the forensics-test repository. These packages were rebuilt to use libfixbuf 3.0.0.alpha1. Please address any comments on these packages to netsa-help@cert.org.
analysis-pipeline-5.11.4-2.{fc33,fc34,fc35,el7,el9,amzn2}.x86_64.rpm - The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM). This package is installed in the forensics-test repository. This package was rebuilt to use libfixbuf 3.0.0.alpha1. Please address any comments on these packages to netsa-help@cert.org.
super_mediator-2.0.0.alpha1-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - Super_mediator is an IPFIX mediator for use with the YAF and SiLK tools. It collects and filters YAF output data to various IPFIX collecting processes and/or csv files. See here for the list of changes. This package is installed in the forensics-test repository. This package was rebuilt to use libfixbuf 3.0.0.alpha1 and silk 3.19.2. Please address any comments on these packages to netsa-help@cert.org.
yaf{,-devel}-3.0.0.alpha1-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Note that for CentOS 7 and 8 systems, yaf has been built to use PF_Ring. See here for the list of changes. These packages are installed in the forensics-test repository. These packages were rebuilt to use libfixbuf 3.0.0.alpha1. Please address any comments on these packages to netsa-help@cert.org.
CERT-Forensics-Tools-1.0-100.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - The following packages were added:
- crunch
- docker-forensics-toolkit
- KStrike
- libfplist
- libfwevt
- libfwps
- mtftar
- pstotext
- python3-pyfixbuf (python36-pyfixbuf for CentOS/RHEL 7)
- VeraCrypt
- videosnarf
- wdpassport-utils
- zeek
python3-semantic_version-2.8.4-8.{el9,amzn2}.noarch.rpm - Semantic_Version for Python 3 is a library implementing the 'SemVer' scheme.
python3-gitdb-4.0.5-4.amzn2.noarch.rpm - GitDB for Python 3 is a Git Object Database.
python3-smmap-3.0.1-6.amzn2.noarch.rpm - SMMap for Python 3 is a sliding window memory map manager.
python3-GitPython-3.1.14-4.amzn2.noarch.rpm - GitPython is a Git Library for Python3.
docker-forensics-toolkit-0.2.0-3.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - Docker Forensics Toolkit is a toolkit for performing post-mortem analysis of Docker runtime environments based on forensic HDD copies of the docker host system. See this page for usage instructions. This version fixes a packaging problem.
VeraCrypt-1.25.9-2.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. This release fixes a packing issue related to updating the icon cache.
snort-3.1.27.0-1.{fc33,fc34,fc35,el8,el9}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the list of changes.
fmem-kernel-modules-el7-x86_64-1.6-1.85.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.62.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-85.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.62.1 for EL7

April 6, 2022: The following changes have been made:

VeraCrypt-1.25.9-1.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. VeraCypt is based on TrueCrypt 7.1a.
wdpassport-utils-0.2-3.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - WDPassPort-Utils is a utility used to lock, unlock, and reset passwords on Western Digital's Passport drives. This version was rebuilt to correctly set the permissions on the wdpassport-utils.py executable.
async-timeout-4.0.2-1.fc33.x86_64 - Async-Timeout is an asyncio-compatible timeout context manager needed bu redis.
python3-redis-4.2.2-1.{fc33,el9}.noarch.rpm and python36-redis-4.2.2-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
cert-forensics-tools-release-{2,7,8,9,33,34,35}-17.noarch.rpm - cert-forensics-tools-release is the package that connects a Fedora-, CentOS/RHEL-, and Amazon Linux-based computer system to the CERT Linux Forensics Tools Repository (LiFTeR). This package has been changed to include a new key for the Splunk application.
To install this file and all other updates, to the following for CentOS/RHEL 7 and Amazon Linux 2:
sudo yum update cert-forensics-tools-release -y sudo yum update -y
And for Fedora 33, 34, 35, and CentOS/RHEL 8 and 9, the following:
sudo dnf update cert-forensics-tools-release -y --refresh sudo dnf update -y
The first command updates the cert-forensics-tools-release package which is signed with the old key and contains the new key. The second command then updates the system, installing any updated packages that are now signed with the new key.
lime-kernel-modules-fc35-x86_64-1.9.1-20.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.18-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.20.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.18-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.44.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.18-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-44.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.18-100 for FC34
fmem-kernel-modules-el9-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.0-73 for EL9
- 5.14.0-74 for EL9
- 5.14.0-75 for EL9
lime-kernel-modules-el9-x86_64-1.9.1-2.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.0-73 for EL9
- 5.14.0-74 for EL9
- 5.14.0-75 for EL9

March 28, 2022: The following changes have been made:

cert-forensics-tools-release-{2,7,8,9,33,34,35}-16.noarch.rpm - cert-forensics-tools-release is the package that connects a Fedora-, CentOS/RHEL-, and Amazon Linux-based computer system to the CERT Linux Forensics Tools Repository (LiFTeR). This package has been changed to include a new Forensics team key (2025-03-24) which is also available here.
To install this file and all other updates, to the following for CentOS/RHEL 7 and Amazon Linux 2:
sudo yum update cert-forensics-tools-release -y sudo yum update -y
And for Fedora 33, 34, 35, and CentOS/RHEL 8 and 9, the following:
sudo dnf update cert-forensics-tools-release -y --refresh sudo dnf update -y
The first command updates the cert-forensics-tools-release package which is signed with the old key and contains the new key. The second command then updates the system, installing any updated packages that are now signed with the new key.
wdpassport-utils-0.2-2.{fc33,fc34,fc35,el7,el8,el9,amzn2}.x86_64.rpm - WDPassPort-Utils is a utility used to lock, unlock, and reset passwords on Western Digital's Passport drives. This version was rebuilt to build the virtual envirnoment at package build time rather than at package installation time
ddrescueview-0.4.5-1.{fc33,fc34,fc35,el8}.x86_64.rpm - Ddrescueview is a small tool that allows the user to graphically examine ddrescue's log files in a user friendly GUI application. The Main window displays a block grid with each block's color representing the block types it contains. Many people know this type of view from defragmentation programs. The program is written in Object Pascal using the Lazarus IDE.
opensearch-py-1.1.0-1.{fc33,fc34,fc35,el7,el8,el9,amzn2}.noarch.rpm - OpenSearch-PY is a Python client for OpenSearch.
pfring-8.0.0-7340.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7340-7340.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.2.0-3618.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.43.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.16-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-43.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.16-100 for FC34

March 23, 2022: The following changes have been made:

foremost-1.5.7-27.{el7,dl8}.x86_64.rpm - Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, EnCase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery. Originally developed by the United States Air Force Office Special Investigation and Center for Information Systems Security Studies and Research, foremost has been opened to the general public. Send any comments, suggestions, patches, or feedback you have on this program to namikus@users.sf.net.

CentOS 9 - The repository now supports CentOS 9 for the x86_64 CPU architecture. Here is the list of tools provided for CentOS 9:

2hash
adns
aeskeyfind
analysis-pipeline
analyzeMFT
antiword
apfs-fuse
ataraw
autopsy
avml
bulk_extractor
cert-forensics-tools-release
CERT-Forensics-Tools
cffi
coreutilsshim
crunch
cryptcat
daq
dc3dd
dcfldd
ddrutility
dfdatetime
dfvfs
dfwinreg
docker-forensics-toolkit
dtfabric
eindeutig
EVTXtract
exfat-utils
fatback
fcrackzip
flatbuffers
fmem-kernel-modules
foremost
fundl
galleta
ghidra
guymager
hachoir
hindsight
idna
jafat
KStrike
libagdb
libbde
libbfio
libcreg
libdnet
libesedb
libevt
libevtx
libewf
libexe
libfixbuf
libfplist
libfsapfs

libfsext
libfshfs
libfsntfs
libfsxfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
libiconv
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf
libpff
libphdi
libpst
libqcow
libregf
libsafec
libscca
libschemaTools
libsigscan
libsmdev
libsmraw
libtomcrypt
libtommath
libvhdi
libvmdk
libvsgpt
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
luajit
lz4
mac-robber
mac_apt
md5deep
missidentify
mtftar
musl
opensearch-py
packetexaminer
pasco
pefile
perl-Carp-Assert
perl-Data-Hexify

perl-DateTime-Format-WindowsFileTime
perl-DateTime
perl-Image-ExifTool
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
pstotext
ptfinder
pyfixbuf
pyparsing
python-construct
python-crypto
pytsk3
pyxattr
rar
redis
rekall-forensics
rifiuti2
rifiuti
scalpel
scrounge-ntfs
silk-ipa
silk-ipset
silk
sleuthkit
snarf
snort
splunkshim
stegdetect
super_mediator
tcpflow
tcpxtract
tln_tools
ucl
unrar
untex
upx
videosnarf
vmfs-tools
vmfs6-tools
Volatility3-linux-symbols
Volatility3-mac-symbols
Volatility3-windows-symbols
Volatility3
Volatility
wdpassport-utils
winevt-kb
winreg-kb
xlsxwriter
xmount
xplico
xva-img
yaf
zeek
zeromq3

fmem-kernel-modules-1.6-1.23.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for CentOS 9 x86_64 architecture was added.
lime-kernel-modules-1.1.r17-23.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for CentOS 9 x86_64 architecture was added.
libfsext{,-devel,-python3,-tools}-20220319-1.{fc33,fc34,fc35,el8,el9,amzn2}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20220319-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
pfring-8.0.0-7328.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7328-7328.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.2.0-3608.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-19.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.16-200 for FC35
- 5.16.15-201 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.19.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.16-200 for FC35
- 5.16.15-201 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.42.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.15-101 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-42.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.15-101 for FC34
fmem-kernel-modules-el8-x86_64-1.6-1.33.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-373 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-33.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-373 for EL8
fmem-kernel-modules-el7-x86_64-1.6-1.84.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.59.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-84.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.59.1 for EL7

March 16, 2022: The following changes have been made:

Volatility-2.6.1-8.{fc35,amzn2}.x86_64.rpm - The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. This version fixes some logic and coding errors in the vol.py script which is actually a BASH script that relies on a docker container to run Volatility. You can find that docker container here. This container means that Python 2 is no longer needed on the host.
python3-dfvfs-20220311-1.{fc33,fc34,fc35,el8,amzn2}.noarch.rpm and python36-dfvfs-20220311-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libfshfs{,-devel,-python3,-tools}-20220313-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libfshfs{,-devel,-python36,-tools}-20220313-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS).
snort-3.1.21.0-1.{fc33,fc34,fc35,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. Snort version 3 has been move to the production repository.
CERT-Forensics-Tools-1.0-99.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - The package snort-sample-rules is no longer automatically installed.
pfring-8.0.0-7324.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7324-7324.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.2.0-3606.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-18.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.14-200 for FC35
- 5.16.13-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.18.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.14-200 for FC35
- 5.16.13-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.41.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.14-100 for FC34
- 5.16.13-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-41.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.14-100 for FC34
- 5.16.13-100 for FC34

March 9, 2022: The following changes have been made:

libphdi{,-devel,-python3,-tools}-20220301-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libphdi{,-devel,-python36,-tools}-20220301-1.el7.x86_64.rpm - Libphdi is a library to access the Parallels Hard Disk image format.
python3-xlsxwriter-3.0.3-1.amzn2.noarch.rpm and python36-xlsxwriter-3.0.3-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
Volatility3-2.0.2-1.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is patched as of 2022-03-03.
python3-pyfixbuf-0.9.0-1.{fc31,fc32,fc33,el8,amzn2}.x86_64.rpm and python36-pyfixbuf-0.9.0-1.el7.x86_64.rpm - Pyfixbuf is a Python API for libfixbuf, an implementation of the IPFIX protocol used for building, collecting, and exporting processes. Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX. Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-1.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm and - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. See here for a list of changes in this version.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.2-2.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - This release of the SiLK tools can be found in an optional repository that is now part of cert-forensics-tools-release named forensics-sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo. This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
Brim-0.28.0.rpm - Brim is an open source desktop application for security and network specialists. Brim makes it easy to search and analyze data from:

February 23, 2022: The following changes have been made:

libfsext{,-devel,-python3,-tools}-20220216-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20220112-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
python3-dtfabric-20220219-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and python36-dtfabric-20220219-1.el7.x86_64.rpm - Dtfabric is a project to manage data types and structures, as used in the libyal projects.
python3-artifacts-20220219-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm, python36-artifacts-20220219-1.el7.x86_64.rpm, and artifacts-data-20220219-1.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
libfsntfs{,-devel,-python3}-20220220-2.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libfsntfs{,-devel,-python36}-20220220-2.el7.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
pfring-8.0.0-7272.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7272-7272.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.2.0-3567.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-16.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.9-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.16.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.9-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.39.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.9-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-39.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.9-100 for FC34

February 16, 2022: The following changes have been made:

aff{lib,lib-devel,tools}-3.7.19-1.el8.x86_64.rpm - Afflib is the library and tools to manipulate files using the Advanced Forensic Format.
adns{,-devel,-progs}-1.6.0-5.{el8,amzn2}.x86_64.rpm - ADNS is a resolver library for C (and C++) programs, and a collection of useful DNS resolver utilities.
xmount-0.7.6-9.{el8,amzn2}.x86_64.rpm - Xmount is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types.
python3-dtfabric-20220213-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and python36-dtfabric-20220213-1.el7.x86_64.rpm - Dtfabric is a project to manage data types and structures, as used in the libyal projects.
pfring-8.0.0-7269.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7269-7269.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.2.0-3564.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
python3-redis-4.1.4-1.fc33.noarch.rpm and python36-redis-4.1.4-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
lime-kernel-modules-fc35-x86_64-1.9.1-15.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.8-200 for FC35
- 5.16.7-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.15.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.8-200 for FC35
- 5.16.7-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.38.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.8-100 for FC34
- 5.16.7-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-38.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.8-100 for FC34
- 5.16.7-100 for FC34
fmem-kernel-modules-el8-x86_64-1.6-1.32.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-365 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-32.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-365 for EL8

February 9, 2022: The following changes have been made:

snort-3.1.21.0-1.{fc33,fc34,fc35,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement.
python3-redis-4.1.3-1.fc33.noarch.rpm and python36-redis-4.1.3-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
pfring-8.0.0-7252.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7252-7252.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.2.0-3547.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-14.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.5-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.14.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.5-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.37.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.16.5-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-37.noarch.rpm - Support for the following kernels were added for LiME:
- 5.16.5-100 for FC34

February 2, 2022: The following changes have been made:

bellsoft-java8-full-1.8.0.322+6.x86_64.rpm - Bellsoft Java was installed for Fedora 33, 34, and 35, CentOS/RHEL 7 and 8, and Amazon Linux 2. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
hachoir-3.1.2-3.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - Hachoir is a Python library to view and edit a binary stream field by field. In other words, Hachoir allows you to "browse" any binary stream just like you browse directories and files. A file is splitted in a tree of fields, where the smallest field is just one bit. Examples of fields types: integers, strings, bits, padding types, floats, etc. Hachoir is the French word for a meat grinder (meat mincer), which is used by butchers to divide meat into long tubes; Hachoir is used by computer butchers to divide binary files into fields. The only changes in this version are packaging changes where the virtual environment version (Amazpm Linux 2) and the non-virtual environment version (all others) were homogenized into a single SPEC file.
Volatility3-2.0.0-3.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is patched as of 2022-01-26.
ghidra-10.1.2_PUBLIC_20220125.1.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
zeek{,-btest,-btest-data,-core,ctl,-devel,-libcaf-devel,-zkg}-4.2.0-1.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm, and libbroker-devel-4.2.0-1.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
python3-dtfabric-20220130-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and python36-dtfabric-20220130-1.el7.x86_64.rpm - Dtfabric is a project to manage data types and structures, as used in the libyal projects.
python3-dfvfs-20220127-1.{fc33,fc34,fc35,el8,amzn2}.noarch.rpm and python36-dfvfs-20220127-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libphdi{,-devel,-python3,-tools}-20220110-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libphdi{,-devel,-python36,-tools}-20220110-1.el7.x86_64.rpm - Libphdi is a library to access the Parallels Hard Disk image format.
python3-redis-4.1.2-1.fc33.noarch.rpm and python36-redis-4.1.2-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
python3-dfdatetime-20220131-1.{fc33,fc34,fc35,el8,amzn2}.noarch.rpm and python36-dfdatetime-20220131-1.el7.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
plaso-20220129-3.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. This release removes the version restriction on the pyparsing package. Note: For CentOS/RHEL 7 and 8 and Amazon Linux 2, Plaso now runs in Python Virtual Environment.
libregf{,-devel,-python3,-tools}-20220131-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rp and libregf{,-devel,-python36,-tools}-20220131-1.el7.x86_64.rpm - Libregf contains libraries and tools to access the Windows Registry File files.
python3-elasticsearch-7.17.0-1.{fc33,fc34,el8,amzn2}.x86_64.rpm and python36-elasticsearch-7.17.0-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
pfring-8.0.0-7227.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7227-7227.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3527.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.18-200 for FC35
- 5.15.17-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.18-200 for FC35
- 5.15.17-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.36.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.18-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-36.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.18-100 for FC34

January 26, 2022: The following changes have been made:

Amazon Linux 2 - The following packages were removed from the Amazon Linux 2 repository because they were built by accident. In most cases, these packages are available from the Extra Packages for Enterprise Linux (EPEL) repository.

aeskeyfind
afflib
cmake3
dc3dd
dcfldd
dd_rescue
ddrescue
dislocker
distorm3
dpapick
exfatprogs
fuse3
gparted

haystack
ioc_writer
ip4r
kracked
libffi
libmaxminddb
libmcrypt
mac-robber
mate-polkit
mbedtls
md5deep
mdbtools
ntfs-3g

p7zip
partclone
perl-Alien-wxWidgets
perl-Cairo
perl-Carp-Assert
perl-Digest-CRC
perl-Glib
perl-Gtk2
perl-Image-ExifTool
perl-Pango
php-extras
pkcs11-helper
pycoin

python2-rarfile
python-enum
python-ssdeep
python-urwid
scalpel
ssdeep
ssldump
tcpxtract
testdisk
tre
Volatility-community-plugins
wxGTK

hachoir-3.1.2-2.amzn2.noarch.rpm - Hachoir is a Python library to view and edit a binary stream field by field. In other words, Hachoir allows you to "browse" any binary stream just like you browse directories and files. A file is splitted in a tree of fields, where the smallest field is just one bit. Examples of fields types: integers, strings, bits, padding types, floats, etc. Hachoir is the French word for a meat grinder (meat mincer), which is used by butchers to divide meat into long tubes; Hachoir is used by computer butchers to divide binary files into fields.
Notes:
1. In this version, these tools are all available: hachoir-grep, hachoir-metadata, hachoir-strip, hachoir-urwid, and hachoir-wx. As such, the previous packages where these tools were packaged separately are obsoleted.
2. This version fixes an error that precluded all of the available tools appearing in the /usr/bin directory.
libfvde{,-devel,-python3,-tools}-20220125-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libfvde{,-devel,-python36,-tools}-20220125-1.el7.x86_64.rpm - Libfvde is a library and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
plaso-20211229-3.{fc33,fc34,fc35,el7,el8,amzn2}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. This release removes the version restriction on the pyparsing package. Note: For CentOS/RHEL 7 and 8 and Amazon Linux 2, Plaso now runs in Python Virtual Environment.
python36-pyparsing-3.0.7-1.el7.noarch.rpm, python3-pyparsing-3.0.7-1.{el8,amzn2}.noarch.rpm, and pyparsing-doc-3.0.7-1.{el7,el8,amzn2}.noarch.rpm - Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
libbde{,-devel,-python3,-tools}-20220121-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libbde{,-devel,-python36,-tools}-20220121-1.el7.x86_64.rpm - Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
libfwsi{,-devel,-python3}-20220123-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libfwsi{,-devel,-python36}-20220123-1.el7.x86_64.rpm - Libfwsi is a library to access the Windows Shell Item format.
python3-dtfabric-20220126-1.{fc33,fc34,fc35,amzn2,el8}.x86_64.rpm and python36-dtfabric-20220126-1.el7.x86_64.rpm - Dtfabric is a project to manage data types and structures, as used in the libyal projects.
libsigscan{,-devel,-python3}-20220124-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libsigscan{,-devel,-python36}-20220124-1.el7.x86_64.rpm - Libsigscan is a library and tools used to binary signature scanning.
libluksde{,-devel,-python3,-tools}-20220121-1.{fc33,fc34,fc35,el8,amzn2}.x86_64.rpm and libluksde{,-devel,-python36,-tools}-20220121-1.el7.x86_64.rpm - Libluksde is a library and tools used to access LUKS Disk Encryption encrypted volumes.
pfring-8.0.0-7207.{el7,el8,amzn2}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7207-7207.{el7,el8,amzn2}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3509.{el7,el8,amzn2}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-12.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.16-200 for FC35
- 5.15.15-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.16-200 for FC35
- 5.15.15-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.35.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.16-100 for FC34
- 5.15.15-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-35.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.16-100 for FC34
- 5.15.15-100 for FC34

January 19, 2022: The following changes have been made:

libfsext{,-devel,-python3,-tools}-20220112-1.{fc33,fc34,fc35,el8}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20220112-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
libfsxfs{,-devel,-python3,-static,-tools}-20220113-1.{fc33,fc34,fc35,el8}.x86_64.rpm and libfsxfs{,-devel,-python36,-static,-tools}-20220113-1.el7.x86_64.rpm - Libfsxfs contains library and tools to access the SGI X File System (XFS).
libfshfs{,-devel,-python3,-tools}-20220115-1.{fc33,fc34,fc35,el8}.x86_64.rpm and libfshfs{,-devel,-python36,-tools}-20220115-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS).
snort-3.1.20.0-1.{fc33,fc34,fc35,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement.
python3-elasticsearch-7.16.3-1.{fc33,fc34,el8}.x86_64.rpm and python36-elasticsearch-7.16.3-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
Volatility3-mac-symbols-20200601-1.noarch.rpm - These three packages are the kernel symbol table files needed by Volatility 3 to correctly interpret information in various MacOS kernels.
python3-redis-4.1.1-1.fc33.noarch.rpm and python36-redis-4.1.1-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
lime-kernel-modules-fc35-x86_64-1.9.1-11.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.14-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.14-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.34.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.14-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-34.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.14-100 for FC34
fmem-kernel-modules-el8-x86_64-1.6-1.31.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-358 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-31.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-358 for EL8
fmem-kernel-modules-el7-x86_64-1.6-1.83.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.53.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-83.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.53.1 for EL7

Amazon Linux 2 - The repository now supports Amazon Linux 2 for the x86_64 CPU architecture. Here is the list of tools provided for Amazon Linux 2:

2hash
acr
adns
aeskeyfind
afflib
aimage
analysis-pipeline
analyzeMFT
antiword
apfs-fuse
artifacts
ataraw
autopsy
avml
bencode
binplist
bloom
bulk_extractor
bulk_extractor-stoplist
CERT-Forensics-Tools
cert-forensics-tools-release
certifi
cffi
cmake3
crunch
cryptcat
cutter-re
daq
dc3dd
dcfldd
dcp
dd_rescue
ddrescue
ddrutility
dfdatetime
dfvfs
dfwinreg
disktype
dislocker
distorm3
dpapick
DropboxReader
dtfabric
eindeutig
elasticsearch
epub
etherape
EVTXtract
exfatprogs
exfat-utils
fatback
fcrackzip
femto
fmem-kernel-modules
foremost
frag_find
fundl
fuse3
fuse-python
galleta
ghidra

gparted
grokevt
guymager
hachoir
haystack
hindsight
ioc_writer
ip4r
jafat
KHracker
kracked
KStrike
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf
libexe
libffi
libfixbuf
libfplist
libfsapfs
libfsext
libfshfs
libfsntfs
libfsxfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
libiconv
libipa
liblnk
libluksde
libmaxminddb
libmcrypt
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf
libpff
libphdi
libqcow
libregf
libscca
libschemaTools
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvsgpt
libvshadow

libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
mac_apt
mac-robber
maryam
mate-polkit
mbedtls
md5deep
mdbtools
meson
missidentify
mount_ewf
mtftar
musl
netsa-python
netsa-rayon
ntfs-3g
openpgm
opensearch-py
p7zip
packetexaminer
partclone
pasco
pefile
perl-Alien-wxWidgets
perl-Cairo
perl-Carp-Assert
perl-Data-Hexify
perl-DateTime-Format-WindowsFileTime
perl-Digest-CRC
perl-Glib
perl-Gtk2
perl-Image-ExifTool
perl-Pango
perl-Parse-Evtx
perl-Parse-Win32Registry
perl-Wx
php-extras
pkcs11-helper
plaso
prism
pstotext
ptfinder
ptk
pycoin
pycparser
pyfixbuf
pyparsing
python2-rarfile
python3-cryptography
python3-PyYAML
python-construct
python-crypto
python-enum
python-netaddr
python-ply

python-registry
python-ssdeep
python-urwid
pytsk3
pyxattr
qtmltfs
qtmltfs-noscripts
rar
reglookup
regripper
regripper-plugins
requests
rifiuti2
rifiuti
scalpel
scrounge-ntfs
sevenzipjbinding
sfdumper
shellbags
silk
silk-ipa
silk-ipset
sleuthkit
snarf
snort
snort-openappid
snort-sample-rules
ssdeep
ssldump
stegdetect
super_mediator
tcpflow
tcpxtract
testdisk
tln_tools
tre
undbx
unrar
untex
VeraCrypt
videosnarf
vmfs6-tools
vmfs-tools
Volatility3
Volatility3-linux-symbols
Volatility3-mac-symbols
Volatility3-windows-symbols
Volatility
Volatility-community-plugins
wdpassport-utils
winevt-kb
winreg-kb
wxGTK
xlsxwriter
xmount
xplico
xva-img
yaf
zeek
zeromq3

January 12, 2022: The following changes have been made:

Volatility3-2.0.0-2.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is patched as of 2022-01-05.
python36-requests-2.27.1-1.el7.x86_64.rpm - Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings. Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web. It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
pfring-8.0.0-7172.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7172-7172.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3475.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-10.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.13-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.13-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.33.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.13-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-33.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.13-100 for FC34

January 5, 2022: The following changes have been made:

libfsntfs{,-devel,-python3}-20211229-2.{fc33,fc34,fc35,el8}.x86_64.rpm and libfsntfs{,-devel,-python36}-20211229-2.el7.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
opensearch-py-1.0.0-1.{fc33,fc34,fc35,el7,el8}.noarch.rpm - OpenSearch-PY is a Python client for OpenSearch.
plaso-20211229-1.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. Note: For CentOS/RHEL 7 and 8, Plaso now runs in Python Virtual Environment.
python{2,36}-psutil-5.9.0-1.el7.x86_64.rpm - Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network) in Python.
mac_apt-1.4.3.dev-3.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Mac_apt is a DFIR (Digital Forensics and Incident Response) tool to process Mac computer full disk images (or live machines) and extract data/metadata useful for forensic investigation. It is a python based framework, which has plugins to process individual artifacts (such as Safari internet history, Network interfaces, Recently accessed files & volumes, etc.). This package is based on the 2022-01-04 version of the code.
hindsight-2021.12-1.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications. Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.
lime-kernel-modules-fc35-x86_64-1.9.1-9.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.12-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.12-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.32.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.12-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-32.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.12-100 for FC34
fmem-kernel-modules-el8-x86_64-1.6-1.30.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-348.7.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-30.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-348.7.1 for EL8

December 29, 2021: The following changes have been made:

python3-dfdatetime-20211228-1.{fc33,fc34,fc35,el8}.noarch.rpm and python36-dfdatetime-20211225-1.el7.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
python3-dfvfs-20211228-1.{fc33,fc34,fc35,el8}.noarch.rpm and python36-dfvfs-20211224-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
bulk_extractor-2.0.0.beta3-1.{,fc33,fc34,fc35,el7,el8}.x86_64.rpm - Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. Bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important. This is the development version for 2.0.0. Note: These packages have been installed in the forensics-test repository.
exfat-utils-1.3.0-2.{fc33,fc34,fc35,el7,cl8}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities for creating, checking, dumping and labeling exFAT file systems. This version was rebuilt to remove the obsoletes directives for exfatprogs and fuse-exfat. This means that the installer must select the appropriate version for their system if not installing with the CERT-Forensics-Tools meta package.
ghidra-10.1.1-PUBLIC_20211221.1.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here. This release fixes a log4j vulnerability.
python3-elasticsearch-7.16.2-1.{fc33,fc34,fc35,el8}.x86_64.rpm and python36-elasticsearch-7.16.2-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python3-packaging-21.3-1.fc33.x86_64.rpm and python36-packaging-21.3-1.el7.x86_64.rpm - Packaging is a library that provides utilities that implement the interoperability specifications which have clearly one correct behaviour (eg: PEP 440) or benefit greatly from having a single shared implementation (eg: PEP 425).
python3-redis-4.1.0-1.fc33.noarch.rpm and python36-redis-4.1.0-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
VeraCrypt-1.25.4-1.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. VeraCypt is based on TrueCrypt 7.1a.
lime-kernel-modules-fc35-x86_64-1.9.1-8.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.11-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.11-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.31.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.11-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-31.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.11-100 for FC34

December 22, 2021: The following changes have been made:

python3-dfdatetime-20211222-1.{fc33,fc34,fc35,el8}.noarch.rpm and python36-dfdatetime-20211222-1.el7.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
pfring-8.0.0-7150.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7150-7150.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-X3460.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-7.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.10-200 for FC35
- 5.15.8-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.10-200 for FC35
- 5.15.8-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.30.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.10-100 for FC34
- 5.15.8-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-30.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.10-100 for FC34
- 5.15.8-100 for FC34

December 15, 2021: The following changes have been made:

plaso-20211024-2.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. Note: For CentOS/RHEL 7 and 8, Plaso now runs in Python Virtual Environment. The Fedora version is unchanged in this release.
python3-elasticsearch-7.16.1-1.{fc33,fc34,fc35,el8}.x86_64.rpm and python36-elasticsearch-7.16.1-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
ghidra-10.1-PUBLIC_20211210.1.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
pfring-8.0.0-7140.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7140-7140.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3453.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-6.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.7-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.7-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.29.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.7-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-29.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.7-100 for FC34

December 10, 2021: The following changes have been made:

python3-artifacts-20211205-1.{fc33,fc34,fc35,el8}.x86_64.rpm, python36-artifacts-20211205-1.el7.x86_64.rpm, and artifacts-data-20211205-1.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
snort-2.9.19-1.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
snort-sample-rules-2.9.19-1.{fc33,fc34,fc35,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.19-1.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
python3-dfwinreg-20211207-1.{fc33,fc34,fc35,el8}.x86_64.rpm and python36-dfwinreg-20211207-1.el7.x86_64.rpm - DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
python3-elasticsearch-7.16.0-1.{fc33,fc34,fc35,el8}.x86_64.rpm and python36-elasticsearch-7.16.0-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
snort-3.1.18.0-1.{fc33,fc34,fc35,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement.
pfring-8.0.0-7115.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7115-7115.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3441.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
CERT-Forensics-Tools-1.0-98.{fc33,fc34,fc35,el7,el8}.x86_64.rpm - This release removes exfat-utils and replaces it with exfatprogs.
lime-kernel-modules-fc35-x86_64-1.9.1-5.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.6-200 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.5.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.6-200 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.28.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.6-100 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-28.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.6-100 for FC34
fmem-kernel-modules-el7-x86_64-1.6-1.82.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.49.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-82.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.49.1 for EL7

December 1, 2021: The following changes have been made:

mac_apt-1.4.3.dev-2.{fc32,fc33,fc34,fc35,el7,el8}.x86_64.rpm - Mac_apt is a DFIR (Digital Forensics and Incident Response) tool to process Mac computer full disk images (or live machines) and extract data/metadata useful for forensic investigation. It is a python based framework, which has plugins to process individual artifacts (such as Safari internet history, Network interfaces, Recently accessed files & volumes, etc.). This package fixes a scripting error for each provided command.
snort-3.1.17.0-1.{fc32,fc33,fc34,fc35,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
veracrypt-1.24.7-2.{fc32,fc33,fc34,fc35,el7,el8}.x86_64.rpm - VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. VeraCypt is based on TrueCrypt 7.1a. This release was rebuilt to include larger and easier to see icons.
python36-lz4-3.1.10-1.el7.x86_64.rpm - LZ4 contains the python bindings for the lz4 compression library.
python3-redis-4.0.2-1.{fc32,fc33}.noarch.rpm and python36-redis-4.0.2-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
pfring-8.0.0-7106.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7106-7106.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3432.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-fc35-x86_64-1.9.1-4.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.5-200 for FC35
- 5.15.4-201 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.4.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.5-200 for FC35
- 5.15.4-201 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.27.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.15.5-100 for FC34
- 5.15.4-101 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-27.noarch.rpm - Support for the following kernels were added for LiME:
- 5.15.5-100 for FC34
- 5.15.4-101 for FC34
Fedora 32 - Updates to Fedora 32 for the x86_64 CPU architecture have ceased.

November 19, 2021: The following changes have been made:

python3-elasticsearch-7.15.2-1.{fc32,fc33,fc34,fc35,el8}.x86_64.rpm and python36-elasticsearch-7.15.2-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python3-pytsk3-20211111-1.{fc32,fc33,fc34,fc35,el8}.x86_64.rpm and python36-pytsk3-20211111-1.el7.x86_64.rpm - Pytsk is Python bindings for The Sleuth Kit.
sleuthkit{,-devel,-libs}-4.11.1-1.1.{fc32,fc33,fc34,fc35,el7,el8}.x86_64.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
autopsy-4.19.2-1.{fc32,fc33,fc34,fc35,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:
1. This version uses Java 8 from Bellsoft.
2. This version was tested on Fedora 32 through 35 and CentOS 7 and 8 for the x86_64 architectures using an E01 dataset that contains a 7-Zip file that contains two JPEG images, one of which has EXIF metadata. Those archives were correctly parsed and the EXIF data verified.
3. If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
  [ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
  sudo systemctl start xrdp
mac_apt-1.4.3.dev-1.{fc32,fc33,fc34,fc35,el7,el8}.x86_64.rpm - Mac_apt is a DFIR (Digital Forensics and Incident Response) tool to process Mac computer full disk images (or live machines) and extract data/metadata useful for forensic investigation. It is a python based framework, which has plugins to process individual artifacts (such as Safari internet history, Network interfaces, Recently accessed files & volumes, etc.). Here are a list of features:
- Cross platform (no dependency on pyobjc)
- Works on E01, VMDK, AFF4, DD, split-DD, DMG (no compression), SPARSEIMAGE & mounted images
- XLSX, CSV, TSV, Sqlite outputs
- Analyzed files/artifacts are exported for later review
- zlib, lzvn, lzfse compressed files are supported!
- Native HFS & APFS parser
- Reads the Spotlight database and Unified Logging (tracev3) files
And here are a list of new functionality added in this release:
- Can read Axiom created targeted collection zip files
- ios_apt can read GrayKey extracted file system
- Can read RECON created .sparseimage files
- Support for macOS Big Sur Sealed volumes (11.0)
- Introducing ios_apt for processing iOS/ipadOS images
- FAST mode ⏳
- Encrypted 🔒 APFS images can now be processed using password/recovery-key 🔑
- macOS Catalina (10.15+) separately mounted SYSTEM & DATA volumes now supported
- AFF4 images (including macquisition created) are supported
python3-dfvfs-20211107-1.{fc32,fc33,fc34,fc35,el8}.noarch.rpm and python36-dfvfs-20211107-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python3-dfdatetime-20211113-1.{fc32,fc33,fc34,fc35,el8}.noarch.rpm and python36-dfdatetime-20211113-1.el7.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
libvshadow{,-devel,-python3,-tools}-20211114-1.{fc32,fc33,fc34,fc35,el8}.x86_64.rpm and libvshadow{,-devel,-python36,-tools}-20211114-1.el7.x86_64.rpm - Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
python3-redis-4.0.1-1.{fc32,fc33}.noarch.rpm and python36-redis-4.0.1-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
libvsgpt{,-devel,-python3,-tools}-20211115.{fc32,fc33,fc34,fc35,el8}.x86_64.rpm and libfsgpt{,-devel,-python36,-tools}-20211115.el7.x86_64.rpm - Libvsgpt is a library and tools used to access the GUID Partition Table (GPT) volume system.
pfring-8.0.0-7094.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7094-7094.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3423.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
bulk_extractor-1.6.0-4.{fc32,fc33,fc34,fc35,el7,el8}.x86_64.rpm - Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. Bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important. This version fixes many issues. In addition, it also contains the BEViewer GUI front-end for bulk_extractor. Note 1: This version was built with the expat-devel library to facility restarting bulk_extractor.
bulk_extractor-2.0.0.dev-2.{fc32,fc33,fc34,fc35,el7,el8}.x86_64.rpm - Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. Bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important. This is the development version for 2.0.0. Note 1: These packages have been installed in the forensics-test repository. Note 2: This version was built with the expat-devel library to facility restarting bulk_extractor.
lime-kernel-modules-fc35-x86_64-1.9.1-3.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.18-300 for FC35
- 5.14.17-301 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.18-300 for FC35
- 5.14.17-301 for FC35
fmem-kernel-modules-fc34-x86_64-1.6-1.26.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.18-200 for FC34
- 5.14.17-201 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-26.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.18-200 for FC34
- 5.14.17-201 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.46.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.18-100 for FC33
- 5.14.17-101 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-46.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.18-100 for FC33
- 5.14.17-101 for FC33
fmem-kernel-modules-el8-x86_64-1.6-1.29.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-348.2.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-29.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-348.2.1 for EL8

November 10, 2021: The following changes have been made:

python36-xlsxwriter-3.0.2-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
zeek{,-btest,-btest-data,-core,ctl,-devel,-libcaf-devel,-zkg}-4.1.1-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm, and libbroker-devel-4.1.1-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
snort-3.1.16.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
fuse-python{2,3}-1.0.4-1.{fc32,fc33,fc34}.x86_64.rpm - Fuse-Python is a Python interface to libfuse, a simple interface for userspace programs to export a virtual filesystem to the Linux kernel.
guymager-0.8.12-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Guymager is a forensic imaging package. See here for the list of changes.
python{2,3}-pycparser-2.21-1.el8.noarch.rpm - Python-PYCParser is a complete C99 parser in pure Python.
rifiuti2-0.7.0-20.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - rifiuti2 is a rewrite of rifiuti, a tool for analyzing Windows Recycle Bin INFO2 file. This package was updated to avoid a conflict with the rifiuti package.
python3-artifacts-20211107-1.{fc32,fc33,fc34,el8}.x86_64.rpm, python36-artifacts-20211107-1.el7.x86_64.rpm, and artifacts-data-20211107-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
pfring-8.0.0-7085.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7085-7085.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3415.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
CERT-Forensics-Tools-1.0-97.{fc32,fc33,fc34,fc35,el7,el8}.x86_64.rpm - This release removes the following tools from Fedora 35 only. All other releases are unchanged
- binplist
- shellbags
- vinetto
- Volatility-community-plugins
In addition, the Volatility application has been replaced by a Docker container based on Alpine Linux 3.10. The volatility, vol, and vol.py programs have been replaced by a script that manages this container. Please address any unexpected behavior or requests for improvements and enhancements to
fmem-kernel-modules-fc34-x86_64-1.6-1.25.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.16-201 for FC34
- 5.14.15-200 for FC34
- 5.14.14-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-25.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.16-201 for FC34
- 5.14.15-200 for FC34
- 5.14.14-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.45.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.16-101 for FC33
- 5.14.15-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-45.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.16-101 for FC33
- 5.14.15-100 for FC33
fmem-kernel-modules-el8-x86_64-1.6-1.28.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-305.25.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-28.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-305.25.1 for EL8

Fedora 35 - The repository now supports Fedora 35 for the x86_64 CPU architecture. Here is the list of tools provided for Fedora 35:

2hash
acr
analysis-pipeline
analyzeMFT
apfs-fuse
artifacts
ataraw
autopsy
avml
bencode
bulk-reviewer
bulk_extractor
cert-forensics-tools-release
CERT-Forensics-Tools
crunch
cryptcat
daq
dcp
ddrescueview
ddrutility
dfdatetime
dfvfs
dfwinreg
docker-forensics-toolkit
DropboxReader
dtfabric
eindeutig
elasticsearch
epub
EVTXtract
exfat-utils
fatback
fcrackzip
femto
fmem-kernel-modules
fred
fundl
fuse-python
galleta

ghidra
grokevt
guymager
hachoir
hindsight
jafat
KStrike
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf
libexe
libfixbuf
libfplist
libfsapfs
libfsext
libfshfs
libfsntfs
libfsxfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf
libpff

libphdi
libqcow
libregf
libscca
libschemaTools
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvsgpt
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
mac_apt
maryam
missidentify
mount_ewf
mtftar
netsa-python
netsa-rayon
packetexaminer
pasco
pefile
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
prism
pstotext
ptfinder
ptk
pyfixbuf
python-construct
pytsk3
qtmltfs-noscripts
qtmltfs

rar
reglookup
regripper-plugins
regripper
rekall-forensics
rifiuti2
rifiuti
scrounge-ntfs
sfdumper
silk-ipa
silk-ipset
silk
sleuthkit
snarf
snort-openappid
snort-sample-rules
snort
stegdetect
super_mediator
tln_tools
umit
unrar
untex
veracrypt
videosnarf
vmfs-tools
vmfs6-tools
Volatility3-linux-symbols
Volatility3-mac-symbols
Volatility3-windows-symbols
Volatility3
Volatility
wdpassport-utils
winevt-kb
winreg-kb
xplico
xva-img
yaf
zeek

fmem-kernel-modules-1.6-1.22.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for the Fedora 35 x86_64 architecture was added.
lime-kernel-modules-1.1.r17-22.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for the Fedora 35 x86_64 architecture was added.
lime-kernel-modules-fc35-x86_64-1.9.1-2.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.16-301 for FC35
fmem-kernel-modules-fc35-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.16-301 for FC35

October 29, 2021: The following changes have been made:

Volatility3-2.0.0-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is the version of Volatility 3 which can be found here.
libfsntfs{,-devel,-python3}-20211023-2.{fc32,fc33,fc34,el8}.x86_64.rpm and libfsntfs{,-devel,-python36}-20211023-2.el7.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
python36-pyparsing-3.0.0-2.el7.noarch.rpm, python3-pyparsing-3.0.0-2.el8.noarch.rpm, and pyparsing-doc-3.0.0-2.{el7,el8}.noarch.rpm - Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
Note: based on the requirements of Plaso, versions of pyparsing newer than version 3.0.0 need to be removed and 3.0.0 installed as described below:
For CentOS/RHEL 8, do the following:
sudo rpm -ev python3-pyparsing plaso --nodeps; sudo dnf install plaso -y --refresh
For CentOS/RHEL 7, do the following:
sudo rpm -ev python36-pyparsing plaso --nodeps; sudo yum clean all; sudo yum install plaso -y
We regret this inconvenience.
yaf{,-devel}-2.12.2-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Note that for CentOS 7 and 8 for the x86_64 architecture, yaf has been built to use PF_Ring.
plaso-20211024-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here.
ghidra-10.0.4-PUBLIC_20210928.1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.
pfring-8.0.0-7059.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7059-7059.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3399.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.24.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.13-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-24.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.13-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.44.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.13-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-44.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.13-100 for FC33
bellsoft-java8-full-1.8.0.312-1+7.x86_64.rpm - Bellsoft Java was installed for Fedora 32, 33, and 34 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
fmem-kernel-modules-el8-x86_64-1.6-1.27.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-348 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-27.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-348 for EL8

October 20, 2021: The following changes have been made:

python{2,3}-cffi-1.15.0-1.el8.x86_64.rpm and cffi-doc-1.15.0-1.el8.noarch.rpm - Python-CFFI is a C Foreign Function Interface for Python. Interact with almost any C code from Python, based on C-like declarations that you can often copy-paste from header files or documentation.
python3-elasticsearch-7.15.1-1.{fc32,fc33,fc34,el8}.x86_64.rpm and python36-elasticsearch-7.15.1-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python3-dfvfs-20211017-1.{fc32,fc33,fc34,el8}.noarch.rpm and python36-dfvfs-20211017-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
KStrike-20210624-1.{fc32,fc33,fc34,el7,el8}.noarch.rpm - KStrike is a stand-alone parser for User Access Logging from Server 2012 and newer systems.
pfring-8.0.0-7045.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.7045-7045.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3390.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.23.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.12-200 for FC34
- 5.14.11-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-23.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.12-200 for FC34
- 5.14.11-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.43.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.12-100 for FC33
- 5.14.11-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-43.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.12-100 for FC33
- 5.14.11-100 for FC33
fmem-kernel-modules-el7-x86_64-1.6-1.81.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.45.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-81.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.45.1 for EL7

October 13, 2021: The following changes have been made:

silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.1-5.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. This package was rebuilt to use Python 3 instead of Python 2.

silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.1-6.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - This release of the SiLK tools can be found in an optional repository that is now part of cert-forensics-tools-release named forensics-sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo. This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root. This package was rebuilt to use Python 3 instead of Python 2.

python3-artifacts-20211012-1.{fc32,fc33,fc34,el8}.x86_64.rpm, python36-artifacts-20211012-1.el7.x86_64.rpm, and artifacts-data-20211003-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.

python3-certifi-2021.10.8-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-certifi-2021.10.8-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.

analyzeMFT-3.0.0-1.{fc32,fc33,fc34,el7,el8}.{i686,x86_64}.rpm - AnalyzeMFT is a tool that fully parses the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats. See here for the changes since the previously installed version 2.0.19.1. Note: This version uses Python 3.

python3-idna-3.3-1.el8.noarch.rpm and python36-idna-3.3-1.el7.noarch.rpm - IDNA provides support for the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891.

pfring-8.0.0-7003.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.

pfring-dkms-8.0.0.7003-7003.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.

ndpi-4.0.0-3370.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.

fmem-kernel-modules-fc34-x86_64-1.6-1.22.noarch.rpm - Support for the following kernels were added for Fmem:

5.14.10-200 for FC34

lime-kernel-modules-fc34-x86_64-1.9.1-22.noarch.rpm - Support for the following kernels were added for LiME:

5.14.10-200 for FC34

fmem-kernel-modules-fc33-x86_64-1.6-1.42.noarch.rpm - Support for the following kernels were added for Fmem:

5.14.10-100 for FC33

lime-kernel-modules-fc33-x86_64-1.9.1-42.noarch.rpm - Support for the following kernels were added for LiME:

5.14.10-100 for FC33

October 6, 2021: The following changes have been made:

bulk_extractor-2.0.0.dev-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. Bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important. This is the development version for 2.0.0. Note that these packages have been installed in the forensics-test repository.
bulk-reviewer-0.3.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm - < href="https://bulk-reviewer.readthedocs.io/en/latest/">BulkReviewer is an Electron desktop application that aids in identification, review, and removal of sensitive files in directories and disk images. Bulk Reviewer scans directories and disk images for personally identifiable information (PII) and other sensitive information using bulk_extractor, a best-in-class digital forensics tool. The desktop application enables users to configure, start, and review scans; generate CSV reports of features found; and export sets of files (either those free of sensitive information, or those with PII that should be restricted or run though redaction software).
EVTXtract-0.2.3-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
CERT-Forensics-Tools-1.0-96.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - This relese does the following:
- Added bulk-reviewer for all except CentOS/RHEL 7.
- Added EVTXtract.
fmem-kernel-modules-fc34-x86_64-1.6-1.21.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.9-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-21.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.9-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.41.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.14.9-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-41.noarch.rpm - Support for the following kernels were added for LiME:
- 5.14.9-100 for FC33

September 29, 2021: The following changes have been made:

python3-elasticsearch-7.15.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm and python36-elasticsearch-7.15.0-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python3-dfvfs-202100918-1.{fc32,fc33,fc34,el8}.noarch.rpm and python36-dfvfs-202100918-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python3-pyxattr-0.7.2-1.{fc32,fc33,el8}.noarch.rpm and python36-pyxattr-0.7.2-1.el7.noarch.rpm - PYXattr is a C extension module for Python which implements extended attributes manipulation. It is a wrapper on top of the attr C library - see attr(5).
Volatility3-1.2.1-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is the version of Volatility 3 which can be found here.
snort-3.1.13.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
pfring-8.0.0-6952.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.6952-6952.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3344.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.20.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.19-200 for FC34
- 5.13.16-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-20.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.19-200 for FC34
- 5.13.16-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.40.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.19-100 for FC33
- 5.13.16-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-40.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.19-100 for FC33
- 5.13.16-100 for FC33
fmem-kernel-modules-el8-x86_64-1.6-1.26.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-305.19.1 for EL8
- 4.18.0-305.17.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-26.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-305.19.1 for EL8
- 4.18.0-305.17.1 for EL8

September 15, 2021: The following changes have been made:

daq{,-devel,-modules}-3.0.5-1.{fc32,fc33,fc34,el8}.x86_64.rpm - The Data Acquisition Library (Daq) is a library used by snort. Note that these packages have been installed in the forensics-test repository.
snort-3.1.12.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
wdpassport-utils-0.2-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - WDPassPort-Utils is a utility used to lock, unlock, and reset passwords on Western Digital's Passport drives.
qtmltfs-2.4.0.2-2.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - QTMLTFS
qtmltfs-noscripts-2.4.0.2-2.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - QTMLTFS (Quantum Linear Tape File System) enables standard file operations on LTO-5 and LTO-6 tape media. This package differs from qtmltfs in that there are no %pre nor %post scripts, eliminating the /bin/sh dependency, making this package more suitable for building spins.
pfring-8.0.0-6892.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.6892-6892.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3311.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.19.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.15-200 for FC34
- 5.13.14-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-19.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.15-200 for FC34
- 5.13.14-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.39.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.15-100 for FC33
- 5.13.14-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-39.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.15-100 for FC33
- 5.13.14-100 for FC33
fmem-kernel-modules-el7-x86_64-1.6-1.80.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.42.2 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-80.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.42.2 for EL7

September 8, 2021: The following changes have been made:

snort-2.9.18.1-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
snort-sample-rules-2.9.18.1-1.{fc32,fc33,fc34,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.18.1-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
python3-elasticsearch-7.14.1-1.{fc32,fc33,fc34,el8}.x86_64.rpm and python36-elasticsearch-7.14.1-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python{2,3}-pefile-2021.9.3-1.{fc32,fc33,fc34,el8}.noarch.rpm and python{2,36}-pefile-2021.9.3-1.el7.noarch.rpm - PEFile is a Portable Executable reader module.
veracrypt-1.24.7-2.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. VeraCypt is based on TrueCrypt 7.1a. This release is patched as of 2021-09-05.
libfwnt{,-devel,-python3,-tools}-20210906-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libfwnt{,-devel,-python36,-tools}-20210906-1.el7.x86_64.rpm - LibFWNT is a library for Windows NT data types.
pfring-8.0.0-6874.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.6874-6874.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3308.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.18.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.13-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-18.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.13-200 for FC34

September 1, 2021: The following changes have been made:

pfring-8.0.0-6862.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.6862-6862.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3307.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-el8-x86_64-1.6-1.25.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-338 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-25.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-338 for EL8
fmem-kernel-modules-el7-x86_64-1.6-1.79.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.41.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-79.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.41.1 for EL7

August 25, 2021: The following changes have been made:

xplico-1.2.2-3.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - xplico is an Internet traffic decoder. Note: due to issues related to the version of PHP, the versions for Fedora and CentOS/RHEL 8 now use a Docker container based on Ubuntu 18.04. To used this version, run the /usr/bin/xplico script and address the issues that that script highlights. Speifically some additional adjustments may need to be made. Here are some of the issues:

Fedora 32: If you see the error related to CGroups, follow the steps here.
Fedora 33: If you see the error related to CGroups, follow the steps here.

Volatility3-1.2.0-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is the version of Volatility 3 which can be found here.

ghidra-10.0.2-PUBLIC_20210804.1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvements here.

python2-yara-4.1.2-1.{fc32,fc33,fc34,el8}.x86_64.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.

pfring-8.0.0-6835.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.

pfring-dkms-8.0.0.6835-6835.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.

ndpi-4.0.0-3305.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.

fmem-kernel-modules-fc34-x86_64-1.6-1.17.noarch.rpm - Support for the following kernels were added for Fmem:

5.13.12-200 for FC34

lime-kernel-modules-fc34-x86_64-1.9.1-17.noarch.rpm - Support for the following kernels were added for LiME:

5.13.12-200 for FC34

fmem-kernel-modules-fc33-x86_64-1.6-1.38.noarch.rpm - Support for the following kernels were added for Fmem:

5.13.12-100 for FC33

lime-kernel-modules-fc33-x86_64-1.9.1-38.noarch.rpm - Support for the following kernels were added for LiME:

5.13.12-100 for FC33

fmem-kernel-modules-el8-x86_64-1.6-1.24.noarch.rpm - Support for the following kernels were added for Fmem:

4.18.0-331 for EL8
4.18.0-305.12.1 for EL8

lime-kernel-modules-el8-x86_64-1.9.1-24.noarch.rpm - Support for the following kernels were added for LiME:

4.18.0-331 for EL8
4.18.0-305.12.1 for EL8

August 18, 2021: The following changes have been made:

snort-3.1.10.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
libmodi{,-devel,-python3,-tools}-20210807-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libmodi{,-devel,-python36,-tools}-20210807-1.el7.x86_64.rpm - Libmodi is a library and tools to access the Mac OS disk image formats.
yaf{,-devel}-2.12.1-2.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Note that for CentOS 7 and 8 for the x86_64 architecture, yaf has been built to use PF_Ring. This release was rebuilt to accomodate PF_Ring version 8.
pfring-8.0.0-6812.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-8.0.0.6812-6812.{el7,el8}.noarch.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3293.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.16.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.10-200 for FC34
- 5.13.9-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-16.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.10-200 for FC34
- 5.13.9-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.37.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.10-100 for FC33
- 5.13.9-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-37.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.10-100 for FC33
- 5.13.9-100 for FC33

August 11, 2021: The following changes have been made:

snort-3.1.9.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
libvmdk{,-devel,-python3,-tools}-20210807-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libvmdk{,-devel,-python36,-tools}-20210807-1.el7.x86_64.rpm - Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
libvslvm{,-devel,-python3,-tools}-20210807-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libvslvm{,-devel,-python36,-tools}-20210807-1.el7.x86_64.rpm - Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
libsmraw{,-devel,-python3,-tools}-20210807-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libsmraw{,-devel,-python36,-tools}-20210807-1.el7.x86_64.rpm - Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
mtftar-0.9.0-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Mtftar is a tool that translates a MTF stream to a TAR stream. MTF is a format commonly found on Microsoft systems as it's what is generated by the NTBACKUP.EXE tool that ships with all modern versions of Windows.
python36-xlsxwriter-3.0.1-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
libregf{,-devel,-python3,-tools}-20210809-1.{fc32,fc33,fc34,el8}.x86_64.rp and libregf{,-devel,-python36,-tools}-20210809-1.el7.x86_64.rpm - Libregf contains libraries and tools to access the Windows NT Registry File files.
fmem-kernel-modules-fc34-x86_64-1.6-1.15.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.8-200 for FC34
- 5.13.7-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-15.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.8-200 for FC34
- 5.13.7-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.36.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.8-100 for FC33
- 5.13.7-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-36.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.8-100 for FC33
- 5.13.7-100 for FC33

August 4, 2021: The following changes have been made:

python3-dfvfs-20210728-1.{fc32,fc33,fc34,el8}.noarch.rpm and python36-dfvfs-20210728-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python36-xlsxwriter-1.4.5-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
python3-dtfabric-20210731-1.{fc32,fc33,fc34,el8}.x86_64.rpm and python36-dtfabric-20210731-1.el7.x86_64.rpm - Dtfabric is a project to manage data types and structures, as used in the libyal projects.
sleuthkit{,-devel,-libs}-4.11.0-1.1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
autopsy-4.19.0-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:
1. This version uses Java 8 from Bellsoft.
2. This version was tested on Fedora 27 through 32 and CentOS 7 and 8 for the x86_64 architectures using an E01 dataset that contains a 7-Zip file that contains two JPEG images, one of which has EXIF metadata. Those archives were correctly parsed and the EXIF data verified.
3. If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
  [ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
  sudo systemctl start xrdp
python3-pytsk3-20210801-1.{fc32,fc33,fc34,el8}.x86_64.rpm and python36-pytsk3-20210801-1.el7.x86_64.rpm - Pytsk is Python bindings for The Sleuth Kit.
libcreg{,-devel,-python2,-python3,-tools}-20210625-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libcreg{,-devel,-python36,-tools}-20210625-1.el7.x86_64.rpm - Libcreg is a library and tools to access the Windows 9x/Me Registry File (CREG) format.
python3-elasticsearch-7.14.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm and python36-elasticsearch-7.14.0-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
pfring-7.8.0-3496.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3496.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3274.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.14.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.6-200 for FC34
- 5.13.5-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-14.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.6-200 for FC34
- 5.13.5-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.35.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.6-100 for FC33
- 5.13.5-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-35.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.6-100 for FC33
- 5.13.5-100 for FC33
fmem-kernel-modules-el8-x86_64-1.6-1.23.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-326 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-23.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-326 for EL8

July 28, 2021: The following changes have been made:

libfsxfs{,-devel,-python3,-static,-tools}-20210726-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libfsxfs{,-devel,-python36,-static,-tools}-20210726-1.el7.x86_64.rpm - Libfsxfs contains library and tools to access the SGI X File System (XFS).
libfshfs{,-devel,-python3,-tools}-20210722-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libfshfs{,-devel,-python36,-tools}-20210722-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS).
nDPI{,-devel}-2.9.0-2.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - nDPI is a ntop-maintained superset of the popular OpenDPI library. These packages were rebuilt to eliminate a conflict with ndpi-4.
pfring-7.8.0-3487.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3487.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-4.0.0-3273.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.4-200 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.4-200 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.34.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.13.4-100 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-34.noarch.rpm - Support for the following kernels were added for LiME:
- 5.13.4-100 for FC33
fmem-kernel-modules-el7-x86_64-1.6-1.78.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.36.2 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-78.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.36.2 for EL7

July 21, 2021: The following changes have been made:

python3-elasticsearch-7.13.4-1.{fc32,fc33,fc34,el8}.x86_64.rpm and python36-elasticsearch-7.13.4-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
libfsext{,-devel,-python3,-tools}-20210720-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20210522-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
libfwnt{,-devel,-python3,-tools}-20210717-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libfwnt{,-devel,-python36,-tools}-20210717-1.el7.x86_64.rpm - LibFWNT is a library for Windows NT data types.
bellsoft-java8-full-1.8.0.302-1+8.x86_64.rpm - Bellsoft Java was installed for Fedora 32, 33, and 34 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
fmem-kernel-modules-fc34-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.17-300 for FC34
- 5.12.15-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-12.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.17-300 for FC34
- 5.12.15-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.33.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.17-200 for FC33
- 5.12.14-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-33.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.17-200 for FC33
- 5.12.14-200 for FC33
fmem-kernel-modules-el8-x86_64-1.6-1.22.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-305.10.2 for EL8
- 4.18.0-305.7.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-22.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-305.10.2 for EL8
- 4.18.0-305.7.1 for EL8

July 14, 2021: The following changes have been made:

hindsight-2021.04.26-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications. Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.

Please note that hindsight is implemented as Python Virtual Environments with wrapper shell script that is installed in /usr/bin. This means that you need to conifugre pip's /etc/pip.conf if your system is located behind a proxy server. This configuration should be completed before hindsight is installed.
python3-elasticsearch-7.13.3-1.{fc32,fc33,fc34,el8}.x86_64.rpm and python36-elasticsearch-7.13.3-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python{2,3}-cffi-1.14.6-1.el8.x86_64.rpm and cffi-doc-1.14.6-1.el8.noarch.rpm - Python-CFFI is a C Foreign Function Interface for Python. Interact with almost any C code from Python, based on C-like declarations that you can often copy-paste from header files or documentation.
Volatility3-1.1.1-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is the version of Volatility 3 which can be found here.
ghidra-10.0.1-PUBLIC_20210708.1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvement here.
CERT-Forensics-Tools-1.0-95.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - This relese does the following:
- Added Hindsight.
python36-requests-2.26.0-1.el7.x86_64.rpm - Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings. Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web. It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-4.0.3-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm, and libbroker-devel-4.0.1-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
fmem-kernel-modules-fc34-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.14-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-11.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.14-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.32.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.14-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-32.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.14-200 for FC33

July 7, 2021: The following changes have been made:

xva-img-1.4.2-2.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - XVA-IMG is a tool for working with Citrix XEN disk images. Citrix Xen uses a custom virtual appliance format for import/export called "XVA". It's basically a strangely crafted tar-file. You don't need this program to unpack this tar-file, just use your favourite tar unpacker (tar, gtar, bsdtar). Once unpacked you will end up with a lot of different files, ova.xml (which contains the settings for the virtual appliance, think VMware vmx) and a number of folders called Ref:/, this is your disks. Each of these folders contain hundreds of files named 00000000, 00000001 with a accompanying .CHECKSUM file (SHA1). Each file is a 1MB slice of the disk, but some of the files in the sequence will probably be missing this is because XVA do not use compression; instead it will exclude slices of the disk that only contains zeros (are empty). This tool can assemble the disk for you (you will end up with a RAW disk) that can easily be mounted and modified. It can then also split the file again and generate checksum. Once ready, you will probably want to use the "package" command to rebuild the XVA file. In this release, the modes for the xva-img file were set to 755 as is appropriate.
python36-xlsxwriter-1.4.4-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
avml-0.3.0-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed. AVML can produce a memory image suitable for processing with Volatility 2 or Volatility 3 once the appropriate profiles have been created.
pfring-7.8.0-3459.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3459.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3226.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-el8-x86_64-1.6-1.21.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-315 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-21.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-315 for EL8

June 30, 2021: The following changes have been made:

Volatility3-1.0.1-3.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is the version of Volatility 3 which can be found here. Release 2 is patched as of 2021-06-25.
pfring-7.8.0-3457.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3457.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3221.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.13-300 for FC34
- 5.12.12-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-10.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.13-300 for FC34
- 5.12.12-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.31.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.13-200 for FC33
- 5.12.12-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-31.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.13-200 for FC33
- 5.12.12-200 for FC33

June 23, 2021: The following changes have been made:

python3-artifacts-20210620-1.{fc32,fc33,fc34,el8}.x86_64.rpm, python36-artifacts-20210620-1.el7.x86_64.rpm, and artifacts-data-20210620-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.

daq{,-devel,-modules}-3.0.4-1.{fc32,fc33,fc34,el8}.x86_64.rpm - The Data Acquisition Library (Daq) is a library used by snort. Note that these packages have been installed in the forensics-test repository.

snort-3.1.6.0-1.{fc32,fc33,fc34,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.

fmem-kernel-modules-fc34-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:

5.12.11-300 for FC34

lime-kernel-modules-fc34-x86_64-1.9.1-9.noarch.rpm - Support for the following kernels were added for LiME:

5.12.11-300 for FC34

fmem-kernel-modules-fc33-x86_64-1.6-1.30.noarch.rpm - Support for the following kernels were added for Fmem:

5.12.11-200 for FC33

lime-kernel-modules-fc33-x86_64-1.9.1-30.noarch.rpm - Support for the following kernels were added for LiME:

5.12.11-200 for FC33

June 16, 2021: The following changes have been made:

libbde{,-devel,-python3,-tools}-20210605-1.{fc32,fc33,fc34,el8}.x86_64.rpm and libbde{,-devel,-python36,-tools}-20210605-1.el7.x86_64.rpm - Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
python{2,3}-pefile-2021.5.24-1.{fc32,fc33,fc34,el8}.noarch.rpm and python{2,36}-pefile-2021.5.24-1.el7.noarch.rpm - PEFile is a Portable Executable reader module.
python3-dfvfs-20210606-1.{fc32,fc33,fc34,el8}.noarch.rpm and python36-dfvfs-20210606-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
plaso-20210606-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here.
snort-2.9.18-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
snort-sample-rules-2.9.18-1.{fc32,fc33,fc34,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.18-1.{fc32,fc33,fc34,el7,el8}.x86_64.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
libregf{,-devel,-python3,-tools}-20210615-1.{fc32,fc33,fc34,el8}.x86_64.rp and libregf{,-devel,-python36,-tools}-20210615-1.el7.x86_64.rpm - Libregf contains libraries and tools to access the Windows NT Registry File files.
fmem-kernel-modules-fc34-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.10-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-8.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.10-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.29.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.10-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-29.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.10-200 for FC33
fmem-kernel-modules-el7-x86_64-1.6-1.77.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.25.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-77.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.25.1 for EL7

June 11, 2021: The following changes have been made:

python3-elasticsearch-7.13.1-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and python36-elasticsearch-7.13.1-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.

plaso-20210412-2.{fc31,fc32,fc33,fc34,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. Note: This version was rebuilt to remove the restriction on the version of Elasticsearch.

pfring-7.8.0-3429.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.

pfring-dkms-7.8.0-3429.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.

ndpi-3.4.0-3200.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.

fmem-kernel-modules-fc34-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:

5.12.9-300 for FC34

lime-kernel-modules-fc34-x86_64-1.9.1-7.noarch.rpm - Support for the following kernels were added for LiME:

5.12.9-300 for FC34

fmem-kernel-modules-fc33-x86_64-1.6-1.28.noarch.rpm - Support for the following kernels were added for Fmem:

5.12.9-200 for FC33

lime-kernel-modules-fc33-x86_64-1.9.1-28.noarch.rpm - Support for the following kernels were added for LiME:

5.12.9-200 for FC33

fmem-kernel-modules-el8-x86_64-1.6-1.20.noarch.rpm - Support for the following kernels were added for Fmem:

4.18.0-310 for EL8
4.18.0-305.3.1 for EL8

lime-kernel-modules-el8-x86_64-1.9.1-20.noarch.rpm - Support for the following kernels were added for LiME:

4.18.0-310 for EL8
4.18.0-305.3.1 for EL8

Fedora 31 - Updates to Fedora 31 for the x86_64 CPU architecture have ceased.

June 2, 2021: The following changes have been made:

python3-dfvfs-20210531-1.{fc31,fc32,fc33,fc34,el8}.noarch.rpm and python36-dfvfs-20210531-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
maryam-2.2.6.post1-1.{fc31,fc32,fc33,fc34,el8}.noarch.rpm - OWASP Maryam is a modular/optional open-source framework based on OSINT and data gathering. Maryam is written in the Python programming language and has been designed to provide a powerful environment to harvest data from open sources and search engines and collect data quickly and thoroughly. See here for documentation on the modules provided for Maryam. Note that Maryam is not available for CentOS/RHEL 7 at this time.
python3-idna-3.2-1.el8.noarch.rpm and python36-idna-3.2-1.el7.noarch.rpm - IDNA provides support for the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891.
python3-certifi-2021.5.30-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-certifi-2021.5.30-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
libfshfs{,-devel,-python3,-tools}-20210602-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and libfshfs{,-devel,-python36,-tools}-20210602-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS). Note that this project currently only focuses on the analysis of the format.
CERT-Forensics-Tools-1.0-94.{fc31,fc32,fc33,fc34,el7,el8}.x86_64.rpm - This relese does the following: Added Maryam for all except CentOS/RHEL 7.
pfring-7.8.0-3424.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3424.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3182.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem: 5.12.8-300 for FC34 5.12.7-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-6.noarch.rpm - Support for the following kernels were added for LiME: 5.12.8-300 for FC34 5.12.7-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.27.noarch.rpm - Support for the following kernels were added for Fmem: 5.12.8-200 for FC33 5.12.7-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-27.noarch.rpm - Support for the following kernels were added for LiME: 5.12.8-200 for FC33 5.12.7-200 for FC33
fmem-kernel-modules-el8-x86_64-1.6-1.19.noarch.rpm - Support for the following kernels were added for Fmem: 4.18.0-305.0.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-19.noarch.rpm - Support for the following kernels were added for LiME: 4.18.0-305.0.1 for EL8

May 26, 2021: The following changes have been made:

libfsext{,-devel,-python3,-tools}-20210522-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20210522-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
python3-dfvfs-20210522-1.{fc31,fc32,fc33,fc34,el8}.noarch.rpm and python36-dfvfs-20210522-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python{2,3}-pefile-2021.5.24-1.{fc31,el8}.noarch.rpm and python{2,36}-pefile-2021.5.24-1.el7.noarch.rpm - PEFile is a Portable Executable reader module.
libevtx{,-devel,-python3,-tools}-20210525-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and libevtx{,-devel,-python36,-tools}-20210525-1.el7.x86_64.rpm - Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
pfring-7.8.0-3419.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3419.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3180.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
snort-3.1.5.0-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
fmem-kernel-modules-fc34-x86_64-1.6-1.5.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.6-300 for FC34
- 5.12.5-300 for FC34
- 5.11.21-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-5.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.6-300 for FC34
- 5.12.5-300 for FC34
- 5.11.21-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.26.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.12.6-200 for FC33
- 5.12.5-200 for FC33
- 5.11.21-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-26.noarch.rpm - Support for the following kernels were added for LiME:
- 5.12.6-200 for FC33
- 5.12.5-200 for FC33
- 5.11.21-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.46.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.22-100 for FC32
- 5.11.21-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-46.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.22-100 for FC32
- 5.11.21-100 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.18.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-305 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-18.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-305 for EL8

May 19, 2021: The following changes have been made:

Volatility-2.6.1-6.{fc31,fc32,fc33,fc34,el7,el8}.x86_64.rpm - The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. This version of Volatility is the official version of Volatility 2.6.1 that has been patched to May 14, 2021. You can read about this version here.
python{2,3}-pefile-2021.5.13-1.{fc31,el8}.noarch.rpm and python{2,36}-pefile-2021.5.13-1.el7.noarch.rpm - PEFile is a Portable Executable reader module.
python{2,3}-future-0.18.2-2.1.{fc31,el8}.noarch.rpm - Python-Future is the missing compatibility layer between Python 2 and Python 3. It allows you to use a single, clean Python 3.x-compatible codebase to support both Python 2 and Python 3 with minimal overhead. This package was built to support the packaging of Python-PEFile which in turn is needed to support the packaging of Volatility-community-plugins.
fmem-kernel-modules-fc34-x86_64-1.6-1.4.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.20-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-4.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.20-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.25.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.20-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-25.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.20-200 for FC33

May 13, 2021: The following changes have been made:

python2-six-1.16.0-1.el8.noarch.rpm - Six provides simple utilities for wrapping over differences between Python 2 and Python 3.
python36-xlsxwriter-1.4.3-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
python3-dfdatetime-20210509-1.{fc31,fc32,fc33,fc34,el8}.noarch.rpm and python36-dfdatetime-20210509-1.el7.noarch.rpm - dfDateTime, or Digital Forensics Date and Time, provides date and time objects to preserve accuracy and precision.
python2-yara-4.1.0-3.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts. This package was rebuilt due to the releases of Yara 4.1.0 for CentOS/RHEL 8.
libolecf{,-devel,-python3,-tools}-20210512-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpma and libolecf{,-devel,-python36,-tools}-20210512-1.el7.x86_64.rpm - Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
pfring-7.8.0-3410.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3410.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3160.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc34-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.19-300 for FC34
- 5.11.18-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-3.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.19-300 for FC34
- 5.11.18-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.24.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.19-200 for FC33
- 5.11.18-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-24.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.19-200 for FC33
- 5.11.18-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.45.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.19-100 for FC32
- 5.11.18-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-45.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.19-100 for FC32
- 5.11.18-100 for FC32

May 6, 2021: The following changes have been made:

libfsntfs{,-devel,-python3}-20210503-2.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and libfsntfs{,-devel,-python36}-20210503-2.el7.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
libcreg{,-devel,-python2,-python3,-tools}-20210502-2.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and libcreg{,-devel,-python36,-tools}-20210502-2.el7.x86_64.rpm - Libcreg is a library and tools to access the Windows 9x/Me Registry File (CREG) format. The previous release was buit with the wrong source file.
libmodi{,-devel,-python3,-tools}-20210501-2.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and libmodi{,-devel,-python36,-tools}-20210501-2.el7.x86_64.rpm - Libmodi is a library and tools to access the Mac OS disk image formats. The previous release was buit with the wrong source file.
python3-dfvfs-20210501-2.{fc31,fc32,fc33,fc34,el8}.noarch.rpm and python36-dfvfs-20210501-2.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats. The previous release was buit with the wrong source file.
daq{,-devel,-modules}-3.0.3-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm - The Data Acquisition Library (Daq) is a library used by snort. Note that these packages have been installed in the forensics-test repository.
snort-3.1.4.0-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
libfsext{,-devel,-python3,-tools}-20210504-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20210504-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
libewf-experimental{,-devel,-tools,-python3,-tools}-20210426-1.{fc31,fc32,fc33,fc34,el8}.x86_64.rpm and libewf-experimental{,-devel,-tools,-python36,-tools}-2,fc340201230-1.el7.x86_64.rpm - Libewf supports Expert Witness Compression Format (EWF) formatted files. See this page for the list of supported and unsupported formats.
Libewf-Experimental installs packages in /usr/local so that it can be optionally installed along with the conventional Libewf packages, where package contents are installed in /usr. Further, the Libewf-Experimental packages have been installed in the forensics-test repository. You will need to enable this repository with this command for Fedora or CentOS/RHEL 8:
sudo dnf config-manager --set-enabled forensics-test
or this command for CentOS/RHEL 7:
sudo yum-config-manager --enable forensics-test
python2-yara-4.1.0-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts. This package was rebuilt due to the releases of Yara 4.1.0 for Fedora 34.
fmem-kernel-modules-fc34-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.17-300 for FC34
lime-kernel-modules-fc34-x86_64-1.9.1-2.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.17-300 for FC34
fmem-kernel-modules-fc33-x86_64-1.6-1.23.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.17-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-23.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.17-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.44.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.17-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-44.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.17-100 for FC32

May 2, 2021: The following changes have been made:

libcreg{,-devel,-python2,-python3,-tools}-20210502-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libcreg{,-devel,-python36,-tools}-20210502-1.el7.x86_64.rpm - Libcreg is a library and tools to access the Windows 9x/Me Registry File (CREG) format.
libesedb{,-devel,-python3,-tools}-20210424-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libesedb{,-devel,-python36,-tools}-20210424-1.el7.x86_64.rpm - Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
libevt{,-devel,-python3,-tools}-20210424-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libevt{,-devel,-python36,-tools}-20210424-1.el7.x86_64.rpm - Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
libevtx{,-devel,-python3,-tools}-20210424-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libevtx{,-devel,-python36,-tools}-20210424-1.el7.x86_64.rpm - Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
libfsapfs{,-devel,-python3,-tools}-20210424-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfsapfs{,-devel,-python36,-tools}-20210424-1.el7.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
libfsext{,-devel,-python3,-tools}-20210424-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20210424-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
libfshfs{,-devel,-python3,-tools}-20210424-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfshfs{,-devel,-python36,-tools}-20210424-1.el7.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS). Note that this project currently only focuses on the analysis of the format.
libfsntfs{,-devel,-python3}-20210424-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfsntfs{,-devel,-python36}-20210424-1.el7.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
libfvde{,-devel,-python3,-tools}-20210425-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfvde{,-devel,-python36,-tools}-20210425-1.el7.x86_64.rpm - Libfvde is a library and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
libfwnt{,-devel,-python3,-tools}-20210421-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfwnt{,-devel,-python36,-tools}-20210421-1.el7.x86_64.rpm - LibFWNT is a library for Windows NT data types.
libfwsi{,-devel,-python3}-20210419-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfwsi{,-devel,-python36}-20210419-1.el7.x86_64.rpm - Libfwsi is a library to access the Windows Shell Item format.
liblnk{,-devel,-python3,-tools}-20210417-1.{fc31,fc32,fc33,el8}.x86_64.rpm and liblnk{,-devel,-python36,-tools}-20210417-1.el7.x86_64.rpm - Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
libluksde{,-devel,-python3,-tools}-20210419-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libluksde{,-devel,-python36,-tools}-20210419-1.el7.x86_64.rpm - Libluksde is a library and tools used to access LUKS Disk Encryption encrypted volumes.
libmodi{,-devel,-python3,-tools}-20210501-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libmodi{,-devel,-python36,-tools}-20210501-1.el7.x86_64.rpm - Libmodi is a library and tools to access the Mac OS disk image formats.
libmsiecf{,-devel,-python3,-tools}-20210420-1.{fc31,fc32,fc33,el8}.x86_64.rpm and ibmsiecf{,-devel,-python36,-tools}-20210420-1.el7.x86_64.rpm - Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
libolecf{,-devel,-python3,-tools}-20210419-1.{fc31,fc32,fc33,el8}.x86_64.rpma and libolecf{,-devel,-python36,-tools}-20210419-1.el7.x86_64.rpm - Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
libqcow{,-devel,-python3,-tools}-20210419-1.{fc31,fc32,fc33,el8}.x86_64.rp and libqcow{,-devel,-python36,-tools}-20210419-1.el7.x86_64.rpm - Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
libregf{,-devel,-python3,-tools}-20210419-1.{fc31,fc32,fc33,el8}.x86_64.rp and libregf{,-devel,-python36,-tools}-20210419-1.el7.x86_64.rpm - Libregf contains libraries and tools to access the Windows NT Registry File files.
libscca{,-devel,-python3,-tools}-20210419-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libscca{,-devel,-python36,-tools}-20210419-1.el7.x86_64.rpm - Libscca is a library to access the Windows Prefetch File (SCCA) format.
libsigscan{,-devel,-python3}-20210419-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libsigscan{,-devel,-python36}-20210419-1.el7.x86_64.rpm - Libsigscan is a library and tools used to binary signature scanning.
libsmdev{,-devel,-python3}-20210418-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libsmdev{,-devel,-python36}-20210418-1.el7.x86_64.rpm - Libsmdev is a library and tools used to access storage media devices.
libsmraw{,-devel,-python3,-tools}-20210418-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libsmraw{,-devel,-python36,-tools}-20210418-1.el7.x86_64.rpm - Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
libvhdi{,-devel,-python3,-tools}-20210425-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libvhdi{,-devel,-python36,-tools}-20210425-1.el7.x86_64.rpm - Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
libvmdk{,-devel,-python3,-tools}-20210418-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libvmdk{,-devel,-python36,-tools}-20210418-1.el7.x86_64.rpm - Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
libvshadow{,-devel,-python3,-tools}-20210425-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libvshadow{,-devel,-python36,-tools}-20210425-1.el7.x86_64.rpm - Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
libvslvm{,-devel,-python3,-tools}-20210425-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libvslvm{,-devel,-python36,-tools}-20210425-1.el7.x86_64.rpm - Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
python2-yara-4.1.0-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.
zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-4.0.1-1.1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm, and libbroker-devel-4.0.1-1.1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
xva-img-1.4.2-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - XVA-IMG is a tool for working with Citrix XEN disk images. Citrix Xen uses a custom virtual appliance format for import/export called "XVA". It's basically a strangely crafted tar-file. You don't need this program to unpack this tar-file, just use your favourite tar unpacker (tar, gtar, bsdtar). Once unpacked you will end up with a lot of different files, ova.xml (which contains the settings for the virtual appliance, think VMware vmx) and a number of folders called Ref:/, this is your disks. Each of these folders contain hundreds of files named 00000000, 00000001 with a accompanying .CHECKSUM file (SHA1). Each file is a 1MB slice of the disk, but some of the files in the sequence will probably be missing this is because XVA do not use compression; instead it will exclude slices of the disk that only contains zeros (are empty). This tool can assemble the disk for you (you will end up with a RAW disk) that can easily be mounted and modified. It can then also split the file again and generate checksum. Once ready, you will probably want to use the "package" command to rebuild the XVA file.
python3-dfvfs-20210501-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20210501-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libtommath{,-devel}-1.2.01.2.0--1.el8.x86_64.rpm - LibTOMMath is a free open source portable number theoretic multiple-precision integer library written entirely in C. The library is designed to provide a simple to work with API that provides fairly efficient routines that build out of the box without configuration.
rifiuti2-0.7.0-5.1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - rifiuti2 is a rewrite of rifiuti, a tool for analyzing Windows Recycle Bin INFO2 file. This package was updated to avoid a conflict with the rifiuti package.
pfring-7.8.0-3406.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3406.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3150.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-1.6-1.21.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for the Fedora 34 x86_64 architecture was added.
lime-kernel-modules-1.1.r17-21.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for the Fedora 34 x86_64 architecture was added.
fmem-kernel-modules-fc33-x86_64-1.6-1.22.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.16-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-22.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.16-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.43.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.16-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-43.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.16-100 for FC32
fmem-kernel-modules-el7-x86_64-1.6-1.76.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.25.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-76.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.25.1 for EL7

Fedora 34 - The repository now supports Fedora 34 for the x86_64 CPU architecture. Here is the list of tools provided for Fedora 34:

2hash
acr
analysis-pipeline
analyzeMFT
apfs-fuse
artifacts
ataraw
autopsy
avml
bencode
binplist
bulk_extractor
cert-forensics-tools-release
CERT-Forensics-Tools
crunch
cryptcat
daq
dcp
ddrescueview
ddrutility
dfdatetime
dfvfs
dfwinreg
distorm3
docker-forensics-toolkit
DropboxReader
dtfabric
eindeutig
epub
exfat-utils
fatback
fcrackzip
femto
fmem-kernel-modules
fred
fundl
fuse-python
galleta
ghidra
ghostpdl
grokevt

guymager
hachoir
jafat
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf-experimental
libewf
libexe
libfixbuf
libfplist
libfsapfs
libfsext
libfshfs
libfsntfs
libfsxfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
libipa
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf
libpff
libphdi
libqcow
libregf
libscca

libschemaTools
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvsgpt
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
m2crypto
mac_apt
missidentify
mount_ewf
nDPI
netsa-python
netsa-rayon
packetexaminer
pasco
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
prism
pstotext
ptfinder
ptk
pycoin
pyfixbuf
python-colorama
python-construct
python-coverage
python-crypto
python-enum34
python-nose
python-sqlite3dbm
python-yara
python2-typing
pytsk3

qtmltfs
rar
reglookup
regripper
regripper-plugins
rekall-forensics
rifiuti2
rifiuti
scrounge-ntfs
sfdumper
shellbags
silk-ipa
silk-ipset
silk
sleuthkit
snarf
snort-openappid
snort-sample-rules
snort
stegdetect
super_mediator
tln_tools
umit
unrar
untex
videosnarf
vinetto
vmfs-tools
vmfs6-tools
Volatility
Volatility-community-plugins
Volatility3
Volatility3-linux-symbols
Volatility3-mac-symbols
Volatility3-windows-symbols
winevt-kb
winreg-kb
xplico
xva-img
yaf
zeek

April 23, 2021: The following changes have been made:

python3-pytsk3-20210419-1.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-pytsk3-20210419-1.el7.x86_64.rpm - Pytsk is Python bindings for The Sleuth Kit.
bellsoft-java8-full-1.8.0.292-1+10.x86_64.rpm - Bellsoft Java was installed for Fedora 31, 32, and 33 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
python36-xlsxwriter-1.4.0-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
pfring-7.8.0-3402.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3402.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3137.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.21.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.15-200 for FC33
- 5.11.14-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-21.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.15-200 for FC33
- 5.11.14-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.42.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.15-100 for FC32
- 5.11.14-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-42.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.15-100 for FC32
- 5.11.14-100 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.17.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-301.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-17.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-301.1 for EL8

April 15, 2021: The following changes have been made:

plaso-20210412-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here.
ghidra-9.2.2-PUBLIC_20201229.1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvement here.
python36-xlsxwriter-1.3.9-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
pfring-7.8.0-3398.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3398.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3130.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.20.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.13-200 for FC33
- 5.11.12-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-20.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.13-200 for FC33
- 5.11.12-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.41.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.13-100 for FC32
- 5.11.12-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-41.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.13-100 for FC32
- 5.11.12-100 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.16.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-240.22.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-16.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-240.22.1 for EL8
fmem-kernel-modules-el7-x86_64-1.6-1.75.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.24.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-75.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.24.1 for EL7

April 9, 2021: The following changes have been made:

libfsxfs{,-devel,-python3,-tools}-20210403-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfsxfs{,-devel,-python36,-tools}-20210403-1.el7.x86_64.rpm - Libfsxfs contains library and tools to access the SGI X File System (XFS).
python3-artifacts-20210404-1.{fc31,fc32,fc33,el8}.x86_64.rpm, python36-artifacts-20210404-1.el7.x86_64.rpm, and artifacts-data-20210404-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.

April 2, 2021: The following changes have been made:

python3-pytsk3-20210327-1.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-pytsk3-20210327-1.el7.x86_64.rpm - Pytsk is Python bindings for The Sleuth Kit.
libbde{,-devel,-python3,-tools}-20210327-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libbde{,-devel,-python36,-tools}-20210327-1.el7.x86_64.rpm - Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
snort-2.9.17.1-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
This release contains these two additional symbolic links that are intended to simplify writing Snort configuration rules in that they are no longer required to contain the Snort version in the path name. These symbolic links are:
1. /usr/lib64/snort_dynamicengine → snort-2.9.17.0_dynamicengine
2. /usr/lib64/snort_dynamicpreprocessor → snort-2.9.17.0_dynamicpreprocessor
Furthermore, the Snort configuration file - /etc/snort/snort.conf - references these version-agnostic path names.
snort-sample-rules-2.9.17.1-1.{fc31,fc32,fc33,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.17.1-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
This release contains these two additional symbolic links that are intended to simplify writing Snort configuration rules in that they are no longer required to contain the Snort version in the path name. These symbolic links are:
1. /usr/lib64/snort_dynamicengine → snort-2.9.17.0_dynamicengine
2. /usr/lib64/snort_dynamicpreprocessor → snort-2.9.17.0_dynamicpreprocessor
Furthermore, the Snort configuration file - /etc/snort/snort.conf - references these version-agnostic path names.
python36-xlsxwriter-1.3.8-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format. XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
pfring-7.8.0-3396.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3396.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3123.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.19.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.11-200 for FC33
- 5.11.10-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-19.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.11-200 for FC33
- 5.11.10-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.40.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.11-100 for FC32
- 5.11.10-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-40.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.11-100 for FC32
- 5.11.10-100 for FC32

March 26, 2021: The following changes have been made:

sleuthkit{,-devel,-libs}-4.10.2-1.1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
autopsy-4.18.0-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:
1. This version uses Java 8 from Bellsoft.
2. This version was tested on Fedora 27 through 32 and CentOS 7 and 8 for the x86_64 architectures using an E01 dataset that contains a 7-Zip file that contains two JPEG images, one of which has EXIF metadata. Those archives were correctly parsed and the EXIF data verified.
3. If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
  [ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
  sudo systemctl start xrdp
pfring-7.8.0-3394.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3394.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3115.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.18.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.9-200 for FC33
- 5.11.8-200 for FC33
- 5.11.7-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-18.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.9-200 for FC33
- 5.11.8-200 for FC33
- 5.11.7-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.39.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.11.7-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-39.noarch.rpm - Support for the following kernels were added for LiME:
- 5.11.7-100 for FC32

March 19, 2021: The following changes have been made:

fmem-kernel-modules-fc33-x86_64-1.6-1.17.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.23-200 for FC33
- 5.10.22-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-17.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.23-200 for FC33
- 5.10.22-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.38.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.22-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-38.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.22-100 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.15.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-294 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-15.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-294 for EL8
fmem-kernel-modules-el7-x86_64-1.6-1.74.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.21.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-74.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.21.1 for EL7

March 12, 2021: The following changes have been made:

Volatility3-1.0.1-2.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is the version of Volatility 3 which can be found here. Release 2 is patched as of 2021-03-10.
plaso-20210213-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here.
pfring-7.8.0-3385.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3385.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3094.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.16.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.21-200 for FC33
- 5.10.20-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-16.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.21-200 for FC33
- 5.10.20-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.37.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.21-100 for FC32
- 5.10.20-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-37.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.21-100 for FC32
- 5.10.20-100 for FC32

March 5, 2021: The following changes have been made:

python2-yara-4.0.5-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.
pfring-7.8.0-3382.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3382.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3084.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.15.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.19-200 for FC33
- 5.10.18-200 for FC33
- 5.10.17-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-15.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.19-200 for FC33
- 5.10.18-200 for FC33
- 5.10.17-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.36.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.19-100 for FC32
- 5.10.18-100 for FC32
- 5.10.17-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-36.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.19-100 for FC32
- 5.10.18-100 for FC32
- 5.10.17-100 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.14.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-240.15.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-14.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-240.15.1 for EL8

February 19, 2021: The following changes have been made:

python3-dfvfs-20210213-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20210213-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python3-elasticsearch-7.11.0-1.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-elasticsearch-7.11.0-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable. Note: This version has been removed from the repository due to incompatibilities with plaso.
python3-elasticsearch-7.9.1-1.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-elasticsearch-7.9.1-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
Note: You will need to downgrade to this version of elasticsearch with the following on Fedora and CentOS/RHEL 8:
sudo dnf downgrade python3-elasticsearch -y
And this on CentOS/RHEL 7:
sudo yum downgrade python36-elasticsearch -y
plaso-20201228-2.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here. This version removes a patch that intended to make plaso work with ElasticSearch version 7.10 and newer.
zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-3.0.12-0.{fc31,fc32,fc33,el7,el8}.x86_64.rpm, and libbroker-devel-3.0.12-0.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
pfring-7.8.0-3371.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3371.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3047.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.14.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.16-200 for FC33
- 5.10.15-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-14.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.16-200 for FC33
- 5.10.15-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.35.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.16-100 for FC32
- 5.10.15-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-35.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.16-100 for FC32
- 5.10.15-100 for FC32

February 12, 2021: The following changes have been made:

python3-dfvfs-20210207-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20210207-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python3-elasticsearch-7.11.0-1.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-elasticsearch-7.11.0-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
Volatility3-1.0.1-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is the version of Volatility 3 which can be found here.
Due to the way in which the previous packages were named, you will need to remove the older version and install this version by hand with the following on Fedora and CentOS/RHEL 8:
sudo rpm -e Volatility3 --nodeps; sudo dnf install -y --refresh Volatility3
And this on CentOS/RHEL 7:
sudo rpm -e Volatility3 --nodeps; sudo yum -y install Volatility3
libvsgpt{,-devel,-python3,-tools}-20210207.{fc31,fc32,fc33,el8}.x86_64.rpm and libfsgpt{,-devel,-python36,-tools}-20210207.el7.x86_64.rpm - Libvsgpt is a library and tools used to access the GUID Partition Table (GPT) volume system.
plaso-20201228-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here.
pfring-7.8.0-3361.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3361.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3044.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.14-200 for FC33
- 5.10.13-200 for FC33
- 5.10.12-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.14-200 for FC33
- 5.10.13-200 for FC33
- 5.10.12-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.34.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.13-100 for FC32
- 5.10.12-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-34.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.13-100 for FC32
- 5.10.12-100 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-277 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-13.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-277 for EL8

February 4, 2021: The following changes have been made:

python3-dfvfs-20210125-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20210125-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libfsext{,-devel,-python3,-tools}-20210129-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libfsext{,-devel,-python36,-tools}-20210129-1.el7.x86_64.rpm - Libfsext is a library and tools to access the Extended File System (EXT).
pfring-7.8.0-3356.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3356.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2999.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.11-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-12.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.11-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.33.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.11-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-33.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.11-100 for FC32
fmem-kernel-modules-el7-x86_64-1.6-1.73.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.15.2 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-73.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.15.2 for EL7

January 29, 2021: The following changes have been made:

Volatility3-2.0.0-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is the version of Volatility 3 which can be found here. It is taken from the source code available as of 2021-01-27.
Due to the way in which the previous packages were named, you will need to remove the older version and install this version by hand with the following on Fedora and CentOS/RHEL 8:
sudo rpm -e Volatility3 --nodeps; sudo dnf install -y --refresh Volatility3
And this on CentOS/RHEL 7:
sudo rpm -e Volatility3 --nodeps; sudo yum -y install Volatility3
python2-yara-4.0.4-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.
fmem-kernel-modules-fc33-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.10-200 for FC33
- 5.10.9-201 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-11.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.10-200 for FC33
- 5.10.9-201 for FC33

January 22, 2021: The following changes have been made:

python36-lz4-3.1.3-1.el7.x86_64.rpm - LZ4 contains the python bindings for the lz4 compression library.
bellsoft-java8-full-1.8.0.282-1+8.x86_64.rpm - Bellsoft Java was installed for Fedora 31, 32, and 33 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
libvsgpt{,-devel,-python3,-tools}-20210118.{fc31,fc32,fc33,el8}.x86_64.rpm and libfsgpt{,-devel,-python36,-tools}-20210118.el7.x86_64.rpm - Libvsgpt is a library and tools used to access the GUID Partition Table (GPT) volume system.
python3-dfvfs-20210120-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20210120-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
daq{,-devel,-modules}-3.0.0-1.{fc31,fc32,fc33,el8}.x86_64.rpm - The Data Acquisition Library (Daq) is a library used by snort. Note that these packages have been installed in the forensics-test repository.
snort-3.1.0.0-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the announcement. Note that these packages have been installed in the forensics-test repository.
pfring-7.8.0-3343.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3343.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2996.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-common-1.9.1-7.noarch.rpm - LiME is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. This package contains only the source code for making the LiME kernel modules, the CaptureMemoryWithLime script and the corresponding manual page. The changes are the following:
- Updated to include a fix for kernels 5.10 and beyond
Note: the version number has changed to correspond with the version on the LiME website.
fmem-kernel-modules-fc33-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.8-200 for FC33
- 5.10.7-200 for FC33
- 5.10.6-200 for FC33
lime-kernel-modules-fc33-x86_64-1.9.1-10.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.8-200 for FC33
- 5.10.7-200 for FC33
- 5.10.6-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.32.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.10.8-100 for FC32
- 5.10.7-100 for FC32
lime-kernel-modules-fc32-x86_64-1.9.1-32.noarch.rpm - Support for the following kernels were added for LiME:
- 5.10.8-100 for FC32
- 5.10.7-100 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-240.10.1 for EL8
lime-kernel-modules-el8-x86_64-1.9.1-12.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-240.10.1 for EL8

January 7, 2021: The following changes have been made:

libewf-experimental{,-devel,-tools,-python3,-tools}-20201230-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libewf-experimental{,-devel,-tools,-python36,-tools}-20201230-1.el7.x86_64.rpm - Libewf supports Expert Witness Compression Format (EWF) formatted files. See this page for the list of supported and unsupported formats.
Libewf-Experimental installs packages in /usr/local so that it can be optionally installed along with the conventional Libewf packages, where package contents are installed in /usr. Further, the Libewf-Experimental packages have been installed in the forensics-test repository. You will need to enable this repository with this command for Fedora or CentOS/RHEL 8:
sudo dnf config-manager --set-enabled forensics-test
or this command for CentOS/RHEL 7:
sudo yum-config-manager --enable forensics-test
python3-idna-3.1-1.el8.noarch.rpm and python36-idna-3.1-1.el7.noarch.rpm - IDNA provides support for the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891. This is the latest version of the protocol and is sometimes referred to as "IDNA 2008".
libfixbuf{,-devel,-ipfixDump}-2.4.1-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Libfixbuf is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101). See here for the list of changes.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.1-3.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. This package was rebuilt to use libfixbuf 2.4.1.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.1-4.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - This release of the SiLK tools can be found in an optional repository that is now part of cert-forensics-tools-release named forensics-sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo. This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root. This package was rebuilt to use libfixbuf 2.4.1.
libschemaTools{,-devel}-1.3-7.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - libschemaTools is a library that provides a standard representation of data records. It is built on fixbuf, using IPFIX information elements. It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source. SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records. This package was rebuilt to use libfixbuf 2.4.1.
python3-pyfixbuf-0.8.1-2.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-pyfixbuf-0.8.1-2.el7.x86_64.rpm - Pyfixbuf is a Python API for libfixbuf, an implementation of the IPFIX protocol used for building, collecting, and exporting processes. Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX. Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.). This package was rebuilt to use libfixbuf 2.4.1. Note also that the Python 2 version is no longer provided.
analysis-pipeline-5.11.3-5.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM). This package was rebuilt to use libfixbuf 2.4.1.
super_mediator-1.8.0-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Super_mediator is an IPFIX mediator for use with the YAF and SiLK tools. It collects and filters YAF output data to various IPFIX collecting processes and/or csv files. See here for the list of changes.
yaf{,-devel}-2.12.1-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. Note that for CentOS 6 and 7 for the x86_64 architecture, yaf has been built to use PF_Ring. See here for the list of changes.
mac-robber-1.02-1.el8.x86_64.rpm - Mac-robber is a digital investigation tool that collects data from allocated files in a mounted file system. Removed: Provided by CentOS/RHEL.
python3-redis-3.5-1.el8.noarch.rpm - Redis is a Python interface to the Redis key-value store. Removed: Provided by CentOS/RHEL.
pfring-7.8.0-3323.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3323.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2968.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.16-200 for FC33
lime-kernel-modules-fc33-x86_64-1.1.r17-9.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.16-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.31.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.16-100 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-31.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.16-100 for FC32

December 23, 2020: The following changes have been made:

python3-dfvfs-20201219-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20201219-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
pfring-7.8.0-3320.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3320.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2958.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.15-200 for FC33
lime-kernel-modules-fc33-x86_64-1.1.r17-8.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.15-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.30.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.15-100 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-30.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.15-100 for FC32
fmem-kernel-modules-el7-x86_64-1.6-1.72.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.11.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-72.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.11.1 for EL7

December 18, 2020: The following changes have been made:

libewf-experimental{,-devel,-tools,-python3,-tools}-20201210-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libewf-experimental{,-devel,-tools,-python36,-tools}-20201210-1.el7.x86_64.rpm - Libewf supports Expert Witness Compression Format (EWF) formatted files. See this page for the list of supported and unsupported formats.
Libewf-Experimental installs packages in /usr/local so that it can be optionally installed along with the conventional Libewf packages, where package contents are installed in /usr. Further, the Libewf-Experimental packages have been installed in the forensics-test repository. You will need to enable this repository with this command for Fedora or CentOS/RHEL 8:
sudo dnf config-manager --set-enabled forensics-test
or this command for CentOS/RHEL 7:
sudo yum-config-manager --enable forensics-test
python36-chardet-4.0.0-1.el7.x86_64.rpm - Chardet is a universal character encoding detector.
ghidra-9.2-PUBLIC_20201113.1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvement here.
Volatility3-2.0.0.b1-20201216.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is a beta version of Volatility 3 which can be found here. It is patched to 2020-12-16.
python36-requests-2.25.1-1.el7.x86_64.rpm - Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings. Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web. It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
python3-cryptography-3.3-1.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-cryptography-3.1-1.el7.x86_64.rpm Cryptography is a package which provides cryptographic recipes and primitives to Python developers. Note: This package is being withdrawn from the repository. It needs to be removed and the vendor-provided version installed in its place.
For Fedora and CentOS/RHEL 8, do the following:
sudo rpm -ev python3-cryptography --nodeps; sudo dnf install python3-cryptography -y --refresh
For CentOS/RHEL 7, do the following:
sudo rpm -ev python36-cryptography --nodeps; sudo yum clean all; sudo yum install python36-cryptography -y
We regret this inconvenience.
snort-2.9.17.0-2.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
This release contains these two additional symbolic links that are intended to simplify writing Snort configuration rules in that they are no longer required to contain the Snort version in the path name. These symbolic links are:
1. /usr/lib64/snort_dynamicengine → snort-2.9.17.0_dynamicengine
2. /usr/lib64/snort_dynamicpreprocessor → snort-2.9.17.0_dynamicpreprocessor
Furthermore, the Snort configuration file - /etc/snort/snort.conf - references these version-agnostic path names.
snort-sample-rules-2.9.17.0-2.{fc31,fc32,fc33,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.17.0-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm and snort-openappid-2.9.1.17-1.el6.{i686,x86_64}.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 7 and 8 for the x86_64 architecture.
This release contains these two additional symbolic links that are intended to simplify writing Snort configuration rules in that they are no longer required to contain the Snort version in the path name. These symbolic links are:
1. /usr/lib64/snort_dynamicengine → snort-2.9.17.0_dynamicengine
2. /usr/lib64/snort_dynamicpreprocessor → snort-2.9.17.0_dynamicpreprocessor
Furthermore, the Snort configuration file - /etc/snort/snort.conf - references these version-agnostic path names.
pfring-7.8.0-3307.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3307.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2954.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.14-200 for FC33
- 5.9.13-200 for FC33
lime-kernel-modules-fc33-x86_64-1.1.r17-7.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.14-200 for FC33
- 5.9.13-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.29.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.14-100 for FC32
- 5.9.13-100 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-29.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.14-100 for FC32
- 5.9.13-100 for FC32

December 10, 2020: The following changes have been made:

python3-certifi-2020.12.5-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-certifi-2020.12.5-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Note: The Python 2 package is no longer provided.
libbde{,-devel,-python36,-tools}-20200724-2.el7.x86_64.rpm and libbde{,-devel,-python3,-tools}-20200724-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format. Note: The Python 2 package is no longer provided.
libesedb{,-devel,-python36,-tools}-20200418-2.el7.x86_64.rpm and libesedb{,-devel,-python3,-tools}-20200418-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format. Note: The Python 2 package is no longer provided.
libevt{,-devel,-python36,-tools}-20200926-2.el7.x86_64.rpm and libevt{,-devel,-python3,-tools}-20200926-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libevt contains libraries and tools to access the Windows Event Log (EVT) format files. Note: The Python 2 package is no longer provided.
libevtx{,-devel,-python36,-tools}-20200709-2.el7.x86_64.rpm and libevtx{,-devel,-python3,-tools}-20200709-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files. Note: The Python 2 package is no longer provided.
libexe{,-devel,-python36,-tools}-20191221-2.el7.x86_64.rpm and libexe{,-devel,-python3,-tools}-20191221-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libexe is a library and tools to access the executable (EXE) format. Note: The Python 2 package is no longer provided.
libfsapfs{,-devel,-python36,-tools}-20201107-2.el7.x86_64.rpm and libfsapfs{,-devel,-python3,-tools}-20201107-2.{fc31,fc32,fc33,el8}.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS). Note: The Python 2 package is no longer provided.
libfshfs{,-devel,-python36,-tools}-20201104-2.el7.x86_64.rpm and libfshfs{,-devel,-python3,-tools}-20201104-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libfshfs is a library and tools to access the Hierarchical File System (HFS). Note that this project currently only focuses on the analysis of the format. Note: The Python 2 package is no longer provided.
libfvde{,-devel,-python36,-tools}-20191221-2.el7.x86_64.rpm and libfvde{,-devel,-python3,-tools}-20191221-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libfvde is a library and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume. Note: The Python 2 package is no longer provided.
libfwnt{,-devel,-python36,-tools}-20200723-2.el7.x86_64.rpm and libfwnt{,-devel,-python3,-tools}-20200723-2.{fc31,fc32,fc33,el8}.x86_64.rpm - LibFWNT is a library for Windows NT data types. Note: The Python 2 package is no longer provided.
libfwps{,-devel,-python36,-tools}-20191221-2.el7.x86_64.rpm and libfwps{,-devel,-python3,-tools}-20191221-2.{fc31,fc32,fc33,el8}.x86_64.rpm - LibFWPS is a library for Windows Property Store data types. Note: The Python 2 package is no longer provided.
liblnk{,-devel,-python36,-tools}-20200810-2.el7.x86_64.rpm and liblnk{,-devel,-python3,-tools}-20200810-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file. Note: The Python 2 package is no longer provided.
libmodi{,-devel,-python36,-tools}-20201019-2.el7.x86_64.rpm and libmodi{,-devel,-python3,-tools}-20201019-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libmodi is a library and tools to access the Mac OS disk image formats. Note that this project currently only focuses on the analysis of the format. Note: The Python 2 package is no longer provided.
libmsiecf{,-devel,-python36,-tools}-20200710-2.el7.x86_64.rpm and libmsiecf{,-devel,-python3,-tools}-20200710-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files. Note: The Python 2 package is no longer provided.
libnk2{,-devel,-python36,-tools}-20181101-3.el7.x86_64.rpm and libnk2{,-devel,-python3,-tools}-20181101-3.{fc31,fc32,fc33,el8}.x86_64.rpm - Libnk2 is a library and tools to access Microsoft Outlook Nickfile (NK2) format files. Note: The Python 2 package is no longer provided.
libolecf{,-devel,-python36,-tools}-20201004-2.el7.x86_64.rpm and libolecf{,-devel,-python3,-tools}-20201004-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed. Note: The Python 2 package is no longer provided.
libpff{,-devel,-python36,-tools}-20180714-5.el7.x86_64.rpm and libpff{,-devel,-python3,-tools}-20180714-5.{fc31,fc32,fc33,el8}.x86_64.rpm - Libpff is a library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided. Note: The Python 2 package is no longer provided.
libphdi{,-devel,-python36,-tools}-20201003-2.el7.x86_64.rpm and libphdi{,-devel,-python3,-tools}-20201003-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libphdi is a library to access the Parallels Hard Disk image format. Note: The Python 2 package is no longer provided.
libqcow{,-devel,-python36,-tools}-20200928-2.el7.x86_64.rpm and libqcow{,-devel,-python3,-tools}-20200928-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format. Note: The Python 2 package is no longer provided.
libregf{,-devel,-python36,-tools}-20201007-2.el7.x86_64.rpm and libregf{,-devel,-python3,-tools}-20201007-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libregf contains libraries and tools to access the Windows NT Registry File files. Note: The Python 2 package is no longer provided.
libscca{,-devel,-python36,-tools}-20200717-2.el7.x86_64.rpm and libscca{,-devel,-python3,-tools}-20200717-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libscca is a library to access the Windows Prefetch File (SCCA) format. Note: The Python 2 package is no longer provided.
libsmraw{,-devel,-python36,-tools}-20191221-2.el7.x86_64.rpm and libsmraw{,-devel,-python3,-tools}-20191221-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies. Note: The Python 2 package is no longer provided.
libvhdi{,-devel,-python36,-tools}-20201204-1.el7.x86_64.rpm and libvhdi{,-devel,-python3,-tools}-20201204-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format. Note: The Python 2 package is no longer provided.
libvmdk{,-devel,-python36,-tools}-20200926-2.el7.x86_64.rpm and libvmdk{,-devel,-python3,-tools}-20200926-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format. Note: The Python 2 package is no longer provided.
libvshadow{,-devel,-python36,-tools}-20191221-2.el7.x86_64.rpm and libvshadow{,-devel,-python3,-tools}-20191221-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format. Note: The Python 2 package is no longer provided.
libvslvm{,-devel,-python36,-tools}-20200817-2.el7.x86_64.rpm and libvslvm{,-devel,-python3,-tools}-20200817-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format. Note: The Python 2 package is no longer provided.
libvsmbr{,-devel,-python36,-tools}-20200818-2.el7.x86_64.rpm and libvsmbr{,-devel,-python3,-tools}-20200818-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libvsmbr is a library and tools to access the Master Boot Record (MBR) volume system. Note: The Python 2 package is no longer provided.
libwrc{,-devel,-python36,-tools}-20191221-2.el7.x86_64.rpm and libwrc{,-devel,-python3,-tools}-20191221-2.{fc31,fc32,fc33,el8}.x86_64.rpm - Libwrc is a library and tools to access the Windows Resource Compiler (WRC) format. Note: The Python 2 package is no longer provided.
Volatility3-2.0.0.b1-3.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is a beta version of Volatility 3 which can be found here. It is patched to 2020-12-07.
python3-cryptography-3.3-1.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-cryptography-3.1-1.el7.x86_64.rpm Cryptography is a package which provides cryptographic recipes and primitives to Python developers. Note that for CentOS/RHEL 7, the version remains at 3.1.
python3-elasticsearch-7.10.1-1.{fc31,fc32,fc33,el8}.x86_64.rpm and python36-elasticsearch-7.10.1-1.el7.x86_64.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
pfring-7.8.0-3294.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3294.{el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2941.{el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.12-200 for FC33
lime-kernel-modules-fc33-x86_64-1.1.r17-6.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.12-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.28.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.12-100 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-28.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.12-100 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-240.1.1 for EL8
- 4.18.0-240 for EL8
lime-kernel-modules-el8-x86_64-1.1.r17-11.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-240.1.1 for EL8
- 4.18.0-240 for EL8

December 4, 2020: The following changes have been made:

libewf-experimental{,-devel,-tools,-python3,-tools}-20201129-1.{fc31,fc32,fc33,el8}.x86_64.rpm and libewf-experimental{,-devel,-tools,-python36,-tools}-20201129-1.el7.x86_64.rpm - Libewf supports Expert Witness Compression Format (EWF) formatted files. See this page for the list of supported and unsupported formats.

Libewf-Experimental installs packages in /usr/local so that it can be optionally installed along with the conventional Libewf packages, where package contents are installed in /usr. Further, the Libewf-Experimental packages have been installed in the forensics-test repository. You will need to enable this repository with this command for Fedora or CentOS/RHEL 8:

sudo dnf config-manager --set-enabled forensics-test

or this command for CentOS/RHEL 7:

sudo yum-config-manager --enable forensics-test

musl-{clang,devel,filesystem,gcc,libc,libc-static}-1.2.1-1.{el7,el8}.x86_64.rpm - MUSL is a fully featured lightweight standard C library for Linux. This package was built to support AVML.

avml-0.2.1-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed. AVML can produce a memory image suitable for processing with Volatility 2 or Volatility 3 once the appropriate profiles have been created.

CERT-Forensics-Tools-1.0-93.el6.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-93.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - This relese does the following:

Added AVML for Fedora 31 and beyond and CentOS/RHEL 7 and beyond.

python3-dfvfs-20201202-1.{fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20201202-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.

sleuthkit{,-devel,-libs}-4.10.1-1.3.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data. This release attempts to correct an issue with the Sleuth Kit was build with the incorrect version of the Java Development packages. Note that release 1.3 copies the /usr/share/java/sleuthkit-4.10.1.jar file to the correct place for Autopsy as found in LiFTeR which is /usr/autopsy/autopsy/modules/ext/sleuthkit-4.10.1.jar If your version of Autopsy is installed in a different place, you will need to copy /usr/share/java/sleuthkit-4.10.1.jar to that place manually.

autopsy-4.17.0-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:

This version uses Java 8 from Bellsoft.
This version was tested on Fedora 27 through 32 and CentOS 7 and 8 for the x86_64 architectures using an E01 dataset that contains a 7-Zip file that contains two JPEG images, one of which has EXIF metadata. Those archives were correctly parsed and the EXIF data verified.
If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
[ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
sudo systemctl start xrdp

libfwsi{,-devel,-python36}-20201204-1.el7.x86_64.rpm and libfwsi{,-devel,-python3}-20201204-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Libfwsi is a library to access the Windows Shell Item format.

libsmdev{,-devel,-python36}-20201204-1.el7.x86_64.rpm and libsmdev{,-devel,-python3}-20201204-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Libsmdev is a library and tools used to access storage media devices.

pfring-7.8.0-3285.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.

pfring-dkms-7.8.0-3285.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.

ndpi-3.4.0-2937.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.

fmem-kernel-modules-fc33-x86_64-1.6-1.5.noarch.rpm - Support for the following kernels were added for Fmem:

5.9.11-200 for FC33
5.9.10-200 for FC33

lime-kernel-modules-fc33-x86_64-1.1.r17-5.noarch.rpm - Support for the following kernels were added for LiME:

5.9.11-200 for FC33
5.9.10-200 for FC33

fmem-kernel-modules-fc32-x86_64-1.6-1.27.noarch.rpm - Support for the following kernels were added for Fmem:

5.9.11-100 for FC32
5.9.10-100 for FC32

lime-kernel-modules-fc32-x86_64-1.1.r17-27.noarch.rpm - Support for the following kernels were added for LiME:

5.9.11-100 for FC32
5.9.10-100 for FC32

CentOS 6 - Updates to CentOS 6 for both the i686 and x86_64 CPU architectures have ceased.

November 25, 2020: The following changes have been made:

snort-2.9.17.0-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm and snort-2.9.17.0-1.el6.{i686,x86_64}.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture.
snort-sample-rules-2.9.17.0-1.{fc31,fc32,fc33,el6,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.17-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm and snort-openappid-2.9.1.17-1.el6.{i686,x86_64}.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture.
yaf{,-devel}-2.11.2-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm and yaf{,-devel}-2.11.2-1.el6.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or
Volatility3-2.0.0.b1-2.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is a beta version of Volatility 3 which can be found here. It is patched to 2020-11-23.
libewf-experimental{,-devel,-tools,-python3,-tools}-20201123-1.{fc31,fc32,fc33,el8}.x86_64.rpm, libewf-experimental{,-devel,-tools,-python36,-tools}-20201123-1.el7.x86_64.rpm, and libewf-experimental{,-devel,-tools,-python2,-tools}-20201123-1.el6.{i686,x86_64}.rpm - Libewf supports Expert Witness Compression Format (EWF) formatted files. See this page for the list of supported and unsupported formats.
Libewf-Experimental installs packages in /usr/local so that it can be optionally installed along with the conventional Libewf packages, where package contents are installed in /usr. Further, the Libewf-Experimental packages have been installed in the forensics-test repository. You will need to enable this repository with this command for Fedora or CentOS/RHEL 8:
sudo dnf config-manager --set-enabled forensics-test
or this command for CentOS/RHEL 7:
sudo yum-config-manager --enable forensics-test
sleuthkit{,-devel,-libs}-4.10.1-1.1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
apfs-fuse-20200928-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - APFS-Fuse is a read-only FUSE driver for the new Apple File System. Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental. It may not be able to read all files, it may return wrong data, or it may simply crash. Use at your own risk. But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far). Thus, the driver may return compressed files instead of uncompressed ones.
python2-distorm3-3.5.0-1.el6.{i386,x86_64}.rpm, python{2,36}-distorm3-3.5.0-1.el7.x86_64.rpm, and python{2,3}-distorm3-3.5.0-1.(fc31,fc32,fc33,el8}.x86_64.rpm - Distorm3 is a lightweight, easy-to-use and fast decomposer library. It disassembles instructions in 16, 32 and 64 bit modes. Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX. Distorm3 is used by The Volatility Framework.
libodraw{,-devel,-tools}-20201003-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Libodraw is a library to access to optical disc (split) RAW image files (bin/cue, iso/cue).
zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-3.0.11-0.{fc31,fc32,fc33,el7,el8}.x86_64.rpm, and libbroker-devel-3.0.11-0.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
pfring-7.8.0-3283.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3283.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2929.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.4.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.9-200 for FC33
lime-kernel-modules-fc33-x86_64-1.1.r17-4.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.9-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.26.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.9-100 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-26.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.9-100 for FC32

November 22, 2020: The following changes have been made:

python3-dfvfs-20201118-1.{fc27,fc28,fc29,fc30,fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20201118-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libfsntfs{,-devel,-python3}-20201115-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20201115-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20201115-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20201115-1.{fc31,fc32,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
libfsxfs{,-devel,-python3,-tools}-20201114-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsxfs{,-devel,-python2,-tools}-20201114-1.el6.{i686,x86_64}.rpm, libfsxfs{,-devel,-python36,-tools}-20201114-1.el7.x86_64.rpm, and libfsxfs{,-devel,-python3,-tools}-20201114-1.{fc31,fc32,el8}.x86_64.rpm - Libfsxfs contains library and tools to access the SGI X File System (XFS).
libsigscan{,-devel,-python3}-20201117-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsigscan{,-devel,-python2}-20201117-1.el6.{i686,x86_64}.rpm, libsigscan{,-devel,-python36}-20201117-1.el7.x86_64.rpm, and libsigscan{,-devel,-python3}-20201117-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Libsigscan is a library and tools used to binary signature scanning.
python36-lz4-3.1.1-1.el7.x86_64.rpm - LZ4 contains the python bindings for the lz4 compression library.
pfring-7.8.0-3278.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3278.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2923.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc33-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.8-200 for FC33
lime-kernel-modules-fc33-x86_64-1.1.r17-3.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.8-200 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.25.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.9.8-100 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-25.noarch.rpm - Support for the following kernels were added for LiME:
- 5.9.8-100 for FC32
fmem-kernel-modules-el7-x86_64-1.6-1.71.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.6.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-71.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.6.1 for EL7
Fedora 30 - Updates to Fedora 30 for both the i686 and x86_64 CPU architectures has ceased.
Fedora 29 - Updates to Fedora 29 for both the i686 and x86_64 CPU architectures has ceased.
Fedora 28 - Updates to Fedora 28 for both the i686 and x86_64 CPU architectures has ceased.
Fedora 27 - Updates to Fedora 27 for both the i686 and x86_64 CPU architectures has ceased.

November 13, 2020: The following changes have been made:

libfsapfs{,-devel,-python2,-python3}-20201107-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsapfs{,-devel,-python2}-20201107-1.el6.{i686,x86_64}.rpm, libfsapfs{,-devel,-python2,-python36}-20201107-1.el7.x86_64.rpm, and libfsapfs{,-devel,-python2,-python3}-20201107-1.{fc31,fc32,fc33,el8}.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
python3-dfvfs-20201107-1.{fc27,fc28,fc29,fc30,fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20201107-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python{2,3}-certifi-2020.11.8-1.{fc27,fc28,fc29,fc30,fc31,fc32,fc33,el8}.noarch.rpm and python{2,36}-certifi-2020.11.8-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
python36-requests-2.25.0-1.el7.x86_64.rpm - Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings. Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web. It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
pfring-7.8.0-3272.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3272.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-2911.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-el7-x86_64-1.6-1.70.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1160.2.2 for EL7
- 3.10.0-1160.2.1 for EL7
- 3.10.0-1160 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-70.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1160.2.2 for EL7
- 3.10.0-1160.2.1 for EL7
- 3.10.0-1160 for EL7
fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.69.noarch.rpm - Support for the following kernels were added for Fmem:
- 2.6.32-754.35.1 for EL6
lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-69.noarch.rpm - Support for the following kernels were added for LiME:
- 2.6.32-754.35.1 for EL6

November 6, 2020: The following changes have been made:

Volatility3-2.0.0.b1-1.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Volatility 3 is a completely open collection of tools, implemented in Python under the Volatility Software License, for the extraction of digital artifacts from volatile memory (RAM) samples. This release is a beta version of Volatility 3 which can be found here.
Volatility3-{windows,linux,mac}-symbols-20191016-1.noarch.rpm - These three packages are the kernel symbol table files needed by Volatility 3 to correctly interpret inforamtion in various Windows, Linux, and MacOS kernels.
CERT-Forensics-Tools-1.0-92.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-92.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - This relese does the following:
- Added Volatility3 and the Volatility 3 symbol table packages for Fedora 31 and beyond and CentOS/RHEL 7 and beyond.
libfshfs{,-devel,-python2,-python3,-tools}-20201104-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfshfs{,-devel,-python2,-tools}-20201104-1.el6.{i686,x86_64}.rpm, libfshfs{,-devel,-python2,-python36,-tools}-20201104-3.el7.x86_64.rpm, and libfshfs{,-devel,-python2,-python3,-tools}-20201104-3.{fc31,fc32,fc33,el8}.x86_64.rpm - Libfshfs is a lbrary and tools to access the Hierarchical File System (HFS). Note that this project currently only focuses on the analysis of the format.
python3-dfvfs-20201105-1.{fc27,fc28,fc29,fc30,fc31,fc32,fc33,el8}.noarch.rpm and python36-dfvfs-20201105-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
pfring-7.8.0-3267.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.8.
pfring-dkms-7.8.0-3267.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.4.0-3267.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
yaf{,-devel}-2.11.0-5.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and yaf{,-devel}-2.11.0-5.{fc31,fc32,fc33,el7,el8}.x86_64.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering. Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system. This release has been updated to support PF_Ring Version 7.8.
bellsoft-java8-full-1.8.0.275-1+1.{i586,x86_64}.rpm - Bellsoft Java was installed for Fedora 27 through 32 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
python3-artifacts-20201106-1.{fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm, artifacts-data-20201106-1.{fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm, python36-artifacts-20201106-1.el7.x86_64.rpm, artifacts-data-20201106-1.el7.x86_64.rpm - python3-artifacts-20201106-1.{fc31,fc32,fc33,el8}.x86_64.rpm, artifacts-data-20201106-1.{fc31,fc32,fc33,el8}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.
fmem-kernel-modules-fc33-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.18-300 for FC33
- 5.8.17-300 for FC33
lime-kernel-modules-fc33-x86_64-1.1.r17-2.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.18-300 for FC33
- 5.8.17-300 for FC33
fmem-kernel-modules-fc32-x86_64-1.6-1.24.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.18-200 for FC32
- 5.8.17-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-24.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.18-200 for FC32
- 5.8.17-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.40.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.18-100 for FC31
- 5.8.17-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-40.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.18-100 for FC31
- 5.8.17-100 for FC31
fmem-kernel-modules-el8-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-193.28.1 for EL8
lime-kernel-modules-el8-x86_64-1.1.r17-10.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-193.28.1 for EL8

October 30, 2020: The following changes have been made:

python{2,36}-psutil-5.7.3-1.el7.x86_64.rpm - Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network) in Python.
plaso-20201007-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso-20201007-1.{fc31,fc32,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here.
libcreg{,-devel,-python3,-tools}-20200725-2.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libcreg{,-devel,-python2,-tools}-20200725-2.el6.{i686,x86_64}.rpm, libcreg{,-devel,-python36,-tools}-20200725-2.el7.x86_64.rpm, and libcreg{,-devel,-python2,-python3,-tools}-20200725-2.{fc31,fc32,el8}.x86_64.rpm - Libcreg is a library and tools to access the Windows 9x/Me Registry File (CREG) format. Note that in this release, the Python3 version for CentOS/RHEl 7 is correctly named, that is it is named libcreg-python36 and not libcreg-python3. There are no other changes in this release.
Volatility-2.6.1-5.{fc27,fc28,fc29,fc30,el6}.{i386,x86_64}.rpm and Volatility-2.6.1-5.{fc31,fc32,el7,el8}.x86_64.rpm - The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. This version of Volatility is the official version of Volatility 2.6.1 that has been patched to October 27, 2020. You can read about this version here.
libfsntfs{,-devel,-python3}-20201027-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20201027-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20201027-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20201027-1.{fc31,fc32,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
libmdmp{,-devel,-tools}-20200819-1.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and libmdmp{,-devel,-tools}-20200819-1.{fc31,fc32,el7,el8}.x86_64.rpm - Libmdmp is a library to access the Windows Minidump (MDMP) format. Note that this project currently only focuses on the analysis of the format.
libhibr{,-devel,-tools}-20200820-1.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and libhibr{,-devel,-tools}-20200820-1.{fc31,fc32,el7,el8}.x86_64.rpm - libhibr is a lbrary and tools to access the Windows Hibernation File (hiberfil.sys) format. Note that this project currently only focuses on the analysis of the format.
libmodi{,-devel,-python2,-python3,-tools}-20201019-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libmodi{,-devel,-python2,-tools}-20201019-1.el6.{i686,x86_64}.rpm, and libmodi{,-devel,-python2,-python36,-tools}-20201019-1.el7.x86_64.rpm, libmodi{,-devel,-python2,-python3,-tools}-20201019-1.{fc31,fc32,el8}.x86_64.rpm - Libmodi is a lbrary and tools to access the Mac OS disk image formats. Note that this project currently only focuses on the analysis of the format.
libphdi{,-devel,-python2,-python3,-tools}-20201003-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libphdi{,-devel,-python2,-tools}-20201003-1.el6.{i686,x86_64}.rpm, libphdi{,-devel,-python2,-python36,-tools}-20201003-1.el7.x86_64.rpm, and libphdi{,-devel,-python2,-python36,-tools}-20201003-1.{fc31,fc32,el8}.x86_64.rpm - Libphdi is a library to access the Parallels Hard Disk image format.
libagdb{,-devel,-tools}-20201023-1.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and libagdb{,-devel,-tools}-20201023-1.{fc31,fc32,el7,el8}.x86_64.rpm - Libagdb is a library to access the SuperFetch database format.
libvsmbr{,-devel,-python2,-python3,-tools}-20200818-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvsmbr{,-devel,-python2,-tools}-20200818-1.el6.{i686,x86_64}.rpm, and libvsmbr{,-devel,-python2,-python36,-tools}-20200818-1.el7.x86_64.rpm, and libvsmbr{,-devel,-python2,-python3,-tools}-20200818-1.{fc31,fc32,el8}.x86_64.rpm - Libvsmbr is a library and tools to access the Master Boot Record (MBR) volume system.
rifiuti2-0.7.0-5.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and rifiuti2-0.7.0-5.fc31,fc32,el7,el8.x86_64.rpm - rifiuti2 is a rewrite of rifiuti, a tool for analyzing Windows Recycle Bin INFO2 file. This package was updated to avoid a conflict with the rifiuti package.
fmem-kernel-modules-1.6-1.20.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for the Fedora 33 x86_64 architecture was added.
lime-kernel-modules-1.1.r17-20.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for the Fedora 33 x86_64 architecture was added.
fmem-kernel-modules-fc32-x86_64-1.6-1.23.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.16-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-23.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.16-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.39.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.16-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-39.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.16-100 for FC31

Fedora 33 - The repository now supports Fedora 33 for the x86_64 CPU architecture. Here is the list of tools provided for Fedora 33:

2hash
acr
analysis-pipeline
analyzeMFT
apfs-fuse
artifacts
ataraw
autopsy
bencode
binplist
bulk_extractor
cert-forensics-tools-release
CERT-Forensics-Tools
certifi
crunch
cryptcat
cryptography
daq
dcp
ddrescueview
ddrutility
dfdatetime
dfvfs
dfwinreg
distorm3
docker-forensics-toolkit
DropboxReader
dtfabric
eindeutig
elasticsearch
epub
exfat-utils
fatback
fcrackzip
femto
fmem-kernel-modules
fred
fundl
fuse-python
galleta
ghidra

ghostpdl
grokevt
guymager
hachoir
jafat
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf
libexe
libfixbuf
libfplist
libfsapfs
libfsext
libfshfs
libfsntfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
libipa
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf
libpff
libphdi
libqcow
libregf
libscca

libschemaTools
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
m2crypto
mac_apt
missidentify
mount_ewf
nDPI
netsa-python
netsa-rayon
packetexaminer
pasco
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
prism
pstotext
ptfinder
ptk
pycoin
pyfixbuf
python-colorama
python-construct
python-coverage
python-crypto
python-enum34
python-nose
python-registry
python-sqlite3dbm
python-unicodecsv
python-yara
python2-typing

pytsk3
qtmltfs
rar
redis
reglookup
regripper-plugins
regripper
rekall-forensics
rifiuti2
rifiuti
scrounge-ntfs
sfdumper
shellbags
silk-ipa
silk-ipset
silk
sleuthkit
snarf
snort-openappid
snort-sample-rules
snort
stegdetect
super_mediator
tln_tools
umit
unrar
untex
veracrypt
videosnarf
vinetto
vmfs-tools
vmfs6-tools
Volatility-community-plugins
Volatility
winevt-kb
winreg-kb
xplico
xva-img
yaf
zeek

October 23, 2020: The following changes have been made:

libvhdi{,-devel,-python2,-python3,-tools}-20201018-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvhdi{,-devel,-python2,-tools}-20201018-1.el6.{i686,x86_64}.rpm, libvhdi{,-devel,-python2,-python36,-tools}-20201018-1.el7.x86_64.rpm, and libvhdi{,-devel,-python2,-python3,-tools}-20201018-1.{fc31,fc32,el8}.x86_64.rpm - Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
libfshfs{,-devel,-python2,-python3,-tools}-20201019-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfshfs{,-devel,-python2,-tools}-20201019-1.el6.{i686,x86_64}.rpm, libfshfs{,-devel,-python2,-python36,-tools}-20201019-3.el7.x86_64.rpm, and libfshfs{,-devel,-python2,-python3,-tools}-20201019-3.{fc31,fc32,el8}.x86_64.rpm - Libfshfs is a lbrary and tools to access the Hierarchical File System (HFS). Note that this project currently only focuses on the analysis of the format.
python3-cryptography-3.1-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-cryptography-3.1-1.el7.x86_64.rpm, and python3-cryptography-3.1-1.{fc30,fc31,el8}.x86_64.rpm - Cryptography is a package which provides cryptographic recipes and primitives to Python developers.
python3-dfvfs-20201018-1.{fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-dfvfs-20201018-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
bellsoft-java8-full-1.8.0.272-1+10.{i586,x86_64}.rpm - Bellsoft Java was installed for Fedora 27 through 32 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
pfring-7.6.0-3245.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3245.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2878.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.

October 16, 2020: The following changes have been made:

libfsapfs{,-devel,-python2,-python3}-20201008-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsapfs{,-devel,-python2}-20201008-1.el6.{i686,x86_64}.rpm, libfsapfs{,-devel,-python2,-python36}-20201008-1.el7.x86_64.rpm, and libfsapfs{,-devel,-python2,-python3}-20201008-1.{fc31,fc32,el8}.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
python3-xlsxwriter-1.3.7-1.{fc27,fc28,fc29}.noarch.rpm and python36-xlsxwriter-1.3.7-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format. XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
libvhdi{,-devel,-python2,-python3,-tools}-20201014-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvhdi{,-devel,-python2,-tools}-20201014-1.el6.{i686,x86_64}.rpm, libvhdi{,-devel,-python2,-python36,-tools}-20201014-1.el7.x86_64.rpm, and libvhdi{,-devel,-python2,-python3,-tools}-20201014-1.{fc31,fc32,el8}.x86_64.rpm - Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
fmem-kernel-modules-fc32-x86_64-1.6-1.22.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.15-200 for FC32
- 5.8.14-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-22.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.15-200 for FC32
- 5.8.14-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.38.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.15-101 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-38.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.15-101 for FC31

October 8, 2020: The following changes have been made:

python3-dfwinreg-20201006-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-dfwinreg-20201006-1.el7.x86_64.rpm, and python3-dfwinreg-20201006-1.{fc31,fc32,el8}.x86_64.rpm - DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
libregf{,-devel,-python2,-python3}-20201007-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libregf{,-devel,-python2}-20201007-1.el6.{i686,x86_64}.rpm, libregf{,-devel,-python2,-python36}-20201007-1.el7.x86_64.rpm, and libregf{,-devel,-python2,-python3}-20201007-1.{fc31,fc32,el8}.x86_64.rpm - Libregf contains libraries and tools to access the Windows NT Registry File files.
libolecf{,-devel,-python2,-python3}-20201004-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libolecf{,-devel,-python2}-20201004-1.el6.{i686,x86_64}.rpm, libolecf{,-devel,-python2,-python36}-20201004-1.el7.x86_64.rpm, and libolecf{,-devel,-python2,-python3}-20201004-1.{fc31,fc32,el8}.x86_64.rpm - Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
pfring-7.6.0-3209.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3209.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2862.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.21.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.13-200 for FC32
- 5.8.12-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-21.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.13-200 for FC32
- 5.8.12-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.37.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.13-100 for FC31
- 5.8.12-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-37.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.13-100 for FC31
- 5.8.12-100 for FC31

October 1, 2020: The following changes have been made:

libevt{,-devel,-python2,-python3}-20200926-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevt{,-devel,-python2}-20200926-1.el6.{i686,x86_64}.rpm, libevt{,-devel,-python2,-python36}-20200926-1.el7.x86_64.rpm, and libevt{,-devel,-python2,-python3}-20200926-1.{fc31,fc32,el8}.x86_64.rpm - Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
libvhdi{,-devel,-python2,-python3,-tools}-20200926-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvhdi{,-devel,-python2,-tools}-20200926-1.el6.{i686,x86_64}.rpm, libvhdi{,-devel,-python2,-python36,-tools}-20200926-1.el7.x86_64.rpm, and libvhdi{,-devel,-python2,-python3,-tools}-20200926-1.{fc31,fc32,el8}.x86_64.rpm - Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
libvmdk{,-devel,-python2,-python3}-20200926-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvmdk{,-devel,-python2}-20200926-1.el6.{i686,x86_64}.rpm, libvmdk{,-devel,-python2,-python36}-20200926-1.el7.x86_64.rpm, and libvmdk{,-devel,-python2,-python3}-20200926-1.{fc31,fc32,el8}.x86_64.rpm - Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
bulk_extractor-1.6.0-3.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and bulk_extractor-1.6.0-3.{fc31,fc32,el7,el8}.x86_64.rpm - Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. Bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important. This version fixes many issues. In addition, it also contains the BEViewer GUI front-end for bulk_extractor. This version was rebuilt to add the python3-matplotlib dependency which caused be_grapher.py to be removed from CentOS/RHEL 7.
libqcow{,-devel,-python2,-python3}-20200928-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libqcow{,-devel,-python2}-20200928-1.el6.{i686,x86_64}.rpm, libqcow{,-devel,-python2,-python36}-20200928-1.el7.x86_64.rpm, and libqcow{,-devel,-python2,-python3}-20200928-1.{fc31,fc32,el8}.x86_64.rpm - Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
python3-dfwinreg-20200928-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-dfwinreg-20200928-1.el7.x86_64.rpm, and python3-dfwinreg-20200928-1.{fc31,fc32,el8}.x86_64.rpm - DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
fmem-kernel-modules-fc32-x86_64-1.6-1.20.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.11-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-20.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.11-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.36.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.11-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-36.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.11-100 for FC31

September 24, 2020: The following changes have been made:

python3-xlsxwriter-1.3.6-1.{fc27,fc28,fc29}.noarch.rpm and python36-xlsxwriter-1.3.6-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format. XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
libfsntfs{,-devel,-python3}-20200921-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20200921-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20200921-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20200921-1.{fc31,fc32,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
python3-dfwinreg-20200415-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-dfwinreg-20200415-1.el7.x86_64.rpm, and python3-dfwinreg-20200415-1.{fc31,fc32,el8}.x86_64.rpm - DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
python3-dfvfs-20200920-1.{fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-dfvfs-20200920-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libfsext{,-devel,-python2,-python3,-tools}-20200819-2.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsext{,-devel,-python2,-tools}-20200819-2.el6.{i686,x86_64}.rpm, libfsext{,-devel,-python2,-python36,-tools}-20200819-2.el7.x86_64.rpm and libfsext{,-devel,-python2,-python3,-tools}-20200819-2.{fc31,fc32,el8}.x86_64.rpm - Libfsext is a lbrary and tools to access the Extended File System (EXT). This release correctly names the CentOS/RHEL 7 version (python36 vs. python3).
mac_apt-0.7-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and mac_apt-0.7-1.{fc321,fc32,el7,el8}.x86_64.rpm - Mac_apt is a DFIR (Digital Forensics and Incident Response) tool to process Mac computer full disk images (or live machines) and extract data/metadata useful for forensic investigation. It is a python based framework, which has plugins to process individual artifacts (such as Safari internet history, Network interfaces, Recently accessed files & volumes, etc.). Here are a list of features:
- Cross platform (no dependency on pyobjc)
- Works on E01, VMDK, AFF4, DD, split-DD, DMG (no compression) and mounted images
- XLSX, CSV, Sqlite outputs
- Analyzed files/artifacts are exported for later review
- zlib, lzvn, lzfse compressed files are supported!
- Native HFS and APFS parser
- Reads the Spotlight database and Unified Logging (tracev3) files
And here are a list of new functionality added in this release:
- Support for macOS Big Sur (11.0)
- FAST mode ⏳
- Encrypted 🔒 APFS images can now be processed using password/recovery-key 🔑
- macOS Catalina (10.15) images can be parsed now
- macOS Catalina (10.15) separately mounted SYSTEM and DATA volumes now supported
- AFF4 images (including macquisition created) now supported
CERT-Forensics-Tools-1.0-91.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-91.{fc31,fc32,el7,el8}.x86_64.rpm - This relese does the following:
- Added mac_apt for Fedora and CentOS/RHEL 7 and 8.
pfring-7.6.0-3176.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3176.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2841.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.19.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.10-200 for FC32
- 5.8.9-200 for FC32
- 5.8.8-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-19.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.10-200 for FC32
- 5.8.9-200 for FC32
- 5.8.8-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.35.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.10-100 for FC31
- 5.8.9-101 for FC31
- 5.8.8-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-35.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.10-100 for FC31
- 5.8.9-101 for FC31
- 5.8.8-100 for FC31
fmem-kernel-modules-el8-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-193.19.1 for EL8
lime-kernel-modules-el8-x86_64-1.1.r17-9.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-193.19.1 for EL8

September 12, 2020: The following changes have been made:

sleuthkit{,-devel,-libs}-4.10.0-1.1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and sleuthkit{,-devel,-libs}-4.10.0-1.1.{fc31,el7,el8}.x86_64.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
autopsy-4.16.0-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and autopsy-4.16.0-1.{fc31,fc32,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:
1. This version uses Java 8 from Bellsoft.
2. This version was tested on Fedora 27 through 32 and CentOS 7 and 8 for the x86_64 architectures using an E01 dataset that contains a 7-Zip file that contains two JPEG images, one of which has EXIF metadata. Those archives were correctly parsed and the EXIF data verified.
3. If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
  [ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
  sudo systemctl start xrdp
python2-pysocks-1.6.8-6.el8.noarch.rpm - Pysocks is a fork of SocksiPy with bug fixes and extra features. It acts as a drop-in replacement for the socket module. This package was built for CentOS 8 to support the Volatility-community-plugins package.
python2-six-1.11.0-5.el8.noarch.rpm - Six provides simple utilities for wrapping over differences between Python 2 and Python 3. This package was built for CentOS 8 to support the Volatility-community-plugins package.
fmem-kernel-modules-fc32-x86_64-1.6-1.18.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.7-200 for FC32
- 5.8.6-201 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-18.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.7-200 for FC32
- 5.8.6-201 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.34.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.6-101 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-34.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.6-101 for FC31

September 3, 2020: The following changes have been made:

python3-dfdatetime-20200824-1.{fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-dfdatetime-20200824-1.el7.noarch.rpm - dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
libfsext{,-devel,-python2,-python3,-tools}-20200819-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsext{,-devel,-python2,-tools}-20200819-1.el6.{i686,x86_64}.rpm, libfsext{,-devel,-python2,-python36,-tools}-20200819-1.el7.x86_64.rpm and libfsext{,-devel,-python2,-python3,-tools}-20200819-1.{fc31,fc32,el8}.x86_64.rpm - Libfsext is a lbrary and tools to access the Extended File System (EXT).
libcreg{,-devel,-python3,-tools}-20200725-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libcreg{,-devel,-python2,-tools}-20200725-1.el6.{i686,x86_64}.rpm, libcreg{,-devel,-python36,-tools}-20200725-1.el7}.x86_64.rpm, and libfsext{,-devel,-python2,-python3,-tools}-20200819-1.{fc31,fc32,el8}.x86_64.rpm - Libcreg is a library and tools to access the Windows 9x/Me Registry File (CREG) format.
pfring-7.6.0-3146.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3146.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2780.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
lime-kernel-modules-common-1.1.r17-6.noarch.rpm - LiME is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. This package contains only the source code for making the LiME kernel modules, the CaptureMemoryWithLime script and the corresponding manual page. The changes are the following:
- LiME code up to date as of August 31, 2020 (which includes changes for the 5.8 Linux kernels)
fmem-kernel-modules-fc32-x86_64-1.6-1.17.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.8.4-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-17.noarch.rpm - Support for the following kernels were added for LiME:
- 5.8.4-200 for FC32

August 28, 2020: The following changes have been made:

python3-dfdatetime-20200809-1.{fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-dfdatetime-20200809-1.el7.noarch.rpm - dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
snort-2.9.16.1-2.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-2.9.16.1-2.{fc31,fc32,el7,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture. This release corrected a packaging error where the openappid option was not correctly disabled.
snort-sample-rules-2.9.16.1-2.{fc27,fc28,fc29,fc30,fc31,fc32,el6,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.1.16.1-2.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.16-1.{fc31,fc32,el7,el8}.x86_64.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture. This release corrected a packaging error where the openappid option was not correctly enabled.
pfring-7.6.0-3144.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3144.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2775.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.16.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.17-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-16.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.17-200 for FC32
fmem-kernel-modules-el7-x86_64-1.6-1.69.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1127.19.1 for EL7
- 3.10.0-1127.18.2 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-69.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1127.19.1 for EL7
- 3.10.0-1127.18.2 for EL7
fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.68.noarch.rpm - Support for the following kernels were added for Fmem:
- 2.6.32-754.33.1 for EL6
lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-68.noarch.rpm - Support for the following kernels were added for LiME:
- 2.6.32-754.33.1 for EL6

August 23, 2020: The following changes have been made:

python3-xlsxwriter-1.3.3-1.{fc27,fc28,fc29}.noarch.rpm and python36-xlsxwriter-1.3.3-1.el7.noarch.rpm - XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format. XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
libvhdi{,-devel,-python2,-python3,-tools}-20200810-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvhdi{,-devel,-python2,-tools}-20200810-1.el6.{i686,x86_64}.rpm, libvhdi{,-devel,-python2,-python36,-tools}-20200810-1.el7.x86_64.rpm, and libvhdi{,-devel,-python2,-python3,-tools}-20200810-1.{fc31,fc32,el8}.x86_64.rpm - Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
libvmdk{,-devel,-python2,-python3}-20200810-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvmdk{,-devel,-python2}-20200810-1.el6.{i686,x86_64}.rpm, libvmdk{,-devel,-python2,-python36}-20200810-1.el7.x86_64.rpm, and libvmdk{,-devel,-python2,-python3}-20200810-1.{fc31,fc32,el8}.x86_64.rpm - Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
liblnk{,-devel,-python2,-python3}-20200810-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, liblnk{,-devel,-python2}-20200810-1.el6.{i686,x86_64}.rpm, liblnk{,-devel,-python2,-python36}-20200810-1.el7.x86_64.rpm, and liblnk{,-devel,-python2,-python3}-20200810-1.{fc31,fc32,el8}.x86_64.rpm - Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
libevt{,-devel,-python2,-python3}-20200810-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevt{,-devel,-python2}-20200810-1.el6.{i686,x86_64}.rpm, libevt{,-devel,-python2,-python36}-20200810-1.el7.x86_64.rpm, and libevt{,-devel,-python2,-python3}-20200810-1.{fc31,fc32,el8}.x86_64.rpm - Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
libvslvm{,-devel,-python2,-python3}-20200817-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvslvm{,-devel,-python2,-python36}-20200817-1.el7.x86_64.rpm, and libvslvm{,-devel,-python2,-python3}-20200817-1.{fc31,fc32,el8}.x86_64.rpm - Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
libfsext{,-devel,-python2,-python3,-tools}-20200811-2.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsext{,-devel,-python2,-tools}-20200811-2.el6.{i686,x86_64}.rpm, libfsext{,-devel,-python2,-python36,-tools}-20200811-2.el7.x86_64.rpm and libfsext{,-devel,-python2,-python3,-tools}-20200811-2.{fc31,fc32,el8}.x86_64.rpm - Libfsext is a lbrary and tools to access the Extended File System (EXT).
python3-elasticsearch-7.9.1-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-elasticsearch-7.9.1-1.el7.x86_64.rpm, python3-elasticsearch-7.9.1-1.{fc31,fc32,el8}.x86_64.rpm, and python2-elasticsearch-7.9.1-1.el6.{i686,x86_64}.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
pfring-7.6.0-3136.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3136.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2753.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.15.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.16-200 for FC32
- 5.7.15-200 for FC32
- 5.7.14-200 for FC32
- 5.7.12-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-15.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.16-200 for FC32
- 5.7.15-200 for FC32
- 5.7.14-200 for FC32
- 5.7.12-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.33.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.15-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-33.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.15-100 for FC31

August 6, 2020: The following changes have been made:

snort-2.9.16.1-1.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-2.9.16.1-1.{fc31,fc32,el7,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture.
snort-sample-rules-2.9.16.1-1.{fc27,fc28,fc29,fc30,fc31,fc32,el6,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.1.16.1-1.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.16-1.{fc31,fc32,el7,el8}.x86_64.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture.
libfsntfs{,-devel,-python3}-20200805-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20200805-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20200805-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20200805-1.{fc31,fc32,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
libregf{,-devel,-python2,-python3}-20200805-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libregf{,-devel,-python2}-20200805-1.el6.{i686,x86_64}.rpm, libregf{,-devel,-python2,-python36}-20200805-1.el7.x86_64.rpm, and libregf{,-devel,-python2,-python3}-20200805-1.{fc31,fc32,el8}.x86_64.rpm - Libregf contains libraries and tools to access the Windows NT Registry File files.
fmem-kernel-modules-fc32-x86_64-1.6-1.14.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.11-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-14.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.11-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.32.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.11-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-32.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.11-100 for FC31

July 31, 2020: The following changes have been made:

libfsntfs{,-devel,-python3}-20200726-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20200726-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20200726-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20200726-1.{fc31,fc32,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
libfsapfs{,-devel,-python2,-python3}-20200727-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsapfs{,-devel,-python2}-20200727-1.el6.{i686,x86_64}.rpm, libfsapfs{,-devel,-python2,-python36}-20200727-1.el7.x86_64.rpm, and libfsapfs{,-devel,-python2,-python3}-20200727-1.{fc31,fc32,el8}.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
libqcow{,-devel,-python2,-python3}-20200729-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libqcow{,-devel,-python2}-20200729-1.el6.{i686,x86_64}.rpm, libqcow{,-devel,-python2,-python36}-20200729-1.el7.x86_64.rpm, and libqcow{,-devel,-python2,-python3}-20200729-1.{fc31,fc32,el8}.x86_64.rpm - Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
pfring-7.6.0-3097.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3097.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2705.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
bellsoft-java8-1.8.0.265-1+1.{i586,x86_64}-full.rpm - Bellsoft Java was installed for Fedora 27 through 32 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
python3-elasticsearch-7.8.1-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-elasticsearch-7.8.1-1.el7.x86_64.rpm, python3-elasticsearch-7.8.1-1.{fc31,fc32,el8}.x86_64.rpm, and python2-elasticsearch-7.8.1-1.el6.{i686,x86_64}.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
fmem-kernel-modules-fc32-x86_64-1.6-1.13.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.10-201 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-13.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.10-201 for FC32
fmem-kernel-modules-el8-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-193.14.2 for EL8
lime-kernel-modules-el8-x86_64-1.1.r17-8.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-193.14.2 for EL8

July 24, 2020: The following changes have been made:

plaso-20200717-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso-20200717-1.{fc31,fc32,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here.
docker-forensics-toolkit-0.2.0-2.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and docker-forensics-toolkit-0.2.0-1.{fc31,fc32,el7,el8}.x86_64.rpm - Docker Forensics Toolkit is a toolkit for performing post-mortem analysis of Docker runtime environments based on forensic HDD copies of the docker host system. See this page for usage instructions. This version fixes a packaging problem.
libfwnt{,-devel,-python2,-python3}-20200723-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwnt{,-devel,-python2}-20200723-1.el6.{i686,x86_64}.rpm, libfwnt{,-devel,-python2,-python36}-20200723-1.el7.x86_64.rpm, and libfwnt{,-devel,-python2,-python3}-20200723-1.{fc31,fc32,el8}.x86_64.rpm - LibFWNT is a library for Windows NT data types.
libscca{,-devel,-python2,-python3,-tools}-20200717-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, ibscca{,-devel,-python2,-tools}-20200717-1.el6.{i686,x86_64}.rpm, libscca{,-devel,-python2,-python36,-tools}-20200717-1.el7.x86_64.rpm, and libscca{,-devel,-python2,-python3,-tools}-20200717-1.{fc31,fc32,el8}.x86_64.rpm - Libscca is a library to access the Windows Prefetch File (SCCA) format.
libolecf{,-devel,-python2,-python3}-20200724-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libolecf{,-devel,-python2}-20200724-1.el6.{i686,x86_64}.rpm, libolecf{,-devel,-python2,-python36}-20200724-1.el7.x86_64.rpm, and libolecf{,-devel,-python2,-python3}-20200724-1.{fc31,fc32,el8}.x86_64.rpm - Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
bellsoft-java8-1.8.0.262-1+10.{i586,x86_64}-full.rpm - Bellsoft Java was installed for Fedora 27 through 32 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
fmem-kernel-modules-fc32-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.9-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-12.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.9-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.31.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.9-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-31.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.9-100 for FC31

July 17, 2020: The following changes have been made:

libmsiecf{,-devel,-python2,-python3}-20200710-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libmsiecf{,-devel,-python2}-20200710-1.el6.{i686,x86_64}.rpm, libmsiecf{,-devel,-python2,-python36}-20200710-1.el7.x86_64.rpm, and libmsiecf{,-devel,-python2,-python3}-20200710-1.{fc31,fc32,el8}.x86_64.rpm - Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
perl-Parse-Win32Registry-1.0-3.{fc27,fc28,fc29,fc30,fc31,fc32,el7,el8}.noarch.rpm - perl-Parse-Win32Registry is a module for parsing Windows Registry files, allowing you to read the keys and values of a registry file without going through the Windows API. It provides an object-oriented interface to the keys and values in a registry file. Registry files are structured as trees of keys, with each key containing further subkeys or values. The module is intended to be cross-platform, and run on those platforms where Perl will run. It supports both Windows NT registry files (Windows NT, 2000, XP, 2003, Vista, 7) and Windows 95 registry files (Windows 95, 98, Millennium Edition). It is intended to be used to parse offline registry files. If a registry file is currently in use, you will not be able to open it. However, you can save part or all of a currently loaded registry file using the Windows reg command if you have the appropriate administrative access.
This version corrected a packaging error in the previous release.
regripper-30000000-2.{fc27,fc28,fc29,fc30,fc31,fc32,el7,el8}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool. This package is contains version 3.0 of the regripper tool. The plugins are packaged separately. This version is based on the May 28, 2020 version of the code, also known as RegRipper 3.0.
This version contains a patch that correctly finds the pluginsfolder.
libevt{,-devel,-python2,-python3}-20200715-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevt{,-devel,-python2}-20200715-1.el6.{i686,x86_64}.rpm, libevt{,-devel,-python2,-python36}-20200715-1.el7.x86_64.rpm, and libevt{,-devel,-python2,-python3}-20200715-1.{fc31,fc32,el8}.x86_64.rpm - Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
pfring-7.6.0-3095.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3095.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2657.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.11.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.8-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-11.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.8-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.30.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.8-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-30.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.8-100 for FC31
fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.67.noarch.rpm - Support for the following kernels were added for Fmem:
- 2.6.32-754.31.1 for EL6
lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-67.noarch.rpm - Support for the following kernels were added for LiME:
- 2.6.32-754.31.1 for EL6

July 10, 2020: The following changes have been made:

liblnk{,-devel,-python2,-python3}-20200709-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, liblnk{,-devel,-python2}-20200709-1.el6.{i686,x86_64}.rpm, liblnk{,-devel,-python2,-python36}-20200709-1.el7.x86_64.rpm, and liblnk{,-devel,-python2,-python3}-20200709-1.{fc31,fc32,el8}.x86_64.rpm - Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
libevt{,-devel,-python2,-python3}-20200708-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevt{,-devel,-python2}-20200708-1.el6.{i686,x86_64}.rpm, libevt{,-devel,-python2,-python36}-20200708-1.el7.x86_64.rpm, and libevt{,-devel,-python2,-python3}-20200708-1.{fc31,fc32,el8}.x86_64.rpm - Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
libevtx{,-devel,-python2,-python3}-20200709-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevtx{,-devel,-python2}-20200709-1.el6.{i686,x86_64}.rpm, libevtx{,-devel,-python2,-python36}-20200709-1.el7.x86_64.rpm, and libevtx{,-devel,-python2,-python3}-20200709-1.{fc31,fc32,el8}.x86_64.rpm - Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
pfring-7.6.0-3060.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3060.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2605.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.10.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.7-200 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-10.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.7-200 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.29.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.7-100 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-29.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.7-100 for FC31

July 3, 2020: The following changes have been made:

libfsntfs{,-devel,-python3}-20200627-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20200627-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20200627-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20200627-1.{fc31,fc32,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
python3-idna-2.10-1.{fc27,fc28,el8}.noarch.rpm and python36-idna-2.10-1.el7.noarch.rpm - IDNA provides support for the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891. This is the latest version of the protocol and is sometimes referred to as "IDNA 2008".
python3-dfdatetime-20200613-1.{fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-dfdatetime-20200613-1.el7.noarch.rpm - dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
python3-dtfabric-20200621-2.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-dtfabric-20200621-2.el7.x86_64.rpm, and python3-dtfabric-20200621-2.{fc31,fc32,el8}.x86_64.rpm - Dtfabric is a project to manage data types and structures, as used in the libyal projects.
python2-yara-4.0.2-1.fc30.{i386,x86_64}.rpm and python2-yara-4.0.2-1.x86_64.{fc31,fc32,el8}.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.
python2-coverage-4.5.1-4.fc32.x86_64.rpm - Python Coverage measures code coverage, typically during test execution. It uses the code analysis tools and tracing hooks provided in the Python standard library to determine which lines are executable, and which have been executed. This package was installed to support building python2-yara for Fedora 32.
python2-nose-1.3.7-24.fc32.noarch.rpm - Python Nose extends the test loading and running features of unittest, making it easier to write, find and run tests. This package was installed to support building python2-yara for Fedora 32.
docker-forensics-toolkit-0.2.0-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and docker-forensics-toolkit-0.2.0-1.{fc31,fc32,el7,el8}.x86_64.rpm - Docker Forensics Toolkit is a toolkit for performing post-mortem analysis of Docker runtime environments based on forensic HDD copies of the docker host system. See this page for usage instructions.
python3-dfvfs-20200625-1.{fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-dfvfs-20200625-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
python3-redis-3.5-1.{fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-redis-3.5-1.el7.noarch.rpm - Redis is a Python interface to the Redis key-value store.
plaso-20200630-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso-20200630-1.{fc31,fc32,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system. Details of this update are available here.
pfring-7.6.0-3059.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3059.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2599.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.9.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.7.6-201 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-9.noarch.rpm - Support for the following kernels were added for LiME:
- 5.7.6-201 for FC32

June 26, 2020: The following changes have been made:

python{2,3}-certifi-2020.6.20-1.{fc27,fc28,fc29,fc30,fc31,el8}.noarch.rpm and python{2,36}-certifi-2020.6.20-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
python3-bencode-4.0.0-1.{fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-bencode-4.0.0-1.el7.noarch.rpm - Bencode re-packages the existing bencoding and bdecoding implemention from the ‘official’ BitTorrent client as a separate, light-weight package for re-using them without having the entire BitTorrent software as a dependency.
zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-3.0.7-0.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libbroker-devel-3.0.7-0.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-3.0.7-0.{fc31,fc32,el7,el8}.x86_64.rpm, and libbroker-devel-3.0.7-0.{fc31,fc32,el7,el8}.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
pfring-7.6.0-3052.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3052.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2544.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.8.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.19-300 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-8.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.19-300 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.28.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.19-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-28.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.19-200 for FC31
fmem-kernel-modules-el7-x86_64-1.6-1.68.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1127.13.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-68.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1127.13.1 for EL7

June 19, 2020: The following changes have been made:

perl-Parse-Win32Registry-1.0-2.{fc27,fc28,fc29,fc30,fc31,fc32,el7,el8}.noarch.rpm - perl-Parse-Win32Registry is a module for parsing Windows Registry files, allowing you to read the keys and values of a registry file without going through the Windows API. It provides an object-oriented interface to the keys and values in a registry file. Registry files are structured as trees of keys, with each key containing further subkeys or values. The module is intended to be cross-platform, and run on those platforms where Perl will run. It supports both Windows NT registry files (Windows NT, 2000, XP, 2003, Vista, 7) and Windows 95 registry files (Windows 95, 98, Millennium Edition). It is intended to be used to parse offline registry files. If a registry file is currently in use, you will not be able to open it. However, you can save part or all of a currently loaded registry file using the Windows reg command if you have the appropriate administrative access.
This version was built with the new modules required for regripper Version 3.0.
regripper-30000000-1.{fc27,fc28,fc29,fc30,fc31,fc32,el7,el8}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool. This package is contains version 3.0 of the regripper tool. The plugins are packaged separately. This version is based on the May 28, 2020 version of the code, also known as RegRipper 3.0.
regripper-plugins-20200528-1.{fc27,fc28,fc29,fc20,fc31,fc32,el7,el8}.noarch.rpm - Regripper-plugins are the plugins packaged separately from the regripper application. This package is taken from the plugins directory at the Github source code site as of 2020-05-28.
python3-elasticsearch-7.8.0-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-elasticsearch-7.8.0-1.el7.x86_64.rpm, python3-elasticsearch-7.8.0-1.{fc31,fc32,el8}.x86_64.rpm, and python2-elasticsearch-7.8.0-1.el6.{i686,x86_64}.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
python36-requests-2.24.0-1.el7.x86_64.rpm - Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings. Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web. It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
pfring-7.6.0-3043.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3043.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2534.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.18-300 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-7.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.18-300 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.27.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.18-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-27.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.18-200 for FC31
fmem-kernel-modules-el8-x86_64-1.6-1.7.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-193.6.3 for EL8
- 4.18.0-193.1.2 for EL8
- 4.18.0-193 for EL8
lime-kernel-modules-el8-x86_64-1.1.r17-7.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-193.6.3 for EL8
- 4.18.0-193.1.2 for EL8
- 4.18.0-193 for EL8

June 12, 2020: The following changes have been made:

Volatility-2.6.1-4.{fc27,fc28,fc29,fc30,el6}.{i386,x86_64}.rpm and Volatility-2.6.1-4.{fc31,fc32,el7,el8}.x86_64.rpm - The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. This version of Volatility is the official version of Volatility 2.6.1 that has been patched to June 8, 2020. You can read about this version here.
libfwnt{,-devel,-python2,-python3}-20200605-1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwnt{,-devel,-python2}-20200605-1.el6.{i686,x86_64}.rpm, libfwnt{,-devel,-python2,-python36}-20200605-1.el7.x86_64.rpm, and libfwnt{,-devel,-python2,-python3}-20200605-1.{fc31,fc32,el8}.x86_64.rpm - LibFWNT is a library for Windows NT data types.
pfring-7.6.0-3016.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3016.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2522.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.16-300 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-6.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.16-300 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.26.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.16-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-26.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.16-200 for FC31
fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.66.noarch.rpm - Support for the following kernels were added for Fmem:
- 2.6.32-754.30.2 for EL6
lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-66.noarch.rpm - Support for the following kernels were added for LiME:
- 2.6.32-754.30.2 for EL6

June 5, 2020: The following changes have been made:

veracrypt-1.24.6-1.{fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and veracrypt-1.24.6-1.{fc31,fc32,el7,el8}.x86_64.rpm - VeraCrypt is a free open source disk encryption software for Windows, Mac OSX and Linux. based on TrueCrypt 7.1a.
pfring-7.6.0-3011.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3011.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2503.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.5.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.15-300 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-5.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.15-300 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.25.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.15-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-25.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.15-200 for FC31
fmem-kernel-modules-el7-x86_64-1.6-1.67.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1127.10.1 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-67.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1127.10.1 for EL7

May 29, 2020: The following changes have been made:

disktype-9-30.1.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and disktype-9-30.1.{fc31,fc32,el7,el8}.x86_64.rpm - Disktype detects the content format of a disk or disk image. This version is based on the standard version with support for exfat, LUKS, f2fs, btrfs, and EXT 2, 3, and 4, all courtesy Erik Uitto formerly from the Silicon Valley Regional Computer Forensics Laboratory in Menlo Park, CA. This version was rebuilt to increment the release number to be higher (30.1) than the current version provided for either Fedora (30) or CentOS/RHEL (29).
python3-elasticsearch-7.7.1-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-elasticsearch-7.7.1-1.el7.x86_64.rpm, python3-elasticsearch-7.7.1-1.{fc31,fc32,el8}.x86_64.rpm, and python2-elasticsearch-7.7.1-1.el6.{i686,x86_64}.rpm - ElasticSearch is the official low-level client for Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable. Note that the Python 2 version is no longer provided except for CentOS/RHEL 6.
python3-bencode-3.0.1-1.{fc26,fc27,fc28,fc29,fc30,fc31,fc32,el8}.noarch.rpm and python36-bencode-3.0.1-1.el7.noarch.rpm - Bencode re-packages the existing bencoding and bdecoding implemention from the ‘official’ BitTorrent client as a separate, light-weight package for re-using them without having the entire BitTorrent software as a dependency.
pfring-7.6.0-3000.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-3000.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2477.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.4.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.14-300 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-4.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.14-300 for FC32
Fedora 26 - Updates to Fedora 26 for both the i686 and x86_64 CPU architectures has ceased.

May 22, 2020: The following changes have been made:

bellsoft-java8-1.8.0.252-1+9.{i586,x86_64}-full.rpm - Bellsoft Java was installed for Fedora 26 through 32 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux where this recommendation can be found.
Note that the previous version of BellSoft's Java that was installed as part of autopsy can be removed with:
sudo yum erase bellsoft-java8 -y
autopsy-4.15.0-6.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and autopsy-4.15.0-6.{fc31,fc32,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. Notes:
1. This version uses the aforementiontion version of Java 8 from Bellsoft.
2. This version was tested on Fedora 26 through 32 and CentOS 7 and 8 for the x86_64 architectures using an E01 dataset that contains a 7-Zip file that contains two JPEG images, one of which has EXIF metadata. Those archives were correctly parsed and the EXIF data verified.
3. If you wish to run autopsy on a system that you are accessing via Microsoft's Remote Desktop Protocol (RDP), testing has shown that the setting the color depth on the backend X server is critical. Use the following to install the XRDP client, if necessary, adjust the host's firewall to allow RDP connection, adjust this depth parameter, and start or restart the XRDP client:
  [ -f /etc/xrdp/xrdp.ini ] || (sudo $(uname -r | grep -q el7 && echo yum || echo dnf) install xrdp && sudo systemctl enable xrdp) sudo firewall-cmd --permanent --add-port=3389/tcp; sudo firewall-cmd --reload sudo sed --in-place 's/#xserverbpp=24/xserverbpp=24/' /etc/xrdp/xrdp.ini sudo systemctl stop xrdp
  sudo systemctl start xrdp
python3-artifacts-20200515-1.{fc26,fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm, artifacts-data-20200515-1.{fc26,fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm, python36-artifacts-20200515-1.el7.x86_64.rpm, artifacts-data-20200515-1.el7.x86_64.rpm - python3-artifacts-20200515-1.{fc31,fc32,el8}.x86_64.rpm, artifacts-data-20200515-1.{fc31,fc32,el8}.x86_64.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
python2-yara-4.0.1-1.fc30.{i386,x86_64}.rpm and python2-yara-4.0.1-1.x86_64.{fc31,fc32,el8}.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.
pfring-7.6.0-2990.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-2990.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2473.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.13-300 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-3.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.13-300 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.24.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.13-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-24.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.13-200 for FC31
fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.39.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.13-100 for FC30
lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-39.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.13-100 for FC30
fmem-kernel-modules-el7-x86_64-1.6-1.66.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1127.8.2 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-66.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1127.8.2 for EL7
fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.65.noarch.rpm - Support for the following kernels were added for Fmem:
- 2.6.32-754.29.2 for EL6
lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-65.noarch.rpm - Support for the following kernels were added for LiME:
- 2.6.32-754.29.2 for EL6

May 15, 2020: The following changes have been made:

plaso-20200430-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso-20200430-1.{fc31,fc32,el7,el8}.x86_64.rpm - Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines. The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers and related systems, such as network equipment to produce a single correlated timeline. This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
sevenzipjbinding-16.02_2.01-1.el7.x86_64.rpm - 7-Zip Bindings is a java wrapper for 7-Zip C++ library. It allows extraction of many archive formats using a very fast native library directly from java through JNI.
This version was build for CentOS/RHEL 7 due to a compiler inconsistency with the version provided with Autopsy 4.15.0.
autopsy-4.15.0-5.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and autopsy-4.15.0-5.{fc31,fc32,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. This release fixes a problem with the 7 Zip ingest module on CentOS/RHEL 7. For all other releases for all other systems, these same packages were simply rebuilt to maintain release numbering consistency and contain no new functionality.
apfs-fuse-20200429-1.{fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm and apfs-fuse-20200429-1.{fc31,fc32,el7,el8}.x86_64.rpm - APFS-Fuse is a read-only FUSE driver for the new Apple File System. Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental. It may not be able to read all files, it may return wrong data, or it may simply crash. Use at your own risk. But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far). Thus, the driver may return compressed files instead of uncompressed ones. Although most of the time it should just report an error.
pfring-7.6.0-2977.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-2977.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2448.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc32-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.12-300 for FC32
- 5.6.11-300 for FC32
lime-kernel-modules-fc32-x86_64-1.1.r17-2.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.12-300 for FC32
- 5.6.11-300 for FC32
fmem-kernel-modules-fc31-x86_64-1.6-1.23.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.11-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-23.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.11-200 for FC31
fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.38.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.11-100 for FC30
lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-38.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.11-100 for FC30

May 11, 2020: The following changes have been made:

autopsy-4.15.0-4.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and autopsy-4.15.0-4.{fc31,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. This release reverts back to the JDK that comes with the OS and away from BellSoft. It also fixed a problem with the CentOS/RHEL version.

May 10, 2020: The following changes have been made:

autopsy-4.15.0-3.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and autopsy-4.15.0-3.{fc31,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card. This release reverts back to the JDK that comes with the OS and away from BellSoft.

May 8, 2020: The following changes have been made:

guymager-0.8.12-1.{fc26,fc27,fc28.fc29,fc30}.{i686,x86_64}.rpm and guymager-0.8.12-1.{fc31,el7,el8}.x86_64.rpm - Guymager is a forensic imaging package. See here for the list of changes.
hachoir-3.1.2-1.{fc26,fc27,fc28,fc29,fc30,fc31,el7,el8}.noarch.rpm - Hachoir is a Python library to view and edit a binary stream field by field. In other words, Hachoir allows you to "browse" any binary stream just like you browse directories and files. A file is splitted in a tree of fields, where the smallest field is just one bit. Examples of fields types: integers, strings, bits, padding types, floats, etc. Hachoir is the French word for a meat grinder (meat mincer), which is used by butchers to divide meat into long tubes; Hachoir is used by computer butchers to divide binary files into fields.
Notes:
1. In this version, these tools are all available: hachoir-grep, hachoir-metadata, hachoir-strip, hachoir-urwid, and hachoir-wx. As such, the previous packages where these tools were packaged separately are obsoleted.
2. For CentOS/RHEL 8, the hachoir-wx program is not available due to a lack of the Python 3 version of wx.
CERT-Forensics-Tools-1.0-90.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-90.{fc31,el7,el8}.x86_64.rpm - This relese does the following:
- Added hachoir for Fedora and CentOS/RHEL 7 and 8.
sleuthkit{,-devel,-libs}-4.9.0-1.1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and sleuthkit{,-devel,-libs}-4.9.0-1.1.{fc31,el7,el8}.x86_64.rpm - The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
bellsoft-jdk8u252+9-linux-{i586,amd64}.rpm - Bellsoft Java was installed for Fedora 26 through 32 and CentOS/RHEL 7 and 8. Bellsoft Java 8 is the recommended version of Java for Autopsy. See these instructions for installing Autopsy on Linux.
autopsy-4.15.0-2.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and autopsy-4.15.0-2.{fc31,el7,el8}.x86_64.rpm - Autopsy^® is a digital forensics platform and graphical interface to The Sleuth Kit^® and other digital forensics tools. It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
ghidra-9.1.2-PUBLIC_20200212.2.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and ghidra-9.1.2-PUBLIC_20200212.2{fc26,fc31,el7,el8}.x86_64.rpm - Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features. Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes. Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python. See the list of changes and improvement here. This release repairs some incorrect file permissions and properly references various other files within the Ghidra hierarchy.
zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-3.0.5-0.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libbroker-devel-3.0.5-0.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-3.0.5-0.{fc31,el7,el8}.x86_64.rpm, and libbroker-devel-3.0.5-0.{fc31,el7,el8}.x86_64.rpm - Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
See here for the changes for all versions of Zeek.
Zeek was originally developed by Vern Paxson. Robin Sommer now leads the project, jointly with a core team of researchers and developers at the International Computer Science Institute in Berkeley, CA; and the National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeek packages install files in /opt/zeek. To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeek/bin && ! "$PATH" =~ /opt/zeek/bin ]] && PATH=$PATH:/opt/zeek/bin [[ -d /opt/zeek/share/man && ! "$MANPATH" =~ /opt/zeek/share/man ]] && MANPATH=$MANPATH:/opt/zeek/share/man
Then run:
. ~/.bashrc
rifiuti2-0.7.0-4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and rifiuti2-0.7.0-4.{fc31,el7,el8}.x86_64.rpm - rifiuti2 is a rewrite of rifiuti, a tool for analyzing Windows Recycle Bin INFO2 file. This package was updated to avoid a conflict with the rifiuti package.
libfsntfs{,-devel,-python3}-20200506-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20200506-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20200506-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20200506-1.{fc31,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
python2-colorama-0.4.1-2.{fc30,fc31,fc32,el8}.noarch.rpm - Python-Colorama is a Python library that makes ANSI escape character sequences (for producing colored terminal text and cursor positioning) work under MS Windows. This package was built to negate obsoletes in fedora-obsolate-packages for Fedora 32. For all other releases, these same packages were simply rebuilt to maintain release numbering consistency and contain no new functionality.
umit-1.0-17.1.{fc32,el8}.noarch.rpm - Umit is a front-end for nmap. This package was built to negate obsoletes in fedora-obsolate-packages for Fedora 32. For all other releases, these same packages were simply rebuilt to maintain release numbering consistency and contain no new functionality.
python{2,3}-m2crypto-0.35.2-3.1.{fc32,el8}.x86_64.rpm - M2Crypto is a Python library that allows you to call OpenSSL functions from Python 2 and 3 scripts. This package was built to negate obsoletes in fedora-obsolate-packages for Fedora 32. For all other releases, these same packages were simply rebuilt to maintain release numbering consistency and contain no new functionality.
python-netaddr-0.7.19-18.1.fc32.x86_64 - python-netaddr is a pure Python network address representation and manipulation library. Python-netaddr provides a Pythonic way of working with: This package was built to negate obsoletes in fedora-obsolate-packages for Fedora 32.
python2-enum34-1.1.6-10.1.fc32.noarch.rpm - python-enum34 is the Python 3.4 version of enum backported to Python 2, in this case. This package was built to negate obsoletes in fedora-obsolate-packages for Fedora 32.
python2-yara-3.11.0-4.{fc30,el6}.{i386,x86_64}.rpm and python2-yara-3.11.0-4.x86_64.{fc31,fc32,el8}.rpm - Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts. This package was built to negate obsoletes in fedora-obsolate-packages for Fedora 32. For all other releases, these same packages were simply rebuilt to maintain release numbering consistency and contain no new functionality.
pfring-7.6.0-2963.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-2963.{el6,el7,el8}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2431.{el6,el7,el8}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-1.6-1.19.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem. Support for the Fedora 32 x86_64 architecture was added.
lime-kernel-modules-1.1.r17-19.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME. Support for the Fedora 32 x86_64 architecture was added.
fmem-kernel-modules-fc31-x86_64-1.6-1.22.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.8-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-22.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.8-200 for FC31
fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.37.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.5.8-100 for FC30
lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-37.noarch.rpm - Support for the following kernels were added for LiME:
- 5.5.8-100 for FC30

Fedora 32 - The repository now supports Fedora 32 for the x86_64 CPU architecture. Here is the list of tools provided for Fedora 32:

2hash
acr
analysis-pipeline
analyzeMFT
apfs-fuse
artifacts
ataraw
autopsy
bencode
binplist
biplist
bulk_extractor
CERT-Forensics-Tools
cert-forensics-tools-release
certifi
colorama
construct
crunch
cryptcat
daq
dcp
ddrescueview
ddrutility
dfdatetime
dfvfs
dfwinreg
distorm3
DropboxReader
dtfabric
eindeutig
elasticsearch
epub
exfat-utils
fatback
fcrackzip
femto
fmem-kernel-modules
fred
fundl
fuse-python

galleta
ghidra
ghostpdl
grokevt
guymager
hachoir
jafat
KHracker
libagdb
libbde
libbfio
libcreg
libesedb
libevt
libevtx
libewf
libexe
libfixbuf
libfplist
libfsapfs
libfsext
libfshfs
libfsntfs
libfvde
libfwevt
libfwnt
libfwps
libfwsi
libguytools
libhibr
liblnk
libluksde
libmdmp
libmodi
libmsiecf
libnk2
libodraw
libolecf
libpff
libphdi

libqcow
libregf
libscca
libschemaTools
libsigscan
libsmdev
libsmraw
libvhdi
libvmdk
libvshadow
libvslvm
libvsmbr
libwrc
libwtcdb
lime-kernel-modules
log2timeline
m2crypto
missidentify
mount_ewf
nDPI
netsa-python
netsa-rayon
packetexaminer
pasco
perl-File-Mork
perl-Mac-PropertyList
perl-Parse-Evtx
perl-Parse-Win32Registry
plaso
prism
pstotext
ptfinder
ptk
pycoin
pyfixbuf
python2-netaddr
python-crypto
python-enum34
python-registry
python-sqlite3dbm

python-unicodecsv
python-yara
pytsk3
qtmltfs
rar
reglookup
regripper
regripper-plugins
rekall-forensics
rifiuti2
rifiuti
scrounge-ntfs
sfdumper
shellbags
silk
silk-ipa
silk-ipset
sleuthkit
snarf
snort
snort-openappid
snort-sample-rules
stegdetect
super_mediator
tln_tools
umit
unrar
untex
videosnarf
vinetto
vmfs6-tools
vmfs-tools
Volatility
Volatility-community-plugins
winevt-kb
winreg-kb
xplico
xva-img
yaf
zeek

May 1, 2020: The following changes have been made:

qtmltfs-2.4.0.2-1.{fc28,fc29,fc30}.{i686,x86_64}.rpm and qtmltfs-2.4.0.2-1.{fc31,el7,el8}.x86_64.rpm - QTMLTFS (Quantum Linear Tape File System) enables standard file operations on LTO-5 and LTO-6 tape media.
libfsntfs{,-devel,-python3}-20200428-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20200428-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20200428-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20200428-1.{fc31,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
python3-dfvfs-20200429-1.{fc26,fc27,fc28,fc29,fc30,fc31,el8}.noarch.rpm and python36-dfvfs-20200429-1.el7.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
libregf{,-devel,-python2,-python3}-20200429-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libregf{,-devel,-python2}-20200429-1.el6.{i686,x86_64}.rpm, libregf{,-devel,-python2,-python36}-20200429-1.el7.x86_64.rpm, and libregf{,-devel,-python2,-python3}-20200429-1.{fc31,el8}.x86_64.rpm - Libregf contains libraries and tools to access the Windows NT Registry File files.
python3-dfdatetime-20200501-1.{fc26,fc27,fc28,fc29,fc30,fc31,el8}.noarch.rpm and python36-dfdatetime-20200501-1.el7.noarch.rpm - dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
pfring-7.6.0-2934.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-2934.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2425.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-common-1.6-1.6.noarch.rpm - Fmem is kernel module that creates device /dev/fmem, similar to /dev/mem but without limitations. This package contains the source code for making the FMEM kernel modules and the install-fmem script. The changes are the following:
- Fmem code up was updated to provide support for Linux 5.6 kernels.
fmem-kernel-modules-fc31-x86_64-1.6-1.21.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.6.7-200 for FC31
- 5.6.6-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-21.noarch.rpm - Support for the following kernels were added for LiME:
- 5.6.7-200 for FC31
- 5.6.6-200 for FC31
fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.5.7-100 for FC30
lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for LiME:
- 5.5.7-100 for FC30
fmem-kernel-modules-el7-x86_64-1.6-1.65.noarch.rpm - Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1127 for EL7
lime-kernel-modules-el7-x86_64-1.1.r17-65.noarch.rpm - Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1127 for EL7
fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.64.noarch.rpm - Support for the following kernels were added for Fmem:
- 2.6.32-754.29.1 for EL6
lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-64.noarch.rpm - Support for the following kernels were added for LiME:
- 2.6.32-754.29.1 for EL6

April 24, 2020: The following changes have been made:

libesedb{,-devel,-python2,-python3}-20200418-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libesedb{,-devel,-python2}-20200418-1.el6.{i686,x86_64}.rpm, libesedb{,-devel,-python2,-python36}-20200418-1.el7.x86_64.rpm, and libesedb{,-devel,-python2,-python3}-20200418-1.{fc31,el8}.x86_64.rpm - Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
libevt{,-devel,-python2,-python3}-20200418-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevt{,-devel,-python2}-20200418-1.el6.{i686,x86_64}.rpm, libevt{,-devel,-python2,-python36}-20200418-1.el7.x86_64.rpm, and libevt{,-devel,-python2,-python3}-20200418-1.{fc31,el8}.x86_64.rpm - Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
libevtx{,-devel,-python2,-python3}-20200419-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevtx{,-devel,-python2}-20200419-1.el6.{i686,x86_64}.rpm, libevtx{,-devel,-python2,-python36}-20200419-1.el7.x86_64.rpm, and libevtx{,-devel,-python2,-python3}-20200419-1.{fc31,el8}.x86_64.rpm - Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
libfsntfs{,-devel,-python3}-20200416-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,-devel,-python2}-20200416-1.el6.{i686,x86_64}.rpm, libfsntfs{,-devel,-python36}-20200416-1.el7.x86_64.rpm, and libfsntfs{,-devel,-python3}-20200416-1.{fc31,el8}.x86_64.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
pfring-7.6.0-2926.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-2926.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2411.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc31-x86_64-1.6-1.20.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.5.17-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-20.noarch.rpm - Support for the following kernels were added for LiME:
- 5.5.17-200 for FC31

April 17, 2020: The following changes have been made:

daq{,-devel,-modules}-2.0.7-10.1.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and daq{,-devel,-modules}-2.0.7-10.1.{fc31,el7,el8}.x86_64.rpm - The Data Acquisition Library (Daq) is a library used by snort. This release differs from daq provided by Fedora and EPEL because it contains the static libraries required by snort.
snort-2.9.16-1.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-2.9.16-1.{fc31,el7,el8}.x86_64.rpm - Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. See here for the changes in this version. This release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture.
snort-sample-rules-2.9.16-1.{fc26,fc27,fc28,fc29,fc30,fc31,el6,el7,el8}.noarch.rpm - These rules are sample rules only and are intended to allow snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the snort rules page to acquire a current set of snort rules.
snort-openappid-2.9.1.16-1.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.16-1.{fc31,el7,el8}.x86_64.rpm - This is the snort package built --enable-open-appid option added to the configure script that configures the build of snort. See here for more details. See the OpenAppId Detector Developer Guide for more information. To install snort-openappid on your system, you must first remove snort. Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
In addition, this release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture.
bulk_extractor-1.6.0-2.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and bulk_extractor-1.6.0-2.{fc31,el7,el8}.x86_64.rpm - Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. Bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important. This version fixes many issues. In addition, it also contains the BEViewer GUI front-end for bulk_extractor. This version was rebuilt to add SQLite and LibXML build dependencies.
libewf-experimental{,-devel,-tools,-python3,-tools}-20200405-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libewf-experimental{,-devel,-tools,-python2,-tools}-20200405-1.el6.{i686,x86_64}.rpm, libewf-experimental{,-devel,-tools,-python36,-tools}-20200405-1.el7.x86_64.rpm, and libewf-experimental{,-devel,-tools,-python3,-tools}-20200405-1.{fc31,el8}.x86_64.rpm - Libewf supports Expert Witness Compression Format (EWF) formatted files. See this page for the list of supported and unsupported formats.
Libewf-Experimental installs packages in /usr/local so that it can be optionally installed along with the conventional Libewf packages, where package contents are installed in /usr. Further, the Libewf-Experimental packages have been installed in the forensics-test repository. You will need to enable this repository with this command for Fedora or CentOS/RHEL 8:
sudo dnf config-manager --set-enabled forensics-test
or this command for CentOS/RHEL 6 and 7:
sudo yum-config-manager --enable forensics-test
python{2,36}-psutil-5.7.0-2.el7.x86_64.rpm - Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network) in Python. Note that the Python 2 version is now provided and the Python 3 version no longer obsoletes the Python 2 version.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.1-1.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.1-1.{fc31,el7,el8}.x86_64.rpm and - SiLK is the System for Internet-Level Knowledge, a collection of traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks. See here for a list of changes in this version. Note: The version of SiLK that was released on 2019-10-24 contained some bugs that were fixed in the version dated 2019-10-28. This release contains those fixes.
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.1-2.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.19.1-2.{fc31,el6,el7,el8}.x86_64.rpm - This release of the SiLK tools can be found in an optional repository that is now part of cert-forensics-tools-release named forensics-sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo. This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root. Note: The version of SiLK that was released on 2019-10-24 contained some bugs that were fixed in the version dated 2019-10-28. This release contains those fixes.
analysis-pipeline-5.11.3-4.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.11.3-4.{fc31,el7,el8}.x86_64.rpm - The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM). This package was rebuilt to use silk 3.19.0 release 3.
prism-1.2-9.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and prism-1.2-9.{fc31,el7,el8}.x86_64.rpm - The prism trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool. The script can be used directly, or might be used as a component in other more specialized scripts. In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup. This package was rebuilt to use silk 3.19.0.
super_mediator-1.7.1-3.{fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator-1.7.1-3.{fc31,el7,el8}.x86_64.rpm - Super_mediator is an IPFIX mediator for use with the YAF and SiLK tools. It collects and filters YAF output data to various IPFIX collecting processes and/or csv files. This package was rebuilt to use silk 3.19.0.
libfsapfs{,-devel,-python2,-python3}-20200416-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsapfs{,-devel,-python2}-20200416-1.el6.{i686,x86_64}.rpm, libfsapfs{,-devel,-python2,-python36}-20200416-1.el7.x86_64.rpm, and libfsapfs{,-devel,-python2,-python3}-20200416-1.{fc31,el8}.x86_64.rpm - libfsapfs is a library to access the Apple File System (APFS).
pfring-7.6.0-2903.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package contains header files and libraries, among other files, to support the PF_Ring network socket. Here is the announcement of PF_Ring 7.6.
pfring-dkms-7.6.0-2903.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed. This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi-3.2.0-2375.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
fmem-kernel-modules-fc31-x86_64-1.6-1.19.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.5.16-200 for FC31
lime-kernel-modules-fc31-x86_64-1.1.r17-19.noarch.rpm - Support for the following kernels were added for LiME:
- 5.5.16-200 for FC31
fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for Fmem:
- 5.5.16-100 for FC30
lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for LiME:
- 5.5.16-100 for FC30
fmem-kernel-modules-el8-x86_64-1.6-1.6.noarch.rpm - Support for the following kernels were added for Fmem:
- 4.18.0-147.8.1 for EL8
lime-kernel-modules-el8-x86_64-1.1.r17-6.noarch.rpm - Support for the following kernels were added for LiME:
- 4.18.0-147.8.1 for EL8

April 10, 2020: The following changes have been made:

python{2,3}-certifi-2020.4.5.1-1.{fc26,fc27,fc28,fc29,fc30,fc31,el8}.noarch.rpm and python{2,36}-certifi-2020.4.5.1-1.el7.noarch.rpm - Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
python{2,3}-pyparsing-2.4.7-1.{fc26,fc27,fc28,fc29,fc30,fc31,el8}.noarch.rpm, python{2,36}-pyparsing-2.4.7-1.el7.noarch.rpm, and pyparsing-doc-2.4.7-1.{fc26,fc27,fc28,fc29,fc30,fc31,el7,el8}.noarch.rpm - Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions. The pyparsing module provides a library of classes that client code uses to construct the grammar directly in Python code.
bulk_extractor-1.6.0-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and bulk_extractor-1.6.0-1.{fc31,el7,el8}.x86_64.rpm - Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. Bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important. This version fixes many issues. In addition, it also contains the BEViewer GUI front-end for bulk_extractor.
CERT-Forensics-Tools-1.0-89.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-89.{fc31,el7,el8}.x86_64.rpm - This relese does the following:
- Added bulk_extractor
Volatility-community-plugins-20190729-5.{fc26,fc27,fc28,fc29,fc30,fc31,el6,el7,el8}.noarch.rpm - The Volatility Community Plugins is a collection of Volatility plugins written and maintained by authors in the forensics community. This package was updated to reflect the removal of the python-dpapick dependency for Fedora 31. No changes were made for any of the other provided systems.
python2-dpapick-0.3-1.fc31.noarch.rpm - Python-DPAPick is a Python toolkit to provide a platform-independant implementation of Microsoft's cryptography subsytem called DPAPI (Data Protection API). This package was removed from the Fedora 31 repository for the x86_64 architecture.
python-CFPropertyList-0.0.1-1.fc31.x86_64.rpm - Python-CFPropertyList is a Python toolkit to that contains classes to read binary property list files as defined by Apple. This package was removed from the Fedora 31 repository for the x86_64 architecture.
python-registry-1.2.0-1.fc31.x86_64.rpm - Python-registry provides read-only access to Windows Registry files, such as NTUSER.DAT, userdiff, and SOFTWARE. This package was removed from the Fedora 31 repository for the x86_64 architecture.
python-unicodecsv-0.14.0-1.fc31.x86_64.rpm - Python-unicodecsv is a drop-in replacement for Python 2.7’s csv module which supports unicode strings without a hassle. This package was removed from the Fedora 31 repository for the x86_64 architecture.
pfring-7.6.0-2900.{el6,el7}.x86_64.rpm -