June 26, 2017:
The following changes have been made:
- partclone-0.3.6-2.el7.x86_64.rpm and partclone-0.3.6-2.el6.{i386,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), exfat, xfs, vmfs3 and vmfs5.
See the /usr/share/doc/partclone/ChangeLog for the list of changes in this release.
This version was rebuilt because of an update to ntfs-3g in EL6 and EL7.
- testdisk-7.0-4.1.el6.{i686,x86_64}.rpm and qphotorec-7.0-4.1.el6.{i386,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
These releases were built to use the latest version of libewf that is installed in this repository.
|
|
June 23, 2017:
The following changes have been made:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 20, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.11.5-200 for FC25
- 4.11.4-200 for FC25
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.11.5-200 for FC25
- 4.11.4-200 for FC25
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.42.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.11.5-100 for FC24
- 4.11.4-100 for FC24
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-42.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.11.5-100 for FC24
- 4.11.4-100 for FC24
- yara-python-3.6.0-1.{fc24,fc25}.x86_64.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in Fedora 24 and 25.
- partclone-0.3.6-2.{fc24,fc25}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), exfat, xfs, vmfs3 and vmfs5.
See the /usr/share/doc/partclone/ChangeLog for the list of changes in this release.
This version was rebuilt because of an update to ntfs-3g in Fedora 24 and 25.
|
|
June 19, 2017:
The following changes have been made:
- yara-python-3.6.0-1.el7.x86_64.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of the update to yara in EPEL for CentOS/RHEL 7.
|
|
June 14, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- partclone-0.3.6-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), exfat, xfs, vmfs3 and vmfs5.
See the /usr/share/doc/partclone/ChangeLog for the list of changes in this release.
- exfat-utils-1.2.7-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
See here for the list of changes since the last released version (1.2.3).
- xmount-0.7.5-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. The changes in this version are the following:
Here are the changes for this version:
- New for version 0.7.5
- Improved and fixed the way fsname is built.
- Added a patch fixing a bug in libxmount_input_aewf (supplied by Guy Voncken)
- New for version 0.7.4
- Re-enabled full OSx support
- libxmount_input_aewf input library is now able to decompress EWF chunks in parallel, which will increase read speed
- sleuthkit-{,devel,libs}-4.4.1-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.4.0) released to this repository.
|
|
June 2, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.41.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-41.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
- lime-kernel-modules-common-1.1.r17-4.noarch.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
This package contains only the source code for making the LiME kernel modules, the CaptureMemoryWithLime script and the corresponding manual page.
This package also obsoletes tie lime-kernel-objects package which contained the source code and all of the kernel objects.
This repackaging increases the number of packages but decreases their size.
This revision fixes a problem that resulted from the release of the
4.11 kernel for Linux.
Note: this RPM is hard-linked between all of the supported architectures, Fedora 20-25 and CentOS 6 and 7
If you use rsync, make certain that you use the -H option to preserve those hard links.
|
|
May 26, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.40.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.10.15-100 for FC24
- 4.10.16-100 for FC24
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-40.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.10.15-100 for FC24
- 4.10.16-100 for FC24
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- jansson{,-devel}-2.9-1.el7.x86_64.rpm and jansson-devel-doc-2.9-1.el7.noarch.rpm - Jansson
is a C library for encoding, decoding and manipulating JSON data. It features:
- Simple and intuitive API and data model
- Comprehensive documentation
- No dependencies on other libraries
- Full Unicode support (UTF-8)
- Extensive test suite
This tool was built to be used by yara-python .
- yara{,-doc,-devel}-3.5.0-7.1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Note that the -devel and -doc packages split out the files needed for development and documentation respectively.
- yara-python-3.5.0-7.1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
- dislocker{,-libs}-0.7.1-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm and fuse-dislocker-0.7.1-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm >/TT>-
Dislocker reads BitLocker encrypted partitions under a Linux system.
The driver has the capability to read/write on:
- Windows Vista, 7, 8, 8.1 and 10 encrypted partitions - that's AES-CBC, AES-XTS, 128 or 256 bits, with or without the Elephant diffuser, encrypted partitions;
- BitLocker-To-Go encrypted partitions - that's USB/FAT32 partitions.
The core driver is composed of a library, with multiple binaries (see the NOTES section below) using this library.
Two binaries are of interest when wanting to decrypt a BitLocker encrypted partition:
- dislocker-fuse: binary using FUSE to dynamically decrypt the BitLocker-ed partition.
You have to give it a mount point where, once keys are decrypted, a file named dislocker-file appears.
This file is a virtual NTFS partition, so you can mount it as any NTFS partition and then read from or write to it.
Note that writing to the NTFS virtual file will change the underlying BitLocker partition's content.
- dislocker-file: binary decrypting a BitLocker encrypted partition into a flat file.
This file has to be given through command line and, once dislocker-file is finished, will be an NTFS partition.
It won't have any link to the original BitLocker partition.
Therefore, if you write to this file, the BitLocker volume won't change, only the NTFS file will.
Note that this may take a long time to create that file, depending on the size of the encrypted partition.
But afterward, once the partition is decrypted, the access to the NTFS partition will be faster.
Another thing to think about is the size on your disk this binary needs: the same size as the volume you're trying to decrypt.
Nevertheless, once the partition is decrypted, you can mount your file as any NTFS partition.
- CERT-Forensics-Tools-1.0-73.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - This package was updated as follows:
- The dislocker suite was added for all supported systems.
|
|
May 19, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.39.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-39.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-6.6.0-1231.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1231.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- aeskeyfind-1.0-3.(fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Aeskeyfind
illustrates automatic techniques for locating 128-bit and 256-bit AES keys in a captured memory image.
The program uses various algorithms and also performs a simple entropy test to filter out blocks that are not keys.
It counts the number of repeated bytes and skips blocks that have too many repeats.
This method works even if several bits of the key schedule have been corrupted due to memory decay.
This package is useful to several activities, as forensics investigations.
- CERT-Forensics-Tools-1.0-72.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - This package was updated as follows:
- The package aeskeyfind was added for all supported systems.
|
|
May 8, 2017:
The following changes have been made:
- nDPI{,-devel}-1.8-3.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
This version eliminates a dependency for CentOS/RHEL 6 for the x86_64 architecture.
The other revisions for all other systems and architectures are to maintain revision compatibility.
|
|
April 28, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.38.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-38.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.37.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-37.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-514.16.1 for EL&
- 3.10.0-514.10.2 for EL7
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-514.16.1 for EL&
- 3.10.0-514.10.2 for EL7
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- libvslvm{,-devel,-python,-python3,-tools}-20160110-2.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libvslvm{,-devel,-python,-tools}-20160110-2.el6.{i686,x86_64}.rpm - Libvslvm
is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
This release added the missing FUSE dependencies.
- CERT-Forensics-Tools-1.0-71.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - This package was updated as follows:
- The package libvslvm-tools was added for all supported systems.
|
|
April 13, 2017:
The following changes have been made:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- Volatility-community-plugins-20170405-2.fc25.noarch.rpm - The Volatility Community Plugins for Fedora 25 had
an incorrect dependency which has been fixed.
|
|
April 7, 2017:
The following changes have been made:
- sleuthkit-{,devel,libs}-4.4.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.3.0) released to this repository.
- pytsk3-20170324-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
- ddrescue-1.22-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
See here for the changes since the last version (1.21) released to this repository.
- ddrutility-2.8-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue. It currently contains the following utilities:
- ddru_findbad
- ddru_ntfsbitmap
- ddru_ntfsfindbad
- ddru_diskutility
- ddru_diskutility
See here for the list of changes in this release.
- dd_rescue-1.99.5-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
See here for the changes since the last version (1.99) released to this repository.
- dc3dd-7.2.646-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i386,x86_64}.rpm - dc3dd is a patched version of GNU dd that
includes several features useful for computer forensics.
- guymager-0.8.4-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Guymager is a forensic imaging package.
See here for the list of changes.
- dfvfs-20170324-1.(fc20,fc21,fc22,fc23,fc24,fc25,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- libbde{,-devel,-python,-python3,-tools}-20170204-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libbde{,-devel,-python,-tools}-20170204-1.el6.{i686,x86_64}.rpm- Libbde
is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
- libbfio,{-devel}-20170123-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i386,{i386,x86_64}}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access.
See here for the list of changes.
- libesedb{,-devel,-python,-python3,-tools}-20170121-1.(fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libesedb{,-devel,-python,-tools}-20170121-1.el6.{i686,x86_64}.rpm- Libesedb
contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
See here for the list of changes.
- libevt{,-devel,-python,-python3,-tools}-20170120-1.(fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libevt{,-devel,-python,-tools}-20170120-1.el6.{i686,x86_64}.rpm - Libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- libevtx{,-devel,-python,-python3,-tools}-20170122-1.(fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libevtx{,-devel,-python,-tools}-20170120-1.el6.{i686,x86_64}.rpm - Libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- libfwsi{,-devel,-python,-python3}-20160110-1.(fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libfwsi{,-devel,-python}-20160110-1.el6.{i686,x86_64}.rpm- Libfwsi is a library to access the
Windows Shell Item format.
See here for the list of changes.
- libiconv{,-devel,-static,-utils}-1.15-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Libiconv
provides an iconv() implementation, for use on systems which don't have one, or whose implementation cannot convert from/to Unicode.
Due to conflicts with other packages, notably glibc, the libiconv packages are installed in /usr/libiconf.
This release makes the library files also available at /usr/libiconf/lib for the x86_64 architecture which makes the package easier to use when building
packages that use libiconv.
- liblnk{,-devel,-python,-python3,-tools}-20170111-1.(fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and liblnk{,-devel,-python,-tools}-20170111-1.el6.{i686,x86_64}.rpm- Liblnk contains libraries and tools to access the
Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libmsiecf{,-devel,-python,-python3,-tools}-20170116-1.(fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libmsiecf{,-devel,-python,-tools}-20170116-1.el6.{i686,x86_64}.rpm- Libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libolecf{,-devel,-python,-python3,-tools}-20170129-1.(fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libolecf{,-devel,-python,-tools}-20170129-1.el6.{i686,x86_64}.rpm- Libolecf
contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libqcow{,-devel,-python,-python3,-tools}-20170222-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libqcow{,-devel,-python,-tools}-20170222-1.el6.{i686,x86_64}.rpm - Libqcow
is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
See here for the list of changes.
- libsigscan{,-devel,-python,-python3,-tools}-20170124-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libsigscan{,-devel,-python,-tools}-20170124-1.el6.{i686,x86_64}.rpm-
a href="https://github.com/libyal/libsigscan/wiki">Libsigscan is a library and tools used to binary signature scanning.
See here for the list of changes.
- libsmdev{,-devel,-python,-python3,-tools}-20170225-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libsmdev{,-devel,-python,-tools}-20170225-1.el6}.{i686,x86_64}.rpm -
Libsmdev is a library and tools used to access storage media devices.
See here for the list of changes.
- libvhdi{,-devel,-python,-python3,-tools}-20170223-1.(fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libvhdi{,-devel,-python,-tools}-20170223-1.el6.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- libvmdk{,-devel,-python,-python3,-tools}-20170226-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libvmdk{,-devel,-python,-tools}-20170226-1.el6.{i686,x86_64}.rpm - Libvmdk
is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
See here the list of changes.
- nDPI{,-devel}-1.8-2.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
This version brings the code base used to build this package up to 2017-03-28.
- partclone-0.2.90-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
See here for the list of changes in this release.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.15.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.15.0‑2.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.15.0‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- silk-ipset{-devel,-lib,-tools}-3.15.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- capstone{,-devel,-python,-python3}-3.0.4-4.{fc20,fc21}.{i686,x86_64}.rpm and capstone-java-3.0.4-4.noarch.rpm - Capstone is a
lightweight multi-platform, multi-architecture disassembly framework.
See here for the list of changes and future features.
- capstone{,-devel,-python,-python3}-3.0.4-4.el7.x86_64.rpm - Capstone is a
lightweight multi-platform, multi-architecture disassembly framework.
See here for the list of changes and future features.
- capstone{,-devel,-python,}-3.0.4-4.el6.(i386,x86_64}.rpm - Capstone is a
lightweight multi-platform, multi-architecture disassembly framework.
See here for the list of changes and future features.
- pyew-2.3.0.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Pyew is a (command line) python tool to analyse malware.
It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits), PE and ELF file formats (it performs code analysis and let you write scripts using an
API to perform many types of analysis), follows direct call/jmp instructions in the interactive command line, displays function names and string data references; supports
OLE2 format, PDF format and more.
It also supports plugins to add more features to the tool.
- radare{,-devel}-2.1.3.0-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and radare{,‑devel}‑2.1.3.0‑1.el7.x86_64.rpm - Radare is a framework for doing reverse engineering.
- python-radare-2.1.3.0-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and python‑radare‑2.1.3.0‑1.el7.x86_64.rpm - Python-Radare are
bindings that allow Radare to be used from Python.
- Volatility-2.6-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.6.
You can read about this version here
Since the Volatility-community-plugins contain the mimikatz plugin, that plugin is no longer packaged with Volatility.
- Volatility-community-plugins-20170405-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.noarch.rpm - The Volatility Community Plugins
is a collection of Volatility plugins written and maintained by authors in the forensics community.
Many of these are the result of the last 3 years of Volatility plugin contests, but some were just written for fun.
Either way, it's an entire arsenal of plugins that you can easily extend into your existing Volatility installation.
These plugins are installed in /usr/share/volatility/plugins/community/.
Note: The following plugins were removed the el6: PhilipHuppert, ThomasChopitea, TranVienHa, YingLi, DaveLasalle, LoïcJaquemet, and artoszInglot.
- python-haystack-0.36-0.noarch.rpm - Python-Haystack is an heap analysis framework, focused on searching and reversing of
C structure in allcoated memory.
- python-pycoin-0.77-0.noarch.rpm - Python-Pycoin is an implementation of several utility routines that may be useful when dealing with
bitcoin and some alt-coins. It has been tested with Python 2.7, 3.3, 3.4 and 3.5.
- python-dpapick-0.3-0.noarch.rpm - Python-Dpapick is a Python toolkit to provide a platform-independant implementation
of Microsoft's cryptography subsytem called DPAPI (Data Protection API).
It can be used either as a library or as a standalone tool.
It is also the first open-source tool that allows decryption of DPAPI structures in an offline way and, moreover, from another plateform than Windows.
It is provided with some application probes that includes the built-in logic to retreive the corresponding secrets that are protected.
For more information go here.
- python-typing-3.6.1.0-0.noarch.rpm - Python-Typing is a backport of the standard library typing module to Python versions older than 3.6.
Typing defines a standard notation for Python function and variable type annotations.
The notation can be used for documenting code in a concise, standard format, and it has been designed to also be used by static and runtime type checkers, static analyzers, IDEs and other tools.
Note: this package was installed only for Fedora 20, 21, and 22.
All other versions of Fedora and CentOS provide this package.
- python-M2Crypto-0.26.0-0.noarch.rpm - Python-M2Crypto is the most complete Python wrapper for OpenSSL
featuring RSA, DSA, DH, EC, HMACs, message digests, symmetric ciphers (including AES); SSL functionality to implement clients and servers; HTTPS extensions to Python’s httplib, urllib, and xmlrpclib;
unforgeable HMAC’ing AuthCookies for web session management; FTP/TLS client and server; S/MIME; ZServerSSL: A HTTPS server for Zope and ZSmime: An S/MIME messenger for Zope.
M2Crypto can also be used to provide SSL for Twisted.
Smartcards are supported through the Engine interface.
- python-ioc_writer-0.3.3-0.noarch.rpm - Python-IOC_Writer is a Python library that allows for basic creation and editing of
OpenIOC objects. It supports a basic CRUD (Create, Read, Update, Delete) for various items.
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 20, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 10, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- super_mediator-1.5.2-1.{fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the list of changes for this release.
- snarf{,-devel,-python}-0.3.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm - Snarf is a distributed alert reporting system.
Applications can use snarf's C and Python APIs to construct and send network alert messages,
which can then be routed to multiple destinations in a configurable manner.
See here for the list of changes for this release.
Note: due to the changing package requirements of snarf, there is no support for Fedora 20 and CentOS/RHEL 6.
- CERT-Forensics-Tools-1.0-70.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - This package was updated as follows:
- The package xplico is now installed for Fedora 25.
- The package snarf is now installed for Fedora 25, 24, 23, 22, and 20, and CentOS/RHEL 6 and 7.
Snarf is not available for Fedora 21.
|
|
March 3, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.9.11-200 for FC25
- 4.9.12-200 for FC25
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.9.11-200 for FC25
- 4.9.12-200 for FC25
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- 2.6.32-642.13.2 for EL6
- 2.6.32-642.15.1 for EL6
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- 2.6.32-642.13.2 for EL6
- 2.6.32-642.15.1 for EL6
|
|
February 23, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- pyfixbuf-0.2.1-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Pyfixbuf
is a Python API for libfixbuf, an implementation of the
IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this
and all releases.
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.70-1.1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
See here for the list of changes.
- socat-1.7.3.2-1.1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Socat is a relay for bidirectional data transfer between two independent data channels.
Each of these data channels may be a file, pipe, device (serial line etc. or a pseudo terminal), a socket (UNIX, IP4, IP6 - raw, UDP, TCP), an
SSL socket, proxy CONNECT connection, a file descriptor (stdin etc.), the GNU line editor (readline), a program, or a combination of two of these.
These modes include generation of "listening" sockets, named pipes, and pseudo terminals.
Socat can be used, e.g., as TCP port forwarder (one-shot or daemon), as an external socksifier, for attacking weak firewalls, as a shell interface to UNIX
sockets, IP6 relay, for redirecting TCP oriented programs to a serial line, to logically connect serial lines on different computers, or to establish a
relatively secure environment (su and chroot) for running client or server shell scripts with network connections.
See the change log that is part of the RPM package for a list of changes since the last version (1.7.3.0).
- pfring-6.4.1-1143.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.4.1-1143.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- bokken-1.8-2.{fc20,fc21,fc22,fc23,fc24,fc24,el6,el7}.{i686,x86_64}.rpm and bokken‑1.8‑1.{el6,el7}.x86_64.rpm - Bokken is a GUI for the
Pyew and Radare projects so it offers almost all the same features that
Pyew has and and some of the Radare's ones.
It's intended to be a basic disassembler, mainly, to analyze malware and vulnerabilities.
This release was built to correct a configuration error in the bokken script that set the shell variable BOKKEN_DIR incorrectly for systms of the x86_64 architecture.
|
|
February 10, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
February 4, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- xplico-1.2.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
Here are the chanes for this version:
- pfring-6.4.1-1064.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.4.1-1064.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- yaf{,-devel}-2.8.4-2.{el6,el7}.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
This package has been rebuilt to assert the --with-pfring configuration option.
Note that this is a package that supports PR_Ring sockets.
To install PF_Ring on your CentOS/RHEL system, please follow the directions found here.
|
|
January 15, 2017:
The following changes have been made:
- super_mediator-1.5.0-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the list of changes for this release.
- libschemaTools{,-devel}-1.2.1-1-{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - libschemaTools
is a library that provides a standard representation of data records.
It is built on fixbuf, using IPFIX information elements.
It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source.
SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records.
See here for the list of changes for this release.
- analysis-pipeline-5.6.1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes for this release.
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
December 31, 2016:
The following changes have been made:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-514.2.2 for EL7
- 3.10.0-514 for EL7
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-514.2.2 for EL7
- 3.10.0-514 for EL7
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- daq-2.0.6-2.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i386,x86_64}.rpm - The Data Acquisition Library (Daq) is a library
used by snort.
Changes made to support NFQ which is the new and improved way to process
iptables packets.
- snort-2.9.9.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-openappid-2.9.9.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - This is the snort package
built with the following additions:
- snort-sample-rules-2.9.9.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
|
|
December 22, 2016:
The following changes have been made:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
December 15, 2016:
The following changes have been made:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
December 12, 2016:
The following changes have been made:
- Fedora 8 - The repository files for Fedora 8 have beem removed.
- Fedora 9 - The repository files for Fedora 9 have beem removed.
- Fedora 10 - The repository files for Fedora 10 have beem removed.
- Fedora 11 - The repository files for Fedora 11 have beem removed.
- Fedora 12 - The repository files for Fedora 12 have beem removed.
- Fedora 13 - The repository files for Fedora 13 have beem removed.
- Fedora 14 - The repository files for Fedora 14 have beem removed.
- Fedora 15 - The repository files for Fedora 15 have beem removed.
- Fedora 16 - The repository files for Fedora 16 have beem removed.
|
|
December 8, 2016:
The following have been released:
- Fedora 25 - The repository now supports Fedora 25
for both the i686 and x86_64 CPU architectures.
Here is the list of tools provided for Fedora 25:
- fmem-kernel-modules-1.6-1.9.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 25 x86_64 and i686 architectures was added.
- lime-kernel-modules-1.1.r17-9.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 25 x86_64 and i686 architectures was added.
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.8.8-200 for FC24
- 4.8.7-200 for FC24
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.8.8-200 for FC24
- 4.8.7-200 for FC24
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.8.10-100 for FC23
- 4.8.8-100 for FC23
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.8.10-100 for FC23
- 4.8.8-100 for FC23
- libpff-20161119-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i386,x86_64}.rpm - Libpff is a library
and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.
PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
Libpff is used by DFF,the Digital Forensics Framework.
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.14.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.14.0‑2.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.14.0‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis-pipeline-5.5-2.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
This release was built using SiLKSiLK version 3.14.0.
- silk-ipset{,-devel,-lib,-tools}-3.14.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- Volatility-community-plugins-20161202-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.noarch.rpm - The Volatility Community Plugins
is a collection of Volatility plugins written and maintained by authors in the forensics community.
Many of these are the result of the last 3 years of Volatility plugin contests, but some were just written for fun.
Either way, it's an entire arsenal of plugins that you can easily extend into your existing Volatility installation.
These plugins are installed in /usr/share/volatility/plugins/community/.
- dff-1.3.6-20161201.1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm - The Digital Forensics Framework (DFF)
is both a digital investigation tool and a development platform.
The framework is used by system administrators, law enforcement examiners, digital forensics researchers and students, and security professionals world-wide.
Written in Python and C++,
it exclusively uses Open Source technologies.
DFF combines an intuitive user interface with a modular and cross-platform architecture.
This version is the developer version as of December 1, 2016.
To support this version, the following were also installed:
- Fedora 25 (From RPM Fusion)
- ffmpeg-3.1.5-1.fc25.i686.rpm
- ffmpeg-devel-3.1.5-1.fc25.i686.rpm
- ffmpeg-libs-3.1.5-1.fc25.i686.rpm
- lame-3.99.5-6.fc25.i686.rpm
- lame-devel-3.99.5-6.fc25.i686.rpm
- lame-libs-3.99.5-6.fc25.i686.rpm
- libavdevice-3.1.5-1.fc25.i686.rpm
- x264-devel-0.148-13.20160924git86b7198.fc25.i686.rpm
- x264-libs-0.148-13.20160924git86b7198.fc25.i686.rpm
- x265-devel-1.9-3.fc25.i686.rpm
- x265-libs-1.9-3.fc25.i686.rpm
- xvidcore-1.3.4-2.fc24.i686.rpm
- xvidcore-devel-1.3.4-2.fc24.i686.rpm
- xplico-1.1.1-6.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.x86_64.rpm - xplico is an Internet traffic decoder.
Xplico needs various variables set in the /etc/php.ini file.
These used to be set in the scripts provided by the package and in the script that starts Xplico.
They are now set in the configuration file for the Apache Web Server.
Nonetheless, when Xplico is installed, the Apache Web Server must be restarted if it was running and started otherwise.
Note also that Xplico is not avaible for Fedora 25. This is because of an incompatibility between PHP 7 which is provided
with Fedora 25 and the version of CakePHP that was used to build Xplico (1.3.20).
- CERT-Forensics-Tools-1.0-69.fc25.{i686,x86_64}.rpm - This package was updated as follows:
- The package Xplico was temporarily removed for Fedora 25. It will be re-added when it supports PHP 7.
|
|
November 14, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.69-1.1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.13.0-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.13.0‑2.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.13.0‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis-pipeline-5.5-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
See here for the changes since the last version (5.4.1).
- silk-ipset{,-devel,-lib,-tools}-3.13.0-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- super_mediator-1.4.0-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
This release was rebuilt to use silk-ipset-3.13.0.
- libvshadow{,-devel,-python,-tools}-20161111-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libvshadow
is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
This version uses the external version of libbfio to support
DFF, the Digital Forensics Framework.
- libfwnt{,-devel,-python,-python3}-20151103-1.(fc20,fc21,fc22,fc23,fc24,el7}.noarch.rpm and libfwnt{,-devel,-python}-20160418-1.el6.noarch.rpm -
LibFWNT, is a library for Windows NT data types.
See here for the list of changes.
This package is needed by dfvfs and plaso.
- libscca{,-devel,-python,-python3,-tools}-20161031-1.{fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libscca{,-devel,-python,-tools}-20161031-1.el6.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
See here for the list of changes.
|
|
November 8, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- python-dfdatetime-20161104-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.noarch.rpm - dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
|
|
October 31, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.7.9-100 for FC23
- 4.7.8-100 for FC23
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.7.9-100 for FC23
- 4.7.8-100 for FC23
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- xplico-1.1.1-5.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.x86_64.rpm - xplico is an Internet traffic decoder.
Xplico needs various variables set in the /etc/php.ini file.
In all releases before this one, these variables were set only when the package was installed, and unset when the package was removed.
This method did not take into account new releases of the package of which /etc/php.ini is a part.
To solve this problem, the script that start xplico - /usr/sbin/xplico - has been changed to set these variables
every time xplico is started and return them to their previous values when xplico is stopped.
This technique makes xplico immune to changes in other packages installed on a system.
- artifacts-20161022-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.noarch.rpm - Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
This package was built to support plaso.
- python-dfdatetime-20161017-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.noarch.rpm - dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
This package is needed by dfvfs.
- libexe{,-devel,-python,-python3,-tools}-20160418-1.(fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libexe{,-devel,-python,-tools}-20160418-2.el6.{i686,x86_64}.rpm - Libexe
is a library to access the executable (EXE) format.
See here for the list of changes.
- libwrc{,-devel,-python,-python3,-tools}-20160418-1.(fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libwrc{,-devel,-python,-tools}-20160418-2.el6.{i686,x86_64}.rpm - Libwrc
is a library to access the Windows Resource Compiler (WRC) format.
See here for the list of changes.
- pytsk3-20160721-1.{fc20,fc21,fc22,fc23,fc24,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
Note that this version is now named pytsk3 and it obsoletes pytsk.
- plaso-1.5.1-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm, plaso-1.5.0-1.,el7.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the 1.5.0 release announcement here.
There is no comprehensive list of changes for 1.5.1.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, 23, and 24 for i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
Installation as an update and as a new install of have been successfully tested.
- dfvfs-20160918-2.(fc20,fc21,fc22,fc23,fc24,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
This version was rebuilt to use the renamed pytsk3.
|
|
October 21, 2016:
The following have been released:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- xplico-1.1.1-4.el7.x86_64.rpm - xplico is an Internet traffic decoder.
This release uses systemctl instead of systemon CentOS/RHEL 7.
- xplico-1.1.1-3.el7.x86_64.rpm - xplico is an Internet traffic decoder.
This release was rebuilt to use the Python 3.3 code for CentOS/RHEL 7.
|
|
October 14, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 7, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 30, 2016:
The following have been released:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 23, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.68-1.1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
See here for the list of changes.
- libbde{,-devel,-python,-python3,-tools}-20160731-2.{fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libbde{,-devel,-python,-tools}-20160731-2.el6.{i686,x86_64}.rpm- Libbde
is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
- libesedb{,-devel,-python,-python3,-tools}-20160622-2.(fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libesedb{,-devel,-python,-tools}-20160622-2.el6.{i686,x86_64}.rpm- Libesedb
contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
See here for the list of changes.
- libmsiecf{,-devel,-python,-python3,-tools}-20160904-1.(fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libmsiecf{,-devel,-python,-tools}-20160904-2.el6.{i686,x86_64}.rpm - Libmsiecf
contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libolecf{,-devel,-python,-python3,-tools}-20160918-2.(fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libolecf{,-devel,-python,-tools}-20160918-2.el6.{i686,x86_64}.rpm- Libolecf
contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libfvde{,-devel,-python,-python3,-tools}-20160918-1.{fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libfvde{,-devel,-python,-tools}-20160918-1.el6.{i686,x86_64}.rpm - Libfvde
is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
See here for a list of changes since the last release (20150222).
- libsmraw{,-devel,-python,-python3,-tools}-20160424-2.{fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm and libsmraw{,-devel,-python,-tools}-20160424-2.el6.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies.
Libsmraw contains supports for multiple (split) RAW naming schemes.
This release was rebuilt to remove debugging information and to support Python 3 where possible and practical.
- dfvfs-20160918-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- dfwinreg-20160428-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm and dfwinreg-20160428-1.{el6,el7}.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- xlsxwriter-0.9.3-1.{fc20,fc21,fc22,fc23,fc24,el6}.{i686,x86_64}.rpm and xlsxwriter-0.9.3-1.el7.x86_64.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- efilter-1-1.5-1.{fc20,fc21,fc22,fc23,fc24,el6}.{i686,x86_64}.rpm and efilter-1-1.5-1.el7.x86_64.rpm - Efilter
is a general purpose query language designed to be embedded in Python applications and libraries.
It supports SQL-like syntax to filter your application's data and provides a convenient way to directly search through the objects your applications manages.
A second use case for EFILTER is to translate queries from one query language to another, such as from SQL to OpenIOC and so on.
A basic SQL-like syntax and a POC lisp implementation are included with the language, and others are relatively simple to add.
- python-psutil-2.1.3-1.el6.{i686,x86_64}.rpm - Python-psutil is a cross-platform library for retrieving information onrunning processes and
system utilization (CPU, memory, disks, network)in Python.
This package was built to support plaso.
- plaso-1.5.0-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm, plaso-1.5.0-1.{el6,el7}.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, 23, and 24 for i686 and x86_64
architectures and CentOS/RHEL versions 6 and 7 for the x86_64 architecture for this version of plaso.
Installation as an update and as a new install of have been successfully tested.
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 11, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-common-1.6-1.3.noarch.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
This package contains the source code for making the FMEM kernel modules and the install-fmem script.
Note: this RPM is hard-linked between all of the supported architectures, Fedora 20-24 and CentOS 6 and 7.
If you use rsync, make certain that you use the -H option
to preserve those hard links.
- lime-kernel-modules-common-1.1.r17-3.noarch.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
This package contains only the source code for making the LiME kernel modules, the CaptureMemoryWithLime script and the corresponding manual page.
This package also obsoletes tie lime-kernel-objects package which contained the source code and all of the kernel objects.
This repackaging increases the number of packages but decreases their size.
Note: this RPM is hard-linked between all of the supported architectures, Fedora 20-24 and CentOS 6 and 7
If you use rsync, make certain that you use the -H option to preserve those hard links.
- yara{,-doc,-devel}-3.5.0-5.1.{fc20,fc21,fc22,fc23,fc24,el6}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
This release (5.1) was rebuilt to coincide with the version from Fedora (3.5.0-5)but to eliminate some dependency problems on Fedora 23 and 24.
Note also that the -devel and -doc packages split out the files needed for development and documentation respectively.
|
|
August 26, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- analyzeMFT-2.0.19-1.1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - AnalyzeMFT is a tool that fully parses
the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.
See here for the changes since the previously installed version 2.0.19.
|
|
August 22, 2016:
The following have been released:
- yara-3.5.0-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Here are the changes since the last version (3.4.0):
- Match length operator (http://yara.readthedocs.io/en/v3.5.0/writingrules.html#match-length)
- Performance improvements
- Less memory consumption while scanning processes
- Exception handling when scanning memory blocks
- Negative integers in meta fields
- Added the --stack-size command-argument
- Functions import_ordinal, is_dll, is_32bit and is_64bit added to PE module
- Functions rich_signature.toolid and rich_signature.version added to PE module
- Lots of bug fixes
- yara-python-3.5.0-2.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
Here are the changes since the last version (3.4.0):
- Match length operator (http://yara.readthedocs.io/en/v3.5.0/writingrules.html#match-length)
- Performance improvements
- Less memory consumption while scanning processes
- Exception handling when scanning memory blocks
- Negative integers in meta fields
- Added the --stack-size command-argument
- Functions import_ordinal, is_dll, is_32bit and is_64bit added to PE module
- Functions rich_signature.toolid and rich_signature.version added to PE module
- Lots of bug fixes
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- cert-forensics-tools-release-2{3,4}-12.noarch.rpm - cert-forensics-tools-release is the package
that connects a Fedora-based computer system to the CERT Linux Forensics Tools Repository (LiFTeR).
This package has been changed to require either a Fedora release or a Generic release to be able to install this package.
Note that this feature is entitied Boolean Dependencies and as such requires a version of rpm version 4.13 or newer.
See here for an explanation of Boolean Dependencies.
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 12, 2016:
The following have been released:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.67-1.1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
See here for the list of changes.
|
|
August 5, 2016:
The following have been released:
- opencl-headers-1.2-7.el6.noarch.rpm - OpenCL-Headers:
The OpenCL registry contains specifications of the core API and the OpenCL C language; a portable intermediate representation of
OpenCL programs; specifications of Khronos- and vendor-approved OpenCL extensions; and links to header files corresponding to the
specifications, which are now hosted in the OpenCL-Headers Github repository.
- hashcat-3.00-1-{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Hashcat is the world's fastest
and most advanced password recovery utility, supporting five unique modes of attack for over 160 highly-optimized hashing algorithms.
Hashcat currently supports CPUs, GPUs other hardware-accelerators on Linux, Windows and OSX, and has facilities to help enable distributed password cracking.
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- RPMForge -
According to this website: https://wiki.centos.org/AdditionalResources/Repositories,
the RPMForge and RepoForge repositories are dead and are no longer recommended for use.
To that end, all of the packages used by CentOS/RHEL 6 and 7 have been added to this repository.
To remove these packages and the RPMForge repository from your system and to install the needed replacement packages from the CERT Linux Forensics Tools Repository, do the following:
sudo yum -y erase `yum list installed | grep -i rpmforge | awk '{print $1}'`
sudo yum -y install CERT-Forensics-Tools
This is the list of tools that have been rebuilt and added to the CERT Linux Forensics Tools Repository.
- 2hash-0.2-1.el6.{i686,x86_64}.rpm - 2hash is a tool to calculate the md5 and sha1 hashes of a file in a single read.
If you’re regularly checking/calculating hashes of large files this’ll save you a lot of disk I/O.
- adns-0.2-1.el6.{i686,x86_64}.rpm - ADNS is a resolver library for C (and C++) programs, and a collection of useful DNS resolver utilities.
- cryptcat-1.2.1-1.1-{el6,el7}.{i686,x86_64}.rpm - Cryptcat is the standard netcat enhanced with twofish encryption
with ports for Windows NT, BSD and Linux. Twofish is courtesy of counterpane, and cryptix.
TCP/IP swiss army knife extended with twofish encryption - Cryptcat is a simple Unix utility which reads and writes data across network connections, using TCP or
UDP protocol while encrypting the data being transmitted.
It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts.
At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities.
Cryptcat has been added to the CERT Linux Forensics Tools (LFTR) Repository from the now defunct RPMForge repository.
- etherape-0.9.13-1.el6.{i386,x86_64} - etherape is a graphical network monitor for Unix modeled after
etherman. Featuring link layer, ip and TCP modes, it displays network activity graphically. Hosts and links change in size with traffic. Color coded protocols display.
It supports Ethernet, FDDI, Token Ring, ISDN, PPP and SLIP devices. It can filter traffic to be shown, and can read traffic from a file as well as live from the network.
Note: this version is the latest available from the Sourceforge website which is newer than the version available from the standard Fedora repositories.
- fatback-1.3-1.el6.{i686,x86_64}.rpm - Fatback is a tool that undeletes files from FAT filesystems.
- lame{,-libs}-3.99.5-1.el6.{i686,x86_64}.rpm - LAME > is an open source MP3 encoder whose quality and speed matches commercial encoders.
LAME handles MPEG1,2 and 2.5 layer III encoding with both constant and variable bitrates.
- missidentify-1.0-1.el6.{i686,x86_64}.rpm - missidentify is a program to find Win32 applications.
In its default mode it displays the filename of any executable that does not have an executable extension (i.e. exe, dll, com, sys, cpl, hxs, hxi, olb, rll, or tlb).
The program can also be run to display all executables encountered, regardless of the extension.
This is handy when looking for all of the executables on a drive.
Other options allow the user to record the strings found in an executable and to work recursively.
See the manual page for more information.
- mount_ewf-20090113-1.el6.noarch.rpm - Mount_ewf is a tool that mounts
EWF files as mounted images using the loopback capability.
- pasco-1.0-1.el6.{i686,x86_64}.rpm - Pasco is a tool that parses the information in an index.dat file and output the
results in a field delimited manner so that it may be imported into your favorite spreadsheet program.
Pasco is built to work on multiple platforms and will execute on Windows (through Cygwin), Mac OS X, Linux, and *BSD platforms.
- perl-Data-Hexify-1.00-1.el6.noarch.rpm - perl-Data-Hexify formats arbitrary (possible binary) data into a format suitable for hex dumps in the style of xd or hexl.
- perl-File-Mork-0.3-1.el6.{i686,x86_64}.rpm - perl-File-Mork is a module to read Mozilla URL history files.
- perl-Mac-PropertyList-1.33-1.el7.noarch.rpm - perl-Mac-PropertyList is a low-level interface to the Mac OS X Property List (plist) format.
- perl-Parse-Win32Registry-0.51-1.el6.noarch.rpm - perl-Parse-Win32Registry is a module for parsing Windows Registry files,
allowing you to read the keys and values of a registry file without going through the Windows API.
It provides an object-oriented interface to the keys and values in a registry file. Registry files are structured as trees of keys, with each key containing further subkeys or values.
The module is intended to be cross-platform, and run on those platforms where Perl will run.
It supports both Windows NT registry files (Windows NT, 2000, XP, 2003, Vista, 7) and Windows 95 registry files (Windows 95, 98, Millennium Edition).
It is intended to be used to parse offline registry files. If a registry file is currently in use, you will not be able to open it. However, you can save part or all of a currently loaded registry file using the Windows reg command if you have the appropriate administrative access.
- python-tidy-0.2-1.{el6,el7}.noarch.rpm - Python-tidy pleans up, regularizes, and reformats the text of
Python scripts.
- rar-5.3.0-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Rar is a powerful archive manager.
It can backup your data and reduce the size of email attachments, decompress RAR, ZIP and other files downloaded from Internet and create new archives in RAR and ZIP file format.
See here for a list of changes in this version.
- socat-1.7.3.0-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Socat is a relay for bidirectional data transfer between two independent data channels.
Each of these data channels may be a file, pipe, device (serial line etc. or a pseudo terminal), a socket (UNIX, IP4, IP6 - raw, UDP, TCP), an
SSL socket, proxy CONNECT connection, a file descriptor (stdin etc.), the GNU line editor (readline), a program, or a combination of two of these.
These modes include generation of "listening" sockets, named pipes, and pseudo terminals.
Socat can be used, e.g., as TCP port forwarder (one-shot or daemon), as an
external socksifier, for attacking weak firewalls, as a shell interface to UNIX
sockets, IP6 relay, for redirecting TCP oriented programs to a serial line, to
logically connect serial lines on different computers, or to establish a
relatively secure environment (su and chroot) for running client or server
shell scripts with network connections.
See the change log that is part of the RPM package for a list of changes.
- tcpflow-1.4.4-1.el7.x86_64.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction.
Tcpflow can also process stored tcpdump packet flows.
- tre-0.8.0-1.el6.{i686,x86_64}.rpm - Tre is a lightweight, robust, and efficient POSIX compliant regexp
matching library with some exciting features such as approximate (fuzzy) matching.
The matching algorithm used in TRE uses linear worst-case time in the length of the text being searched, and quadratic worst-case time in the length of the used regular expression.
In other words, the time complexity of the algorithm is O(M^2N), where M is the length of the regular expression and N is the length of the text.
The used space is also quadratic on the length of the regex, but does not depend on the searched string.
This quadratic behaviour occurs only on pathological cases which are probably very rare in practice.
- unrar-5.3.0-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Unrar is a powerful archive manager.
It can backup your data and reduce the size of email attachments, decompress RAR, ZIP and other files downloaded from Internet and create new archives in RAR and ZIP file format.
See here for a list of changes in this version.
|
|
July 27, 2016:
The following have been released:
- plaso-1.4.0-4.{fc20,fc21,fc22,fc23}.{i686,x86_64}.rpm, plaso-1.4.0-4.{el6,el7}.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release is version 1.4.0 and not a beta release as was previously installed in the repository.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, 23, and 24 for i686 and x86_64
architectures and CentOS/RHEL versions 7 for the x86_64 architecture for this version of plaso.
- dfvfs-20160726-1.(fc20,fc21,fc22,fc23,fc24,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
This version uses the source code dated 2016-03-06 to fix this error: https://github.com/log2timeline/plaso/issues/803.
- python-dfdatetime-20160706-1.el6.noarch.rpm - dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
This package is needed by dfvfs.
|
|
July 24, 2016:
The following have been released:
- undbx-0.21-1.el7.x86_64.rpm - Undbx extracts, recovers and undeletes e-mail messages from
Outlook Express .dbx files.
This package was orphaned in RedHat EPEL and has been installed in this repository.
|
|
July 22, 2016:
The following have been released:
- fmem-kernel-modules-common-1.6-1.2.noarch.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
This package contains the source code for making the FMEM kernel modules and the install-fmem script.
Note: this RPM is hard-linked between all of the supported architectures, Fedora 20-24 and CentOS 6 and 7.
If you use rsync, make certain that you use the -H option
to preserve those hard links.
- foremost-1.5.7-13.1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i386,x86_64}.rpm - Foremost is a console program to recover files
based on their headers, footers, and internal data structures.
This process is commonly referred to as data carving.
Foremost can work on image files, such as those generated by dd, Safeback,
EnCase, etc, or directly on a drive.
The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types.
These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.
Originally developed by the United States Air Force Office Special Investigation and
Center for Information Systems Security Studies and Research, foremost has been opened to the general public.
Send any comments, suggestions, patches, or feedback you have on this program to namikus@users.sf.net.
- libewf{-devel,-tools,-python}-20160718-20140608.1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm and ewftools-20160718-20140608.1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
This package is built from the libewf source code dated 20140608 but to make it the latest version, the version number was changed to the build date (20160718)
and the release number changed to include the source code release date (20140608).
To install this version, do the following:
- Disable the forensics-test repository with this command: sudo yum-config-manager --disable forensics-test
- Save the list of installed libewf tools with this command: LIBEWF=`rpm -qa|grep 'ewf.*2014060801'|sed 's/-2014.*//`
- Remove this list of installed libewf tools with this command: sudo rpm -ev $LIBEWF --nodeps
- Install the new versions of these libewf tools with this command: sudo yum -y install $LIBEWF
- Update all packages with this command: sudo yum -y update
- sleuthkit-{,devel,libs}-4.2.0-4.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
This release was brought up to current with the version of code in github dated 2016-07-18.
Also, the code for srch_strings was reverted to the 4.1.3 version, fixing the double free error.
- testdisk-7.0-3.1.el6.{i686,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
This release was built to use the latest version of libewf that is installed in this repository.
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
July 15, 2016:
The following have been released:
- Fedora 24 - The repository now supports Fedora 24
for both the i686 and x86_64 CPU architectures.
Here is the list of tools provided for Fedora 24:
- libpff-20160110-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i386,x86_64}.rpm - Libpff is a library
and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.
PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
Libpff is used by DFF,the Digital Forensics Framework.
See here for the list of changes.
- libvshadow{,-devel,-python,-tools}-20160110-2.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libvshadow
is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
This version uses the external version of libbfio to support
DFF, the Digital Forensics Framework.
- dff-1.3.6-20160630.1.{fc20,fc21,fc22,fc23,fc24,el7}.{i686,x86_64}.rpm - The Digital Forensics Framework (DFF)
is both a digital investigation tool and a development platform.
The framework is used by system administrators, law enforcement examiners, digital forensics researchers and students, and security professionals world-wide.
Written in Python and C++,
it exclusively uses Open Source technologies.
DFF combines an intuitive user interface with a modular and cross-platform architecture.
This version is the developer version as of June 30, 2016.
To support this version, the following were also installed:
- Fedora 24 (From RPM Fusion)
- ffmpeg-libs-2.8.7-1.fc24.{i386,x86_64}.rpm
- ffmpeg-2.8.7-1.fc24.{i386,x86_64}.rpm
- ffmpeg-devel-2.8.7-1.fc24.{i386,x86_64}.rpm
- lame-devel-3.99.5-5.fc24.{i386,x86_64}.rpm
- libavdevice-2.8.7-1.fc24.{i386,x86_64}.rpm
- x264-devel-0.148-7.20160614gita5e06b9.fc24.{i386,x86_64}.rpm
- x265-devel-1.9-1.fc24.{i386,x86_64}.rpm
- x265-libs-1.9-1.fc24.{i386,x86_64}.rpm
- xvidcore-1.3.4-2.fc24.{i386,x86_64}.rpm
- xvidcore-devel-1.3.4-2.fc24.{i386,x86_64}.rpm
- Fedora 23 (From RPM Fusion)
- libbfio-devel-20160108-1.fc23.{i386,x86_64}.rpm
- libbfio-20160108-1.fc23.{i386,x86_64}.rpm
- libavdevice-2.8.7-1.fc23.{i386,x86_64}.rpm
- ffmpeg-libs-2.8.7-1.fc23.{i386,x86_64}.rpm
- ffmpeg-devel-2.8.7-1.fc23.{i386,x86_64}.rpm
- CentOS 7 (From NUX)
- faac-1.28-6.0.el7.nux.x86_64.rpm
- fdk-aac-0.1.4-1.x86_64.rpm
- ffmpeg-devel-2.6.8-3.el7.nux.x86_64.rpm
- ffmpeg-libs-2.6.8-3.el7.nux.x86_64.rpm
- libavdevice-2.6.8-3.el7.nux.x86_64.rpm
- x264-libs-0.142-11.20141221git6a301b6.el7.nux.x86_64.rpm
- x265-libs-1.9-1.el7.nux.x86_64.rpm
- xvidcore-1.3.2-5.el7.nux.x86_64.rpm
- libbde{,-devel,-python,-tools}-20160418-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
- libbfio{-devel,-python}-20160108-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i386,{i386,x86_64}}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access.
- libevt{,-devel,-python,-tools}-20160421-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- libevtx{,-devel,-python,-tools}-20160421-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- liblnk{,-devel,-python,-tools}-20160420-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Liblnk contains libraries and tools to access the
Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libmsiecf{,-devel,-python,-tools}-20160421-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libfsntfs{,-devel,-python,-tools}-20160418-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libfsntfs contains library and tools
to access the New Technology File System (NTFS).
See here for the list of changes.
- libolecf{,-devel-,-python,-tools}-20160423-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libolecf
contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.66-1.1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
See here for the list of changes.
- libregf{,-devel,-python,-tools}-20160424-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libregf
contains libraries and tools to access the Windows NT Registry File files.
See here for the list of changes.
- libsmraw{,-devel,-python,-tools}-20160424-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- libvhdi{,-devel,-python,-tools}-20160424-1.(fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- fmem-kernel-modules-1.6-1.8.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 24 x86_64 and i686 architectures was added.
- lime-kernel-modules-1.1.r17-8.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 24 x86_64 and i686 architectures was added.
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.1.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.5.7-300 for FC24
- 4.5.5-300 for FC24
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-1.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.5.7-300 for FC24
- 4.5.5-300 for FC24
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
- lime-kernel-modules-common-1.1.r17-2.noarch.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
This package contains only the source code for making the LiME kernel modules, the CaptureMemoryWithLime script and the corresponding manual page.
This package also obsoletes tie lime-kernel-objects package which contained the source code and all of the kernel objects.
This repackaging increases the number of packages but decreases their size.
Note: this RPM is hard-linked between all of the supported architectures, Fedora 20-24 and CentOS 6 and 7
If you use rsync, make certain that you use the -H option to preserve those hard links.
- snort-2.9.8.3-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-openappid-2.9.8.3-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - This is the snort package
built with the following additions:
- The --enable-open-appid option was added to the configure script that configures the build of snort.
See here for more details.
- The files found here and named snort-openappid.tar.gz are installed in
/usr/share/snort/cisco/apps.
- Here is the OpenAppId Detector Developer Guide .
- snort-sample-rules-2.9.8.3-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- dfvfs-20160706-1.(fc20,fc21,fc22,fc23,fc24,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, 23, and 24 for i686 and x86_64 architectures
and CentOS/RHEL version 7 for the x86_64 architecture for this version of dfvfs.
- libfwnt{,-devel,-python,-python3}-20160418-1.(fc20,fc21,fc22,fc23,fc24,el7}.noarch.rpm and libfwnt{,-devel,-python}-20160418-1.el6.noarch.rpm -
LibFWNT, is a library for Windows NT data types.
See here for the list of changes.
This package is needed by dfvfs.
- python-dfdatetime-20160706-1.{fc20,fc21,fc22,fc23,fc24,el7}.noarch.rpm - dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
This package is needed by dfvfs.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.12.2-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.12.2‑2.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.12.2‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- distorm3-3.3.4-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i386,x86_64}.rpm - Distorm3 is a lightweight,
easy-to-use and fast decomposer library.
It disassembles instructions in 16, 32 and 64 bit modes.
Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX.
Distorm3 is used by The Volatility Framework.
The changes are listed here.
- Volatility-2.5-4.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.5.
It also contains the mimikatz plugin.
This release was build using the code as of 2016-07-08.
- Volatility-community-plugins-20160708-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.noarch.rpm - The Volatility Community Plugins
is a collection of Volatility plugins written and maintained by authors in the forensics community.
Many of these are the result of the last 3 years of Volatility plugin contests, but some were just written for fun.
Either way, it's an entire arsenal of plugins that you can easily extend into your existing Volatility installation.
These plugins are installed in /usr/share/volatility/plugins/community/.
- exfat-utils-1.2.4-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
See here for the list of changes since the last released version (1.2.3).
- nDPI{,-devel}-1.8-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
- xplico-1.1.1-2.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
This release was rebuilt to work with nDPI-1.8.
- python-registry-1.2.0-1.{fc20,fc21,fc22,fc23,fc23,el6,el7}.{i386,x86_64}.rpm - Python-registry
provides read-only access to Windows Registry files, such as NTUSER.DAT, userdiff, and SOFTWARE.
The interface is two-fold: a high-level interface suitable for most tasks, and a low level set of parsing objects and methods which may be used for advanced
study of the Windows Registry.
- valabind-0.10.1-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm and valabind‑0.10.1‑1.el7.x86_64.rpm - Valabind is a tool to parse vala
or vapi files to transform them into swig interface files, C++,
NodeJS-ffi, or GIR.
With swig, you can create language bindings for any API written in vala or C with a vapi interface.
It can also generate bindings for C++.
- radare{,-devel}-2.0.10.4-1.{fc20,fc21,fc22,fc23,fc24,el6}.{i686,x86_64}.rpm and radare{,‑devel}‑2.0.10.4‑1.el7.x86_64.rpm - Radare is a framework for doing reverse engineering.
- python-radare-2.0.10.4-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm and python‑radare‑2.0.10.4‑1.el7.x86_64.rpm - Python-Radare are
bindings that allow Radare to be used from Python.
- radare-extras-2.0.10.4-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm and radare‑extras‑2.0.10.4‑1.el7.x86_64.rpm - Radare-Extras are
are extra plugins for radare2.
- disktype-9-19.1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.noarch.rpm - Disktype detects the content format of a disk or disk image.
This version is based on the standard version with support for
exfat,
LUKS,
f2fs,
btrfs, and
EXT 2, 3, and 4,
all courtesy Erik Uitto from the Silicon Valley Regional Computer Forensics Laboratory in Menlo Park, CA.
This version was rebuilt to increment the release number to be higher (19.1) than the current version provided for either Fedora (19) or CentOS/RHEL (12).
- netsa-rayon-1.4.3-2.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm and netsa-rayon-pipevis-0.0-3.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm -
Netsa-rayon is a Python library and set of tools for generating basic two-dimensional statistical visualizations.
Netsa-rayon can be used to automate reporting; provide data visualization in command-line, GUI or web applications; or do ad-hoc exploratory data analysis.
Netsa-rayon can generate visualizations in PDF, PNG, SVG and PostScript formats using Pycairo.
It can also be used in wxPython GUI applications.
Netsa-rayon is compatible with Python versions 2.6 and greater, and requires netsa-python and at least one of
Pycairo (for static output) or wxPython,/a> (for GUI output).
See here for a list of changes.
This release was rebuilt to use Syhinx version 1.2.2 to produce the documentation.
- analysis-pipeline-5.4.1-1.{fc20,fc21,fc22,fc23,fc24,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
See here for the changes since the last version (5,4).
|
|
June 24, 2016:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 10, 2016:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- analysis-pipeline-5.4-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
|
|
June 7, 2016:
The following have been released:
- netsa-python-1.5-1.{fc20,fc21,fc22,fc23,el6,el7}.{i386,x86_64}.rpm , netsa_silk-1.5-1.{fc20,fc21,fc22,fc23,el6,el7}.{i386,x86_64}.rpm - Netsa-python is a
library of Python routines and frameworks that the NetSA team at CERT has found helpful when developing analyses using the SiLK toolkit. Of particular note are the
netsa.script NetSA Scripting Framework, which provides a standard framework for writing scripts that process flow data, and the netsa.util.shell command line
processing system, which provides tools for managing extremely complicated collections of shell processes that should fail or succeed together (extremely useful when working with named pipes).
Netsa-python is compatible with Python versions 2.4 and greater.
See here for a list of the changes since the last release which was version 1.4.3.
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
May 27, 2016:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
May 26, 2016:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
May 16, 2016:
The following have been released:
- CERT-Forensics-Tools-1.0-68.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i686,x86_64}.rpm - This package was updated as follows:
- The package fuse-exfat was incorrectly obsoleted by CERT-Forensics-Tools. This
incorrect obsoleting directive was removed since it was already in exfat-utils, where it belongs.
|
|
May 13, 2016:
The following have been released:
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.12.1-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.12.1‑2.{fc20,fc21,fc22,fc23}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.12.1‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
May 9, 2016:
The following have been released:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- libewf{-devel,-tools,-python}-2014060801-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm, ewftools-2014060801-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
These packages have been installed in the forensics-test repository.
To use this repository, you will need to enable it with this command: sudo yum-config-manager --enable forensics-test.
- sleuthkit-{,devel,libs}-4.2.0-4.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
This release was brought up to current with the version of code in github dated 2015-10-07.
Also, the code for srch_strings was reverted to the 4.1.3 version, fixing the double free error.
These packages have been installed in the forensics-test repository.
To use this repository, you will need to enable it with this command: sudo yum-config-manager --enable forensics-test.
Note: if you install libewf-2014060801 you will need this version of The Sleuth Kit.
|
|
April 29, 2016:
The following have been released:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
April 21, 2016:
The following have been released:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- yaf{,-devel}-2.8.4-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
See here for the changes since the last released version (2.8.2).
- partclone-0.2.88-1.{fc22,fc21,fc20}.x86_64.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
See here for the list of changes in this release.
This version is being released due to changes dictated by the ntfs-3g, version 2016.2.22, which was released on April 21, 2016 for Fedora 22.
All other versions were rebuilt to maintain release numbering consistency.
|
|
April 14, 2016:
The following have been released:
- partclone-0.2.88-1.el7.x86_64.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
See here for the list of changes in this release.
This version is being released due to changes dictated by the ntfs-3g, version 2016.2.22, which was released on April 14, 2016 for CentOS/RHEL 7.
This version will be installed on all other supported OSes and architectures by April 22, 2016.
- partclone-0.2.71-5.el6.{i386,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
See here for the list of changes in this release.
This version is being released due to changes dictated by the ntfs-3g, version 2016.2.22, which was released on April 14, 2016 for CentOS/RHEL 6.
This version will be installed on all other supported OSes and architectures by April 22, 2016.
|
|
April 11, 2016:
The following have been released:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- partclone-0.2.88-1.fc23.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
See here for the list of changes in this release.
This version is being released due to changes dictated by the ntfs-3g, version 2016.2.22, which was released on April 10, 2016 for Fedora 23.
This version will be installed on all other supported OSes and architectures by April 22, 2016.
|
|
April 8, 2016:
The following have been released:
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.12.0-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.12.0‑2.{fc20,fc21,fc22,fc23}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.12.0‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis-pipeline-5.3.2-2.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
This version was rebuilt to use the latest version of SiLK, specifically 3.12.0.
- silk-ipset{,-devel,-lib,-tools}-3.12.0-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- super_mediator-1.3.0-2.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
This release was rebuilt to use silk-ipset-3.12.0.
- yaf{,-devel}-2.8.2-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
See here for the changes since the last released version (2.8.1).
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- byacc-1.9.20130304-3.el6.{i386,x86_64}.rpm - BYacc is a parser generator utility that reads a grammar
specification from a file and generates an LR(1) parser for it.
The parsers consist of a set of LALR(1) parsing tables and a driver routine written in the C programming language.
It has a public domain license which includes the generated C.
Byacc was installed on CentOS/RHEL 6 so that libewf could be built.
- libewf-{,devel,python}-20160209-2.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm, ewftools-20160209-2.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
This version fixes the error that results when the deflate compression method (which is the default) is selected.
These packages have been installed in the forensics-test repository.
To use the, you will need to enable this repository in the /etc/yum.repos.d/cert-forensics-tools.repo file and you must be root to do this.
|
|
March 24, 2016:
The following have been released:
- ddrescue-1.21-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
Here are the changes for this version (1.21):
- mapbook.cc (Mapbook): Fix iobuf alignment. (Reported by Heikki Tauriainen).
- Removed short option names '-1' and '-2'.
- Allow only regular files for '--log-rates' and '--log-reads'.
- Option '-D, --odirect' now works also in fill mode.
- rescuebook.cc (copy_block): Return 1 on unaligned read error. Set e_code on any error if verify_on_error.
- Option '-X, --exit-on-error' has been extended to all phases.
- Assigned short name '-Z' to option '--max-read-rate'.
- mapbook.cc (update_mapfile): 'fsync' the mapfile every 5 minutes.
- Rescuebook: Show full range of sizes from non-tried to finished.
- rescuebook.cc (show_status): Show percent rescued.
- configure: Avoid warning on some shells when testing for g++.
- Makefile.in: Detect the existence of install-info.
- libguytools-2.0.4-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libguytools is a package of subroutines and header files needed to
build and operate guymager.
The changes are:
- Removed arch specific code in toolsignal.cpp.
- guymager-0.8.1-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Guymager is a forensic imaging package.
See here for the list of changes.
- libsigscan{,-devel,-python,-python3,-tools}-20160312-1.{fc20,fc21,fc22,fc23,el7}.{i686,x86_64}.rpm and libsigscan{,-devel,-python,-tools}-20160312-1.el6.{i686,x86_64}.rpm-
a href="https://github.com/libyal/libsigscan/wiki">Libsigscan is a library and tools used to binary signature scanning.
See here for the list of changes.
- libsmdev{,-devel,-python,-python3,-tools}-20160320-1.{fc20,fc21,fc22,fc23,el7}.{i686,x86_64}.rpm and libsmdev{,-devel,-python,-tools}-20160320-1.el6.{i686,x86_64}.rpm -
Libsmdev is a library and tools used to access storage media devices.
See here for the list of changes.
- dfvfs-20160306-1.(fc20,fc21,fc22,fc23,el6,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, and 23 for i686 and x86_64 architectures
and CentOS/RHEL versions 6 and 7 for the x86_64 architecture for this version of dfvfs.
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- 2.6.18-409 for EL5
- 2.6.18-408 for EL5
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- 2.6.18-409 for EL5
- 2.6.18-408 for EL5
|
|
March 18, 2016:
The following have been released:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
- super_mediator-1.3.0-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the changes since the last released version (1.2.1).
|
|
March 11, 2016:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 4, 2016:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- ghex{,-devel,libs}-3.18.0-1.el7.x86_64.rpm - The Ghex hex editor
was installed for RHEL/CentOS 7.
The previous version for RHEL/CentOS 7 (2.24) required packages that are no longer provided as part of the standard RHEL/CentOS 7 distribution.
This version does not require those packages.
|
|
February 26, 2016:
The following have been released:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- analysis-pipeline-5.3.2-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
See here for the changes to the Version 5 release of analysis-pipeline.
|
|
February 12, 2016:
The following have been released:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- libewf-{,devel,python}-20160209-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm, ewftools-20160209-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
These packages have been installed in the forensics-test repository.
To use the, you will need to enable this repository in the /etc/yum.repos.d/cert-forensics-tools.repo file and you must be root to do this.
- yaf{,-devel}-2.8.1-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
See here for the changes since the last released version (2.8.0).
- libschemaTools{,-devel}-1.2.0-1-{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - libschemaTools is a library that provides a standard
representation of data records. It is built on fixbuf, using IPFIX information elements.
It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source.
SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records.
- analysis-pipeline-5.3.1-3.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
See here for the changes to the Version 5 release of analysis-pipeline.
|
|
February 7, 2016:
The following have been released:
- libvslvm{,-devel,-python,-python3,-tools}-20160110-1.{fc20,fc21,fc22}.{i686,x86_64}.rpm, libvslvm{,-devel,-python,-python3,-tools}-20160110-1.el7.x86_64.rpm, and
libvslvm{,-devel,-python,-tools}-20160110-1.,el6.{i686,x86_64}.rpm - Libvslvm
is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
See here for the list of changes.
- dfvfs-20160203-1.(fc20,fc21,fc22,fc23,el6,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, and 23 for i686 and x86_64 architectures
and CentOS/RHEL versions 6 and 7 for the x86_64 architecture for this version of dfvfs.
- xlsxwriter-0.8.4-1.{fc20,fc21,fc22,fc23}.{i686,x86_64}.rpm and xlsxwriter-0.8.4-1.{el6,el7}.x86_64.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more, including:
- 100% compatible Excel XLSX files.
- Full formatting.
- Merged cells.
- Defined names.
- Charts.
- Autofilters.
- Data validation and drop down lists.
- Conditional formatting.
- Worksheet PNG/JPEG images.
- Rich multi-format strings.
- Cell comments.
- Integration with Pandas.
- Textboxes.
- Memory optimization mode for writing large files.
It supports Python 2.5, 2.6, 2.7, 3.1, 3.2, 3.3, 3.4, 3.5, Jython and PyPy and uses standard libraries only.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- plaso-1.4-3.{fc20,fc21,fc22,fc23}.{i686,x86_64}.rpm, plaso-1.4-3.{el6,el7}.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release adds the missing artifacts and python-requests dependencies.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, and 23 for i686 and x86_64
architectures and CentOS/RHEL versions 7 for the x86_64 architecture for this version of plaso.
|
|
February 5, 2016:
The following have been released:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.3.4-300 for FC23
- 4.3.3-303 for FC23
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.3.4-300 for FC23
- 4.3.3-303 for FC23
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- splunk-6.3.2-aaff59bb082c-linux-2.6-x86_64.rpm and splunk-6.3.2-aaff59bb082c.i386.rpm - This version of
Splunk was added to the Splunk repository for Fedora 20 through 23 and Fedora 6 and 7 for the i386 and x86_64 architectures.
Follow these instructions after upgrading
to this version.
Make sure that you following these instruction after upgrading but before rebooting.
If you do not following these instructions your system may hang when it reboots.
- libbde{,-devel,-python,-tools}-20160110-1.{fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
- libevt{,-devel,-python,-tools}-20160107-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- libevtx{,-devel,-python,-tools}-20160107-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- libfwsi{,-devel,-python}-20160110-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libfwsi is a library to access the
Windows Shell Item format.
See here for the list of changes.
- liblnk{,-devel,-python,-tools}-20160107-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Liblnk contains libraries and tools to access the
Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libmsiecf{,-devel,-python,-tools}-20160107-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libolecf{,-devel-,-python,-tools}-20160107-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libolecf
contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libqcow{,-devel,-tools,-python}-20160123-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libqcow
is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
See here for the list of changes.
- libregf{,-devel,-python,-tools}-20160107-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libregf
contains libraries and tools to access the Windows NT Registry File files.
See here for the list of changes.
- libsigscan{,-devel,-python,-tools}-20160108-1.{fc20,fc21,el6,el7}.{i686,x86_64}.rpm - Libsigscan is a library and tools used to
binary signature scanning.
See here for the list of changes.
- libsmdev{,-devel,-python,-tools}-20160109-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libsmdev
is a library and tools used to access storage media devices.
See here for the list of changes.
- libsmraw{,-devel,-python,-tools}-20160108-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- libvhdi{,-devel,-python,-tools}-20160108-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- libvmdk{,-devel,-python,-tools}-20160119-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libvmdk
is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
See here the list of changes.
- libvshadow{,-devel,-python,-tools}-20160110-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libvshadow
is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
- dfwinreg-20160116-1.{fc20,fc21,fc22,fc23}.{i686,x86_64}.rpm and dfwinreg-20160116-1.{el6,el7}.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- libscca{,-devel,-python,-python3,-tools}-20160108-1.{fc20,fc21,fc22,fc23}.{i686,x86_64}.rpm and libscca{,-devel,-python,-python3,-tools}-20160108-1.{el6,el7}.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
See here for the list of changes.
- plaso-1.4-2.{fc20,fc21,fc22,fc23}.{i686,x86_64}.rpm, plaso-1.4-2.{el6,el7}.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release adds the missing artifacts and python-requests dependencies.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, and 23 for i686 and x86_64
architectures and CentOS/RHEL versions 7 for the x86_64 architecture for this version of plaso.
- libfsntfs{,-devel,-python,-tools}-20160108-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
See here for the list of changes.
|
|
January 8, 2016:
The following have been released:
- super_mediator-1.2.1-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the changes since the last released version (1.1.3).
- yaf{,-devel}-2.8.0-1.{fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
See here for the changes since the last released version (2.7.1).
- libesedb{,-devel,-python,-tools}-20151213-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libesedb contains a library and tools to access the Extensible Storage
Engine (ESE) Database File (EDB) format. ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
See here for the list of changes.
- libevt{,-devel,-python,-tools}-20151206-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- libevtx{,-devel,-python,-tools}-20160103-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- liblnk{,-devel,-python,-tools}-20151205-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Liblnk contains libraries and tools to access the
Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libmsiecf{,-devel,-python,-tools}-20151220-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libolecf{,-devel-,-python,-tools}-20151223-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libolecf
contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libqcow{,-devel,-tools,-python}-20151219-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libqcow
is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
See here for the list of changes.
- libsmdev{,-devel,-python,-tools}-20151219-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libsmdev
is a library and tools used to access storage media devices.
See here for the list of changes.
- libsmraw{,-devel,-python,-tools}-20151219-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- libvhdi{,-devel,-python,-tools}-20151220-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- libvshadow{,-devel,-python,-tools}-20151220-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libvshadow
is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
See here for the list of changes.
- dfvfs-20151227-1.(fc20,fc21,fc22,fc23,el6,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, 22, and 23 for i686 and x86_64 architectures
and CentOS/RHEL versions 6 and 7 for the x86_64 architecture for this version of dfvfs.
- libregf{,-devel,-python,-tools}-20151223-1.(fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Libregf
contains libraries and tools to access the Windows NT Registry File files.
See here for the list of changes.
- exfat-utils-1.2.3-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
See here for the list of changes since the last released version (1.2.0).
- nDPI{,-devel}-1.7.1-1.{fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
December 18, 2015:
The following have been released:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-327.3.1 for EL7
- 3.10.0-327 for EL7
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-327.3.1 for EL7
- 3.10.0-327 for EL7
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- regripper-28000000-5.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.noarch.rpm - Regripper is a
Windows Registry data extraction and correlation tool.
This package is contains version 2.8 of the regripper tool. The plugins are packaged separately.
This release contains version 08-26-13 of the auto_rip.pl.
See here for more details about this script.
This version is based on on the December 16, 2015 version of the regripper code.
- regripper-plugins-20151216-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.noarch.rpm - Regripper-plugins are the plugins packaged separately from
the regripper application.
This package is taken from the plugins directory at the Github source code site.
- libfsntfs{,-devel,-python,-tools}-20151205-1.(fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i686,x86_64}.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
See here for the list of changes.
- libsmdev{,-devel,-python,-tools}-20151216-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i686,x86_64}.rpm - Libsmdev
is a library and tools used to access storage media devices.
See here for the list of changes.
- libsmraw{,-devel,-python,-tools}-20151005-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- libvhdi{,-devel,-python,-tools}-20150105-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- pytsk-20150406-4.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
This version was rebuilt to use The Sleuth Kit version 4.2.0 for all systems except CentOS/RHEL 5 which uses The Sleuth Kit version 4.1.3.
In addition, it was rebuilt to specify the correct version of CC for Fedora 23.
- dfvfs-20151218-1.(fc17,fc18,fc19,fc20,fc21,fc22,fc23,el6,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 17, 18, 19, 20, 21, 22, and 23 for i686 and x86_64 architectures and CentOS/RHEL versions 6 and 7 for the x86_64 architecture
for this version of dfvfs.
- ghostpdl-9.18-1.{fc17,fc18,fc19,fc20,fc21fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Ghostpdl is Artifex Software's implementation of the
PCL-5™ and PCL-XL™ family of page description languages.
Ghostpdl is used by Xplico.
- super_mediator-1.1.3-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the changes since the last version (1.1.2).
- Fedora 19 Support for Fedora 19 i686 and x86_64 architectures - Updates to Fedora 19 for
both the i686 and x86_64 CPU architectures has ceased.
- Fedora 18 Support for Fedora 18 i686 and x86_64 architectures - Updates to Fedora 18 for
both the i686 and x86_64 CPU architectures has ceased.
- Fedora 17 Support for Fedora 17 i686 and x86_64 architectures - Updates to Fedora 17 for
both the i686 and x86_64 CPU architectures has ceased.
|
|
December 4, 2015:
The following have been released:
- CERT-Forensics-Tools-1.0-67.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i686,x86_64}.rpm - This package was updated as follows:
- For CentOS/RHEL 7, the hexedit replaced the ghex program.
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- snort-2.9.8.0-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-openappid-2.9.8.0-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - This is the snort package
built with the following additions:
- The --enable-open-appid option was added to the configure script that configures the build of snort.
See here for more details.
- The files found here and named snort-openappid.tar.gz are installed in
/usr/share/snort/cisco/apps.
- Here is the OpenAppId Detector Developer Guide .
- snort-sample-rules-2.9.8.0-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
|
|
November 30, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 20, 2015:
The following have been released:
- distorm3-3.1-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - Distorm3 is a lightweight,
easy-to-use and fast decomposer library.
It disassembles instructions in 16, 32 and 64 bit modes.
Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX.
Distorm3 is used by The Volatility Framework.
The changes are listed here.
This version is build from distorm3 version 3.1 which is needed to address the issue noted here.
- Volatility-2.5-3.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.5.
It also contains the mimikatz plugin.
This release was also built with Distorm3 version 3.1 as noted above.
- Volatility-community-plugins-20151112-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.noarch.rpm - The Volatility Community Plugins
is a collection of Volatility plugins written and maintained by authors in the forensics community.
Many of these are the result of the last 3 years of Volatility plugin contests, but some were just written for fun.
Either way, it's an entire arsenal of plugins that you can easily extend into your existing Volatility installation.
These plugins are installed in /usr/share/volatility/plugins/community/.
- CERT-Forensics-Tools-1.0-66.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el5,el6,el7}.{i686,x86_64}.rpm - This package was updated to add the following packages:
- Added Volatility-community-plugins.
- fmem-kernel-modules-fc23-{i686,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc23-{i686,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 13, 2015:
The following have been released:
- Fedora 23 - The repository now supports Fedora 23
for both the i686 and x86_64 CPU architectures.
Here is the list of tools provided for Fedora 23:
- fmem-kernel-modules-1.6-1.7.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 23 x86_64 and i686 architectures was added.
- lime-kernel-modules-1.1.r17-7.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 23 x86_64 and i686 architectures was added.
- nDPI{,-devel}-1.7-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
Note that RHEL/CentOS 5 is not supported due to issues with autoconf.
- xplico-1.1.1-1.{fc17,fc18,fc19,fc20,fc21,fc22,fc23,el6,el7}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
This release was rebuilt to work with nDPI-1.6. All other suported systems were upgraded for release version consistency.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
Here are the changes since the last version (1.1.0):
- Whatsapp OS and Phone number
- Added MGCP dissector
- IMAP bug fixed
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 6, 2015:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 30, 2015:
The following have been released:
- super_mediator-1.1.2-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the changes since the last version (1.1.1).
|
|
October 23, 2015:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- libfsntfs{,-devel,-python,-tools}-20150906-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
See here for the list of changes.
- dfvfs-20151008-1.(fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 17, 18, 19, 20, 21, and 22 for i686 and x86_64 architectures and CentOS/RHEL versions 6 and 7 for the x86_64 architecture
for this version of dfvfs.
- libbfio{,-devel,-python,-tools}-20150927-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i386,x86_64}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access.
See here for the list of changes.
- libevtx{,-devel,-python,-tools}-20150928-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- libfixbuf{,-devel}-1.7.1-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- pyfixbuf-0.2.0-3.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Pyfixbuf is a Python API for libfixbuf, an implementation
of the IPFIX protocol used for building collecting and exporting processes.
PyFixBuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the content of the message before forwarding to another IPFIX collection point,
or in converting IPFIX to another format (text, database, JSON, etc.).
This release was rebuilt to use libfixbuf-1.7.1.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.11.0.1-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.11.0.1‑2.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.11.0.1‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis-pipeline-4.4.1-3.{fc17,fc18,fc9,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
This version was rebuilt to use the latest version of SiLK, specifically 3.11.0.
- silk-ipset{,-devel,-lib,-tools}-3.11.0-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- super_mediator-1.1.1-3.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
This release was rebuilt to use libfixbuf-1.7.1 and silk-ipset-3.11.0.
- yaf{,-devel}-2.7.1-3.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
This release was rebuilt to use libfixbuf-1.7.1.
- libfvde{,-devel,-tools}-20151013-1.{fc17,fc18,fc9,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libfvde is a lbrary and tools to access FileVault Drive
Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
See here for a list of changes since the last release (20150222).
- Volatility-2.5-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility uses the code as available from here as of 2015-10-20 which is identified as Volatility 2.5.
It also contains the mimikatz plugin.
|
|
October 16, 2015:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 9, 2015:
The following have been released:
- sleuthkit-{,devel,libs}-4.2.0-2.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
This release was brought up to current with the version of code in github dated 2015-10-07.
Also, the code for srch_strings was reverted to the 4.1.3 version, fixing the double free error.
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 2, 2015:
The following have been released:
- ADIA-FC17-{i686,x86-64}-{VMware,VirtualBox}.iso - These items are VMware and VirtualBox-based forensic appliances built with Fedora 17 for the i686 and x86_64 architectures.
Please note that they are not a live CDs.
See here for more details.
The changes made are the folloing:
- Latest CERT Forensics Key installed.
- All packages updated as of September 24, 2015.
- SElinux disabled on all releases.
- snort-2.9.7.6-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-openappid-2.9.7.6-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - This is the snort package
built with the following additions:
- The --enable-open-appid option was added to the configure script that configures the build of snort.
See here for more details.
- The files found here and named snort-openappid.tar.gz are installed in
/usr/share/snort/cisco/apps.
- Here is the Open Source Detectors Developers Guide here.
- snort-sample-rules-2.9.7.6-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
|
|
September 25, 2015:
The following have been released:
- dd_rescue-1.99-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Here are the changes from the previously distributed version (1.46):
- Version 1.99 brings updates to the ddr_crypt plugin: It adds hardware
acceleration for ARMv8 CPUs/SOCs (even if in 32bit mode) -- this is a 10x
speedup on AES en/decryption operations. (An Cortex-A57 at 2.1GHz (Exy7420)
does ~1GB/s with AES128-CTR.) The ddr_crypt plugin xattr support has been
extended and it has an option to process openSSL compatible Salted__ files. A
bug in CTR initialization has been fixed. The main program sees improved write
error retry logic and better fault injection logic (support for ranges, using
absolute positions). There are now more variants of Android binaries.
- ddrescue-1.20-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
Here are the changes for this version:
- 'logfile' has been renamed to 'mapfile' everywhere.
- Changed short name of option '--synchronous' to '-y'.
- Changed long name of option '-d' to '--idirect'.
- Added new option '-D, --odirect'.
- Added new option '-J, --verify-on-error'.
- Added new option '--max-read-rate'.
- rescuebook.cc (copy_block): Copy arbitrary blocks with '--idirect'.
- Include only bad_sector blocks in 'errsize'.
- rescuebook.cc (show_status): Show the estimated remaining time.
- io.cc (format_time): Show time in days, hours, minutes and seconds.
- Added per sector location data to fill mode.
- mapbook.cc: Added emergency save of the mapfile.
- Show device name with '--ask' or '-vv' on Haiku.
- mapfile.cc (read_mapfile): Read read-only mapfiles from stdin.
- ddrescuelog.cc: Allow multiple mapfiles for '-t, --show-status'.
- ddrescuelog.cc (create_mapfile): '-' writes mapfile to stdout.
- ddrescue.texi: Added new chapter 'Optical media'.
- ddrescue.texi: Documented maximum size of the rescue domain.
- configure: Option '--enable-linux' renamed to '--enable-non-posix'.
- Makefile.in: Added new targets 'install*-compress'.
- File 'ddrescue.h' renamed to 'mapbook.h'.
- File 'logbook.cc' renamed to 'mapbook.cc'.
- File 'logfile.cc' renamed to 'mapfile.cc'.
- Files linux.{h,cc} renamed to non_posix.{h,cc}.
- libbde{,-devel,-python,-tools}-20150905-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
- liblnk{,-devel,-python,-tools}-20150830-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Liblnk contains libraries and tools to access the
Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libfsntfs{,-devel,-python,-tools}-20150829-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libfsntfs contains library and tools to access the New Technology File System (NTFS).
See here for the list of changes.
- dfvfs-20150915-1.(fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 17, 18, 19, 20, 21, and 22 for i686 and x86_64 architectures and CentOS/RHEL versions 6 and 7 for the x86_64 architecture
for this version of dfvfs.
- artifacts-20150409-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.noarch.rpm - Artifacts is a free, community-sourced, machine-readable knowledge base
of forensic artifacts that the world can use both as an information source and within other tools.
This package was built to support plaso.
- python-dpkt-1.8-2.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm and python-dpkt-1.8-2.{el6,el7}.x86_64.rpm - Python-dpkt is a fast, simple packet creator and parser,
with definitions for the basic TCP/IP protocols, for Python.
This package was built to support plaso.
- python-pefile-1.2.10_139.2.{fc17,fc18,fc19,el6,el7}.{i686,x86_64}.rpm - Python-pefile is a multi-platform Python module to parse and work with
This version was built to support plaso.
Portable Executable (aka PE) files.
Most of the information contained in the PE headers is accessible as well as all sections' details and their data.
This package was built to support plaso.
- python-psutil-2.1.3-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm - Python-psutil is a cross-platform library for retrieving information onrunning processes and
system utilization (CPU, memory, disks, network)in Python.
This package was built to support plaso.
- python-tornado-3.2.1-3.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm - Python-tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.
Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling,
WebSockets, and other applications that require a long-lived connection to each user.
This package was built to support plaso.
- python-ipython{,-console,-doc,-gui,-notebook,-sphinx,-tests)-2.4.1-8.fc20.{i686,x86_64}.rpm - IPython is an enhanced interactive Python shell.
This package was built to support plaso.
- python-requests-2.3.0-3.fc20.{i686,x86_64}.rpm - Python-requests is an Apache2 Licensed HTTP library, written in Python, for human beings.
Python’s standard urllib2 module provides most of the HTTP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web.
It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
This package was built to support plaso.
- plaso-1.3.0-2.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm, plaso-1.3.0-1.{el6,el7}.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release adds the missing artifacts and python-requests dependencies.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 20, 21, and 22 for i686 and x86_64 architectures and CentOS/RHEL versions 7 for the x86_64 architecture
for this version of plaso.
For Fedora 17, 18, and 19 and CentOS/RHEL 5 and 6 for the i686 and x86_64 architectures, all dependencies are satisfied but not all available packages mee the minimum requirements for plaso.
Effort to satisfy these out-of-date dependencies will be expended when there is a specific request to do so.
- sleuthkit-{,devel,libs}-4.2.0-1.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the list of changes in this release.
- pytsk-20150406-3.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
This version was rebuilt to use The Sleuth Kit version 4.2.0 for all systems except CentOS/RHEL 5 which uses The Sleuth Kit version 4.1.3.
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- yara-3.4.0-2.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Here are the changes since the last version (3.3.0):
- Short-circuit evaluation for conditions
- New yr_rules_save_stream/yr_rules_load_stream APIs.
- load() and save() methods in yara-python accept file-like objects
- Improvements to the PE and ELF modules
- Some performance improvements
- New command-line option --print-module-data
- Multiple bug fixes.
In addition, release 2 was built with openssl-devel
- yara-python-3.4.0-2.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Yara-python is a Python
extension that gives access to Yara's powerful features from Python scripts.
Here are the changes since the last version (3.3.0):
- Short-circuit evaluation for conditions
- New yr_rules_save_stream/yr_rules_load_stream APIs.
- load() and save() methods in yara-python accept file-like objects
- Improvements to the PE and ELF modules
- Some performance improvements
- New command-line option --print-module-data
- Multiple bug fixes.
In addition, release 2 was built with openssl-devel
|
|
September 18, 2015:
The following have been released:
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.10.2-5.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
The SiLK analysis suite has been recompiled to make use of the default UTC time rather than local time.
Please be aware of the following changes that will need to be made to any existing analytics or workflows if you would like to continue to make use of local time rather than UTC.
- Any analytic or workflow that makes use of a SiLK tool that outputs time (e.g., rwcut, rwcount, etc.) will need to be changed to use the
--timestamp-format=local switch in the SiLK command(s).
- Additionally, the TZ environment variable or system clock will need to be set to the local time zone that is desired.
- Any analytic or workflow that makes use of a SiLK tool that takes time as an input (e.g., rwfilter, rwcount, etc.) will need to be changed to convert local time to UTC.
On a *nix system, this can be done by making use of the date(1) program.
See the man page for complete documentation.
An example command that can be used to convert a local date time to UTC for use in the --start-date switch is:
date -ud <local date time> +%Y/%m/%dT%H
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.10.2‑6.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.10.2‑6.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
These packages have also been recomplied to make use of the default UTC time rather than local time.
See above.
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 11, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- libvhdi{,-devel,-python,-tools}-20150905-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- libpff-20131028-2.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - Libpff is a library
and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.
PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
Libpff is used by DFF - the Digital Forensics Framework.
See here for the list of changes.
This version was rebuilt to reference libbfio externally rather than the internal version provided with libpff.
- ffmpeg{-libs,-devel}-2.6.4-1.fc22.{i686,x86_64}.rpm - FFmpeg is a complete, cross-platform solution to record,
convert and stream audio and video. It includes libavcodec - the leading audio/video codec library.
These packages have been made available in are support of dff.
- libavdevice-2.6.4-1.fc22.{i686,x86_64}.rpm - Libavdevice is a complementary library to libavf "libavformat".
It provides various "special" platform-specific muxers and demuxers, e.g. for grabbing devices, audio capture and playback etc.
These packages have been made available in are support of dff.
- dff-1.3.5.20150908-2.{fc17,fc18,fc19,fc20,fc21,fc22,el7}.{i686,x86_64}.rpm - The Digital Forensics Framework (DFF)
is both a digital investigation tool and a development platform.
The framework is used by system administrators, law enforcement examiners, digital forensics researchers and students, and security professionals world-wide.
Written in Python and C++,
it exclusively uses Open Source technologies.
DFF combines an intuitive user interface with a modular and cross-platform architecture.
This version is the developer version as of September 8, 2015.
|
|
September 4, 2015:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- exfat-utils-1.2.0-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
Here are the changes from the previous version (1.0.1):
- 1.2.0 (2015-08-26)
- * Switched from SCons to autotools.
- * Added musl libc support [Brendan Heading].
- Worked around "FS is larger than device" error for memory cards formatted by Panasonic Lumix cameras.
- Worked around "unknown entry type 0xe1" error for memory cards formatted by Sony cameras.
- 1.1.1 (2014-11-15)
- Fixed mkfs crash on some sectors-per-cluster (-s option) values.
- 1.1.0 (2014-07-08)
- Relicensed the project from GPLv3+ to GPLv2+.
- OpenBSD support [Helg Bredow].
- Improved I/O errors handling.
- Implemented fsync() and fsyncdir().
- Fixed crash on Mac OS X 10.5 caused by non-standard use of realpath(). Also fixed TrueCrypt disks unmounting.
- Avoid extra erase on writes to the end of a file. This should improve linear write speed.
- Allow arbitrary changing of lower 9 bits of mode. Allow owner/group changing to the same owner/group. This fixes rsync.
- Fixed buffers overflows when handling lengthy file names.
- Fixed "real size does not equal to size" error on volumes with pagefile.sys.
- Fixed negative IUsed in "df -i" output.
In addition, because exfat-utils now includes mount.exfat and mount.exfat-fuse, exfat-utils obsoletes fuse-exfat.
- CERT-Forensics-Tools-1.0-65.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - This package was updated to add the following packages:
- Obsoleted fuse-exfat for Fedora 17-22 and CentOS 6 and 7.
|
|
August 21, 2015:
The following have been released:
- partclone-0.2.80-1.{fc17,fc18,fc19,fc20,fc21,fc22,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
See here for the list of changes in this release.
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 14, 2015:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 7, 2015:
The following have been released:
- daq-2.0.6-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i386,x86_64}.rpm - The Data Acquisition Library (Daq) is a library
used by snort.
See here for the changes in 2.0.6.
- snort-2.9.7.5-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-openappid-2.9.7.5-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - This is the snort package
built with the following additions:
- The --enable-open-appid option was added to the configure script that configures the build of snort.
See here for more details.
- The files found here and named snort-openappid.tar.gz are installed in
/usr/share/snort/cisco/apps.
- Here is the Open Source Detectors Developers Guide here.
- snort-sample-rules-2.9.7.5-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- 2.6.32-573.1.1 for EL6
- 2.6.32-573 for EL6
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- 2.6.32-573.1.1 for EL6
- 2.6.32-573 for EL6
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
July 31, 2015:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.1.3-200 for FC22
- 4.1.2-200 for FC22
- 4.0.8-300 for FC22
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.1.3-200 for FC22
- 4.1.2-200 for FC22
- 4.0.8-300 for FC22
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- plaso-1.3.0-1.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm, plaso-1.3.0-1.{el6,el7}.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
Go here to read about all of the changes and features in this release.
- dfvfs-20150730-1.(fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
- libfwsi{,-devel,-python}-20150701-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libfwsi is a library to access the
Windows Shell Item format.
See here for the list of changes.
- python-pefile-1.2.10_139.2.{el6,el7}.x86_64.rpm - Python-pefile is a multi-platform Python module to parse and work with
Portable Executable (aka PE) files.
Most of the information contained in the PE headers is accessible as well as all sections' details and their data.
This version was built for CentOS/RHEL 6 and 7 to support plaso.
- python-construct-2.5.2-1.fc22.{i686,x86_64}.rpm - Python-construct is a powerful declarative parser (and builder) for binary data.
Support was added for Fedora 22.
|
|
July 17, 2015:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
July 10, 2015:
The following have been released:
- libfixbuf{,-devel}-1.7.0-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- pyfixbuf-0.2.0-2.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Pyfixbuf is a Python API for libfixbuf, an implementation
of the IPFIX protocol used for building collecting and exporting processes.
PyFixBuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the content of the message before forwarding to another IPFIX collection point,
or in converting IPFIX to another format (text, database, JSON, etc.).
This release was rebuilt to use libfixbuf-1.7.0.
- super_mediator-1.1.1-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the changes since the last version (1.1.1).
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.10.2-3.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This release was rebuilt to use libfixbuf-1.7.0.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.10.2‑4.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.10.2‑4.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- yaf{,-devel}-2.7.1-2.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
This release was rebuilt to use libfixbuf-1.7.0.
- yaf{,-devel}-2.2.1-10.el5.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter.
Note that this version of Yaf is only available for CentOS/RHEL 5.
This release was rebuilt to use libfixbuf-1.7.0.
- dino-1.5-2.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.noarch.rpm - Dino, the drop in network observer, is a lightweight front end for network visualization.
Project:DINO, short for Drop In Network Observer, uses the open source network monitoring tools SiLK and
SNORT to create an easy to use dashboard for situational awareness.
It is built on PHP and Open Flash Chart, it is designed to be run
on Linux systems and has been tested on Fedora, Redhat and Ubuntu.
DINO queries flow records stored by SiLK and creates graphs of things like top talkers, incoming/outgoing traffic/hourly
traffic/top ports and snort alerts with the related flows records.
This release was rebuilt to use libfixbuf-1.7.0.
- libevt-{,devel,python,tools}-20150706-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- libolecf{,-devel-,-python,-tools}-20150630-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libolecf
contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libregf{,-devel,-python,-tools}-20150704-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libregf
contains libraries and tools to access the Windows NT Registry File files.
See here for the list of changes.
- CERT-Forensics-Tools-1.0-64.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - This package was updated to add the following packages:
- Obsoleted snarf for CentOS/RHEL 7
|
|
July 2, 2015:
The following have been released:
- fmem-kernel-modules-fc22-{i686,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.0.5-300 for FC22
- 4.0.6-300 for FC22
- lime-kernel-modules-fc22-{i686,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.0.5-300 for FC22
- 4.0.6-300 for FC22
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- bokken-1.8-1.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm and bokken‑1.8‑1.{el6,el7}.x86_64.rpm - Bokken is a GUI for the
Pyew and Radare projects so it offers almost all the same features that
Pyew has and and some of the Radare's ones. It's intended to be a basic disassembler, mainly, to analyze malware and vulnerabilities.
- Removed pyew entirely. Its support has been in a non-official deprecated
state for the past two years but we were trying not to do it. Pyew has
some dependencies that makes harder to package it, it's missing a lot of
features from r2, plus it sees very few releases.
- Removed other almost useless features in their current form: Strings repr
and Interactive mode. We expect to bring those at some point in a proper
way.
- Added r2 console. It crashes here and there but we think it's rather
usable.
- Added interactive Python console.
- Rearranged and simplified some tabs: Strings, Relocs and File info.
- Some additional cleanups and fixes.
Note: Although bokken was installed for CentOS/RHEL6, it does not work correctly due to a bug in the librsvg2 library.
- radare{,-devel}-2.0.9.9-1.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm and radare{,‑devel}‑2.0.9.9‑1.el7.x86_64.rpm - Radare is a framework for doing reverse engineering.
- valabind-0.9.2-1.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm and valabind‑0.9.2‑1.el7.x86_64.rpm - Valabind is a tool to parse vala
or vapi files to transform them into swig interface files, C++,
NodeJS-ffi, or GIR.
With swig, you can create language bindings for any API written in vala or C with a vapi interface.
It can also generate bindings for C++.
- python-radare-2.0.9.9-1.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm and python‑radare‑2.0.9.9‑1.el7.x86_64.rpm - Python-Radare are
bindings that allow Radare to be used from Python.
- dd_rescue-1.98-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Here are the changes from the previously distributed version (1.46):
- It has a few improvements such as a few cleanups, a fault injection framework for
testing and significantly improved speed of the pseudo RNG. But the important feature
is the addtion of a crypt plugin. You can insert it into the plugin chain to de/encrypt
data using the AES family of algorithms. (More are planned for the future.) You can use
128/192/256 bit keys and optionally use a higher number of rounds to have an increased
security margin. Keys (and IVs) can be generated, saved, retrieved or generated from
password and salt. Please be aware that despite diligent testing this is a new plugin --
so be prepared that there will be some changes and bugfixes to it in the near future.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.10.2-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.10.2‑2.{fc17,fc18,fc19,fc20,fc21,fc22}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.10.2‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- silk-ipset{,-devel,-lib,-tools}-3.10.2-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- liblnk{,-devel,-python,-tools}-20150617-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Liblnk
contains libraries and tools to access the Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libolecf{,-devel-,-python,-tools}-20150629-1.(fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libolecf
contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libvmdk{,-devel,-python,-tools}-20150516-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Libvmdk
is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
See here the list of changes.
- dfvfs-20150630-1.(fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
- daq-2.0.5-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i386,x86_64}.rpm - The Data Acquisition Library (Daq) is a library
used by snort.
See here for the changes in 2.0.5.
- snort-2.9.7.3-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-openappid-2.9.7.3-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - This is the snort package
built with the following additions:
- The --enable-open-appid option was added to the configure script that configures the build of snort.
See here for more details.
- The files found here and named snort-openappid.tar.gz are installed in
/usr/share/snort/cisco/apps.
- Here is the Open Source Detectors Developers Guide here.
- snort-sample-rules-2.9.7.3-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- nDPI{,-devel}-1.6-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
Note that RHEL/CentOS 5 is not supported due to issues with autoconf.
- xplico-1.1.0-3.{fc17,fc18,fc19,fc20,fc21,fc22,el6,el7}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
This release was rebuilt to work with nDPI-1.6. All other suported systems were upgraded for release version consistency.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
- pytsk-20150406-4.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
This version was primarily rebuilt to fix problems caused by GCC Version 5 on Fedora 22. The other systems were rebuilt to keep release consistency.
- python-xlwt-1.0.0-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i386,x86_64}.rpm - Python-xlwt is a library for generating spreadsheet files that
are compatible with Excel 97/2000/XP/2003, OpenOffice.org Calc, and Gnumeric. Python-xlwt has full support for Unicode. Excel spreadsheets can be generated on any platform without
needing Excel or a COM server.
See here for a list of changes since the previously released version (0.7.4).
- Volatility-2.4-9.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility uses the code as available from here as of 2015-06-30.
It also contains the mimikatz plugin.
- super_mediator-1.1.0-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the changes since the last version (0.3.0).
|
|
June 12, 2015:
The following have been released:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 5, 2015:
The following have been released:
- Fedora 22 - The repository now supports Fedora 22
for both the i686 and x86_64 CPU architectures.
Here is the list of tools provided for Fedora 22:
- ssdeep-2.13-1.{fc17,fc18,fc19,fc20,fc21,fc22,el5,el6,el7}.{i686,x86_64}.rpm - Ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes. See here for the list of changes.
- bokken-1.7-1.{fc17,fc18,fc19,fc20,fc21,fc22,el6}.{i686,x86_64}.rpm - Bokken is a GUI for the
Pyew and Radare projects so it offers almost all the same features that
Pyew has and and some of the Radare's ones. It's intended to be a basic disassembler, mainly, to analyze malware and vulnerabilities.
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-1.6-1.5.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 22 x86_64 and i686 architectures was added.
- lime-kernel-modules-1.1.r17-5.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 22 x86_64 and i686 architectures was added.
|
|
May 15, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
May 11, 2015:
The following have been released:
- libewf-{,devel,tools}-20100226-1.{fc21}.{i686,x86_64}.rpm, ewftools-20140608-1.{fc21}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
This package contains the Version 1 API for the libewf tools and is needed to build the libewf-20140608 package.
- libewf-{,devel,python}-20140608-1.{fc21}.{i686,x86_64}.rpm, ewftools-20140608-1.{fc21}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Note that beginning with Fedora 19, the tools package is named ewftools to reflect the package name found in those releases of Fedora.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
Note: Version 20140608 is the latest production of libewf but there is a later version (20141129), an experimental version, in
the repository. We have received a report that version 20141129 has a bug and cannot handle split E01 files correctly. The report noted
this error in the plaso timeline tool.
The bug report is here.
If you wish to install the 20140608 version of libewf, do the following, all as root
rpm -ev $(rpm -qa | grep 'ewf.*20150105*') --nodeps
yum -y install {ewftools,libewf-python,libewf}-20140608-2
Then edit /etc/yum.repos.d/cert-forensics-tools.repo so that the beginning of the file looks like the following:
[forensics]
name=CERT Forensics Tools Repository
baseurl=http://www.cert.org/forensics/repository/fedora/cert/$releasever/$basearch
enabled=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-cert-forensics-2016-02-22
gpgcheck=1
proxy=_none_
deltarpm=0
exclude=ewftools* libewf*
This will install the last stable version of libewf which fixes the split E01 bug.
Note that when a new version of libewf becomes available, you will need to removed these chnages to /etc/yum.repos.d/cert-forensics-tools.repo.
Watch this page for that announcement.
|
|
May 1, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- partclone-0.2.71-4.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
This release was built to use the latest version of libntfs-3g.so for Fedora 20 and CentOS 6 and 7.
All other versions were rebuilt to maintain release consistency.
- testdisk-6.14-3.3.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
This release was built to use the latest version of libntfs-3g.so..
|
|
Apr 24, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- lime-kernel-modules-fc19-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc19-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- partclone-0.2.71-3.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
This release was built to use the latest version of libntfs-3g.so for Fedora 21.
All other versions were rebuilt to maintain release consistency.
- libpff-20131028-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - Libpff is a library
and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.
PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
Libpff is used by DFF - the Digital Forensics Framework.
See here for the list of changes.
|
|
Apr 17, 2015:
The following have been released:
- dfvfs-20150414-1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
- libolecf{,-devel-,-python,-tools}-20150413-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libolecf contains libraries and tools
to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libesedb-{,devel,python,tools}-20150409-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libesedb contains a library and tools to access the Extensible Storage
Engine (ESE) Database File (EDB) format. ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
See here for the list of changes.
- sleuthkit-{,devel,libs}-4.1.3-6.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
The changes from the previous version - 4.1.3-5 - was to add a patch to support pytsk for CentOS/RHEL 7.
All other versions were updated to this release for consistency.
- pytsk-20150406-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
|
|
Apr 10, 2015:
The following have been released:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
Apr 3, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.19.3-200 for FC21
- 3.19.2-201 for FC21
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.19.3-200 for FC21
- 3.19.2-201 for FC21
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-229.1.2 for EL7
- 3.10.0-229 for EL7
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-229.1.2 for EL7
- 3.10.0-229 for EL7
|
|
March 27, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- snort-openappid-2.9.7.2-2.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - This is the snort package
built with the following programs added to the /usr/bin directory. See here for more details.
- u2openappid
- u2streamer
- snort_dump_packets_control
- Volatility-2.4-8.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility uses the code as available from here as of 2015-03-23.
It also contains the mimikatz plugin.
- daemonize-1.7.3-7.{el5,el6,el7}.{i686,x86_64}.rpm - Daemonize daemonize runs a command as a Unix daemon.
As defined in W. Richard Stevens' 1990 book, Unix Network Programming
(Addison-Wesley, 1990), a daemon is a process that executes 'in the background' (i.e., without an associated
terminal or login shell) either waiting for some event to occur, or waiting to perform some specified task on a periodic basis.
- libvmdk{,-devel,-python,-tools}-20150325-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libvmdk
is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
See here the list of changes.
- python-construct-2.5.2-1.fc21.{i686,x86_64}.rpm - Python-construct is a powerful declarative parser (and builder) for binary data.
Support was added for Fedora 21.
|
|
March 20, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- libmsiecf{,-devel,-python,-tools}-20150314-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libregf{,-devel,-python,-tools}-20150315-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - libregf contains libraries and tools
to access the Windows NT Registry File files.
See here for the list of changes.
- umview-0.8.2-1.1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm and libumlib{,-devel}-0.8.2-1.1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm -
UMview is a user-mode implementation of View-OS.
Processes are run with a controlling daemon that captures all the system calls (at present using the ptrace() system call) and uses dynamically loadable modules to change their semantic.
- fuseext2-0.3-1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - Fuxeext2 is a module for the FUSE
kernel service allows any FUSE-enabled user to mount Second Extended file systems, e.g. disk images.
The module has been initially written for UMView, the user-mode implementation of View-OS.
|
|
March 13, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- snort-2.9.7.2-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.7.2-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- snort-openappid-2.9.7.2-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - This is the snort package
built with the following additions:
- The --enable-open-appid option was added to the configure script that configures the build of snort.
See here for more details.
- The files found here and named snort-openappid.tar.gz are installed in
/usr/share/snort/cisco/apps.
- luajit{,-devel}-202-9.{fc17,fc18,el6,el7}.{i686,x86_64}.rpm - Luajit is a just-in-time compiler for the
LUA programming language.
Building snort-openappid for Fedora 17 and 18 and CentOS/RHEL 6 and 7 required luajit-devel.
|
|
March 6, 2015:
The following have been released:
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.10.1-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.10.1‑2.{fc17,fc18,fc19,fc20,fc21}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.10.1‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- libguytools-2.0.3-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libguytools is a package of subroutines and header files needed to
build and operate guymager.
The changes are:
- Corrected problem with trailing backslashes
- Switched to my new developer email address (Guy Voncken )
- guymager-0.7.4-2.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - Guymager is a forensic imaging package.
This version has been rebuilt to use version 2.0.3 of libguytools.
- dfvfs-20150303-1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
- emacs-gettext{,-el}-0.18.1.1-7.7.noarch.rpm, gettext{,-common-devel,-devel,-libs}-0.18.1.1-7.7.noarch.rpm - The Gettext
utilities are a set of tools that provides a framework to help other GNU packages produce multi-lingual messages.
These tools include a set of conventions about how programs should be written to support message catalogs, a directory and file naming
organization for the message catalogs themselves, a runtime library supporting the retrieval of translated messages,
and a few stand-alone programs to massage in various ways the sets of translatable strings, or already translated strings.
A special GNU Emacs mode also helps interested parties in preparing these sets, or bringing them up to date.
These packages have been built for CentOS/RHEL 6 in support of the libfvde packages.
- libfvde{,-devel,-tools}-20150222-1.{fc17,fc18,fc9,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - Libfvde is a lbrary and tools to access FileVault Drive
Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
Here are the changes from the last version (20130305):
- 20150222
- Code clean up
- Worked on documenation
- Changes for handling 0x001a metadata with different plist key sequence
- 20150106
- 20141226
- changes for updated dependencies
- 20141130
- 20141120
- 20141018
- 20141017
|
|
February 27, 2015:
The following have been released:
- yara-3.3.0-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Here are the changes since the last version (2.1.0):
- Added support for negative integers and floating point numbers
- Implemented operators >, <, >=, <= for strings
- Implemented word boundary anchors (\b, \B) in regular expressions
- New features in PE module
- Math module
- New --print-namespace command line argument
- Better error handling in low memory conditions
- BUGFIX: at operator not working with certain strings containing wildcards
- BUGFIX: precedence of bitwise operators was incorrect
- BUGFIX: incorrect imphash result for certain PE files importing functions by ordinal
- BUGFIX: handle and memory leaks
- BUGFIX: multiple segfaults
- yara-python-3.3.0-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Yara-python is a Python
extension that gives access to Yara's powerful features from Python scripts.
Here are the changes since the last version (2.1.0):
- Added support for negative integers and floating point numbers
- Implemented operators >, <, >=, <= for strings
- Implemented word boundary anchors (\b, \B) in regular expressions
- New features in PE module
- Math module
- New --print-namespace command line argument
- Better error handling in low memory conditions
- BUGFIX: at operator not working with certain strings containing wildcards
- BUGFIX: precedence of bitwise operators was incorrect
- BUGFIX: incorrect imphash result for certain PE files importing functions by ordinal
- BUGFIX: handle and memory leaks
- BUGFIX: multiple segfaults
- dfvfs-20150224-1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
- pyfixbuf-0.2.0-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Pyfixbuf is a Python API for libfixbuf, an implementation
of the IPFIX protocol used for building collecting and exporting processes.
PyFixBuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the content of the message before forwarding to another IPFIX collection point,
or in converting IPFIX to another format (text, database, JSON, etc.).
See here for a list of changes.
- python-registry-1.1.0-2.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i386,x86_64}.rpm - Python-registry provides read-only access
to Windows Registry files, such as NTUSER.DAT, userdiff, and SOFTWARE.
The interface is two-fold: a high-level interface suitable for most tasks, and a low level set of parsing objects and methods which may be used for advanced
study of the Windows Registry.
Python-registry is written in pure Python, making it portable across all major platforms.
This release brings python-registry up to date as of 2015-02-26.
|
|
February 20, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.18.6-200 for FC21 (added in release 7 of this package)
- 3.18.7-200 for FC21
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.18.6-200 for FC21 (added in release 7 of this package)
- 3.18.7-200 for FC21
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.18.6-100 for FC20 (added in release 26 of this package)
- 3.18.7-100 for FC20
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.18.6-100 for FC20 (added in release 26 of this package)
- 3.18.7-100 for FC20
- ddrutility-2.7-1.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue. It currently contains the following utilities:
- ddru_findbad
- ddru_ntfsbitmap
- ddru_ntfsfindbad
- ddru_diskutility
Here are the changes since the last release (2.6):
- ddru_ntfsfindbad 1.5 released:
- Fixed possible program crash if partition boot sector error
- Better partition boot sector error output
- ddru_ntfsbitmap 1.5 released:
- Fixed possible program crash if partition boot sector error
- Better partition boot sector error output
- dfvfs-20150217-1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
- python-registry-1.1.0-1.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i386,x86_64}.rpm - Python-registry provides read-only access
to Windows Registry files, such as NTUSER.DAT, userdiff, and SOFTWARE.
The interface is two-fold: a high-level interface suitable for most tasks, and a low level set of parsing objects and methods which may be used for advanced
study of the Windows Registry.
Python-registry is written in pure Python, making it portable across all major platforms.
- shellbags-0.5.5-1.{fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - Shellbags Microsoft Windows uses a set of
registry keys known as "shellbags" to maintain the size, view, icon, and position of a folder when using Explorer. Shellbags persist information for
directories even after the directory is removed, which means that they can be used to enumerate past mounted volumes, deleted files, and user actions.
See Using shellbag information to reconstruct user activities for an overview of the
investigative value of shellbags.
|
|
February 13, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- Volatility-2.4-6.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility uses the code as available from here as of 2015-02-09
- libbde{,-devel,-python,-tools}-20150204-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
|
|
February 6, 2015:
The following have been released:
- libsigscan{,-devel,-python,-tools}-20150125-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libsigscan is a library and tools used to
binary signature scanning.
See here for the list of changes.
- libbde{,-devel,-python,-tools}-20150124-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
- dfvfs-20150203-1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - dfVFS, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
|
|
January 31, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- dfvfs-20150127-1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - Dfvfs, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
- libluksde{,-devel,-python,-tools}-20150106-1.{fc17,fc18,fc19,fc20,fc21,el7}.{i686,x86_64}.rpm - Libluksde is a library and tools used to
access LUKS Disk Encryption encrypted volumes.
See here for the list of changes.
- libvhdi{,-devel,-python,-tools}-20150110-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- yaf{,-devel}-2.7.1-1.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
Here are the changes from the last version (2.6.0):
- Fix a bug with --flow-stats in particular configurations
|
|
January 23, 2015:
The following have been released:
- ddrutility-2.6-4.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue.
The change in this release is to reference the correct location of the nfscluster for installed versions.
|
|
January 16, 2015:
The following have been released:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
January 9, 2015:
The following have been released:
- lime-kernel-modules-fc19-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc19-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- distorm3-3.0-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - Distorm3 is a lightweight,
easy-to-use and fast decomposer library.
It disassembles instructions in 16, 32 and 64 bit modes.
Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX.
Distorm3 is used by The Volatility Framework.
The changes are listed here.
- ghostpdl-9.15-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Ghostpdl is Artifex Software's implementation of the
PCL-5™ and PCL-XL™ family of page description languages. Ghostpdl is used by Xplico.
This is the eleventh full release in the stable 9.x series, and is primarily a maintenance release.
Highlights in this release include:
- Ghostscript now supports the PDF security handler revision 6.
- The pdfwrite and ps2write (and related) devices can now be forced to "flatten"
glyphs into "basic" marking operations (rather than writing fonts to the output),
by giving the
-dNoOutputFonts command line option (defaults to "false")
- PostScript programs can now use get_params or get_param to determine if a page contains color markings by reading the pageneutralcolor
state from the device (so whether the page is "color" or "mono").
Note that this is only accurate when in clist mode, so
-dMaxBitmap=0 and -dGrayDetection=true should both be used.
- The pdfwrite device now supports Link annotations with GoTo and GoToR actions
- The pdfwrite device now supports BMC/BDC/EMC pdfmarks
- Regarding the new color management for the pdfwrite device introduced in the previous release, the proscription on using the new color management when producing
PDF/A-1 compliant files is now lifted. To reiterate, also, with the new color management implementation, using the
UseCIEColor option is strongly discouraged.
For further information on the new pdfwrite color management,
see: Color Conversion and Management
- Plus the usual round of bug fixes, compatibility changes, and incremental improvements.
To see all of the changes for all releases of ghostpdl, view ths file file:///usr/share/doc/ghostpdl/History9.htm on a system where ghostpdl is installed.
- LogAnalysisToolKit-1.7-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.noarch.rpm - LogAnalysisToolkit is a collection of command line and web-based tools for
use in incident response and long-term analysis of web server and proxy server log data.
LATK can detect beaconing traffic in proxy logs and SQL injection, and XSS attempts in web server logs.
Often when responding to a security incident, the only files available are web server and proxy server logs.
LATK will aid you in detecting odd traffic, such as botnet beaconing and SQL injection attempts.
The data available in these files can be overwhelming, but the tools in LATK can be used to parse these files and build a MySQL database for querying.
- dino-1.5-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.noarch.rpm - Dino, the drop in network observer, is a lightweight front end for network visualization.
Project:DINO, short for Drop In Network Observer, uses the open source network monitoring tools SiLK and
SNORT to create an easy to use dashboard for situational awareness.
It is built on PHP and Open Flash Chart, it is designed to be run
on Linux systems and has been tested on Fedora, Redhat and Ubuntu.
DINO queries flow records stored by SiLK and creates graphs of things like top talkers, incoming/outgoing traffic/hourly
traffic/top ports and snort alerts with the related flows records.
- yaf{,-devel}-2.7.0-1.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
Here are the changes from the last version (2.6.0):
- New Gh0st RAT Application Label
- New NetBIOS Datagram Service Application Label
- yafMeta2Pcap can now accept IPFIX input
- getFlowKeyHash now exports IPFIX
- Support for indexing PCAPNG files
- New YAF option --no-output to produce no IPFIX output
- New YAF options --hash and --stime to search for a single flow with the given hash and start time
- DNS DPI now exports query section of resource record for all responses with nonzero RCODE
- Faster searching of pcap-meta files
- Implement SAME_SIZE flag for TCP flows
- Minor Bug Fixes
- snarf{,-devel,-python}-0.2.4-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Snarf is a distributed alert reporting system.
Applications can use snarf's C and Python APIs to construct and send network alert messages,
which can then be routed to multiple destinations in a configurable manner.
Here are the changes:
- Support non-flow ip address fields in alerts.
- Fix ZeroMQ compatibility problems, now requires ZeroMQ 2.2.x.
- Fix problem with certain GLib2 version / platform combinations.
- libbde{,-devel,-python,-tools}-20150106-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
- libbfio{,-devel,-python,-tools}-20150105-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access.
See here for the list of changes.
- libevt{,-devel,-python,-tools}-20150105-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - libevt contains libraries and tools
to access the Windows XML Event Log (EVT) format files.
See here for the list of changes.
- libevtx{,-devel,-python,-tools}-20150105-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- liblnk{,-devel,-python,-tools}-20150105-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - liblnk contains libraries and tools
to access the Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libmsiecf{,-devel,-python,-tools}-20150106-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libolecf{,-devel-,-python,-tools}-20150106-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libolecf contains libraries and tools
to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libqcow{,-devel,-tools,-python}-20150105-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libqcow
is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
See here for the list of changes.
- libregf{,-devel,-python,-tools}-20150105-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - libregf contains libraries and tools
to access the Windows NT Registry File files.
See here for the list of changes.
- libsmdev{,-devel,-python,-tools}-20150105-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libsmdev
is a library and tools used to access storage media devices.
See here for the list of changes.
- libsmraw{,-devel,-python,-tools}-20141022-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- libvhdi{,-devel,-python,-tools}-20150105-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- libvmdk{,-devel,-python,-tools}-20150105-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libvmdk
is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
See here the list of changes.
- libvshadow{,-devel,-python,-tools}-20150106-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libvshadow
is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
See here for the list of changes.
|
|
December 24, 2014:
The following have been released:
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.10.0-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.10.0-2.{fc17,fc18,fc19,fc20,fc21,el6,el7}.{i686,x86_64}.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis-pipeline-4.4.1-2.{fc17,fc18,fc9,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
This version was rebuilt to use the latest version of SiLK, specifically 3.10.0-1.
- silk-ipset{,-devel,-lib,-tools}-3.10.0-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
- pytsk-20141220-1.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
- libfwsi{,-devel,-python}-20141116-1.(fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - Libfwsi is a library to access the
Windows Shell Item format.
See here for the list of changes.
- dfvfs-20141220-1.(fc17,fc18,fc19,fc20,fc21,el6,el7}.noarch.rpm - Dfvfs, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See hre for the list of changes.
- pyparsing{,-doc}-2.0.3-1.{fc17,fc18,fc19,fc20,el6,el7}.{i386,x86_64}.rpm, python3-pyparsing-2.0.3-1.{fc17,fc18,fc19,fc20}.{i386,x86_64}.rpm -
Pyparsing is a module that provides an alternative approach to creating and executing simple grammars,
vs. the traditional lex/yacc approach, or the use of regular expressions.
The module provides a library of classes that client code uses to construct the grammar directly in Python code.
Pyparsing is provided by RedHat for Fedora 21.
Pyparsing version 2.0.3 is needed by plaso.
- plaso-1.2.0-2.{fc17,fc18,fc19,fc20,fc21}.{i686,x86_64}.rpm, plaso-1.2.0-2.{el6,el7}.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
Go here to read about all of the changes and features in this release.
In addition, this release is current up to the development version as of December 24, 2014.
|
|
December 15, 2014:
The following have been released:
- Fedora 21 - The repository now supports Fedora 21
for both the i686 and x86_64 CPU architectures.
Here is the list of tools provided for Fedora 21:
- fmem-kernel-modules-1.6-1.4.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 21 x86_64 and i686 architectures was added.
- lime-kernel-modules-1.1.r17-4.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 21 x86_64 and i686 architectures was added.
- fmem-kernel-modules-fc21-{i686,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.17.6-300 for FC21
- 3.17.4-302 for FC21
- 3.17.4-301 for FC21
- 3.17.4-300 for FC21
- 3.17.3-300 for FC21
- 3.17.1-302 for FC21
- lime-kernel-modules-fc21-{i686,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.17.6-300 for FC21
- 3.17.4-302 for FC21
- 3.17.4-301 for FC21
- 3.17.4-300 for FC21
- 3.17.3-300 for FC21
- 3.17.1-302 for FC21
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
- CERT-Forensics-Tools-1.0-61.{fc17,fc18,fc19,fc20,fc21,el5,el6,el7}.{i686,x86_64}.rpm - This package was updated to add the following packages:
- Removed snarf for Fedora 21
- Added ddrescueview for all supported OSes and architectures.
|
|
December 12, 2014:
The following have been released:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-{fc17,fc18,fc19,fc20,el5,el6,el7}-{i686,x86_64}-1.1.r17-*.noarch.rpm - Building errors were discovered the solution to which was to rebuild all lime modules
for all supported versions of Fedora and CentOS/RHEL for all supported architectures.
Steps were taken to verify future builds for LiME for each OS/Architecture pair.
- fmem-kernel-modules-{fc17,fc18,fc19,fc20,el5,el6,el7}-{i686,x86_64}-1.1.r17-*.noarch.rpm - No changes were made but the release numbers were changed to remain in sync with the
lime-kernel-modules release numbers.
- libewf{,-devel,-tools,-python}-20141129-1.{fc17,fc18}.{i686,x86_64}.rpm, libewf{-devel,-tools,-python}-20141129-1.{fc19,fc20}.{i686,x86_64}.rpm, ewftools-20141129-1.{fc19,fc20}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Note: Beginning with Fedora 19, the tools package is named ewftools to reflect the package name found in those releases of Fedora.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
Note: This package is not provided for CentOS/RHEL 5 and 6.
Here are the changes from the previously released version (20140608):
- 20141129
- 20141102
- bug fixes
- ewf.net added FileEntry::GetType
- 20141030
- bug fix in Python-bindings
- changes for updated dependencies
- 20141021
- 20141012
- 20141007
- updated dependencies and corresponding changes
- worked on autogen.sh and synclibs.sh scripts
- 20141002
- removed README.macosx
- changes for project site move
- 20140801
- bug fix in Python-bindings
In addition, this version was built to include the Version 1 API. Because of this, the shared object library libewf.so.1 and libewf.so.1.0.4 are no longer provided in this package.
If your application requires these shared object libraries, they should be rebuilt to use the shared objects that come with this package, namely libewf.so.2 and libewf.so.2.1.0.
- aff{lib,lib-devel,tools}-3.7.4-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Afflib is the library and tools to manipulate files
using the Advanced Forensic Format.
- pytsk-20141207-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
In addition, the following changes were also made:
- The scripts ewf.py, tskfuse.py, and imgfuse.py were also installed in /usr/bin.
- The runtime dependency fuse-python was also added.
- libfixbuf{,-devel}-1.6.2-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-9.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This release was rebuilt with libfixbuf version 1.6.2.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-10.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
This release was rebuilt with libfixbuf version 1.6.2.
- super_mediator-0.3.0-7.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
This release was rebuilt to use libfixbuf version 1.6.2.
- yaf{,-devel}-2.6.0-4.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
This release was rebuilt to use libfixbuf version 1.6.2.
- yaf{,-devel}-2.2.1-9.el5.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter.
Note that this version of Yaf is only available for CentOS/RHEL 5.
This release was rebuilt to use libfixbuf version 1.6.2.
|
|
November 26, 2014:
The following have been released:
- xmount-0.7.3-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. The changes in this version are the following:
Note that xmount is not available for CentOS/RHEL 5.
Here are the changes for this version:
- New build system using cmake.
- New command line syntax. Make sure to check the man page!
- New --offset and --sizelimit command line parameters.
- Support for multiple input images.
- Support for image morphing. Currently supporting combine, raid (RAID0) and unallocated (HFS and FAT).
- Internal support for ewf files.
- Volatility-2.4-5.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility uses the code as available from here as of 2014-11-24.
- ddrescueview-0.3-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm - Ddrescueview is a small tool that allows
the user to graphically examine ddrescue's log files in a user friendly GUI application.
The Main window displays a block grid with each block's color representing the block types it contains.
Many people know this type of view from defragmentation programs.
The program is written in Object Pascal using the Lazarus IDE.
- ddrutility-2.6-3.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue.
The change in this release is to reference the correct location of the nfscluster program for CentOS 6.
All other versions are unchanged but were rebuilt for revision number compatibility.
|
|
November 21, 2014:
The following have been released:
- lime-kernel-modules-fc19-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc19-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- libevtx-{,devel,python,tools}-20141112-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- sleuthkit-{,devel,libs}-4.1.3-5.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
The changes from the previous version - 4.1.3-3 - was to add a correct fix for java bindings.
Note that the version provided by Fedora - 4.1.3-4 - does not provide this support in the binary packages they provide nor can that support be added using their source packages.
- Support for Fedora 21 x86_64 architecture - The repository now supports Fedora 21 for the x86_64 CPU architecture.
The cert-forensics-tool-release has been installed in the cert repository and all other packages have been installed in the forensics-test repository.
As root, you will need to enable this repository in the /etc/yum.repos.d/cert-forensics-tools.repo file.
To install the CERT-Forensics-Tools package, it was necesary to run sudo yum erase protobuf-c first.
This repository was built with the Fedora 21 development repository and the Fedora 21 testing updates repository.
When Fedora 21 is released, the CERT Forensics Tools repository will be entirely rebuilt using that distribution and support for the i686 architecture will be
added at that time.
If you find any problem with the packages in the CERT Linux Forensics Tools Repository, please send email to:
|
|
November 15, 2014:
The following have been released:
- dfvfs-20141108-1.(fc17,fc18,fc19,fc20,el6,el7}.noarch.rpm - Dfvfs, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
This version no longer scans VSS snapshot volumes by default.
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for:
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for:
LiME:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- libesedb-{,devel,python,tools}-20141110-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libesedb contains a library and tools to access the Extensible Storage
Engine (ESE) Database File (EDB) format. ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
See here for the list of changes.
- ddrutility-2.6-2.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue. It currently contains the following utilities:
- ddru_findbad
- ddru_ntfsbitmap
- ddru_ntfsfindbad
- ddru_diskutility
The change in this release is to reference the correct location of the nfscluster program for CentOS 6.
- partclone-0.2.71-2.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
This release was built to use the latest version of libntfs-3g.so for CentOS.
- testdisk-6.14-3.2.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
This release was built to use the latest version of libntfs-3g.so for CentOS.
|
|
November 7, 2014:
The following have been released:
- guymager-0.7.4-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Guymager is a forensic imaging package.
See here for the list of changes.
- liblnk-{,devel,python,tools}-20141026-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - liblnk contains libraries and tools
to access the Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libregf-{,devel,python,tools}-20141030-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libregf contains libraries and tools
to access the Windows NT Registry File files.
See here for the list of changes.
- Volatility-2.4-4.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility uses the code as available from here as of 2014-11-03.
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for:
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for:
LiME:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
|
|
October 31, 2014:
The following have been released:
- analysis-pipeline-4.4.1-1.{fc17,fc18,fc9,fc20,el5,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
See here for the changes in this release.
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- libevt-{,devel,python,tools}-20141026-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- libevtx-{,devel,python,tools}-20141026-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- libmsiecf-{,devel,python,tools}-20141025-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libolecf-{,devel,python,tools}-20141026-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libolecf contains libraries and tools
to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libsmraw{,-devel,-tools,-python}-20141026-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- mdbtools{,-devel,-gui}-0.7-43.13.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm, libmdbodbc1-0.7-43.13.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm, -
The MDB Tools project is a effort to document the MDB file format used in Microsoft's Access
database package, and to provide a set of tools and applications to make that data available on other platforms.
Specifically, MDB Tools includes programs to export schema and data to other databases such as
MySQL, Oracle, Sybase, PostgreSQL, and others.
Also included is a SQL engine for performing simple SQL queries. The 0.5 release includes an updated GUI interface (screenshot is available here).
A sparse but functional ODBC driver is included as well.
MDB Tools currently has read-only support for Access 97 (Jet 3) and Access 2000/2002 (Jet 4) formats. Write support is currently being worked on and the first cut is expected to be included in the 0.6 release.
For more information check the FAQ and the Installation Guide.
- ssdeep-2.12.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes. See here for the list of changes.
Also see the SourceForge Page for forums, bugtracking, CVS, et al.
|
|
October 24, 2014:
The following have been released:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
- lime-kernel-modules-fc19-{i686,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc19-{i686,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- ddrutility-2.6-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue. It currently contains the following utilities:
- ddru_findbad
- ddru_ntfsbitmap
- ddru_ntfsfindbad
- ddru_diskutility
Here are the changes since the last release (2.5):
- Changes have been made for compiling compatibility:
- Some unneeded items removed from configure.ac
- Added lib check for iconv
- Some improvements have been made to the documentation:
- Added examples to the --mftdomain option of ntfs_bitmap
- Updated info about ddru_findbad being slow
- Ddru_findbad 1.11 released:
- No longer relies on bash
- Fixed a bug dealing with bad ntfscluster results
- Images are now accessed as read only
- Ddru_ntfsfindbad 1.4 released:
- Fixed potential memory bug with name conversions
- Fixed iconv BOM issue
- Fixed a bug with mft data run length
- Fixed issue with current postition in logfile
- Ddru_ntfsbitmap 1.4 released:
- Fixed potential memory bug with name conversions
- Fixed iconv BOM issue
- Ddru_diskutility 1.3 released:
- distorm3-3-2.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i386,x86_64}.rpm - Distorm3 is a lightweight,
easy-to-use and fast decomposer library. It disassembles instructions in 16, 32 and 64 bit modes. Supported instruction sets: FPU, MMX, SSE, SSE2,
SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX. Distorm3 is used by
The Volatility Framework.
This version used the code release on September 20, 2012.
- libsmdev{,-devel,-tools,-python}-20141021-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libsmdev
is a library and tools used to access storage media devices.
See here for the list of changes.
- libsmraw{,-devel,-tools,-python}-20141022-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- libvhdi{,-devel,-python,-tools}-20141021-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- libvmdk{,-devel,-tools,-python}-20141021-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libvmdk
is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
See here the list of changes.
- libbde{,-devel,-python,-tools}-20141023-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here the list of changes.
- libvshadow{,-devel,-tools,-python}-20141023-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libvshadow
is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
See here for the list of changes.
- daq-2.0.4-1.{fc17,fc18,fc19,fc20,el6,el7}.{i386,x86_64}.rpm - The Data Acquisition Library (Daq) is a library
used by snort.
Here are the changes since the last version:
- Changes in 2.0.4 Released on 2014-09-06
- api/daq_common.h
- Changed name from 'priv_flow_id' to 'flow_id'.
- Changed the 'flow_id' field to an uint32_t rather than void * since that's how it is used and will be safer to pass around.
- m4/sf.m4, sfbpf/Makefile.am
- Fix DAQ macros to allow users to edit libpcap version in cache file.
- Also fixed a parallel build error for individual make targets in spfbf.
- os-daq-modules/daq_netmap.c, README, configure.ac, api/daq_common.h, os-daq-modules/Makefile.am, os-daq-modules/daq_afpacket.c
- Add new open source netmap DAQ module for Linux/FreeBSD; see the README for more details.
- Clean up error reporting during AFPacket DAQ module initialization.
- Changes in 2.0.3 Released on 2014-06-06:
- api/daq.h, api/daq_api.h, api/daq_base.c, api/daq_mod_ops.c, os-daq-modules/daq_afpacket.c, os-daq-modules/daq_pcap.c, os-daq-modules/daq_static_modules.c,
os-daq-modules/daq_static_modules.h, sfbpf/sf_bpf_filter.c, sfbpf/sf_bpf_printer.c, sfbpf/sf_gencode.c, sfbpf/sf_nametoaddr.c, sfbpf/sfbpf-int.h, sfbpf/sfbpf_dlt.h
- configure.ac
- Fixed FreeBSD 10 compatibility
- os-daq-modules/daq_pcap.c
- Fix compatibility with libpcap 1.5.1 and 1.5.2.
- snort-2.9.7.0-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.7.0-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
|
|
October 17, 2014:
The following have been released:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- libfixbuf{,-devel}-1.6.1-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-7.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This release was rebuilt with libfixbuf version 1.6.1.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-8.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
This release was rebuilt with libfixbuf version 1.6.1.
- super_mediator-0.3.0-7.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
This release was rebuilt to use libfixbuf version 1.6.1.
- yaf{,-devel}-2.6.0-3.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
This release was rebuilt to use libfixbuf version 1.6.1.
- yaf{,-devel}-2.2.1-8.el5.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter.
Note that this version of Yaf is only available for CentOS/RHEL 5.
This release was rebuilt to use libfixbuf version 1.6.1.
|
|
October 10, 2014:
The following have been released:
- ddrescue-1.19-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
Here are the changes for this version:
- Fixed a race condition at start of run with '--timeout=0'.
- Added new option '-P, --data-preview'.
- Added new option '-u, --unidirectional'.
- Added new option '-X, --exit-on-error'.
- Added new option '--ask' to ask for user confirmation.
- Added new option '--cpass' to select passes during copying phase.
- Added new option '--pause' to insert a pause between passes.
- Removed option '-l, --logfile-size'.
- Skip on the first error during the copying phase.
- rescuebook.cc: Trimming done in one pass, may be run in reverse.
- The splitting phase has been replaced by a scraping phase.
- Changed long name of option '-n' to '--no-scrape'.
- rescuebook.cc: Alternate direction of passes during retrying phase.
- Show ATA model and serial number with '--ask' or '-vv' on Linux.
- configure: Added new option '--enable-linux'.
- New files linux.h linux.cc.
- License changed to GPL version 2 or later.
- libsmdev{,-devel,-tools,-python}-20141004-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libsmdev
is a library and tools used to access storage media devices.
See here for the list of changes.
- partclone-0.2.71-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
Here are the changes for this version:
- fix configure.ac and add libblkid-dev check
- fix xfs
- merger btrfs to 3.14 and update makefile
- try to merge btrfs 3.14.1
- fix restore-to-raw option
- ptk-1.0.5-5.{fc17,fc18,fc19,fc20,el5,el6,el7}.noarch.rpm - PTK is a computer forensic framework for the command line
tools in the SleuthKit plus many more modules. PTK uses MySQL which is assumed to be configured, using the
command line tool mysql_secure_installation or equivalent, and operating.
It also assumes a web server, for example Apache, has been configured and is operational.
Here are the list of changes:
- For RHEL/CentOS 7, the package now depends on mysql-compat-server. All other versions are unchanged but were rebuilt for revision number compatibility.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-5.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This version correctly removes an incorrect Obsoletes: directive from the spec file.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-6.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
This version was built to keep in step with the release 5 update noted above.
- testdisk-6.14-3.1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
This release correctly removes an incorrect Obsoletes: directive from the spec file.
- Volatility-2.4-3.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
See here for a list of changes and features in this major release.
This version of Volatility uses the code as available from here as of 2014-10-09.
|
|
October 3, 2014:
The following have been released:
- bulk_extractor-1.5.5-2.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Bulk_extractor
bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without
parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or
processed with automated tools. bulk_extractor also creates histograms of features that it finds, as features that are more
common tend to be more important. This version fixes many issues. In addition, it also contains the BEViewer GUI front-end for bulk_extractor.
Note that this release of bulk_extractor is not available for CentOS/RHEL 5 due to an outdated version of flex for that OS.
The change in this release fixes an issue where python3.2 was explicitly referenced in report_encodings.py.
- dfvfs-20140928-1.(fc17,fc18,fc19,fc20,el6,el7}.noarch.rpm - Dfvfs, the Digital Forensics Virtual File System, provides read-only access
to file-system objects from various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
See here for the list of changes.
- xmount-0.7.2-1.{fc17,fc18,fc19,fc20,el7}.{i686,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. The changes in this version are the following:
Note that xmount is not available for CentOS/RHEL 5 and 6.
Here are the changes for this version:
- 0.7.0
- Changed build system from autoconf / automake to cmake
- Moved input image support into external libs
- Added morphing functionality including combine, raid and unallocated
- Added --offset and --sizelimit command line parameter
- Massive code cleanup including some small bug fixes
- 0.7.1
- Fixed bug with --sizelimit command line option.
- 0.7.2
- Fixed bug in FreeResources(). Do not free vdi.p_vdi_block_map as it is part of vdi.p_vdi_header
- ssdeep-2.11-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes. See here for the list of changes.
- lime-kernel-modules-fc19-{i686,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc19-{i686,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- libfixbuf{,-devel}-1.6.0-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-3.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This release was rebuilt with libfixbuf version 1.6.0.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-4.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
This release was rebuilt with libfixbuf version 1.6.0.
- super_mediator-0.3.0-6.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
This release was rebuilt to use libfixbuf version 1.6.0.
- yaf{,-devel}-2.6.0-2.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
This release was rebuilt to use libfixbuf version 1.6.0.
- yaf{,-devel}-2.2.1-7.el5.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter.
Note that this version of Yaf is only available for CentOS/RHEL 5.
This release was rebuilt to use libfixbuf version 1.6.0.
- fred-0.1.1-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm and fred-0.1.1-1.{el6,el7}.x86_64.rpm - Fred Forensic Registry EDitor (fred) is a cross-platform Microsoft registry hive editor.
This project was born out of the need for a reasonably good registry hive viewer for Linux to conduct forensic analysis.
Therefore it includes some functions not found in normal "free" registry editors like a hex viewer with data interpreter and a reporting function that can easily be extended with custom ECMAScript report templates.
|
|
September 26, 2014:
The following have been released:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-{i686,x86_64}-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-123.6.3 for EL7
- 3.10.0-123.8.1 for EL7
- fmem-kernel-modules-el7-{i686,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-123.6.3 for EL7
- 3.10.0-123.8.1 for EL7
- Volatility-2.4-2.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
See here for a list of changes and features in this major release.
This version of Volatility uses the code as available from here as of 2014-09-23.
- plaso-1.1.0-2.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm, plaso-1.1.0-2.{el6,el7}.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
For this release, IPython was added as a dependency.
- python-ipython{,-console,-doc,-gui,-notebook,-sphinx,-tests)-2.2.0-1.el7.x86_64.rpm - IPython is an enhanced interactive Python shell.
This package was only provided for CentOS/RHEL 7 for the x86_64 architecture.
- python-tornado{,-doc}-3.2.1-3.el7.x86_64.rpm - Python-tornado Tornado is an open source version of the scalable,
non-blocking web server and tools. The framework is distinct from most mainstream web server frameworks (and certainly most Python frameworks) because it is non-blocking and
reasonably fast. Because it is non-blocking and uses epoll, it can handle thousands of simultaneous standing connections, which means it is
ideal for real-time web services.
- python-path-3.0.1-2.el7.x86_64.rpm - Python-path implements a path objects as first-class entities, allowing common
operations on files to be invoked on those path objects directly. See documentation here.
- matchjax-2.2-4.el7.noarch.rpm, mathjax{-ams,-caligraphic,-fraktur,-main,-math,-sansserif,-script,-size1,-size2,-size3,-size4,-typewriter,-winchrome,-winie6}-fonts-2.2-4.el7.noarch.rpm -
Matchjax is an open source JavaScript display engine for mathematics that works in all browsers.
- fontawesome-fonts{,-web}-4.1.0-1.el7.noarch.rpm - Font Awesome provides scalable vector icons that can instantly be
customized — size, color, drop shadow, and anything that can be done with the power of CSS.
- ttembed-1.1-3.el7.x86_64.rpm - TTembed removes embedding limitations from TrueType fonts by setting the fsType field in the OS/2 table to zero.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.9.0-2.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis-pipeline-4.4-2.{fc17,fc18,fc9,fc20,el5,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
This version was rebuilt to use the latest version of SiLK, specifically 3.9.0-1.
- silk-ipset{,-devel,-lib,-tools}-3.9.0-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
|
|
September 19, 2014:
The following have been released:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- dff-1.3.0.20140123-2.{fc17,fc18,fc19,fc20,el7}.{i686,x86_64}.rpm - The Digital Forensics Framework (DFF)
is both a digital investigation tool and a development platform.
The framework is used by system administrators, law enforcement examiners, digital forensics researchers and students, and security professionals world-wide.
Written in Python and C++,
it exclusively uses Open Source technologies.
DFF combines an intuitive user interface with a modular and cross-platform architecture.
This version is the developer version as of January 23, 2014.
The changes were to add missing dependencies, specifically PyQt4-webkit for CentOS/RHEL 7
and python-poppler-qt4 for all supported architectures.
- python-poppler-qt4-0.16.2-8.el7.x86_64.rpm - Python-poppler-qt4 is a Python
interface to the Poppler Qt4 interface library, libpoppler-qt4, which is a library that allows Qt4 programmers to easily load and render
PDF files.
The Poppler Qt4 interface library uses poppler internally to do its job, but the Qt4 programmer will never have to worry about poppler internals.
- analysis-pipeline-4.4-1.{fc17,fc18,fc9,fc20,el5,el6,el7}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
See here for the changes in this release.
- libevtx-{,devel,python,tools}-20140901-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- libfvde{,-devel,-tools}-20140907-1.{fc17,fc18,fc9,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libfvde is a lbrary and tools to access FileVault Drive
Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
Here are the changes from the last version (20130305):
- exposed some encryption context plist functions in API
- updated dependencies
- updated msvscpp files, not operational yet
- worked on libcthreads build support
- liblnk-{,devel,python,tools}-20140905-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - liblnk contains libraries and tools
to access the Windows Shortcut File (LNK) format file.
Here are the changes from the last version (20140731):
- updated libfwsi version check
- bug fix in Python-bindings
- worked on property store data block support
- libregf-{,devel,python,tools}-20140905-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libregf contains libraries and tools
to access the Windows NT Registry File files.
Here are the changes from the last version (20140803):
- updated libfwsi version check
- bug fix in Python-bindings
- code clean
- ssdeep-2.11-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes. See here for the list of changes.
- xplico-1.1.0-2.{fc17,el6}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
This release was rebuilt to work under CentOS/RHEL 7. All other suported systems were upgraded for release version consistency.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
- bulk_extractor-1.5.5-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Bulk_extractor
bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without
parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or
processed with automated tools. bulk_extractor also creates histograms of features that it finds, as features that are more
common tend to be more important. This version fixes many issues. In addition, it also contains the BEViewer GUI front-end for bulk_extractor.
Note that this release of bulk_extractor is not available for CentOS/RHEL 5 due to an outdated version of flex for that OS.
|
|
September 12, 2014:
The following have been released:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- 2.6.32-431.29.2 for EL6
- 2.6.32-431.23.3 for EL6
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- 2.6.32-431.29.2 for EL6
- 2.6.32-431.23.3 for EL6
- lime-kernel-modules-el5-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el5-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- xplico-1.1.0-2.{fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
This release was rebuilt specifically for CentOS/RHEL 7. All other suported systems were upgraded for release version consistency.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
Note that Fedora 17 is not supported yet but support is expected soon.
- python-psycopg2{,-debug,-docs}-2.5.1-2.el7.x86_64.rpm - Python-psycopg2 is a PostgreSQL adapter for the Python
programming language. At its core it fully implements the Python DB API 2.0 specifications.
Several extensions allow access to many of the features offered by PostgreSQL.
This package was installed for CentOS/RHEL 7 to support xplico.
- yaf{,-devel}-2.6.0-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Here are the changes from the last version (2.5.0):
- Added a new tool, ipfixDump, to read and dump the contents of IPFIX files. Requires Fixbuf 1.4.0 or later.
- Add LDAP application label
- Filedaemon can now move files from one directory to another without passing to a child program
- SSL/TLS DPI modification to capture SSL record version
- Update CERT PEN Information Elements to use full information model if Fixbuf 1.4.0 or later is available
- Fix for Modbus application label to reduce false positives
- Bug Fix for TOS field when running with --uniflow
- Bug Fix in RPM spec file
- Bug Fix for labeling malformed DNS packets
- Bug Fix for processing out of order packets with --force-read-all
- Bug Fix for exporting reverse payload
- Other minor bug fixes
- jafat-1.1.6-2.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i386,x86_64}.rpm - JAFAT
is an assortment of tools to assist in the forensic investigation of computer systems.
The changes in this release were to put the doc files in the correct place in the file system.
|
|
August 29, 2014:
The following have been released:
- dfvfs-20140824-1.(fc17,fc18,fc19,fc20,el6,el7}.noarch.rpm - Dfvfs, the Digital Forensics Virtual File System, provides read-only access to file-system objects from
various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation
of the various storage media types, volume systems and file systems.
See here for the list of changes.
- sqlite{,-devel,tcl}-3.7.17-4.l6}.x86_64.rpm, sqlite-doc-3.7.17-4.el6.noarch.rpm, and lemon-3.7.17-4.el6.x86_64.rpm - Sqlite,
is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.
SQLite is the most widely deployed SQL database engine in the world. The source code for SQLite is in the public domain.
This version was installed for RHEL/CentOS 6 for the x86_64 archicture to support plaso.
- CERT-Forensics-Tools-1.0-60.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - This package was updated to add the following packages:
libesedb-tools , libqcow-tools , libsmdev-tools , libsmraw-tools , libvmdk-tools , and bokken.
- libesedb-tools - Libesedb contains tools to access the Extensible Storage
Engine (ESE) Database File (EDB) format. ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
- libqcow-tools - Libqcow contains tools used to access the QEMU Copy-On-Write (QCOW) image format.
- libsmdev-tools - Libsmdev contains tools used to access storage media devices.
- libsmraw-tools - Libsmraw contains tools used to read and write (split) RAW storage media bitstream copies.
- libvmdk-tools - Libvmdk contains tools used to access the VMware Virtual Disk (VMDK) image format.
- bokken - Bokken is a GUI for the Pyew and Radare
projects so it offers almost all the same features that Pyew has and and some of the Radare's ones. It's intended to be a basic disassembler, mainly, to analyze malware and vulnerabilities.
- pyew-2.0-1.el7.x86_64.rpm - Pyew is a (command line) Python tool to analyse malware.
It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits), PE and
ELF file formats (it performs code analysis and let you write scripts using an API to perform
many types of analysis), follows direct call/jmp instructions in the interactive command line, displays function names and string data references; supports
OLE2 format, PDF format and more.
It also supports plugins to add more features to the tool.
- radare-2.0.9.7-1.el7.x86_64.rpm - Radare is a framework for doing reverse engineering.
- valabind-0.7.4-2.el7.x86_64.rpm - Valabind is a tool to parse vala
or vapi files to transform them into swig interface files, C++,
NodeJS-ffi, or GIR.
With swig, you can create language bindings for any API written in vala or C with a vapi interface.
It can also generate bindings for C++.
- python-radare-2.0.9.7-1.el7.x86_64.rpm - Python-Radare are
bindings that allow Radare to be used from Python.
- python-tidy-0.2-1.el7.noarch.rpm - Python-tidy pleans up, regularizes, and reformats the text of
Python scripts.
- pygtksourceview - PyGtkSourceView provides Python bindings for the
GtkSourceView widget and is built on top of PyGTK.
|
|
August 22, 2014:
The following have been released:
- lime-kernel-modules-fc19-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc19-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.15.9-200 for FC20
- 3.15.10-200 for FC20
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.15.9-200 for FC20
- 3.15.10-200 for FC20
- dc3dd-7.2.641.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64} - dc3dd is a patched version of GNU dd that
includes several features useful for computer forensics. New in this version are the following:
- Log output may be sent to multiple job logs and hash logs. Simply specify log=LOG and/or hlog=LOG more than once.
- Verification of an image restored to a device larger than the image is now supported.
Specify hof=DEVICE to hash only the bytes dc3dd writes to the device.
Specify fhod=DEVICE to hash both the bytes dc3dd writes to the device and all the bytes that follow, up to the end of the device.
- Specifying hof=DEVICE will now default to phod=DEVICE behavior (hash only the bytes output by dc3dd, not the full device).
- dd_rescue-1.46-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Here are the changes from the previously distributed version (1.46):
- ddr_hash now supports calculating HMACS instead of plain hashes. The hash calculation
has been cleaned up a bit. When a seed val of 0 is passed on the command line, additional
randomness is created using the rdrand() command on x86/x86-64 (if available).
- (2014-06-27) A vulnerability in most implementations of lzo decompression has been
reported. The liblzo2 library (up to and including v 2.06) used by the ddr_lzo plugin
(until dd_rescue-1.45) is affected. You need to feed specially crafted compressed
data in blocks of 16MB or larger to the decompressor on 32-bit platforms to exploit it,
see the report for more details. (This issue has ID LMS-20140616-1/ CVE-2014-4607.)
The man page ddr_lzo advises to be careful when feeding data from untrusted sources
to the decompressor; it seems that this advice has been wise. Fortunately, ddr_lzo
does not normally feed such large blocks to the decompressor; you'd need to manually
increase the soft block size to at least 8MB and ignore a warning to trigger this issue
with dd_rescue. But it is possible. So here's the advice:
- Update liblzo2 to 2.07 (or a fixed 2.06 version) which has this issue fixed (your Linux
distributor should provide this very soon). This is enough to fix the issue, as the
ddr_lzo plugin of dd_rescue does dynamically link against liblzo2, except for Android.
- libsmraw{,-devel,-tools,-python}-20140817-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- yaf{,-devel}-2.5.0-3.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm/yaf{,-devel}-2.2.1-6.el5.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
The RHEL/CentOS 5 package needed to be rebuilt with the latest verson of libfixbuf.
The RHEL/CentOS 6 package for the x86_64 archiecture was rebuilt with the correct version of libfixbuf so all other versions of yaf and yaf-devel were rebuilt to keep the release number consistent.
- super_mediator-0.3.0-5.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
The Fedora 17 package for the i386 archiecture was rebuilt with the correct version of libfixbuf so all other versions of super_mediator were rebuilt to keep the release number consistent.
- protobuf-c{,-devel}-0.15-2.2.el6.x86_64.rpm - Protobuf-c package provides a code generator and runtime libraries
to use Protocol Buffers from pure C (not C++).
This package was only provided for CentOS/RHEL 6 for the x86_64 architecture.
This RHEL/CentOS 6 package for the i386 architecture was rebuilt to use the latest version of protobuf-devel.
- snarf{,-devel,-python}-0.2.2-3.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Snarf is a distributed alert reporting system.
Applications can use snarf's C and Python APIs to construct and send network alert messages,
which can then be routed to multiple destinations in a configurable manner.
This version was built to use version 0.15 of protobuf and protobuf-c-devel where required.
Note: Extra Packages for Enterprise Linux (EPEL) for RHEL/CentOS 7 includes a version of protobuf-c that is incompatible with
snarf and its installation causes problems when attempting to install snarf.
To solve this problem, you need to add the following exclude line to /etc/yum.repos.d/epel.repo file:
[epel]
name=Extra Packages for Enterprise Linux 7 - $basearch
#baseurl=http://download.fedoraproject.org/pub/epel/7/$basearch
mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch
failovermethod=priority
enabled=1
gpgcheck=0
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
exclude=protobuf-c
|
|
August 15, 2014:
The following have been released:
- bulk_extractor-1.5.3-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Bulk_extractor
bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without
parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or
processed with automated tools. bulk_extractor also creates histograms of features that it finds, as features that are more
common tend to be more important. This version fixes many issues. In addition, it also contains the BEViewer GUI front-end for bulk_extractor.
Note that this release of Bulk_extractor is not available for CentOS/RHEL 5 due to an outdated version of flex for that OS.
- fmem-kernel-modules-{fc19,fc20,el5,el6,el7}-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-{fc19,fc20,el5,el6,el7}-{i686,x86_64}-1.1.r17-*.noarch.rpm - Support for the following kernels were added for
LiME:
- libbde{,-devel,-python,-tools}-20140731-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the support formats, protection methods, and additional features.
Here are the changes for this release:
- added is locked function
- bug fix in Python bindings
- compression method is now forced to effective 16-bits
- fixes for FreeBSD 8 compilation
- moved password hashes to password keep
- small change in bdemount for Dokan support
- small improvements to error reporting
- updated dependencies
- updated msvscpp files
- worked on bdemount
- worked on exposing metadata
- worked on exposing metadata via bdeinfo
- worked on Python bindings
- worked on setup.py
- worked on tests
- Volatility-2.4-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
See here for a list of changes and features in this major release.
|
|
August 8, 2014:
The following have been released:
- fmem-kernel-modules-{fc19,fc20,el5,el6,el7}-{i686,x86_64}-1.6-1.*.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.14.13-100 for FC19
- 3.15.8-200 for FC20
- 3.15.7-200 for FC20
- 3.15.6-200 for FC20
- 3.15.5-200 for FC20
- 2.6.18-371.11.1 for EL5
- 2.6.32-431.20.5 for EL6
- 3.10.0-123.4.4 for EL7
- lime-kernel-modules-{fc19,fc20,el5,el6,el7}-{i686,x86_64}-1.1.r17-*.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.14.13-100 for FC19
- 3.15.8-200 for FC20
- 3.15.7-200 for FC20
- 3.15.6-200 for FC20
- 3.15.5-200 for FC20
- 2.6.18-371.11.1 for EL5
- 2.6.32-431.20.5 for EL6
- 3.10.0-123.4.4 for EL7
- dfvfs-20140727-1.(fc17,fc18,fc19,fc20,el6,el7}.noarch.rpm - Dfvfs, the Digital Forensics Virtual File System, provides read-only access to file-system objects from
various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation
of the various storage media types, volume systems and file systems.
- libesedb-{,devel,python,tools}-20140803-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libesedb contains a library and tools to access the Extensible Storage
Engine (ESE) Database File (EDB) format. ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
See here for the list of changes.
- libevt-{,devel,python,tools}-20140731-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- libevtx-{,devel,python,tools}-20140731-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- liblnk-{,devel,python,tools}-20140731-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - liblnk contains libraries and tools
to access the Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libmsiecf-{,devel,python,tools}-20140731-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libolecf-{,devel,python,tools}-20140801-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libolecf contains libraries and tools
to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libqcow{,-devel,-tools,-python}-20140729-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libqcow
is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
See here for the list of changes.
- libregf-{,devel,python,tools}-20140803-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - libregf contains libraries and tools
to access the Windows NT Registry File files.
See here for the list of changes.
- libsmdev{,-devel,-tools,-python}-20140803-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libsmdev
is a library and tools used to access storage media devices.
See here for the list of changes.
- libsmraw{,-devel,-tools,-python}-20140728-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
See here for the list of changes.
- libvshadow{,-devel,-tools,-python}-20140731-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libvshadow
is a library and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume.
See here for the list of changes.
- python-registry-1.0.4-1.{fc17,fc18,fc19,fc20,el7}.{i386,x86_64}.rpm - Python-registry provides read-only access
to Windows Registry files, such as NTUSER.DAT, userdiff, and SOFTWARE.
The interface is two-fold: a high-level interface suitable for most tasks, and a low level set of parsing objects and methods which may be used for advanced
study of the Windows Registry.
Python-registry is written in pure Python, making it portable across all major platforms.
- libfixbuf{,-devel}-1.5.0-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.3-3.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.3-4.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics-sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- super_mediator-0.3.0-4.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
This package was rebuilt to use libfixbuf version 1.5.0.
- yaf{,-devel}-2.5.0-2.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter and
yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap dumpfiles as generated by tcpdump, from live capture from an interface
using pcap, an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into
serialized IPFIX message streams (IPFIX files) on the local file system.
This package was rebuilt to use libfixbuf version 1.5.0.
|
|
July 24, 2014:
The following have been released:
- ddrescue-1.18.1-2.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
A patch from the developer was applied that adds the following arguments:
- --no-reverse-pass: do not switch direction for each pass
- --skip-on-first-err start skipping on first error
- --trim-sequentially don't trim small blocks first
- --split-sequentially don't split large blocks first
- --no-reverse: This makes the second pass also go in the same direction as the first.
This is for those who may ask for the option.
But in my benchmark testing I can say there is no real benefit to turning off reverse.
- --skip-on-first-err: By default, ddrescue doesn't start skipping until 2 errors are
encountered in a row. Sometimes the errors are spread out so that skipping does not
happen very often if at all. This option will make ddrescue skip on the first error on the
first pass forwards, and also on the second pass in reverse. If used with --no-reverse,
the second forward pass skips on the second error like normal. Note that if used with
the --reverse option then ddrescue will behave as normal and this option will not do
anything. This option does best when setting a higher skip size, as when used with the
default skip size it does not have a positive effect.
- --trim-sequentially: Normally ddrescue trims the smallest block first, which can cause
unwanted head movement. This option makes it trim in order in one pass in the direction
specified. My tests did not show any speed difference, but the small size of the test
also did not have excessive head movement to begin with.
- --split-sequentially: Normally ddrescue splits the largest blocks first (which can
cause a lot of unwanted head movement), and then when there are only small blocks of
less than 7 sectors in size it will split sequentially. This option makes it split
in order in one pass in the direction specified. In my benchmarking tests this helped
slightly with overall recovery time, which is likely a result of drive read-ahead. This
was even with a small test size, so it is possible that there could be more to gain on
a full size recovery. Note that this speed increase would not normally be noticed due
to the amount of time errors take to process, and is a very small increase overall. The
biggest benefit is the head movement.
- ddrutility-2.5-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue. It currently contains the following utilities:
- ddru_findbad
- ddru_ntfsbitmap
- ddru_ntfsfindbad
- fmem-kernel-modules-1.6-1.3.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
This package is not linked between OS and Architectures.
- fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- ip4r-2.0.2-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm and ip4r-2.0-1.{el6,el7}.x86_64.rpm - IP4R
and ip4 are types that contain a single IPv4 address and a range of IPv4 addresses respectively.
They can be used as a more flexible, indexable version of the cidr type.
This version has been built for PostgreSQL version 9.3.4 for Fedora and CentOS/RHEL 7
and version 9.2 for CentOS/RHEL using the CentOS
Software Collections Repository.
- liblnk-{,devel,python,tools}-20140714-1.(fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - liblnk contains libraries and tools
to access the Windows Shortcut File (LNK) format file.
- lime-kernel-modules-1.1.r17-3.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
This package is not linked between OS and Architectures.
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- python-rarfile-2.6-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Python-rarfile is a
Python module for RAR archive reading.
- snort-2.9.6.2-1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.6.2-1.1.{fc17,fc18,fc19,fc20,el6,el7}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- yara-2.1.0-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Here are the changes since the last version (1.7.2):
- Improve regexp engine
- Improve multithreading support
- Case-insensitive and single-line matching modes for "matches" operator's regexps
- Added "error_on_warning" argument to "match" in yara-python
- Recognize x64 PE files
- BUGFIX: Mutex handle leak
- BUGFIX: NULL pointer dereferences
- BUGFIX: Buffer overflow
- BUGFIX: Crash while using compiled rules with yara64 in Windows
- BUGFIX: Infinite loop while scanning 64bits process in Windows
- BUGFIX: Side-effect on "externals" argument in yara-python's "match" function
- BUGFIX: "x of them" not working with strings containing unbounded jumps
- yara-python-2.1.0-1.{fc17,fc18,fc19,fc20,el5,el6,el7}.{i686,x86_64}.rpm - Yara-python is a Python
extension that gives access to Yara's powerful features from Python scripts.
Here are the changes since the last version (1.7.2):
- Improve regexp engine
- Improve multithreading support
- Case-insensitive and single-line matching modes for "matches" operator's regexps
- Added "error_on_warning" argument to "match" in yara-python
- Recognize x64 PE files
- BUGFIX: Mutex handle leak
- BUGFIX: NULL pointer dereferences
- BUGFIX: Buffer overflow
- BUGFIX: Crash while using compiled rules with yara64 in Windows
- BUGFIX: Infinite loop while scanning 64bits process in Windows
- BUGFIX: Side-effect on "externals" argument in yara-python's "match" function
- BUGFIX: "x of them" not working with strings containing unbounded jumps
|
|
July 17, 2014:
The following have been released:
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-5.noarch.rpm and
fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem and LiME
- 3.15.4-200
- 3.15.3-200
- 3.14.9-200
- Support for CentOS 7.0.1406 x86_64 architecture - The repository now supports CentOS 7.0.1406
for the x86_64 CPU architecture.
Here is the list of tools provided for CentOS 7.0.1406
All other packages installed when the CERT-Forensics-Tools package is installed are taken from the CentOS 7
Release,
Updates,
Extras,
EPEL, and
RPM Forge repositories.
|
|
July 2, 2014:
The following have been released:
- plaso-1.1.0-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm, plaso-1.1.0-1.el6.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
Go here to read about all of the changes and features in this release.
- libevt-{,devel,python,tools}-20140531-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
- python-construct-2.5.2-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Python-construct is a powerful declarative parser (and builder) for binary data.
- bencode-1.0-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Bencode is the BitTorrent bencode module as light-weight, standalone package.
- libesedb-{,devel,python,tools}-20140406-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Libesedb contains a library and tools to access the Extensible Storage
Engine (ESE) Database File (EDB) format. ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
- dfvfs-20140604-1.(fc17,fc18,fc19,fc20,el6}.noarch.rpm - Dfvfs, the Digital Forensics Virtual File System, provides read-only access to file-system objects from
various storage media types and file formats. The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation
of the various storage media types, volume systems and file systems.
- libvhdi{,-devel,-python,-tools}-20140330-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- libvshadow{,-devel,-tools,-python}-20140323-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a library and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here here the list of changes.
- libvmdk{,-devel,-tools,-python}-20140421-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Libvmdk
is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
Here here the list of changes.
- libsmraw{,-devel,-tools,-python}-20140621-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Libsmraw
is a library and tools used to read and write (split) RAW storage media bitstream copies. Libsmraw contains supports for multiple (split) RAW naming schemes.
Here here the list of changes.
- libsmdev{,-devel,-tools,-python}-20140529-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Libsmdev
is a library and tools used to access storage media devices.
Here here the list of changes.
- libqcow{,-devel,-tools,-python}-20140529-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Libqcow
is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
Here here the list of changes.
- libewf{,-devel,-tools,-python}-20140608-2.{fc17,fc18,el5,el6}.{i686,x86_64}.rpm, libewf{-devel,-tools,-python}-20140608-2.{fc19,fc20}.{i686,x86_64}.rpm, ewftools-20140608-1.{fc19,fc20}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Note that beginning with Fedora 19, the tools package is named ewftools to reflect the package name found in those releases of Fedora.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
The change from the previous release (1) is that python support has been added in package libewf-python
- openssl{,-devel,-libs,-perl,-static}-1.0.1e-38.{fc17,fc18}.{i686,x86_64}.rpm, - OpenSSL is a collaborative effort to develop a robust, commercial-grade, full-featured, and
Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.
The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation.
This packages provided for Fedora 17 and 18 because those versions of Fedora are no longer maintained by RedHat and in the case of ADIA for Fedora 17, OpenSSL is used to secure the
Webmin connection.
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-4.noarch.rpm and
fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem and LiME
|
|
June 27, 2014:
The following have been released:
- dd_rescue-1.45-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Note: these packages are available from the RPM Forge repository for CentOS/RHEL 5 and 6.
See here for more details on the RPM Forge repository.
Here are the changes from the previously distributed version (1.40):
- Release 1.45-1:
ddr_hash received a bugfix (sha512/sha384 could overflow a buffer).
It gained support for sha1 hash.
ddr_hash can now conveniently retrieve (and check) and store hashes in xattrs and md5sum/sha256sum/... style files.
A new null plugin (ddr_null) was added.
- Release 1.44-1:
The plugin libddr_MD5.so (short ddr_MD5) has been renamed to ddr_hash, reflecting that we also support sha1, sha256,
sha224, sha512, sha384 now. Checks have been added to the test suite and the documentation been updated accordingly.
- Release 1.43-1:
The main feature of 1.43 is the new lzo plugin. It de/compresses data
using the lzo algorithms, which are very fast to decompress and most
versions are also fast to compress (at somewhat moderate compression
levels). The plugin supports many of dd_rescue's features, such
as skipping bad blocks (encoding sparseness/holes into the output)
as well as appending. It also continues on errors (skipping a whole
block if nodiscard is NOT given) and allows to search for valid lzo
block headers if sync is lost. fuzz testing has been done to support
reliability. A man page ddr_lzo(1) has been created.
The plugin interface has been enhanced to support ddr_lzo; the MD5 plugin
has also seen some work beyond just refactoring: It supports the parameter
output/outfd= now and supports all type of holes that can be generated in
a chain with ddr_lzo now.
Some minor improvements (docu, messages) and bug fixes have been
applied. There also is a new ARMv8 (AArch64 aka ARM64) optimized
routine to detect zero-blocks.
- Release 1.42.1-1:
1.42.1 contains a fix for a sublety how we set up a handler for
SIGILL and return with longjmp to detect the supported instruction
sets of the CPU -- we need to manually reset the process' signal mask,
otherwise a second failed probe would abort.
- Release 1.42-1:
1.42 brings the possibility to load plugins to analyze or transform data
before it's written to the output file(s). A plugin to calculate the MD5
hash is provided. posix_fadvise() is used if available (optimization) and
dd_rescue now only provides a short usage info rather than the long help
text on wrong parameters.
- Release 1.41-1:
There has been a lot of internal refactoring that improves the detection of CPU
features (at runtime) and libc/compiler features (at build time). One result is
that this version supports building against the Android NDK. (armv7l binaries
built against Android API 17 (aka 4.2) libc can be found below in the download
section.) Another consequence is that AVX2 support is now enabled (for saving
CPU cycles on sparse block detection). A few minor bugs have been addressed
(the most serious one a harmless off-by-one on determining the size of a
block device). Number formatting is more consistent now. There also a new
option -u/--rmvtrim that deletes the created file again and issues a fstrim
on the filesystem -- good if you filled the empty space of a filesystem with
zeros for data protection and SSD refreshment.
- Release 1.40.1-1:
It just has one patch to fix the SSE2 detection on i386 -- the old code would end in an endless loop ...
- ddrescue-1.18.1-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
Here are the changes from the previous distributed version (1.17):
- ddrescuelog.cc (do_logic_ops): Fixed 'or' and 'xor'.
- Added new option '-H, --test-mode' to simulate read errors.
- Added new option '-L, --loose-domain' to ddrescue and ddrescuelog.
- Added new option '-N, --no-trim' to disable trimming of damaged areas.
- Added new option '-O, --reopen-on-error'.
- Added new options '-1, --log-rates', and '-2, --log-reads'.
- Extended '-K, --skip-size' with maximum and disable values.
- Changed long name of option '-r' to '--retry-passes'.
- Changed short name of option '--generate-mode' to '-G'.
- Default value of option '-l, --logfile-size' increased to 10000.
- If interrupted, ddrescue terminates by raising the signal received.
- rescuebook.cc (copy_non_tried): Do not mark skipped blocks as non-trimmed. Try them in additional passes (before trimming).
- rescuebook.cc: Limit the copying phase to 3 passes.
- rescuebook.cc: Alternate direction of passes during copying phase.
- rescuebook.cc: Smallest blocks are trimmed first.
- rescuebook.cc (split_errors): Read largest first if logfile full.
- Improved speed when using option '-m, --domain-logfile'.
- io.cc (show_status): Show the current total run time.
- rescuebook.cc: Show pass number and direction during copying.
- rescuebook.cc (show_status): Show block pos instead of current_pos.
- main.cc: Show "an unknown number of bytes" for unknown isize.
- Added option '-B, --binary-prefixes' to ddrescuelog.
- Added new option '-C, --complete-logfile' to ddrescuelog.
- Added new option '-P, --compare-as-domain' to ddrescuelog.
- Improved speed of logic operations in ddrescuelog.
- rescuebook.cc (Rescuebook::do_rescue): Show warning when domain is smaller than logfile.
- ddrescuelog.cc (do_show_status): Show logfile and domain extents when domain is smaller than logfile.
- block.h: Class Block now forces the invariant by itself.
- Code reorganization. New class 'Logfile'.
- Added status message to rescue logfile.
- Many improvements to documentation.
- ddrescue.texinfo: Renamed to ddrescue.texi.
- libewf-{,devel,tools}-20140608-1.{fc17,fc18,el5,el6}.{i686,x86_64}.rpm, libewf-{devel,tools}-20140608-1.{fc19,fc20}.{i686,x86_64}.rpm, ewftools-20140608-1.{fc19,fc20}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Note that beginning with Fedora 19, the tools package is named ewftools to reflect the package name found in those releases of Fedora.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
Here are the changes from the previous version (20140427):
- bug fix for utf16 header functions
- bug fix in ewfmount regarding logical files date and time values
- updated python.m4
- fixes to build static library with mingw and cygwin
- bug fixes in m4 files
- removed #error restriction in dependency include header files
- make pyewf_handle_open more strict to catch non-string objects without the check the code will segfault on non-string objects
- {python-,}binplist-0.1.4-2.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Binplist is a binary property list (plist) parser module written in python.
Here are the changes from the previous release (0.1.4-0):
- The python library (python-binplist) has been split from the binplist executable.
- In binplist, the following changes were made:
- The plist.py file was removed.
- The binplist.py file was renamed to binplist.
- The /usr/bin/binplist.py[co] and /usr/bin/plist.py[co] files are removed.
These files are automatically created if either binplist.py or plist.py programs were executed by root.
Their presence causes log2timeline.py and related programs to fail.
- plaso-1.0.2-2.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm, plaso-1.0.2-2.el6.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
Here are the changes from the previous release (1.0.2-1)
- Missing dependencies were added (python-construct, libolecf-python, python-dpkt, python-binplist).
Note that on CentOS/RHEL 6, the python-construct and python-dpkt were release in support of plaso.
- Fixed a bug in the Firefox history parser.
- For the CentOS/RHEL 6 version, the
Software Collections Library
version of Python 2 is used to byte compile the Python source files.
- lime-kernel-modules-fc20-{i686,x86_64}-1.1.r17-3.noarch.rpm,
lime-kernel-modules-{fc19,el5,el6}-{i686,x86_64}-1.1.r17-2.noarch.rpm,
fmem-kernel-modules-fc20-{i686,x86_64}-1.6-1.3.noarch.rpm,
fmem-kernel-modules-{fc19,el5,el6}-{i686,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem and LiME
- 3.14.8-200 for FC20
- 3.14.6-200 for FC20
- 3.14.7-100 for FC19
- 3.14.8-100 for FC19
- 2.6.32-431.20.3 for EL6
- 2.6.18-371.9.1 for EL5
|
|
June 11, 2014:
The following have been released:
- lime-kernel-modules-common-1.1.r17-1.noarch.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
This package contains only the source code for making the LiME kernel modules, the CaptureMemoryWithLime script and the corresponding manual page.
This package also obsoletes tie lime-kernel-objects package which contained the source code and all of the kernel objects.
This repackaging increases the number of pckages but decreases their size.
Note: this RPM is hard-linked between all of the supported architectures, Fedora 17-20 and CentOS 5 and 6.
If you use rsync, make certain that you use the -H option
to preserve those hard links.
- lime-kernel-modules-1.1.r17-1.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects, specifically the following:
- lime-kernel-modules-{fc17,fc18,fc19,fc20,el5,el6}-{i686,x86_64}-1.1.r17-*.noarch.rpm - These are the actual kernel objects packaged for each operating system version
and architecture.
Note: again these RPMs are hard-linked between all of the supported architectures, Fedora 17-20 and CentOS 5 and 6.
- fmem-kernel-modules-common-1.6-1.1.noarch.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
This package contains the source code for making the FMEM kernel modules and the install-fmem script.
This package also obsoletes tie fmem-kernel-objects package which contained the source code and all of the kernel objects.
This repackaging increases the number of pckages but decreases their size.
Note: this RPM is hard-linked between all of the supported architectures, Fedora 17-20 and CentOS 5 and 6.
If you use rsync, make certain that you use the -H option
to preserve those hard links.
|
|
May 22, 2014:
The following have been released:
- nDPI{,-devel}-1.4.0.1-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - nDPI nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
- xplico-1.1.0-1.{fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
See here for the changes in this release.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
Note that Fedora 17 is not supported yet but support is expected soon.
- libewf-{,devel,tools}-20140427-1.{fc17,fc18,el5,el6}.{i686,x86_64}.rpm, libewf-{devel,tools}-20140427-1.{fc19,fc20}.{i686,x86_64}.rpm, ewftools-20140427-1.{fc19,fc20}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Note that beginning with Fedora 19, the tools package is named ewftools to reflect the package name found in those releases of Fedora.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Here are the changes from the previous version (20140216):
- fixes to build static library with mingw and cygwin
- bug fixes in m4 files
- removed #error restriction in dependency include header files
- make pyewf_handle_open more strict to catch non-string objects without the check the code will segfault on non-string objects
- bug fixes in empty block compression
- bug fix in libewf_read_io_handle_read_chunk_data error tolerance code path
- bokken-1.6-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Bokken is a GUI for the
Pyew and Radare projects so it offers almost all the same features that
Pyew has and and some of the Radare's ones. It's intended to be a basic disassembler, mainly, to analyze malware and vulnerabilities.
- pyew-2.0-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Pyew is a (command line)
Python tool to analyse malware. It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits),
PE and ELF file formats
(it performs code analysis and let you write scripts using an API to perform many types of analysis), follows direct call/jmp instructions in the interactive command line, displays
function names and string data references; supports OLE2 format,
PDF format and more. It also supports plugins to add more features to the tool.
- radare-2.0.9.7-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Radare is a framework for doing reverse engineering.
- python-radare-2.0.9.7-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Python-Radare are
bindings that allow Radare to be used from Python .
- vala{,-devel,-doc,-tools}-0.20-1.el6.{i686,x86_64}.rpm and emacs-vala-0.20-1.el6.{i686,x86_64}.rpm -
Vala is a new programming language that aims to bring modern
programming language features to GNOME developers without imposing any additional runtime requirements and without using a different ABI compared
to applications and libraries written in C.
- valabind-0.7.4-2.{fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - Valabind is a tool to parse vala
or vapi files to transform them into swig interface files, C++,
NodeJS-ffi, or GIR.
With swig, you can create language bindings for any API written in vala or C with a vapi interface.
It can also generate bindings for C++.
- snort-2.9.6.1-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.6.1-1.1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- md5deep-4.4-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - This package was updated to reflect the new version of md5deep.
See here for the list of changes in this version.
- pytsk-20140506-1.{fc17,fc18,fc19,fc20,el5,el6}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
- yaf{,-devel}-2.5.0-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter and
yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap dumpfiles as generated by tcpdump, from live capture from an interface
using pcap, an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into
serialized IPFIX message streams (IPFIX files) on the local file system.
See here for a list of changes in this version.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.2-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
Note: In this release of SiLK (3.8.2-1), support for the IPA extensions have been removed.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.2-2.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics-sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- silk-ipset{,-devel,-lib,-tools}-3.8.2-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- guymager-0.7.3-2.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package.
The change made in this version was to replace all lines in the configuration file (/etc/guymager/guymager.cfg) that contain backslashes at the end lines with
spaces to work around a programming error in libguytools.
- lime-kernel-objects-1.1.r16-1.28.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
The changes added support for the following kernels:
FC20
- 3.14.4-200
- 3.14.3-200
- 3.14.2-200
- 3.13.9-200
- 3.13.8-200
- 3.13.7-200
- 3.13.10-200
|
FC19
- 3.14.4-100
- 3.13.9-100
- 3.13.7-100
- 3.13.11-100
|
EL6
- 2.6.32-431.17.1
- 2.6.32-431.11.2
|
EL5
- 2.6.18-371.8.1
- 2.6.18-371.6.1
|
- fmem-kernel-objects-1.6-1.28.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the same kernels noted for lime.
- plaso-1.0.2-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm, plaso-1.0.2-1.el6.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See here for the changes in this release.
|
|
April 24, 2014:
The following have been released:
- splunk-4.3.7-181874.i386.rpm, splunk-4.3.7-181874-linux-2.6-x86_64.rpm and
splunk-6.0.3-204106.i386.rpm, splunk-6.0.3-204106-linux-2.6-x86_64.rpm - These versions of
Splunk provide what is needed to upgrade to the latest version which is 6.0.3.
The version in the repository is old and contains an expired signing key.
We apologize for not keeping Splunk up to date and any inconvenience this upgrade may cause.
Please note that these versions are installed in the forensics-test repository which is normally disabled.
To update to the latest version (6.0.3 as of this writing), follow this procedure:
- First, upgrade to splunk 4.3.7 by following the procedure found here.
In step 2 in the Steps for upgrading section, use this command to upgrade to splunk 4.3.7:
sudo yum --enablerepo=forensics-test update splunk-4.3.7
- Next, read this first before you start the upgrade.
- Then, upgrade to splunk 6.0.3 using this command:
sudo yum --enablerepo=forensics-test update splunk-6.0.3
- If you have previously enabled splunk to start on a reboot, you need to use these commands to reestablish that configuration:
sudo /opt/splunk/bin/splunk disable boot-start
sudo /opt/splunk/bin/splunk enable boot-start
- Then restart splunk with the following:
sudo /opt/splunk/bin/splunk start
Note: On Wednesday, September 10, 2014, the latest version of Splunk will become the default version in the regular cert repository.
You will need to perform the upgrade noted above before then so that Splunk will continue to function properly.
|
|
April 7, 2014:
The following have been released:
- CERT-Forensics-Tools-1.0-58.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - This package was updated to add the following:
- plaso - A timeline tool (Fedora 17 and beyond, and CentOS/RHEL 6.5 for x86_64 only)
- libregf-tools - Tools to access Windows NT Registry files
- libmsiecf-tools - Tools to access Microsoft Internet Explorer (MSIE) Cache File (index.dat) files
- libevt-tools - Tools to access Windows Event Log (EVT) format files
- liblnk-tools - Tools to access Windows NT Registry files
- libolecf-tools - Tools to access OLE 2 Compound File (OLECF) format files
- ddrutility (not CentOS/RHEL 5) - Utility for use with gnuddrescue to aid with data recovery
- fcrackzip - Zip Password Cracker
- undbx (not CentOS/RHEL 5) - Tool to extract, recover and undelete e-mail messages from Outlook Express .dbx files
- silk-ipa (Fedora 17 and beyond, and CentOS/RHEL 6.5 for x86_64 only) - Script to enable the IPA-based version of the SiLK tools
Note: On CentOS/RHEL, installing the CERT-Forensics-Tools meta package or plaso requires postgresql.
For Fedora, postgresql is provided in the the CERT Linux Forensics Tools repository.
However, for CentOS 6.5 for the x86_x64 architecture only, the version of postgresql comes from the CentOS
Software Collections Repository.
This means that you must install the centos-release-SCL package by running yum install centos-release-SCL as root before you apply updates from the repository.
- hachoir-metadata-1.3.3-2.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - hachoir-metadata is a tool
that extracts metadata from multimedia files: music, picture, video, and archives.
The changes were to correct the permissions of the installed files.
- plaso-1.0.1alpha-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm, plaso-1.0.1alpha-1.el6.x86_64.rpm - Plaso
is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
- libregf-{,devel,python,tools}-20140118-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - libregf contains libraries and tools
to access the Windows NT Registry File files.
- libmsiecf-{,devel,python,tools}-20140131-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - libmsiecf contains libraries and tools
to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
- libevt-{,devel,python,tools}-20140112-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - libevt contains libraries and tools
to access the Windows Event Log (EVT) format files.
- libevtx-{,devel,python,tools}-20140112-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
- liblnk-{,devel,python,tools}-20140112-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - liblnk contains libraries and tools
to access the Windows Shortcut File (LNK) format file.s
- libolecf-{,devel,python,tools}-20131108-1.(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - libolecf contains libraries and tools
to access the OLE 2 Compound File (OLECF) format filed.
The OLE 2 Compound File format is used to store certain versions of Microsoft Office files, thumbs.db and other file formats.
- protobuf-c{,-devl}-0.15-2.1.el6.x86_64.rpm - Protobuf-c package provides a code generator and runtime libraries
to use Protocol Buffers from pure C (not C++).
This package was only provided for CentOS/RHEL 6 for the x86_64 architecture.
- protobuf{,-compiler,-devel,-lite,-lite-devel,-lite-static,-python,-static,-vim)-2.4.1-1.el6.x86_64.rpm - Protobuf (Protocol Buffers)
are a way of encoding structured data in an efficient yet extensible format. Google uses Protocol Buffers for almost all of its internal RPC protocols and file formats.
This package was only provided for CentOS/RHEL 6 for the x86_64 architecture.
- python-ipython{,-console,-doc,-gui,-notebook,-tests)-0.13.2-1.el6.x86_64.rpm - IPython is an enhanced interactive Python shell.
This package was only provided for CentOS/RHEL 6 for the x86_64 architecture.
- perl-Parse-Evtx-{,-tools}1.1.1-2.{fc13,fc14,fc15,fc16,el5,el6}.noarch.rpm - perl-Parse-Evtx
is a Windows Event Log Parser library and tools collection.
Because files in the previous release - 1.1.1-1 - of perl-Parse-Evtx now conflict with files in libevtx-tools, the tools from perl-Parse-Evtx were moved to perl-Parse-Evtx-tools so
that perl-Parse-Evtx, upon which log2timeline depends, could be installed.
- binplist-0.1.4-0-(fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Binplist is a binary property list (plist) parser module written in python.
- libewf-{,devel,tools}-20140216-1.{fc17,fc18,el5,el6}.{i686,x86_64}.rpm, libewf-{devel,tools}-20140216-1.{fc19,fc20}.{i686,x86_64}.rpm, ewftools-20140216-1.{fc19,fc20}.{i686,x86_64}.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Note that beginning with Fedora 19, the tools package is named ewftools to reflect the package name found in those releases of Fedora.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Here are the changes from the previous version (20140216):
- bug fix in recent process status changes
- integrating latest update for multi threaded ewfacquire changes
- changed behavior of empty-block check
- worked on integrating multi threaded ewfacquire changes
- updated dependencies
- added libcdatetime
- removed borlandc files
- small updates
- moved low-level function support from compile time to run time
- worked on sync with experimental version
- Also added missing fuse-devel build requirement
- sleuthkit-{,devel,libs}-4.1.3-3.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
The changes from the previous version - 4.1.3-1 - are the following:
- Patch to support pytsk.
- Rebuilt with libewf-20140216
- pytsk-20131230-1.{fc17,fc18,fc19,fc20,el5,el6}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
- partclone-0.2.69-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
This release was built to use the correct version of libntfs-3g.so.
- lime-kernel-objects-1.1.r16-1.27.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
The changes added support for the following kernels:
- 3.13.6-200 for FC20
- 3.13.5-202 for FC20
- 3.13.5-200 for FC20
- 3.13.4-200 for FC20
- 3.13.3-201 for FC20
- 3.12.10-300 for FC20
- 3.13.6-100 for FC19
- 3.13.5-103 for FC19
- 3.13.5-101 for FC19
- 3.12.11-201 for FC19
- 2.6.32-431.5.1 for EL6
- fmem-kernel-objects-1.6-1.27.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the same kernels noted for lime.
- ddrutility-2.2-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue. It currently contains the following utilities:
- ddru_findbad
- ddru_ntfsbitmap
- ddru_ntfsfindbad (NEW)
- fcrackzip-1.0-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Fcrackzip is a zip password cracker, similar to fzc, zipcrack and others.
It is intended to be free, fast, portable, and featureful.
- undbx-0.21-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Undbx extracts, recovers and undeletes e-mail messages from
Outlook Express .dbx files.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.1-3.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
Note: In this release of SiLK (3.8.1-3), support for the IPA extensions have been removed.
They have been replaced by an optional repository that is now part of cert-forensics-tools-release named forensics-sip, the definition of which can be found in
/etc/yum.repos.d/cert-forensics-tools.repo.
This repo is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
When that script is run, the following additional packages are installed or updated:
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.1-4.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm or
silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.1-4.el6.x86_64.rpm - The only change to this release
is that it was built with the IPA IP address annotation system.
- postgresql{,-contrib,-devel,-docs,-libs,-plperl,-plpython,-plpython3,-pltcl,-server,-test,-upgrade}-9.3.4-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm -
PostgreSQL is an advanced Object-Relational database management system (DBMS).
The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.
These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.
The PostgreSQL server can be found in the postgresql-server sub-package.
- ipa{,-devel,-python}-0.5.2-3.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm and
ipa{,-devel,-python}-0.5.2-3.{el6}.x86_64.rpm - IPA is an IP address annotation system.
IPA provides a flexible and efficient repository of IP address information, tools for querying and maintaining the data, and shared libraries and modules for data access.
For more information, read the IPA documentation.
- ip4r-2.0-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm and ip4r-2.0-1.el6.x86_64.rpm - IP4R
and ip4 are types that contain a single IPv4 address and a range of IPv4 addresses respectively.
They can be used as a more flexible, indexable version of the cidr type.
This version has been built for PostgreSQL version 9.3.4 for Fedora and version 9.2 for CentOS/RHEL using the CentOS
Software Collections Repository.
|
|
February 12, 2014:
The following have been released:
- lime-kernel-objects-1.1.r16-1.26.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
The tool supports acquiring memory either to the file system of the device or over the network.
LiME is unique in that it is the first tool that allows full memory captures from Android devices.
It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more
forensically sound than those of other tools designed for Linux memory acquisition.
In addition, this package includes a script named CaptureMemoryWithLime and a corresponding man page that manages the installation of
the appropriate kernel object and dumps memory on the installed machine to the indicated file.
LiME can be used with Volatility as described
here to analyze memory as part of an investigation of digital assets.
LiME releases will track with fmem-kernel-objects as to the list of supported kernels.
- fmem-kernel-objects-1.6-1.26.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following kernels:
- 3.12.9-301 for FC20
- 3.12.8-300 for FC20
- 3.12.7-300 for FC20
- 3.12.8-200 for FC19
- 3.12.7-200 for FC19
- 2.6.18-371.4.1 for EL5
- daq-2.0.2-1.{fc16,fc17,fc18,fc19,el6}.{i386,x86_64}.rpm - The Data Acquisition Library (Daq) is a library
used by snort.
Here are the changes since the last version:
- os-daq-modules/daq_ipfw.c: Don't treat being interrupted by a signal as an error.
- configure.ac, daq.spec, os-daq-modules/daq_afpacket.c: Fix frame length sanity check.
- README, configure.ac, os-daq-modules/daq_afpacket.c: Fix AFPacket DAQ module to attempt to reconstruct the automatically
stripped VLAN header prior to passing it to the reader. Also, use AFPacket TX Ring instead of sendto to improve TX performance.
(Requires a newer Linux kernel version, README and configure.ac updated to reflect this.)
- disktype-9-15.{fc17,fc18,fc19,fc20,el5,el6}.noarch.rpm - Disktype detects the content format of a disk or disk image.
This version is based on the standard version with support for
exfat,
LUKS,
f2fs,
btrfs, and
EXT 2, 3, and 4, all courtesy Erik Uitto from the Silicon Valley Regional Computer Forensics Laboratory in
Menlo Park, CA.
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.63-1.1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
Here are the changes from the previous distributed version (0.6.61):
- Daniel Gryniewicz found buffer overrun in LIST_COPY_TIME
- Old dependency filter breaks file coloring
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.1-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for the list of the changes since the previous version (3.8.0).
- analysis-pipeline-4.3.2-2.{fc17,fc18,fc9,fc20,el5,el6}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
This version was rebuilt to use the latest version of SiLK, specifically 3.8.1-1.
- silk-ipset-{devel,lib,tools}-3.8.1-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- sleuthkit-{,devel,libs}-4.1.3-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
Here are the changes since 4.1.2:
- Fixed bug that could crash UFS/ExtX in inode_lookup
- More bounds checking in ISO9660 code
- Image layer bounds checking
- Update version of SQLITE-JDBC
- Changed how java loads navite libraries
- Config file for YAFFS2 spare area
- New method in image layer to return names
- Yaffs2 cleanup
- Escape all strings in SQLite database
- SQlite code uses NTTFS sequence number to match parent IDs
- snort-2.9.6.0-1.1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.6.0-1.1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- xmount-0.6.0-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. The changes in this version are the following:
- Added support for split DD input files.
- Patch for newer libewf support (meaning packages newer than 20110903), courtesy Erik Uitto from the
Silicon Valley Regional Computer Forensics Laboratory in Menlo Park, CA.
|
|
January 24, 2014:
The following have been released:
- dff-1.3.0.20140123-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm - The Digital Forensics Framework (DFF)
is both a digital investigation tool and a development platform.
The framework is used by system administrators, law enforcement examiners, digital forensics researchers and students, and security professionals world-wide.
Written in Python and C++,
it exclusively uses Open Source technologies.
DFF combines an intuitive user interface with a modular and cross-platform architecture.
Note that only Fedora 17, 18, 19, and 20 are supported in this release.
This release uses ffmpeg version 2.
This version is the developer version as of January 23, 2014.
Note that these packages have been placed in the forensics-test repository which must be enabled in the /etc/yum.repos.d/cert-forensics-tools.repo
by setting enabled to 1 (true).
|
|
January 22, 2014:
The following have been released:
- analysis-pipeline-4.3.2-1.{fc17,fc18,fc9,fc20,el5,el6}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
See the release notes for a list of changes.
- ffmpeg{,-libs,-devel}-2.1.1-1.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm - FFmpeg is a complete, cross-platform solution to record,
convert and stream audio and video. It includes libavcodec - the leading audio/video codec library.
These packages have been made available in are support of dff.
- dff-1.3.0-4.{fc17,fc18,fc19,fc20}.{i686,x86_64}.rpm - The Digital Forensics Framework (DFF) is both
a digital investigation tool and a development platform.
The framework is used by system administrators, law enforcement examiners, digital forensics researchers and students, and security professionals world-wide.
Written in Python and C++,
it exclusively uses Open Source technologies.
DFF combines an intuitive user interface with a modular and cross-platform architecture.
Note that only Fedora 17, 18, 19, and 20 supported in this release.
This release uses ffmpeg version 2.
- fmem-kernel-objects-1.6-1.25.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following kernels:
- 3.12.6-300 for FC20
- 3.12.5-302 for FC20
- 3.11.10-301 for FC20
- 3.12.6-200 for FC19
- 3.12.5-200 for FC19
- 3.11.10-200 for FC19
- 3.11.9-200 for FC19
- 3.11.8-200 for FC19
- 3.11.7-200 for FC19
- 3.11.10-100 for FC18
- 3.11.9-100 for FC18
- 3.11.7-100 for FC18
- 3.11.4-101 for FC18
- 2.6.32-431.3.1 for EL6
- 2.6.32-431.1.2.0.1 for EL6
- 2.6.32-431 for EL6
- 2.6.18-371.3.1 for EL5
- guymager-0.7.3-1.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package.
See here for the list of changes.
- netsa-rayon-1.4.3-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm and netsa-rayon-pipevis-0.0-3.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm -
Netsa-rayon is a Python library and set of tools for generating basic two-dimensional statistical visualizations.
Netsa-rayon can be used to automate reporting; provide data visualization in command-line, GUI or web applications; or do ad-hoc exploratory data analysis.
Netsa-rayon can generate visualizations in PDF, PNG, SVG and PostScript formats using Pycairo.
It can also be used in wxPython GUI applications.
Netsa-rayon is compatible with Python versions 2.6 and greater, and requires netsa-python and at least one of
Pycairo (for static output) or wxPython,/a> (for GUI output).
See here for a list of changes.
- python-rarfile-2.2-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Python-rarfile is a
Python module for RAR archive reading.
- python-registry-1.0.1-1.{fc17,fc18,fc19,fc20}.{i386,x86_64}.rpm - Python-registry provides read-only access
to Windows Registry files, such as NTUSER.DAT, userdiff, and SOFTWARE.
The interface is two-fold: a high-level interface suitable for most tasks, and a low level set of parsing objects and methods which may be used for advanced
study of the Windows Registry.
Python-registry is written in pure Python, making it portable across all major platforms.
- pytsk-20131230-1.{fc17,fc18,fc19,fc20,el5,el6}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
- yaf{,-devel}-2.4.0-3.{fc17,fc18,fc19,fc20,el6}.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter and
yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap dumpfiles as generated by tcpdump, from live capture from an interface
using pcap, an Endace DAG capture device, or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into
serialized IPFIX message streams (IPFIX files) on the local file system.
These packages were rebuilt to remove support for p0f.
- yara-2.0.0-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Here are the changes since the last version (1.7.2):
- Faster
- Better multi-thread support
- Rules can be saved in binary form
- yara-python-2.0.0-1.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - Yara-python is a Python
extension that gives access to Yara's powerful features from Python scripts.
Here are the changes since the last version (1.7.2):
- Faster
- Better multi-thread support
- Rules can be saved in binary form
- Volatility-2.3.1-2.el5.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
See here for a list of changes.
This version also includes the plugins from the Malware Analyst's Cookbook to version R134.
This version was rebuilt to use the latest version of yara.
- xrdp-0.7.0-1.el6.{i386,x86_64}.rpm - XRDP is an open source Remote Desktop Protocol (RDP) server.
CentOS/RHEL 6 did not have such a server so this version was added and released through the repository.
- CERT-Forensics-Tools-1.0-57.{fc17,fc18,fc19,fc20,el5,el6}.{i686,x86_64}.rpm - This package was updated to add the following:
- analyzeMFT
- hdparm
- kracked, for Fedora and CentOS/RHEL 6 only
- libpff-tools
- snarf, for Fedora and CentOS/RHEL 6 only
- super_mediator
- vmfs-tools
|
|
January 6, 2014:
The following have been released:
- Fedora 20 - The repository now supports Fedora 20
for both the i686 and x86_64 CPU architectures.
Here is the list of tools provided for Fedora 20:
All other packages installed when the CERT-Forensics-Tools package is installed are taken from the Fedora 20
Release and
Updates repositories.
Note that the RPM Fusion repository is not required to install of the CERT Linux Forensics Tools.
- Fedora 16 Support for Fedora 16 i686 and x86_64 architectures - Updates to Fedora 16 for
both the i686 and x86_64 CPU architectures has ceased.
|
|
January 8, 2014:
The following have been released:
- cert-forensics-tools-release-{16,17,18,19,5.10,6}-9.noarch.rpm - These packages were added to provide the new
CERT Forensics Oeprations and Investigations Team Key.
The fingerprint for this key is: 5FA3 2061 C4A0 F073 D6E7 3C1D BFCC 1527 ED92 ABE3.
You must do the following as root to install this new package before updating
existing packages installed from the repository:
yum update cert-forensics-tools-release
You can then do the following as root to install any other updates for your system:
yum update
In addition, all of the packages in the Fedora 16, 17, 18, 19, and RHEL/CentOS repositories have been resigned with this new key.
|
|
December 13, 2013:
The following have been released:
- libewf-{,devel,tools}-20131210-1.{fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm/{ewftools,libewf,libewf-devel}-20131210-1.fc19.{i686,x86_64}.rpm -
Libewf is a library for support of the Expert Witness Compression Format (EWF).
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Note that in Fedora 19, the tools package is named ewftools to reflect the package name found in the Fedora 19 release.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Here are the changes from the previous version (20130416):
- updated dependencies
- worked on Python bindings
- added libcthreads
- fix in DFXML output for size values
- worked on ewfmount
- libfixbuf{,-devel}-1.4.0-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.8.0-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for the list of the changes since the previous version (3.7.2).
- yaf{,-devel}-2.4.0-2.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm/yaf{,-devel}-2.2.1-5.el5.{i686,x86_64}.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
These packages were rebuilt to use libfixbuf version 1.4.0.
- super_mediator-0.3.0-2.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
This package was rebuilt to use libfixbuf version 1.4.0.
- python-apsw-3.8.2-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Python-apsw
is a Python wrapper for the SQLite embedded relational database engine.
In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
- pytsk-20131124-1.{fc16,fc17,fc18,fc19,el5,el6}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
- yara-1.7.2-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Here are the changes since the last version (1.7):
- BUGFIX: Regular expressions marked as both "wide" and "ascii" were treated as just "wide"
- BUGFIX: Bug in "n of ()" operator
- BUGFIX: Bug in get_process_memory could cause infinite loop
- BUGFIX: Fix SIGABORT in ARM
- BUGFIX: Failing to detect one-byte strings at the end of a file.
- BUGFIX: Strings being incorrectly printed when markes both as wide and ascii
- BUGFIX: Stack overflow while following circular symlinks
- BUGFIX: Expression "/re/ matches var" always matching if "var" was an empty string
- BUGFIX: Strings marked as "fullword" were incorrectly matching in some cases
- yara-python-1.7.2-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
Here are the changes since the last version (1.7):
- BUGFIX: Regular expressions marked as both "wide" and "ascii" were treated as just "wide"
- BUGFIX: Bug in "n of ()" operator
- BUGFIX: Bug in get_process_memory could cause infinite loop
- BUGFIX: Fix SIGABORT in ARM
- BUGFIX: Failing to detect one-byte strings at the end of a file.
- BUGFIX: Strings being incorrectly printed when markes both as wide and ascii
- BUGFIX: Stack overflow while following circular symlinks
- BUGFIX: Expression "/re/ matches var" always matching if "var" was an empty string
- BUGFIX: Strings marked as "fullword" were incorrectly matching in some cases
- Volatility-2.3.1-1.{fc16,fc17,fc18,fc19,el5,el6}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
See here for a list of changes.
This version also includes the plugins from the Malware Analyst's Cookbook to version R134.
See here for the list of recent changes.
|
|
November 18, 2013:
The following have been released:
- device-mapper-multipath{,-libs,-sysvinit}-0.4.9-*.1.{fc16,fc17,fc18,fc19}.{i386,x86_64}.rpm,kpartx-0.4.9-*.1.{fc16,fc17.fc18,fc19}.{i386,x86_64} ,
device-mapper-multipath{,-libs}-0.4.9-64.1.el6.{i386,x86_64}.rpm,kpartx-0.4.9-64.1.el6.{i386,x86_64} ,
device-mapper-multipath-0.4.7-59.1.el5.{i386,x86_64}.rpm,kpartx-0.4.7-59.1.el6.{i386,x86_64} - Device-mapper-multipath
provides tools to manage multipath devices by instructing the device-mapper multipath kernel module what to do.
Of particular importance is kpartx which reads partition tables on specified device and create device maps over partitions segments detected.
Unfortunately, kpartx as distributed fails if the specified device is not writable.
This version opens the specified device read-only which makes it more usable when dealing with read-only evidence.
This read-only change is the only change made to the latest distribution for each of Fedora 16-19, and CentOS/RHEL 5 and 6.
|
|
November 8, 2013:
The following have been released:
- snort-2.9.5.5-1.1.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.5.5-1.1.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- sleuthkit-{,devel,libs}-4.1.2-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
Here are the changes since 4.1.0:
- Core
- Fixed more visual studio projects to work on 64-bit
- Added FILE_SHARE_WRITE to all windows open calls
- Removed unused methods in CRC code that caused compile errors
- Added NTFS FNAME times to time2 struct in TSK_FS_META to make them easier to access -- should have done this a long time ago!
- fls -m and tsk_gettimes output NTFS FNAME times to output for timelines
- hfind with EnCase hashsets works when DB is specified (and not only index)
- TskAuto now goes into UNALLOC partitions by default too
- Added support to automatically find all Cellebrite raw dump files given the name of the first image
- Added 64-bit windows targets to VisualStudio files
- Added NTFS sequence to parent address in directory and directory itself
- Updated SQLite code to use sequence when finding parent object ID
- Java
- Added method to Image to perform sanity check on image sizes
- Java bindings JAR files now have native libraries in them
- Logical files are added with a transaction
- fiwalk
- Fixed compile error on Linux etc
- analyzeMFT-2.0.11-1.1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - AnalyzeMFT is a tool that fully parses
the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.
- Volatility-2.3-1.{fc16,fc17,fc18,fc19,el5,el6}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
See here for a list of changes.
This version also includes the plugins from the Malware Analyst's Cookbook to version R134.
See here for the list of recent changes.
- fmem-kernel-objects-1.6-1.24.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following kernels:
- 3.11.6-201 for FC19
- 3.11.6-200 for FC19
- 3.11.4-201 for FC19
- 3.11.3-201 for FC19
- 3.11.2-200 for FC19
- 3.11.1-200 for FC19
- 3.10.11-200 for FC19
- 3.10.10-200 for FC19
- 3.10.9-200 for FC19
- 3.10.7-200 for FC19
- 3.10.6-200 for FC19
- 3.10.5-201 for FC19
- 3.10.4-300 for FC19
- 3.11.4-101 for FC18
- 3.10.14-100 for FC18
- 3.10.13-101 for FC18
- 3.10.12-100 for FC18
- 3.10.11-100 for FC18
- 3.10.10-100 for FC18
- 3.10.9-100 for FC18
- 3.10.7-100 for FC18
- 3.10.6-100 for FC18
- 3.10.4-100 for FC18
- 2.6.32-358.23.2 for EL6
- 2.6.32-358.18.1 for EL6
- 2.6.18-348.18.1 for EL5
- 2.6.18-371.1.2 for EL5
|
|
September 17, 2013:
The following have been released:
- postgresql{,-contrib,-devel,-libs,-plperl,-plpython,-server,9.3.0-1PGDG.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - PostgreSQL
is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to
access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the
PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the
postgresql93-server sub-package.
- pgadmin3_93-1.18.0-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - PGadmin
III is a powerful administration and development platform for the PostgreSQL database, free for any use.
It is designed to answer the needs of all users, from writing simple SQL queries to developing complex
databases. The graphical interface supports all PostgreSQL features and makes administration easy.
- ipa{,-devel,-python}-0.5.2-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - IPA
is an IP address annotation system.
IPA provides a flexible and efficient repository of IP address information, tools for querying and maintaining the data, and shared libraries and modules for data access.
For more information, read the IPA documentation.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.7.2-2.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This version has support for the IPA library.
- ip4r93-2.0-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - IP4R
and ip4 are types that contain a single IPv4 address and a range of IPv4 addresses respectively.
They can be used as a more flexible, indexable version of the cidr type.
This version has been built for PostgreSQL version 9.3.
- ghostpdl-9.10-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Ghostpdl is Artifex Software's implementation of the
PCL-5™ and PCL-XL™ family of page description languages. Ghostpdl is used by Xplico.
- testdisk-6.14-2.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
This version correctly specifies the version of libntfs-3g.so.
- partclone-0.2.48-4.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
This release was built to use the correct version of libntfs-3g.so.
- libbde{,-devel,-python,-tools}-20130908-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the support formats, protection methods, and additional features.
Here are the changes for this release:
- updated dependencies
- added libcthreads build support
- updated msvscpp files
- bug fixes
- code clean up
- pytsk-20130910-1.{fc16,fc17,fc18,fc19,el5,el6}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
|
|
September 2, 2013:
The following have been released:
- dd_rescue-1.40-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Here are the changes from the previous distributed version (1.33):
- Release 1.40-1
It brings copying of extended attributes (with -p/--preserve). It doubles the default soft
block size for buffered IO, but brings sparse write optimization for half-empty blocks.
It also optimizes copying by using the first write to get rid off odd file offsets. It
also adds a lot more test cases to make check.
- Release 1.39-1
It fixes an issue where a copied file could be appended zeros if hardblocksize copy was used
(e.g. b/c hardbs==softbs, bnc #833765). There's also a bit better ARM asm optimization,
yielding a ~15% performance increase. There's also a help/manpage clarification that
syncfreq actually is a size. And we use autoconf now to determine the target system
features. Default build target now uses libdl.
- Release 1.38-1
Improving SSE sparse detection performance (by 40%), adding a testcase for the 1.35/1.36
bug and run it in make check. There's even an AVX version, but it's not enabled by
default, as it's untested. --force/-f now allows to ignore a non-zero output position
on non-seekable output and the curr.rate and ETA calculations have improved a bit.
- Release 1.37-1
Fixing an issue with SSE2 sparse detection, which could spuriously detect zero-filled
blocks and thus result in corrupted copies if option -a was used. (This would happen for
blocks that had no bytes with the uppermost bit set, such as e.g. ASCII text.) Embarassing!
Also fixed issues on big-endian machines (although these were inconsequential for dd_rescue).
- Release 1.36-1
It fixes an overflow issue with the number output for long running
dd_rescue processes. SSE2 is now also enabled in x86 (32bit, with runtime detection) and
an optimized ARM version (assembler yeah!) to find zero blocks was added.
- Release 1.35-1
It had some improvements on the output that it prints -- beyond internal improvements it introduces
colours to the output unless the terminal type is clearly dumb; there is also an option to control this.
Numbers are highlighted for readability. Output is rate limited (10/s). 1.35 also brings a simple
rewrite logic for handling write errors. There's an SSE2 optimized version to find
zero blocks for sparse writing.
- python-apsw-3.8.0-2.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Python-apsw
is a Python wrapper for the SQLite embedded relational database engine.
In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
- pytsk-20130826-1.{fc16,fc17,fc18,fc19,el5,el6}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
See here for a list of changes.
- regripper-28000000-4.{fc16,fc17,fc18,fc19,el5,el6}.noarch.rpm - Regripper is a
Windows Registry data extraction and correlation tool.
This package is contains version 2.8 of the regripper tool. The plugins are packaged separately.
This release contains version 08-26-13 of the auto_rip.pl.
See here for more details about this script.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.7.2-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
Here are the changes from the previous version (3.7.1):
- PySiLK changes
- Add IPSet.is_ipv6() and IPSet.convert() methods.
- Fix a bug when saving an IPv6-IPset that contains only IPv4 addresses.
- IPset bug fixes
- Fix bugs when computing the union or intersection of an IPv4-IPset and an IPv6-IPset that contains only IPv4 addresses.
- rwfilter bug fixes
- Fix a spurious warning when loading an IPset.
- Fix a memory issue during shutdown when an argument to one of the --*cidr switches (--scidr, --dcidr, etc) is mistyped.
- rwflowpack, flowcap bug fixes
- Fix a bug where the daemon failed to read TCP flags contained in a SubTemplateMultiList when reading IPFIX data over the network.
- Fix a memory leak when receiving IPFIX data containing a SubTemplateList or a SubTemplateMultiList.
- silk-ipset-{devel,lib,tools}-3.7.2-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
|
|
August 26, 2013:
The following have been released:
- libvshadow{,-devel,-tools,-python}-20130723-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version:
- fixes for 32-bit WINAPI build of pyvshadow in file object glue code
- Changes for stand-alone libbfio build
- updated msvscpp files
- remove unnecessary restriction in library include headers
- updated dependencies
- daq-2.0.1-1.{fc16,fc17,fc18,fc19,el6}.{i386,x86_64}.rpm - The Data Acquisition Library (Daq) is a library
used by snort.
here are the changes since the last version:
- daq.h, daq_api.h, daq_base.c, daq_common.h, daq_mod_ops.c,
daq_afpacket.c, daq_dump.c, daq_ipfw.c, daq_ipq.c, daq_nfq.c,
daq_pcap.c, daq_static_modules.c, daq_static_modules.h,
sf_bpf_filter.c, sf_bpf_printer.c, sf_gencode.c, sf_nametoaddr.c,
sf_optimize.c, sfbpf-int.c, sfbpf-int.h, sfbpf.h,
sfbpf_dlt.h:
Update copyright year.
- daq_dump.c, daq_ipfw.c, daq_ipq.c, daq_nfq.c:
Ensure verdict is in range before bumping peg counts.
Thanks to John Menerick for reporting the
issue.
- snort-2.9.5.3-1.1.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - (Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.5.3-1.1.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- dd_rescue-1.34-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Here are the changes from the previous distributed version (1.33):
- This version provides better support for various *nix systems (specifically had a few fixes for FreeBSD),
better compatibility with compilers (clang and g++ and clang++). It can now also load libfallocate at runtime (libdl)
and detects a few more fatl write errors as such.
- ddrescue-1.17-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
Here are the changes from the previous distributed version (1.16):
- Added new option -l, --logfile-size.
- Added new option -w, --ignore-write-errors.
- Option --fill has been renamed to --fill-mode.
- Option --generate-logfile has been renamed to --generate-mode.
- Added option --sector-size as a synonym of --block-size.
- Added option --retries as a synonym of --max-retries.
- Added option --size as a synonym of --max-size.
- rescuebook.cc: Trimming is now done from both edges of each non-trimmed block. Largest blocks are trimmed first.
- rescuebook.cc: Largest blocks are now split first until logfile reaches --logfile-size entries.
- logbook.cc (extend_sblock_vector, truncate_vector): Terminate if truncation would discard finished blocks.
- rescuebook.cc: Mark failed blocks with 1 sector as bad-sector.
- logbook.cc (extend_sblock_vector): Remove last block of logfile if it starts at isize and is not marked as finished.
- io.cc (show_status,update_rates): Detect a jump back in time and adjust status.
- ddrescue.h (slow_read): Return false for the first 10 seconds.
- io.cc (show_status) Leave cursor after message so that ^C does not overwrite it.
- main.cc: Do not require --force for generate mode.
- ddrescue.h (Logbook::logfile_exists): Do not return false if logfile exists but is empty.
- Added new chapter 'Using ddrescue safely' to the manual.
- Documented that 'direct disc access' only reads whole sectors.
- configure: Options now accept a separate argument.
- Makefile.in: Added new target install-bin.
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.61-1.1.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
Here are the changes from the previous distributed version (0.6.61):
- Move documentation to unversioned directory
- netsa-rayon-1.4.2-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm and netsa-rayon-pipevis-0.0-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm -
Netsa-rayon is a Python library and set of tools for generating basic two-dimensional statistical visualizations.
Netsa-rayon can be used to automate reporting; provide data visualization in command-line, GUI or web applications; or do ad-hoc exploratory data analysis.
Netsa-rayon can generate visualizations in PDF, PNG, SVG and PostScript formats using Pycairo.
It can also be used in wxPython GUI applications.
Netsa-rayon is compatible with Python versions 2.6 and greater, and requires netsa-python and at least one of
Pycairo (for static output) or wxPython (for GUI output).
See here for a list of changes.
- snarf{,-devel,-python}-0.2.2-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Snarf is a distributed alert reporting system.
Applications can use snarf's C and Python APIs to construct and send network alert messages,
which can then be routed to multiple destinations in a configurable manner.
Here are the changes:
- Initial release to open source community.
- Additional documentation.
- Bug fixes.
- ghostpdl-9.09-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Ghostpdl is Artifex Software's implementation of the
PCL-5™ and PCL-XL™ family of page description languages. Ghostpdl is used by Xplico. This version attempts to update Xplico's version
of pcl6 - the binary installed as part of ghostpdl - as stored in /opt/xplico/bin if Xplico is installed.
- ssdeep-2.10-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes. See here for the list of changes.
- testdisk-6.14-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
Here are the changes from the last version (6.13):
- General Improvements
- The log file generated by the Windows version (cygwin) reports bad sectors in a more readable fashion, example
- ReadFile Data error (cyclic redundancy check).
- As openssl isn't used, don't link with this cryptographic library (Debian tries to avoid mixing GPL code and openssl)
- TestDisk
- Improvements
- testdisk /list now displays the disk model, serial number, firmware version and hpa or dco presence if detected
- Recover WBFS (Wii Backup File System) partition
- Make FAT RebuildBS works when there is a single FAT table
- Interface: Display the partition table type if autodetected
- Interface: modified warning about mismatching geometry between FAT or NTFS boot sector and HD geometry information (Debian #651756)
- Interface: Remove "Allow partial last cylinder" option
- Bug fixes
- Fix crc in EFI backup GPT
- Rewrote how TestDisk aligns partition on cylinder or 1MB boundary. It avoids to create partition entry where the partition ends after the end of the disk.
- PhotoRec
- Improvements
- Improve Olympus .orf recovery
- Improve WP Mac/WP5/WP6 Corel Documents .wpd files recovery
- Fix thumbs.db recovery, avoid some false positive with .doc
- Interface: if less than 10 file families are enabled, display the results even if zero has been found yet
- New file formats:
- .aep After Effects
- .axx AxCrypt
- .dp Designer, a Photobook Designer Software
- .lzh archive
- .mmap MindManager
- .plt Gerber Graphix Advantage
- .prproj Adobe Premiere project
- .psb Adobe Photoshop Image
- .pts PTGui, panoramic stitching software
- .qcp The QCP File Format and Media Types for Speech Data (RFC3625)
- .shn Shorten audio file
- .snt Windows Sticky Notes
- .ttd TinyTag Data
- .wallet Armory bitcoin wallet
- .wim Windows imaging (WIM) image
- Bug fixes
- Fix an endless loop during .caf file recovery
- Fix tiff recovery including some raw file formats, 64-bit version wasn't affected
|
|
August 1, 2013:
The following have been released:
- CERT-Forensics-Tools-1.0-55.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - This package was updated to do the following:
- For Fedora 19, use ewftools.
- For all else, use libewf-tools and obsolete ewftools.
- libbfio{,devel}-20120425-1.{fc16,fc17,fc18,fc19,el5,el6}.{i386,x86_64}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access.
Here are the changes:
- add VC_EXTRALEAN to config_msc.h
- add autoconf/make test suite
- add callback function to resize memory range if needed?
- additional checks for system strings
- allow re-set of pool entries?
- bug fix for POSIX wide character support in path functions
- check if libbfio.3 is up to date
- code clean up
- fixed memory leak due to recent changes
- remove deprecated functions in libbfio_legacy.[ch]
- removed deprecated functions
- updated .pc and .spec file
- updated codegear files
- updated common
- updated configure.ac
- updated configure.ac and m4 files
- updated dependencies
- updated gettext
- updated libcstring, libuna
- updated libuna
- updated list type, offset list
- updated msvscpp and borlandc files
- updated msvscpp files
- updated spec and pc files
- what about disk full on write
- wide to narrow (ASCII with codepage) conversion
- worked on absolute path support with /../
- worked on file range back end
- worked on full file name support for open on demand
- worked on full path functions
- worked on libcfile rewrite
- worked on libcpath rewrite
- libpff-20120802-2.{fc16,fc17,fc18,fc19,el5,el6}.{i386,x86_64}.rpm - Libpff is a library
and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal
Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
Libpff is used by DFF - the Digital Forensics Framework.
See the libpff website for the list of changes
- dff-1.3.0-3.{fc17,fc18,fc19}.{i686,x86_64}.rpm - The Digital Forensics Framework (DFF) is both
a digital investigation tool and a development platform. The framework is used by system administrators, law enforcement examinors, digital forensics researchers
and students, and security professionals world-wide. Written in Python and C++, it exclusively uses Open Source technologies. DFF combines an intuitive user
interface with a modular and cross-platform architecture. Note that only Fedora 17, 18, and 19 supported in this release.
Here are the changes (thanks to Danil Bazin for the bug report and suggested fixes):
- Added a dynamic loader configuration file, activated them when dff is installed, and deactived them when dff is uninstalled.
- Added missing PyQt4 dependency.
- Added missing reglookup dependency.
- Added the __init__.py file needed for searching.
- Recomplied with latest libbfio and libpff libraries.
- Installed the ffmpeg-devel package from the RPMFusion to add video support to dff.
This required the installation of these additional pagkages, all also from RPMFusion:
- ffmpeg-libs
- librtmp
- x264-libs
- xvidcore
- fmem-kernel-objects-1.6-1.23.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following kernels:
- 2.6.32-358.11.1 for EL6
- 3.9.8-108 for FC17
- 3.9.10-100 for FC17
- 3.9.5-201 for FC18
- 3.9.6-208 for FC18
- 3.9.9-201 for FC18
- 3.9.10-200 for FC18
- 3.9.11-200 for FC18
- 3.9.5-301 for FC19
- 3.9.9-302 for FC19
- 3.10.3-300 for FC19
- libbde{,-devel,-python,-tools}-20130729-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the support formats, protection methods, and additional features.
Here are the changes for this release:
- updated dependencies
- pybde fixes for >2G file objects in BFIO glue code
- worked on git support
- updated dependencies
- fixed some typos
- fix for dealing with padding in FVE metadata block
- partclone-0.2.48-3.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
This release was built to use the latest libntfs-3g shared library, bringing all of the releases to the same release level.
- recoll-1.19.4-2.1.{fc16,fc17,fc18,fc19,el6}.{i686,x86_64}.rpm - Recoll
is a text search tool for Unix and Linux desktops. Recoll finds keywords inside documents as well as file names.
See here for a list of changes in this version.
In addition, tar archives have been enabled and the epub, pstotext, and aspell packages have been added as required packages.
- stegdetect-0.6.0-2.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - stegdetect is an automated tool for detecting steganographic content in images.
This package was rebuilt to remove compiler optimization, the inclusion of which caused stegdetect to crash.
Thanks to Pete Troxell for the bug reports and suggested fixes.
- kracked-0.1-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - Kracked is a tool that creates word lists from files, memory captures for example.
- {vmfs-tools,ilibvmfs-devel}-0.2.5-1.{fc16,fc17,fc18,fc19,el5,el6}.{i686,x86_64}.rpm - VMfs-tools is a collection of
command-line tools for operating on VMware's VMFS file system.
Included in this release is limited VMFS version 5 support.
|
|
August 6, 2013:
The following have been released:
- Fedora 19 - The repository now supports Fedora 19
for both the i686 and x86_64 CPU architectures.
- Fedora 15 Support for Fedora 16 i686 and x86_64 architectures - Updates to Fedora 15 for
both the i686 and x86_64 CPU architectures has ceased.
|
|
July 10, 2013:
The following have been released:
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.60-1.1.{fc15,fc16,fc17,fc18, el6}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
- sleuthkit-{,devel,libs}-4.1.0-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
Here are the changes since 4.0.2:
- Core
- Added YAFFS2 support (patch from viaForensics).
- Added Ext4 support (patch from kfairbanks)
- changed all include paths to be 'tsk' instead of 'tsk3' (IMPORTANT FOR ALL DEVELOPERS!)
- Framework
- Added Linux and MAC support.
- Added L01 support.
- Added APIs to find files by name, path and extension.
- Removed deprecated TskFile::getAttributes methods.
- moved code around for AutoBuild tool support.
- Java Bindings
- added DerivedFile datamodel support
- added a public method to Content to add ability to close() its tsk handle before the object is gc'd
- added faster skip() and random seek support to ReadContentInputStream
- refactored datamodel by pushing common methods up to AbstractFile
- fixed minor memory leaks
- improved regression testing framework for java bindings datamodel
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.7.1-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See the release notes for a list of changes since the previous version, 2.5.0.
- analysis-pipeline-4.2-2.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
See the release notes for a list of changes since the previous version, 3.0.0.
- silk-ipset-{devel,lib,tools}-3.7.1-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
- super_mediator-0.3.0-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
- netsa-python-1.4.3-1.{fc15,fc16,fc17,fc18,el5,el6}.{i386,x86_64}.rpm - Netsa-python is a
library of Python routines and frameworks that the NetSA team at CERT has found helpful when developing analyses using the SiLK toolkit. Of particular note are the
netsa.script NetSA Scripting Framework, which provides a standard framework for writing scripts that process flow data, and the netsa.util.shell command line
processing system, which provides tools for managing extremely complicated collections of shell processes that should fail or succeed together (extremely useful when working with named pipes).
Netsa-python is compatible with Python versions 2.4 and greater.
See here for a list of the changes since the last release which was version 1.3.
- netsa-rayon-1.4.1-2.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm and netsa-rayon-pipevis-0.0-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm -
Netsa-rayon is a Python library and set of tools for generating basic two-dimensional statistical visualizations.
Netsa-rayon can be used to automate reporting; provide data visualization in command-line, GUI or web applications; or do ad-hoc exploratory data analysis.
Netsa-rayon can generate visualizations in PDF, PNG, SVG and PostScript formats using Pycairo.
It can also be used in wxPython GUI applications.
Netsa-rayon is compatible with Python versions 2.4 and greater, and requires netsa-python and at least one of
Pycairo (for static output) or wxPython (for GUI output).
See here for a list of changes.
- snarf{,-devel,-python}-0.2.1-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Snarf is a distributed alert reporting system.
Applications can use snarf's C and Python APIs to construct and send network alert messages,
which can then be routed to multiple destinations in a configurable manner.
- prism-1.2-3.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The prism
trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool.
The script can be used directly, or might be used as a component in other more specialized scripts.
In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup.
This is a new release keeping up with the latest SiLK 3 tools.
- CERT-Forensics-Tools-1.0-54.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - This package was updated to do the following:
- Added libbde-tools for all supported architectures
- Added libfvde-tools for all supported architectures
- Added libvhdi-tools for all supported architectures
- Obsoletes rayon and replaces it with netsa-python
- pytsk-2012113-3.{fc15,fc16,fc17,fc18,el5,el6}.{i386,x86_64}.rpm - Pytsk is Python bindings for
The Sleuth Kit.
This release has been rebuilt to use version 4.1.0 of The Sleuth Kit.
|
|
June 17, 2013:
The following have been released:
- aff{lib,lib-devel,tools}-3.7.1-2.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Afflib is the library and tools to manipulate files
using the Advanced Forensic Format. Please note: as of AFFLIB 3.6, all tool names start with the string aff which marks a change from AFFLIB version 3.5.
This version now uses the correct version of libewf-devel.
- testdisk-6.13-3.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
This version now uses the correct version of libewf-devel.
- libbde{,-devel,-python,-tools}-20130422-1.fc18.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker
Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
The supported BDE formats are:
- BitLocker Windows Vista
- BitLocker Windows 7
- BitLocker Windows 8 (Consumer Preview)
- BitLocker To Go
The supported protection methods are:
- clear key
- password
- recovery password
- start-up key
- FKEV and/or TWEAK key data
The additional features are:
- support for partial encrypted volumes
- zeros out the BDE metadata, matches behavior seen on Windows
- libfvde{,-devel,-tools}-20130422-1.fc18.{i686,x86_64}.rpm - Libfvde is a lbrary and tools to access FileVault Drive
Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
The supported FileVault2 implementations are:
- Mac OS X Lion
- Mac OS X Mountain Lion
The supported encryption volume types are:
- removable media volume (initial support as of 20121113 version)
- system volume
The supported protection methods are:
- password
- recovery password
- VMK key data (as of 20121114 version)
The development in progress work areas are:
- extend CoreStorage volume support
- partial encrypted volumes
- libvhdi{,-devel,-python,-tools}-20130512-1.fc18.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the
Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
The supported formats for reading are:
The supported image types are:
- Fixed-size hard disk image
- Dynamic-size (or sparse) hard disk image
The image types currently not supported are:
- Differential (or differencing) hard disk image
The areas for work in progress are:
- Differential image support
- Dokan library support
|
|
June 6, 2013:
The following have been released:
- python-apsw-3.7.17-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Python-apsw
is a Python wrapper for the SQLite embedded relational database engine.
In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
- libewf-{,devel,tools}-20130416-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Here are the changes from the previous version (20130128):
- added error tolerance for Logicube image with missing checksum in data section
- bug fix in libcfile.m4 for building on MingW and Cygwin
- changes and fixes in debug output
- changes to zlib.m4 for adler32 detection
- code clean up
- fix in libsmdev for MinGW build
- fixed maximum number of segments
- fixed unknown symbols error related to libbfio
- moved README.mingw and README.static to wiki
- sync with experimental version
- updated codegear files
- updated dependencies
- updated msvscpp files
- updated types.h
- updates for libsmdev
- worked on libcdata integration
- fmem-kernel-objects-1.6-1.22.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following kernels:
- 3.9.4-200 for FC18
- 3.9.2-200 for FC18
- 3.8.13-100 for FC17
- 3.8.12-100 for FC17
- 2.6.32-358.6.2 for EL6
- 2.6.18-348.6.1 for EL5
|
|
May 23, 2013:
The following have been released:
- libvshadow{,-devel,-tools,-python}-20130509-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version>
- added libcthreads
- added libvshadow_volume_get_store_identifier function
- added store read from file IO handle function
- changes to read block descriptors on demand improves vshadowinfo preformance
- fixed issue in read buffer due to recent changes
- fixes for multiple open/close on the same volume object
- slight improvement of error tolerability of catalog parsing
- vshadowmount small changes
- worked on multi-threading support
- worked on multi-threading support
- worked on multi-threading support
- worked on tests
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.59-1.1.{fc15,fc16,fc17,fc18, el6}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
- regripper-28000000-3.{fc15,fc16,fc17,fc18,el5,el6}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool.
This package is contains version 2.8 of the regripper tool. The plugins are packaged separately.
This release contains the auto_rip.pl.
See here for more details about this script.
|
|
May 14, 2013:
The following have been released:
- ADIA-FC17-{i686,x86-64}-{VMware,VirtualBox}.iso - These items are VMware and VirtualBox-based forensic appliances built with Fedora 17 for the i686 and x86_64 architectures.
Please note that they are not a live CDs.
See here for more details.
|
|
May 7, 2013:
The following have been released:
- partclone-0.2.48-3.el6}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
This release (3) was built to use the latest libntfs-3g shared library which comes from the fuse-ntfs-3g package. It has only be rebuilt for
RHEL/CentOS 6 to fix a conflict with this shared library.
- prism-1.2-2.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The prism
trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool.
The script can be used directly, or might be used as a component in other more specialized scripts.
In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup.
The changes in this version are the following:
- Added new wsgi web UI.
- Filter DeprecationWarnings to prevent user confusion.
- Correct runtime dependencies.
- rayon-1.3.3-2.{fc13,fc14,fc15,fc16,el5,el6}.{i686,x86_64}.rpm - Rayon is a Python library and set of tools for generating
basic two-dimensional statistical visualizations. Rayon can be used to automate reporting; provide data visualization in command-line, GUI or web applications; or do ad-hoc exploratory data analysis.
Rayon can generate visualizations in PDF, PNG, SVG and PostScript formats using Pycairo. It can also be used in wxPython GUI applications.
Rayon is compatible with Python versions 2.4 and greater, and requires netsa-python and at least one of Pycairo (for static output) or wxPython (for GUI output).
This version has been rebuilt to more precisely defined the build and operational dependencies.
- libvshadow{,-devel,-tools,-python}-20130501-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version>
- added initial version of qcowmount with Dokan library support
- yaf{,-devel}-2.4.0-1.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Note that this release of Yaf is not available for CentOS/RHEL 5 due to an outdated version of PCRE for that OS.
Here are the changes since the last version:
- New HTTP DPI Fields
- Updated DPI Elements
- Bug Fix to not replace yaf.conf on install
- New application label: VMware server console
- Added support to decode ERSPAN headers
- Drop statistics are updated when statistics messages are exported
- yafcollect bug fix
- Other Bug Fixes
- fmem-kernel-objects-1.6-1.21.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following kernels:
- 3.8.11-200 for FC18
- 3.8.11-100 for FC17
|
|
April 30, 2013:
The following have been released:
- regripper-28000000-1.{fc15,fc16,fc17,fc18,el5,el6}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool.
This package is contains version 2.8 of the regripper tool. The plugins are packaged separately.
See the Update History for a list of the changes made since the last release (20130404).
- regripper-plugins-20130429-1.{fc15,fc16,fc17,fc18,el5,el6}.noarch.rpm - Regripper-plugins are the plugins packaged separately from
the regripper application.
See the Update History for the list of changes made in this release.
- fmem-kernel-objects-1.6-1.20.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following kernels:
- 3.8.9-200 for FC18
- 3.8.8-203 for FC18
- 3.8.8-202 for FC18
- 3.8.8-100 for FC17
- 2.6.32-358.6.1 for EL6
- 2.6.18-348.4.1 for EL5
|
|
April 26, 2013:
The following have been released:
- scalpel-2.0-2.el5.{i686,x86_64}.rpm - This package was updated to reflect the new version of the regular expression matching library tre.
Note that this change is only for RHEL/CentOS 5.
- snort-2.9.4.6-1.1.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - (Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.4.6-1.1.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- libvshadow{,-devel,-tools,-python}-20130417-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version.
- added tests directory
- bug fix in dependencies
- code clean up
- pyvshadow updates
- updated README files
- updated dependencies
- updates and bug fixes in pyvshadow
- vshadowtools now detect if there is a VSS signature first and bail out with a different error if not
|
|
April 22, 2013:
The following have been released:
- snort-2.9.4.5-1.1.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - (Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.4.5-1.1.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- regripper-plugins-20130404-1.{fc15,fc16,fc17,fc18,el5,el6}.noarch.rpm - Regripper-plugins are the plugins packaged separately from
the regripper application.
The plugins added are the following:
- NOTE: these are the packager's comments on what is new in this release, not the authors.
- NEW PLUGIN attachmgr.pl The Windows Attachment Manager manages how attachments are handled, and settings are on a per-user basis. Malware has been shown to access
these settings and make modifications.
- NEW PLUGIN javasoft.pl Gets contents of JavaSoft/UseJava2IExplorer value
- NEW PLUGIN lsa_packages.pl Lists various *Packages key contents beneath LSA key
- NEW PLUGIN olsearch.pl Gets contents of user's OutLook Searches
- NEW PLUGIN outlook2.pl Gets MAPI (Outlook) settings *BETA*
- NEW PLUGIN photos.pl Read data on images opened via Win8 Photos app
- NEW PLUGIN scanwithav.pl Checks ScanWithAV value in Software hive, per KB 883260
- NEW PLUGIN uac.pl Get User Account Control (UAC) Values from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
- UPDATE appinitdlls.pl updated to address 64-bit systems
- UPDATE ares.pl updated based on data provided by J. Weg
- UPDATE ie_settings.pl added "AutoConfigURL" value info
- UPDATE inprocserver.pl fixed retrieving LW time from correct key
- UPDATE landesk.pl added Wow6432Node path
- UPDATE sevenzip.pl minor updates added
- UPDATE soft_run.pl updated to include Policies keys; added additional keys
- UPDATE ssh_host_keys.pl Added rptMsg for key not found errors by Corey Harrell
- UPDATE termserv.pl updated with autostart locations
- UPDATE user_run.pl added additional keys; updated to include Policies keys; updated to include additional keys; updated to include 64-bit, additional keys/values
- UPDATE winlogon_u updated with ThreatExpert info
- UPDATE winscp_sessions.pl Added rptMsg for key not found errors by Corey Harrell
- NOTE RegRipperPluginsPackage (RRPP) now counts 236 plugins
- bloom-1.4.6-2.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Bloom
is an NPS bloom filter package that includes the frag_find utility.
This version removes the frag_find tool which is now packaged separately.
- frag_find-1.0.0-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Frag_find
is a program for finding blocks of one or more MASTER files in a disk IMAGE file.
This is useful in cases where a MASTER file has been stolen and you wish to establish that the file has been present on a subject's drive.
If most of the MASTER file's sectors are found on the IMAGE drive---and if the sectors are in consecutive sector runs---then the chances are excellent that the file was once there.
- CERT-Forensics-Tools-1.0-53.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - This package was updated to do the following:
- add frag_find for all supported architectures
- disktype-9-9.3.{fc15,fc16,fc17,fc18,el5,el6}.noarch.rpm - Disktype detects the content format of a disk or disk image.
This release corrects a package building error dealing with release numbering.
- fmem-kernel-objects-1.6-1.19.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following kernels:
- 3.8.7-201 for FC18
- 3.8.6-203 for FC18
- RHEL/CentOS 5: Added the following:
2.6.18-8.el5.i686
2.6.18-8.el5.x86_64
2.6.18-8.el5PAE.i686
2.6.18-8.1.1.el5.i686
2.6.18-8.1.1.el5.x86_64
2.6.18-8.1.1.el5PAE.i686
2.6.18-8.1.10.el5.i686
2.6.18-8.1.10.el5.x86_64
2.6.18-8.1.10.el5PAE.i686
2.6.18-8.1.14.el5.i686
2.6.18-8.1.14.el5.x86_64
2.6.18-8.1.14.el5PAE.i686
2.6.18-8.1.15.el5.i686
2.6.18-8.1.15.el5.x86_64
2.6.18-8.1.15.el5PAE.i686
2.6.18-8.1.3.el5.i686
2.6.18-8.1.3.el5.x86_64
2.6.18-8.1.3.el5PAE.i686
2.6.18-8.1.4.el5.i686
2.6.18-8.1.4.el5.x86_64
2.6.18-8.1.4.el5PAE.i686
2.6.18-8.1.6.el5.i686
2.6.18-8.1.6.el5.x86_64
2.6.18-8.1.6.el5PAE.i686
2.6.18-8.1.8.el5.i686
2.6.18-8.1.8.el5.x86_64
2.6.18-8.1.8.el5PAE.i686
2.6.18-53.el5.i686
2.6.18-53.el5.x86_64
2.6.18-53.el5PAE.i686
2.6.18-53.1.13.el5.i686
2.6.18-53.1.13.el5.x86_64
2.6.18-53.1.13.el5PAE.i686
2.6.18-53.1.14.el5.i686
2.6.18-53.1.14.el5.x86_64
2.6.18-53.1.14.el5PAE.i686
2.6.18-53.1.19.el5.i686
2.6.18-53.1.19.el5.x86_64
2.6.18-53.1.19.el5PAE.i686
2.6.18-53.1.21.el5.i686
2.6.18-53.1.21.el5.x86_64
2.6.18-53.1.21.el5PAE.i686
2.6.18-53.1.4.el5.i686
2.6.18-53.1.4.el5.x86_64
2.6.18-53.1.4.el5PAE.i686
2.6.18-53.1.6.el5.i686
2.6.18-53.1.6.el5.x86_64
2.6.18-53.1.6.el5PAE.i686
2.6.18-92.el5.i686
2.6.18-92.el5.x86_64
2.6.18-92.el5PAE.i686
2.6.18-92.1.1.el5.i686
2.6.18-92.1.1.el5.x86_64
2.6.18-92.1.1.el5PAE.i686
2.6.18-92.1.10.el5.i686
2.6.18-92.1.10.el5.x86_64
2.6.18-92.1.10.el5PAE.i686
2.6.18-92.1.13.el5.i686
2.6.18-92.1.13.el5.x86_64
2.6.18-92.1.13.el5PAE.i686
2.6.18-92.1.17.el5.i686
2.6.18-92.1.17.el5.x86_64
2.6.18-92.1.17.el5PAE.i686
2.6.18-92.1.18.el5.i686
2.6.18-92.1.18.el5.x86_64
2.6.18-92.1.18.el5PAE.i686
2.6.18-92.1.22.el5.i686
2.6.18-92.1.22.el5.x86_64
2.6.18-92.1.22.el5PAE.i686
2.6.18-92.1.6.el5.i686
2.6.18-92.1.6.el5.x86_64
2.6.18-92.1.6.el5PAE.i686
2.6.18-128.el5.i686
2.6.18-128.el5.x86_64
2.6.18-128.el5PAE.i686
2.6.18-128.1.1.el5.i686
|
2.6.18-128.1.1.el5.x86_64
2.6.18-128.1.1.el5PAE.i686
2.6.18-128.1.10.el5.i686
2.6.18-128.1.10.el5.x86_64
2.6.18-128.1.10.el5PAE.i686
2.6.18-128.1.14.el5.i686
2.6.18-128.1.14.el5.x86_64
2.6.18-128.1.14.el5PAE.i686
2.6.18-128.1.16.el5.i686
2.6.18-128.1.16.el5.x86_64
2.6.18-128.1.16.el5PAE.i686
2.6.18-128.1.6.el5.i686
2.6.18-128.1.6.el5.x86_64
2.6.18-128.1.6.el5PAE.i686
2.6.18-128.2.1.el5.i686
2.6.18-128.2.1.el5.x86_64
2.6.18-128.2.1.el5PAE.i686
2.6.18-128.4.1.el5.i686
2.6.18-128.4.1.el5.x86_64
2.6.18-128.4.1.el5PAE.i686
2.6.18-128.7.1.el5.i686
2.6.18-128.7.1.el5.x86_64
2.6.18-128.7.1.el5PAE.i686
2.6.18-164.el5.i686
2.6.18-164.el5.x86_64
2.6.18-164.el5PAE.i686
2.6.18-164.10.1.el5.i686
2.6.18-164.10.1.el5.x86_64
2.6.18-164.10.1.el5PAE.i686
2.6.18-164.11.1.el5.i686
2.6.18-164.11.1.el5.x86_64
2.6.18-164.11.1.el5PAE.i686
2.6.18-164.15.1.el5.i686
2.6.18-164.15.1.el5.x86_64
2.6.18-164.15.1.el5PAE.i686
2.6.18-164.2.1.el5.i686
2.6.18-164.2.1.el5.x86_64
2.6.18-164.2.1.el5PAE.i686
2.6.18-164.6.1.el5.i686
2.6.18-164.6.1.el5.x86_64
2.6.18-164.6.1.el5PAE.i686
2.6.18-164.9.1.el5.i686
2.6.18-164.9.1.el5.x86_64
2.6.18-164.9.1.el5PAE.i686
2.6.18-194.el5.i686
2.6.18-194.el5.x86_64
2.6.18-194.el5PAE.i686
2.6.18-194.11.1.el5.i686
2.6.18-194.11.1.el5.x86_64
2.6.18-194.11.1.el5PAE.i686
2.6.18-194.11.3.el5.i686
2.6.18-194.11.3.el5.x86_64
2.6.18-194.11.3.el5PAE.i686
2.6.18-194.11.4.el5.i686
2.6.18-194.11.4.el5.x86_64
2.6.18-194.11.4.el5PAE.i686
2.6.18-194.17.1.el5.i686
2.6.18-194.17.1.el5.x86_64
2.6.18-194.17.1.el5PAE.i686
2.6.18-194.17.4.el5.i686
2.6.18-194.17.4.el5.x86_64
2.6.18-194.17.4.el5PAE.i686
2.6.18-194.26.1.el5.i686
2.6.18-194.26.1.el5.x86_64
2.6.18-194.26.1.el5PAE.i686
2.6.18-194.3.1.el5.i686
2.6.18-194.3.1.el5.x86_64
2.6.18-194.3.1.el5PAE.i686
2.6.18-194.32.1.el5.i686
2.6.18-194.32.1.el5.x86_64
2.6.18-194.32.1.el5PAE.i686
2.6.18-194.8.1.el5.i686
2.6.18-194.8.1.el5.x86_64
2.6.18-194.8.1.el5PAE.i686
2.6.18-238.el5.i686
2.6.18-238.el5.x86_64
|
2.6.18-238.el5PAE.i686
2.6.18-238.1.1.el5.i686
2.6.18-238.1.1.el5.x86_64
2.6.18-238.1.1.el5PAE.i686
2.6.18-238.12.1.el5.i686
2.6.18-238.12.1.el5.x86_64
2.6.18-238.12.1.el5PAE.i686
2.6.18-238.19.1.el5.i686
2.6.18-238.19.1.el5.x86_64
2.6.18-238.19.1.el5PAE.i686
2.6.18-238.5.1.el5.i686
2.6.18-238.5.1.el5.x86_64
2.6.18-238.5.1.el5PAE.i686
2.6.18-238.9.1.el5.i686
2.6.18-238.9.1.el5.x86_64
2.6.18-238.9.1.el5PAE.i686
2.6.18-274.el5.i686
2.6.18-274.el5.x86_64
2.6.18-274.el5PAE.i686
2.6.18-274.12.1.el5.i686
2.6.18-274.12.1.el5.x86_64
2.6.18-274.12.1.el5PAE.i686
2.6.18-274.17.1.el5.i686
2.6.18-274.17.1.el5.x86_64
2.6.18-274.17.1.el5PAE.i686
2.6.18-274.18.1.el5.i686
2.6.18-274.18.1.el5.x86_64
2.6.18-274.18.1.el5PAE.i686
2.6.18-274.3.1.el5.i686
2.6.18-274.3.1.el5.x86_64
2.6.18-274.3.1.el5PAE.i686
2.6.18-274.7.1.el5.i686
2.6.18-274.7.1.el5.x86_64
2.6.18-274.7.1.el5PAE.i686
2.6.18-308.el5.i686
2.6.18-308.el5.x86_64
2.6.18-308.el5PAE.i686
2.6.18-308.1.1.el5.i686
2.6.18-308.1.1.el5.x86_64
2.6.18-308.1.1.el5PAE.i686
2.6.18-308.11.1.el5.i686
2.6.18-308.11.1.el5.x86_64
2.6.18-308.11.1.el5PAE.i686
2.6.18-308.13.1.el5.i686
2.6.18-308.13.1.el5.x86_64
2.6.18-308.13.1.el5PAE.i686
2.6.18-308.16.1.el5.i686
2.6.18-308.16.1.el5.x86_64
2.6.18-308.16.1.el5PAE.i686
2.6.18-308.20.1.el5.i686
2.6.18-308.20.1.el5.x86_64
2.6.18-308.20.1.el5PAE.i686
2.6.18-308.24.1.el5.i686
2.6.18-308.24.1.el5.x86_64
2.6.18-308.24.1.el5PAE.i686
2.6.18-308.4.1.el5.i686
2.6.18-308.4.1.el5.x86_64
2.6.18-308.4.1.el5PAE.i686
2.6.18-308.8.1.el5.i686
2.6.18-308.8.1.el5.x86_64
2.6.18-308.8.1.el5PAE.i686
2.6.18-308.8.2.el5.i686
2.6.18-308.8.2.el5.x86_64
2.6.18-308.8.2.el5PAE.i686
2.6.18-348.el5.i686
2.6.18-348.el5.x86_64
2.6.18-348.el5PAE.i686
2.6.18-348.1.1.el5.i686
2.6.18-348.1.1.el5.x86_64
2.6.18-348.1.1.el5PAE.i686
2.6.18-348.2.1.el5.i686
2.6.18-348.2.1.el5.x86_64
2.6.18-348.2.1.el5PAE.i686
2.6.18-348.3.1.el5.i686
2.6.18-348.3.1.el5.x86_64
2.6.18-348.3.1.el5PAE.i686
|
- RHEL/CentOS 6: Added the following:
2.6.32-71.el6.i686
2.6.32-71.el6.x86_64
2.6.32-71.14.1.el6.i686
2.6.32-71.14.1.el6.x86_64
2.6.32-71.18.1.el6.i686
2.6.32-71.18.1.el6.x86_64
2.6.32-71.18.2.el6.i686
2.6.32-71.18.2.el6.x86_64
2.6.32-71.24.1.el6.i686
|
2.6.32-71.24.1.el6.x86_64
2.6.32-71.29.1.el6.i686
2.6.32-71.29.1.el6.x86_64
2.6.32-71.7.1.el6.i686
2.6.32-71.7.1.el6.x86_64
2.6.32-131.0.15.el6.i686
2.6.32-131.0.15.el6.x86_64
2.6.32-220.el6.i686
2.6.32-220.el6.x86_64
|
2.6.32-279.el6.i686
2.6.32-279.el6.x86_64
2.6.32-358.0.1.el6.i686
2.6.32-358.0.1.el6.x86_64
2.6.32-358.el6.i686
2.6.32-358.el6.x86_64
2.6.32-358.2.1.el6.i686
2.6.32-358.2.1.el6.x86_64
|
- cert-forensics-tools-release-5.9-8.noarch.rpm - This package was added to correct a configuration problem where the package could not be installed on all RHEL/CentOS-5 systems.
|
|
April 3, 2013:
The following have been released:
- dd_rescue-1.33-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Here are the changes from the previous distributed version (1.31):
- This version brings long options, a new double overwrite mode (-2) and a man page.
- fmem-kernel-objects-1.6-1.18.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following Fedora kernels:
- 3.8.5-201 for FC18
- 3.8.4-102 for FC17
- python-apsw-3.7.16.1_r1-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Python-apsw is a Python wrapper for the SQLite embedded
relational database engine.
In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
- yara-1.7-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Here are the changes since the last version:
- faster compilation
- added suport for modulus (%) and bitwise xor (|) operators
- better hashing of regular expressions
- BUGFIX: yara-python segfault when using dir() on Rules and Match classes
- BUGFIX: Integer overflow causing infinite loop
- BUGFIX: Handling strings containing \x00 characters correctly
- BUGFIX: Regular expressions not matching at the end of the file when compiled with RE2
- BUGFIX: Memory leaks
- BUGFIX: File handle leaks
- yara-python-1.7-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Yara-python is a Python extension that
gives access to YARA's powerful features from Python scripts.
See the changes for yara above.
|
|
March 26, 2013:
The following have been released:
- guymager-0.7.1-1.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.6.13):
- Duplicate image creation
- New RunStats module
- New job queue mechanism - Note that because of this capability and the version of qt-devel on RHEL/CentOS 5, this version of guymager is not available on RHEL/CentOS 5
- New userfield
- New configuration table for main Guymager table
- New font configuration
- New cfg table HiddenDevices
- New configuration parameter CommandAcquisitionEnd
- Writing hidden area info into info file
- Gray out rescan button when scan is running
- In order to avoid the "contagious error", DirectIO is switched on in fallback mode.
- Removed race condition where write thread would write hash into image before it has been calculated by hash thread.
- SHA-1 support added
- fmem-kernel-objects-1.6-1.17.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following Fedora kernels:
- 3.8.4-202 for FC18
- 3.8.3-203 for FC18
- 3.8.2-206 for FC18
- 3.8.3-103 for FC17
|
|
March 12, 2013:
The following have been released:
- disktype-9-9.2.{fc15,fc16,fc17,fc18,el5,el6}.noarch.rpm - Disktype detects the content format of a disk or disk image.
This release corrects a package building error dealing with libewf.
- libfixbuf{,-devel}-1.3.0-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-2.5.0-3.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This version has been recompiled to use the latest version of libfixbuf for the supported operating system and architecture.
- yaf{,-devel}-2.3.3-3.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Note that this release of Yaf is not available for CentOS/RHEL 5 due to an outdated version of PCRE for that OS.
This version has been recompiled to use the latest version of libfixbuf for the supported operating system and architecture.
- yaf{,-devel}-2.2.1-4.{el5}.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter.
Note that this version of Yaf is only available for CentOS/RHEL 5.
It has been recompiled to use the latest version of libfixbuf .
|
|
March 5, 2013:
The following have been released:
- Fedora 18 - The repository now supports Fedora 18
for both the i686 and x86_64 CPU architectures.
All packages have been moved from the forensics-test repository to the standard cert repository.
If you find any unexpected behavior with the packages as currently distributed, please send email to
- partclone-0.2.48-2.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
This release was built to use the latest libntfs-3g shared library.
- dff-1.3.0-1.{fc17,fc18}.{i686,x86_64}.rpm - The Digital Forensics Framework (DFF) is both
a digital investigation tool and a development platform. The framework is used by system administrators, law enforcement examinors, digital forensics researchers
and students, and security professionals world-wide. Written in Python and C++, it exclusively uses Open Source technologies. DFF combines an intuitive user
interface with a modular and cross-platform architecture. Note that only Fedora 17 and 18 are supported in this release.
See here for a list of recent changes
- fmem-kernel-objects-1.6-1.16.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes added support for the following Fedora kernels:
- 3.7.9-205 for FC18
- 3.8.1-201 for FC18
- 3.7.9-101 for FC17
- 3.7.9-104 for FC17
- xplico-1.0.1-3.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
This release includes support for Python version 3.3 which is the default for Fedora 18.
- snort-2.9.4.1-1.1.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - (Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- libvshadow{,-devel,-tools,-python}-20130304-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version.
- added PackageMaker files
- updated include/types.h
- fixed typo in vhsadowmount
- regripper-plugins-20130218-1.{fc15,fc16,fc17,fc18,el5,el6}.noarch.rpm - Regripper-plugins are the plugins packaged separately from
the regripper application. The plugins added are the following:
- NEW PLUGIN by Corey Harrell: uac.pl that gets UAC configuration values (SOFTWARE)
- UPDATE by Harlan Carvey to comdlg32.pl, many updates (NTUSER)
- NOTE profile software-all was updated
- NOTE profiles all DO NOT contain plugins TLN versions: you must create your own profiles or use them directly
- NOTE RegRipperPluginsPackage (RRPP) counts 236 plugins
|
|
February 21, 2013:
The following have been released:
- dd_rescue-1.32-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Here are the changes from the previous distributed version (1.31):
- 1.32: This version has a new option (-x) to append to the output file and you can specify -Y (multiple times if you wish so)
to write the same data to secondary output files.
- ghostpdl-9.07-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Ghostpdl is Artifex Software's implementation of the
PCL-5™ and PCL-XL™ family of page description languages. Ghostpdl is used by Xplico. This version attempts to update Xplico's version
of pcl6 - the binary installed as part of ghostpdl - as stored in /opt/xplico/bin if Xplico is installed.
- fmem-kernel-objects-1.6-1.15.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes are the following:
- 3.7.6-201 for FC18
- 3.7.7-201 for FC18
- 3.7.8-202 for FC18
- 3.7.9-201 for FC18
|
|
February 8, 2013:
The following have been released:
- dd_rescue-1.31-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
Here are the changes from the previous distributed version (1.28):
- 1.31: This version brings a few tiny improvements in the output (such as displaying the total elapsed time in the summary as opposed to ETA of 0,
and the amount of data really written with option -W). But importantly, it has the new mode of triple overwriting of data (options -3 and -4),
with random numbers, inverse random numbers, new random numbers (only for -4) and zeros, this way allowing paranoia-safe deletion of information.
- 1.30: This version brought a fix for outputting data to stdout and a fix for a possible double free operation (introduced in 1.29).
The message formatting has been streamlined a bit. The PRNG can now be initialized from a file (e.g. -Z /dev/urandom).
The program now can also avoid writing to a target block if the target block already has the same data (option -W).
Think of SSDs or other devices where you want to avoid writes.
- 1.29: This contains a bug was fixed, where the last bytes where not copied corrected if hardbs == softbs. 1.29 also brings a number
of new features; the ability to write the same (softbs sized) block again and again (option -R, automatically set if infile is /dev/zero),
the ability to limit transfer size such that the outfile won't be enlarged (-M) and the possibility to use userspace random numbers (libc/frandom)
to fill files with random data (options -z and -Z). Last not least, OBS also builds .deb binaries for Ubu12.04 / Deb6 now.
- fuse-exfat-1.0.1-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fuse-exfat is an exFAT file
system implementation with write support. exFAT is a simple file system created by Microsoft.
It is intended to replace FAT32 removing some of it's limitations.
exFAT is a standard file system for SDXC memory cards.
Here are the changes from the previous version:
- Fixed unexpected removal of a directory if it is moved into itself.
- Fixed "Operation not permitted" error on reading an empty file.
- exfat-utils-1.0.1-1.1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
Here are the changes from the previous version:
- Fixed unexpected removal of a directory if it is moved into itself.
- Fixed "Operation not permitted" error on reading an empty file.
- libewf-{,devel,tools}-20130128-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Here are the changes from the previous version (20121209):
- worked on sync with experimental version
- docstring changes in pyewf
- fix for corruption scenario
- fixes in pyewf examples
- updated msvscpp files
- updated codegear files
- updated pyewf
- worked on sync with experimental version
- replace libmfcache by new libfcache
- updated configure files
- updated dpkg files
- updated rpm spec file
- updated pyewf - fixes multiple issues
- updated dependencies
- worked on sync with experimental version
- added pyewf/setup.py with thanks to Michael Cohen
- bug fix for 31th day of the month issue
- libvshadow{,-devel,-tools,-python}-20130131-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version.
- worked on pyvshadow
- worked on exposing block descriptors via vshadowinfo
- worked on exposing block descriptors via API
- removed LIBVSHADOW_STORE_FLAG_IO_HANDLE_MANAGED flags
- sleuthkit-{,devel,libs}-4.0.2-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
Here are the changes since 4.0.1:
- New Features
- Added fiwalk tool from Simson. Not supported in Visual Studio yet.
- Bug Fixes
- Fixed fcat to work on NTFS files (still doesn't support ADS though).
- Fixed HFS+ support in tsk_loaddb / SQLite -- root directory was not added.
- NTFS code now looks at all MFT entries when listing directory contents. It used to only look at unallocated entries for orphan files. This fixes an image that had allocated files missing from the directory b-tree.
- NTFS code uses sequence number when searching MFT entries for all files.
- Libewf detection code change to support v2 API more reliably (ID: 3596212).
- NTFS $SII code could crash in rare cases if $SDS was multiple of block size.
- Framework
- Added new API to TskImgDB that returns the base name of an image.
- Numerous performance improvements to framework.
- Removed requirement in framework to specify module extension in pipeline configuration file.
- Added blackboard artifacts to represent both operating system and network service user accounts.
- Java Bindings
- added more APIs to find files by name, path and where clause
- added API to get currently processed dir when image is being added,
- added API to return specific types of children of image, volume system, volume, file system.
- moved more common methods up to Content interface
- deprecated context of blackboard attributes,
- deprecated SleuthkitCase.runQuery() and SleuthkitCase.closeRunQuery()
- fixed ReadContentInputStream bugs (ignoring offset into a buffer, implementing available() )
- methods that are lazy loading are now thread safe
- Hash class is now thread-safe
- use more PreparedStatements to improve performance
- changed source level from java 1.6 to 1.7
- Throw exceptions from C++ side better
- fiwalk-0.6.16-3.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fiwalk
is a program that processes a disk image using the SleuthKit library and outputs its results in
Digital Forensics XML, the Attribute Relationship File Format (ARFF) format used by the
Weka Datamining Toolkit, or an easy-to-read textual format.
This release has been rebuilt to use version 4.0.2 of The Sleuth Kit, which because that release now contains both fiwalk and jpeg_extract, this release
no longer contains those to programs.
- yaf{,-devel}-2.3.3-2.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Note that this release of Yaf is not available for CentOS/RHEL 5 due to an outdated version of PCRE.
See here for the list of changes.
- fmem-kernel-objects-1.6-1.14.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes are the following:
|
|
February 5, 2013:
The following have been released:
- Support for Fedora 18 i686 and x86_64 architectures - The repository now supports Fedora 18 for both the i686 and
x86_64 CPU architectures. Please note that while the release packages are located in the standard cert repository, all other packages
are located in the forensics-test repository. To install and use these packages, you must enable the forensics-test repository by editing
the /etc/yum.repos.d/cert-forensics-tools.repo and changing the enabled=0 line to enabled=1. You must do this as root.
The schedule is to move all packages to the standard cert repository on Monday, March 4, 2013 unless testing disrupts this schedule.
If you find any unexpected behavior with the packages as currently distributed, please send email to
- fuse-exfat-1.0.0-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fuse-exfat is an exFAT file
system implementation with write support. exFAT is a simple file system created by Microsoft.
It is intended to replace FAT32 removing some of it's limitations.
exFAT is a standard file system for SDXC memory cards.
Here are the changes from the previous version:
- Fixed crash when renaming a file within a single directory and a new name differs only in case.
- Fixed clusters allocation: a cluster beyond valid clusters range could be allocated.
- Fixed crash when a volume is unmounted while some files are open.
- SConscript now respects AR and RANLIB environment variables.
- Improved error handling.
- Enabled big_writes. This improves write speed (larger block size means less switches between kernel- and user-space).
- Do BLKROGET ioctl to make sure the device is not read-only: after "blockdev --setro" kernel still allows to open the device in read-write mode but fails writes.
- exfat-utils-1.0.0-1.1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
Here are the changes from the previous version:
- Fixed crash when renaming a file within a single directory and a new name differs only in case.
- Fixed clusters allocation: a cluster beyond valid clusters range could be allocated.
- Fixed crash when a volume is unmounted while some files are open.
- SConscript now respects AR and RANLIB environment variables.
- Improved error handling.
- Enabled big_writes. This improves write speed (larger block size means less switches between kernel- and user-space).
- Do BLKROGET ioctl to make sure the device is not read-only: after "blockdev --setro" kernel still allows to open the device in read-write mode but fails writes.
- libvshadow{,-devel,-tools,-python}-20130113-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version.
- 2013 update
- updated dependencies
- updated msvscpp files
- added vshadowmount.1 man page
- python-apsw-3.7.15.2_r1-1.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Python-apsw is a Python wrapper for the SQLite embedded
relational database engine. In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
- libiconv{,-devel,-static,-utils}-1.14-3.{fc15,fc16,fc17,fc18,el6}.{i686,x86_64}.rpm - Libiconv
provides an iconv() implementation, for use on systems which don't have one, or whose implementation cannot convert from/to Unicode.
Due to conflicts with other packages, notably glibc, the libiconv packages are installed in /usr/libiconf.
Note that libiconv is not available for RHEL/CentOS 5.
This release makes the library files also available at /usr/libiconf/lib for the 86_64 architecture which makes the package easier to use when building
packages that use libiconv.
The only changes in this release are the removal of files in the libiconv package which conflicted with files in the libiconv-devel package.
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.58-1.1.{fc15,fc16,fc17,fc18, el6}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats. The packages include the following:
- libpst includes:
- readpst which can convert email messages to both mbox and MH mailbox formats
- pst2ldif which can convert the contacts to .ldif format for import into ldap databases, and
- pst2dii which can convert email messages to the DII load file format used by Summation.
- libpst-libs package contains the shared library used by the pst utilities.
- libpst-python package contains libpst shared objects from python code.
- libpst-devel package contains the library links and header files needed to develop applications using the libpst shared library.
- libpst-devel-doc package contains the doxygen generated documentation for the libpst.so shared library.
- libpst-doc package contains the html documentation for the pst utilities.
This version uses the libiconv library.
Note that libpst is not available for RHEL/CentOS 5.
Here are the changes since the last version:
- fix From quoting on embedded rfc/822 messages.
- fmem-kernel-objects-1.6-1.13.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes are the following:
- 3.7.4-204 for FC18
- 3.6.10-4 for FC18
- 3.7.3-101 for FC17
- 3.6.11-4 for FC16
- CERT-Forensics-Tools-1.0-52.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - This package was updated to do the following:
- add exfat-utils for all supported architectures
- remove gpart and ext3grep from Fedora 18 and beyond
|
|
January 3, 2013:
The following have been released:
- guymager-0.6.13-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.6.12):
- Package dependency to udisks added (for recent Ubuntu)
- libparted search extended to subdirs
- Added cfg parameter ForceCommandGetSerialNumber
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.57-1.1.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats. The packages include the following:
- libpst includes:
- readpst which can convert email messages to both mbox and MH mailbox formats
- pst2ldif which can convert the contacts to .ldif format for import into ldap databases, and
- pst2dii which can convert email messages to the DII load file format used by Summation.
- libpst-libs package contains the shared library used by the pst utilities.
- libpst-python package contains libpst shared objects from python code.
- libpst-devel package contains the library links and header files needed to develop applications using the libpst shared library.
- libpst-devel-doc package contains the doxygen generated documentation for the libpst.so shared library.
- libpst-doc package contains the html documentation for the pst utilities.
This version uses the libiconv library.
Note that libpst is not available for RHEL/CentOS 5.
- python-apsw-3.7.15.1_r1-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Python-apsw is a Python wrapper for the SQLite embedded
relational database engine. In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
- fmem-kernel-objects-1.6-1.12.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes are the following:
- Support for 3.6.10-2 for FC17
- Support for 3.6.10-2 for FC16
|
|
December 14, 2012:
The following have been released:
- daq-2.0.0-1.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - The Data Acquisition Library (Daq) is a library
used by snort.
- snort-2.9.4-1.1.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - (Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.4-1.1.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the
snort rules page to acquire a current set of snort rules.
- libewf-{,devel,tools}-20121209-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package. If the Version 1
API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- fmem-kernel-objects-1.6-1.11.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes are the following:
- Support for 3.6.9-2 for FC17
|
|
December 4, 2012:
The following have been released:
- jafat-1.1.6-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - JAFAT
is an assortment of tools to assist in the forensc investigation of computer systems.
- Volatility-2.2-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
See https://code.google.com/p/volatility/source/list for a list of changes.
This version also includes the plugins from the Malware Analyst's Cookbook to version R134.
See here for the list of recent changes.
- exfat-utils-0.9.8-1.1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
- epub-0.5.0-1.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - Epub is the distribution and interchange format
standard for digital publications and documents based on Web Standards. Epub defines a method for representing, packaging, and encoding structured and semantically enhanced
web content - including XHTML, CSS, SVG, images, and other resources - for distribution in a single-file format.
Epub allows publishers to produce and send a single digital publication file through distribution and offers interoperability between consumers
software / hardware for unencrypted reflowable digital books and other publications.
Epub is a helper application for recoll.
- libiconv{,-devel,-static,-utils}-1.14-2.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - Libiconv
provides an iconv() implementation, for use on systems which don't have one, or whose implementation cannot convert from/to Unicode.
Due to conflicts with other packages, notably glibc, the libiconv packages are installed in /usr/libiconf.
Note that libiconv is not available for RHEL/CentOS 5.
This release makes the library files also available at /usr/libiconf/lib for the x86_64 architecture which makes the package easier to use when building
packages that use libiconv.
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.55-2.2.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats. The packages include the following:
- libpst includes:
- readpst which can convert email messages to both mbox and MH mailbox formats
- pst2ldif which can convert the contacts to .ldif format for import into ldap databases, and
- pst2dii which can convert email messages to the DII load file format used by Summation.
- libpst-libs package contains the shared library used by the pst utilities.
- libpst-python package contains libpst shared objects from python code.
- libpst-devel package contains the library links and header files needed to develop applications using the libpst shared library.
- libpst-devel-doc package contains the doxygen generated documentation for the libpst.so shared library.
- libpst-doc package contains the html documentation for the pst utilities.
Note that libpst is not available for RHEL/CentOS 5.
This version has been rebuilt to use the libiconv library.
- pstotext-1.9-2.1.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - PStotext is a utility that
reads in postscript files and outputs an ASCII rendering. While the rendering is not always accurate, it is often sufficient.
PStotext is a helper application for recoll
- recoll-1.18.1-1.1.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - Recoll
is a text search tool for Unix and Linux desktops. Recoll finds keywords inside documents as well as file names.
See here for a list of changes in this version. In addition, tar archives have been
enabled and the epub, pstotext, and aspell packages have been added as required packages.
- fmem-kernel-objects-1.6-1.10.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
The changes are the following:
- Support for 3.6.8-2 for FC17
- Support for 3.6.7-4 for FC16
|
|
November 27, 2012:
The following have been released:
- fmem-kernel-objects-1.6-1.8.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations. This device (physical RAM) can be copied using dd or other tool. Works on 2.6 Linux
kernels and beyond. Contained in this package are pre-compiled versions of fmem.ko for all kernels release with Fedora 14, 15, 16, and 17.
These are installed in /usr/share/fmem-kernel-objects-1.6 by the triple KernelVersion.FedoraRelease.Architecture. In addition, the source code
is available in /usr/share/doc/fmem-kernel-object-1.6. Finally, there is a script entitled install-fmem which is installed in the /usr/bin
directory that can be used to install the correct fmem.ko kernel object on the current system. This package is intended to provide pre-compiled versions
of the fmem module so that they can be installed as needed when doing on-site memory captures during the data collection phase of an investigation that includes digital assets.
The changes are the following:
- Support for 3.6.7-4 for FC17
- sleuthkit-{,devel,libs}-4.0.1-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
Here are the changes since 3.2.3:
- New Features:
- Can open raw Windows devices with write mode sharing.
- More DOS partition types are displayed.
- Added fcat tool that takes in file name and exports content (equivalent to using ifind and icat together).
- Added new API to TskImgDB that returns hash value associated with carved files.
- Performance improvements with FAT code (maps and dir_add)
- Performance improvements with NTFS code (maps)
- Added AONLY flag to block_walk
- Updated blkls and blkcalc to use AONLY flag -- MUCH faster.
- Bug Fixes:
- Fixed mactime issue where it could choose the wrong timezone that did not follow daylight savings times.
- Fixed file size of alternate data streams in framework.
- Incorporated memory leak fixes and raw device fixes from ADF Solutions.
- fiwalk-0.6.16-2.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Fiwalk
is a program that processes a disk image using the SleuthKit library and outputs its results in
Digital Forensics XML, the Attribute Relationship File Format (ARFF) format used by the
Weka Datamining Toolkit, or an easy-to-read textual format.
This release has been rebuilt to use version 4.0.1 of The Sleuth Kit.
- pytsk-2012113-2.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Pytsk is Python bindings for
The Sleuth Kit.
This release has been rebuilt to use version 4.0.1 of The Sleuth Kit.
- testdisk-6.13-2.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
This release was rebuilt to use the ntfs-3g development and library packages required for CentOS/RHEL 5, but
all other versions were rebuilt for synchronization purposes.
- bulk_extractor-1.3.1-2.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Bulk_extractor
bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without
parsing the file system or file system structures. The results are stored in feature files that can be easily inspected, parsed, or
processed with automated tools. bulk_extractor also creates histograms of features that it finds, as features that are more
common tend to be more important. This version fixes many issues. In addition, it also contains the BEViewer GUI front-end for bulk_extractor.
- CERT-Forensics-Tools-1.0-50.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - This package was updated to do the following:
- added bulk_extrator, bulk_extrator-stoplist, and fiwalk for RHEL/CentOS 5 for all supported architectures
- obsoletes BEViewer since that tool is now included in bulk_extrator
|
|
November 19, 2012:
The following have been released:
- fuse-exfat-0.9.8-1.1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fuse-exfat is an exFAT file
system implementation with write support. exFAT is a simple file system created by Microsoft.
It is intended to replace FAT32 removing some of it's limitations.
exFAT is a standard file system for SDXC memory cards.
- libiconv{,-devel,-static,-utils}-1.14-1.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - Libiconv
provides an iconv() implementation, for use on systems which don't have one, or whose implementation cannot convert from/to Unicode.
Due to conflicts with other packages, notably glibc, the libiconv packages are installed in /usr/libiconf.
Note that libiconv is not available for RHEL/CentOS 5.
- libpst{,-devel,-devel-doc,-doc,-libs,-python}-0.6.55-2.1.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - The libpst
package includes:
- readpst which can convert email messages to both mbox and MH mailbox formats
- pst2ldif which can convert the contacts to .ldif format for import into ldap databases, and
- pst2dii which can convert email messages to the DII load file format used by Summation.
The libpst-libs package contains the shared library used by the pst utilities.
The libpst-python package allows use of the libpst shared object from python code.
The libpst-devel package contains the library links and header files needed to develop applications using the libpst shared library.
The libpst-devel-doc package contains the doxygen generated documentation for the libpst.so shared library.
The libpst-doc package contains the html documentation for the pst utilities.
Note that libpst is not available for RHEL/CentOS 5.
- partclone-0.2.48-1.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage. Partclone provides utilities to save and restore used blocks on a
partition and is designed for higher compatibility of the file system by using existing libraries, e.g. e2fslibs is used to read and write
the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
- CERT-Forensics-Tools-1.0-48.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - This package was updated to do the following:
- now is architecture-specific to accomodate kernel-PAE-modules-extra for the i686 architecture
- added fuse-exfat
- added partclone
|
|
November 14, 2012:
The following have been released:
- fmem-kernel-objects-1.6-1.7.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations. This device (physical RAM) can be copied using dd or other tool. Works on 2.6 Linux
kernels and beyond. Contained in this package are pre-compiled versions of fmem.ko for all kernels release with Fedora 14, 15, 16, and 17.
These are installed in /usr/share/fmem-kernel-objects-1.6 by the triple KernelVersion.FedoraRelease.Architecture. In addition, the source code
is available in /usr/share/doc/fmem-kernel-object-1.6. Finally, there is a script entitled install-fmem which is installed in the /usr/bin
directory that can be used to install the correct fmem.ko kernel object on the current system. This package is intended to provide pre-compiled versions
of the fmem module so that they can be installed as needed when doing on-site memory captures during the data collection phase of an investigation that includes digital assets.
The changes are the following:
- Support for 3.6.6-1 for FC17
- Support for 3.6.6-1 for FC16
- libvshadow{,-devel,-tools,-python}-20121107-2.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version.
- updates msvscpp 2010 build
- pyvshadow: fixes for 32-bit build
- pytsk-2012113-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Pytsk is Python bindings for
The Sleuth Kit.
- disktype-9-9beta.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Disktype detects the content format of a disk or disk image.
It knows about common file systems, partition tables, and boot codes.
This version adds support for ext4, btrfs, and exFAT file systems.
- CERT-Forensics-Tools-1.0-47.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - This package was updated to do the following:
- add kernel-modules-extra for both architectures. These kernel modules include support for ufs file systems.
- add kernel-PAE-modules-extra for the x86 architecture. These kernel modules include support for ufs file systems.
- added disktype
|
|
November 7, 2012:
The following have been released:
- fmem-kernel-objects-1.6-1.6.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations. This device (physical RAM) can be copied using dd or other tool. Works on 2.6 Linux
kernels and beyond. Contained in this package are pre-compiled versions of fmem.ko for all kernels release with Fedora 14, 15, 16, and 17.
These are installed in /usr/share/fmem-kernel-objects-1.6 by the triple KernelVersion.FedoraRelease.Architecture. In addition, the source code
is available in /usr/share/doc/fmem-kernel-object-1.6. Finally, there is a script entitled install-fmem which is installed in the /usr/bin
directory that can be used to install the correct fmem.ko kernel object on the current system. This package is intended to provide pre-compiled versions
of the fmem module so that they can be installed as needed when doing on-site memory captures during the data collection phase of an investigation that includes digital assets.
The changes are the following:
- Support for 3.6.5-1 for FC17
- Support for 3.6.5-2 for FC16
- libvshadow{,-devel,-tools,-python}-20121103-2.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version.
- fix in spec file
- updated dependencies
- pyvshadow: fix for Mac OS X build
- updated msvscpp files
- code clean up
- pytsk-20121106-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Pytsk is Python bindings for
The Sleuth Kit.
|
|
October 29, 2012:
The following have been released:
- fmem-kernel-objects-1.6-1.5.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations. This device (physical RAM) can be copied using dd or other tool. Works on 2.6 Linux
kernels and beyond. Contained in this package are pre-compiled versions of fmem.ko for all kernels release with Fedora 14, 15, 16, and 17.
These are installed in /usr/share/fmem-kernel-objects-1.6 by the triple KernelVersion.FedoraRelease.Architecture. In addition, the source code
is available in /usr/share/doc/fmem-kernel-object-1.6. Finally, there is a script entitled install-fmem which is installed in the /usr/bin
directory that can be used to install the correct fmem.ko kernel object on the current system. This package is intended to provide pre-compiled versions
of the fmem module so that they can be installed as needed when doing on-site memory captures during the data collection phase of an investigation that includes digital assets.
The changes are the following:
- Support for 3.6.3-1 for FC17
- Support for 3.6.2-1 for FC16
- md5deep-4.3-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - This package was updated to reflect the new version of md5deep.
Here are the list of new features:
- Fixed check for endian-ness, affecting hash generation on big-endian platforms.
- Fixed minor bugs related to OpenSolaris.
- libvshadow{,-devel,-tools,-python}-20121016-2.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version.
|
|
October 19, 2012:
The following have been released:
- fmem-kernel-objects-1.6-1.3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations. This device (physical RAM) can be copied using dd or other tool. Works on 2.6 Linux
kernels and beyond. Contained in this package are pre-compiled versions of fmem.ko for all kernels release with Fedora 14, 15, 16, and 17.
These are installed in /usr/share/fmem-kernel-objects-1.6 by the triple KernelVersion.FedoraRelease.Architecture. In addition, the source code
is available in /usr/share/doc/fmem-kernel-object-1.6. Finally, there is a script entitled install-fmem which is installed in the /usr/bin
directory that can be used to install the correct fmem.ko kernel object on the current system. This package is intended to provide pre-compiled versions
of the fmem module so that they can be installed as needed when doing on-site memory captures during the data collection phase of an investigation that includes digital assets.
The changes are the following:
- Support for kernel 3.6.1-1 for FC17
- Support for kernel 3.6.2-4 for FC17
- nDPI-1.4.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - nDPI nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
- xplico-1.0.1-1.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - xplico is an Internet traffic decoder.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
It also assumes a web server, for example Apache, has been configured and is operational.
Here are the changes since 1.0.0:
- nDPI integration
- performace improved
- FTP dissector improved
- Added the prism dissector
- CLI execution bug fixed
- PCAP-over-IP SSL encryption
- IRC dissector improvements
- File reconstruction from Fragmented Payloads improved
- FaceBook Chat updated
- FaceBook Message (partial)
- HTTP without initial packets (packets lost)
- RTP dissector imporved
- PCAP2WAV, RTP2WAV interface added
- libvshadow{,-devel,-tools,-python}-20121016-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a
storage media volume. Here are the changes since the last version.
- pyvshadow: bug fixes
- Missing Py_None increment reference
- added increment/decrement reference of volume object in store
- pyvshadow: added creation time as integer function
- made get store more restrictive
- added store get size function for python binding
- updated dpkg and spec files
- added store get offset function
- worked on Python bindings
- fix for dpkg files docs
- worked on Python bindings
- sleuthkit-{,devel,libs}-4.0.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
Here are the changes since 3.2.3:
- New Features:
- Added multithreaded support
- Added C++ wrapper classes
- Added JNI bindings / Java data model classes
- 3314047: Added utf8-specific versions of 'toid' methods for img,vs,fs types
- 3184429: More consistent printing of unset times (all zerso instead of 1970)
- New database design that allows for multiple images in the same database
- GPT volume system tries other sector sizes if first attempt fails.
- Added hash calculation and lookup to AutoDB and JNI.
- Upgraded SQLite to 3.7.9.
- Added Framework in (windows-only)
- EnCase hash support
- Libewf v2 support (it is now non-beta)
- First file in a raw split or E01 can be specified and the rest of the files are found.
- mactime displays times as 0 if the time is not set (isntead of 1970)
- Changed behavior of 'mactime -y' to use ISO8601 format.
- Updated HFS+ code from ATC-NY.
- FAT orphan file improvements to reduce false positives.
- TskAuto better reports errors.
- Upgrade build projects from Visual Studio 2008 to 2010.
- Bug Fixes:
- Relaxed checking when conflict exists between DOS and GPT partitions. Had a Mac image that was failing to resolve which partition table to use.
- ptk-1.0.5-4.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - PTK is a computer forensic framework for the command line
tools in the SleuthKit plus many more modules. PTK uses MySQL which is assumed to be configured, using the
command line tool mysql_secure_installation or equivalent, and operating.
It also assumes a web server, for example Apache, has been configured and is operational.
Here are the list of changes:
- Now recognizes that both The Sleuth Kit Version 3 and Version 4 are valid versions.
|
|
October 11, 2012:
The following have been released:
- regripper-25000000-2.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool.
This package is now contains only the version 2.5 of the regripper tool. The plugins are packaged separately.
This package corrects a problem where the individual plugins could not be found. This error is corrected by using perl's @INC array to find the plugin directory.
- regripper-plugins-20120926-1.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Regripper-plugins are the plugins packaged separately from
the regripper application. The plugins added are the following:
- NEW PLUGIN by Harlan Carvey: appcertdlls.pl that gets entries from AppCertDlls key (SYSTEM)
- NEW PLUGIN by Harlan Carvey: appcompatcache.pl that parses files from the Shim Cache (SYSTEM)
- NEW PLUGIN by Harlan Carvey: appcompatcache_tln.pl that parses files from the Shim Cache, TLN output (SYSTEM)
- NEW PLUGIN by Harlan Carvey: applets_tln.pl that gets the content of Applets key, TLN output (NTUSER)
- NEW PLUGIN by Harlan Carvey: appspecific.pl that gets contents of user's Intellipoint\AppSpecific subkeys (NTUSER)
- NEW PLUGIN by Harlan Carvey: ares.pl that gets contents of user's Software\Ares key (NTUSER)
- NEW PLUGIN by Corey Harrell: backuprestore.pl that gets FilesNotToSnapshot, KeysNotToRestore, FilesNotToBackup (SYSTEM)
- NEW PLUGIN by Harlan Carvey: compatassist.pl that checks user's Compatibility Assistant\Persisted values (NTUSER)
- NEW PLUGIN by Harlan Carvey: direct.pl that searches Direct keys for MostRecentApplication subkeys (SOFTWARE)
- NEW PLUGIN by Harlan Carvey: direct_tln.pl that searches Direct keys for MostRecentApplication subkeys, TLN output (SOFTWARE)
- NEW PLUGIN by Corey Harrell: disablesr.pl that gets the on/off value for System Restore (SOFTWARE)
- NEW PLUGIN by Harlan Carvey: installer.pl that determines products install information (SOFTWARE)
- NEW PLUGIN by Harlan Carvey: javafx.pl that gets contents of user's JavaFX key (NTUSER)
- NEW PLUGIN by Harlan Carvey: legacy_tln.pl that lists LEGACY entries in Enum\Root key, TLN output (SYSTEM)
- NEW PLUGIN by Harlan Carvey: networklist_tln.pl that collects network info from NetworkList key, TLN output (SOFTWARE)
- NEW PLUGIN by Harlan Carvey: osversion.pl that checks for OSVersion value, malware related (NTUSER)
- NEW PLUGIN by Corey Harrell: prefetch.pl that gets the Prefetch Parameters (SYSTEM)
- NEW PLUGIN by Harlan Carvey: runmru_tln.pl that gets contents of user's RunMRU key, TLN output (NTUSER)
- NEW PLUGIN by Harlan Carvey: shellbags.pl that gets contents of users's Shell/BagMRU keys, Windows7 (USRCLASS)
- NEW PLUGIN by Harlan Carvey: sysinternals.pl that checks for SysInternals apps keys (NTUSER)
- NEW PLUGIN by Harlan Carvey: sysinternals_tln.pl that checks for SysInternals apps keys, TLN output (NTUSER)
- NEW PLUGIN by Harlan Carvey: tracing.pl that gets list of apps that can be traced (SOFTWARE)
- NEW PLUGIN by Harlan Carvey: tracing_tln.pl that gets list of apps that can be traced, TLN output (SOFTWARE)
- NEW PLUGIN by Harlan Carvey: trustrecords.pl that gets user's Office 2010 TrustRecords values (NTUSER)
- NEW PLUGIN by Harlan Carvey: trustrecords_tln.pl that gets user's Office 2010 TrustRecords values, TLN output (NTUSER)
- NEW PLUGIN by Harlan Carvey: tsclient_tln.pl that gets contents of user's Terminal Server Client key, TLN output (NTUSER)
- NEW PLUGIN by Harlan Carvey: typedpaths_tln.pl that gets contents of user's typedpaths key, TLN output (NTUSER)
- NEW PLUGIN by Harlan Carvey: userassist_tln.pl that displays contents of UserAssist subkeys, TLN output (NTUSER)
- NEW PLUGIN by Mari DeGrazia: winbackup.pl that gets Windows Backup settings (SOFTWARE)
- NEW PLUGIN by Harlan Carvey: wpdbusenum.pl that gets WpdBusEnumRoot subkey info (SYSTEM)
- UPDATE by Harlan Carvey to legacy.pl, added analysis tip (SYSTEM)
- UPDATE by Harlan Carvey to muicache.pl, the plugin works both on NTUSER and/or USRCLASS hives (NTUSER,USRCLASS)
- UPDATE by Harlan Carvey to networklist.pl, added NameType value reporting (SOFTWARE)
- UPDATE by Harlan Carvey to soft_run.pl, added support to newer OS and 64 bits (SOFTWARE)
- UPDATE by Harlan Carvey to tsclient.pl, added parsing of Servers key (NTUSER)
- UPDATE by Harlan Carvey to userassist.pl (NTUSER)
- REMOVED TEMPORARILY plugin typedurlstime.pl, postponed on next packages
- REMOVED TEMPORARILY plugin typedurlstime_tln.pl, postponed on next packages
- REMOVED plugin bagtest.pl, deprecated
- REMOVED plugin bagtest2.pl, deprecated
- REMOVED plugin crashcontrol.pl, too similar to crashdump.pl
- REMOVED plugin filesnottosnapshot.pl, superseded by backuprestore.pl
- REMOVED plugin pstools.pl, superseded by the more general sysinternals.pl plugin
- REMOVED plugin userassist2.pl, deprecated since userassist.pl was updated
- REMOVED plugin vista_comdlg32.pl, deprecated since comdlg32.pl was updated
- REMOVED plugin win7_ua.pl, Windows7-RC and Vigenerè encryption are obsolete
- NOTE added profile usrclass-all for USRCLASS.DAT hive
- NOTE profiles all-all, ntuser-all, sam-all, security-all, software-all, system-all, usrclass-all were updated
- NOTE profiles '-all' DO NOT contain plugins TLN versions: you must create your own profiles or use them directly
- NOTE source code repository was switched to GIT and it was aligned to the current release
- NOTE RegRipperPluginsPackage (RRPP) now counts 236 plugins
- libvshadow{,-devel,-tools}-20120922-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
- fmem-kernel-objects-1.6-1.1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Fmem is kernel module that creates device /dev/fmem,
similar to /dev/mem but without limitations. This device (physical RAM) can be copied using dd or other tool. Works on 2.6 Linux kernels and beyond. Contained in this package
are pre-compiled versions of fmem.ko for all kernels release with Fedora 14, 15, 16, and 17. These are installed in /usr/share/fmem-kernel-objects-1.6 by the
triple KernelVersion.FedoraRelease.Architecture. In addition, the source code is available in /usr/share/doc/fmem-kernel-object-1.6. Finally, there is a
script entitled install-fmem which is installed in the /usr/bin directory that can be used to install the correct fmem.ko kernel object on the current system.
This package is intended to provide pre-compiled versions of the fmem module so that they can be installed as needed when doing on-site memory captures during the data collection
phase of an investigation that includes digital assets.
- CERT-Forensics-Tools-1.0-46.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - This package was updated to do the following:
- add fmem-kernel-objects for all supported releases.
- log2timeline-0.65-1.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Log2timeline is a framework for the automatic creation of a super timeline.
Here are the changes in this version:
- [UTMP input] New input module parsing utmp/wtmp files in Linux, written by Francesco Picasso.
- [SELINUX input] New input module parsing SELinux audit files in Linux, written by Francesco Picasso.
- [l2t_process] Renamed to l2t_process_old, being replaced by l2t_process.py from l2t-tools.
- [EVTX Library] Fixed a small bug in the code, causing some EVTX file parsing to fail.
- [Altiris input] Fixed a small bug when the date is malformed.
- [Log2Timeline library] Fixed few bugs:
- Small error in the format sort, caused oxml to sometimes be skipped in processing.
- [GENERIC_LINUX input] Added a small extra eval sentence.
- [LS_QUARANTINE] Fixed a minor bug in the get_time routine, if a database occurs it is caught by an eval sentence.
- [TEST] Added few more tests.
- [MOST INPUT MODULES] Changed the line my $line = <$fh> or return undef; in most input modules.
- [WIN library] Added few more transformations of Windows stored time zones into a "olson" ones understood by DateTime.
- [CHROME input] Fixed a small unicode bug in the "File Downloaded" section.
- [faersluskra2timalina] Added a new frontend to the tool, exact copy of log2timeline, except all parameters in Icelandic... kinda
- [timescanner tool] Removed this frontend from the Makefile since it serves no purpose (as in no longer part of the automatic installation).
- python-apsw-3.7.14.1_r1-1.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - Python-apsw is a Python wrapper for the SQLite embedded
relational database engine. In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
|
|
September 17, 2012:
The following have been released:
- recoll-1.17.3-1.1.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - Recoll
is a text search tool for Unix and Linux desktops. Recoll finds keywords inside documents as well as file names.
- It can search any document format.
- It can reach any storage place: files, archive members, email attachments, transparently handling decompression.
- One click will open the document inside a native editor or display an even quicker text preview.
- The software is free, open source, and licensed under the GPL.
- See here for a list of detailed features.
This version installs all of the needed helper applications and enables them all by default.
- untex-1.3-3.1.{fc14,fc15,fc16,fc17,el6}.{i686,x86_64}.rpm - Untex
removes some LaTeX commands from the files listed in the arguments (or standard input) and prints the output to standard output.
- CERT-Forensics-Tools-1.0-45.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - This package was updated to do the following:
- add recoll for all supported releases except RHEL/CentOS 5.
- libfixbuf{,-devel}-1.2.0-1.{fc14,fc15,fc16,fc17el5,el6}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- yaf{,-devel}-2.3.2-2.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Note that this release of Yaf is not available for CentOS/RHEL 5 due to an outdated version of PCRE.
See here for the list of changes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-2.5.0-2.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This version has been recompiled to use the latest version of libfixbuf for the supported operating system and architecture.
- libvshadow{,-devel,-tools}-20120915-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libvshadow
is a ibrary and tools used to support the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
|
|
September 4, 2012:
The following have been released:
- prism-1.1.1-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The prism
trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool.
The script can be used directly, or might be used as a component in other more specialized scripts.
In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup.
- CERT-Forensics-Tools-1.0-44.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - This package was updated to do the following:
- add prism all systems where the SiLK tools are installed.
|
|
August 23, 2012:
The following have been released:
- analysis-pipeline-3.0.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events, and to feed interesting data to a security information and event manager (SIEM).
The Analysis Pipeline supports many types of analysis, including:
- Watch list alerting (did we see traffic from a known bad IP?)
- Beacon detection
- Passive FTP detection
- IPv6 tunnel detection
- Thresholding (e.g., is total bytes over a limit?)
- Collection issues (is a sensor no longer reporting?)
Although the Analysis Pipeline can be run interactively, it is designed to be incorporated into the SiLK collection and packing infrastructure, where it can
analyze every SiLK Flow record produced by rwflowpack as the records are being added to the SiLK data repository.
When a record matches an analysis, the Analysis Pipeline may output the record in a pipe-delimited textual format. Whether a record is output depends
on how often the administrator has configured the Analysis Pipeline to issue that type of output. The administrator can easily configure a SIEM to process
the output generated by the Analysis Pipeline.
- CERT-Forensics-Tools-1.0-43.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - This package was updated to do the following:
- add BEViewer all systems where bulk_extractor is installed.
- add analysis-pipeline all systems where the SiLK tools are installed.
|
|
August 21, 2012:
The following have been released:
- libewf-{,devel,tools}-20120813-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package.
If the Version 1 API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- registrydecoder-20120816-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_84}.rpm - Registrydecoder
is tool for the acquisition, analysis, and reporting of registry contents.
See here for a list of changes.
- regripper-plugins-20120812-1.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Regripper-plugins are the plugins packaged separately from
the regripper application.
This version includes version 20120612 of the plugins from here.
The plugins added are the following:
- NEW PLUGIN by Hal Pomeranz: ssh_host_keys.pl that extracts stored Putty and WinSCP host keys from NTUSER hive
- NEW PLUGIN by Hal Pomeranz: ssh_host_keys.pl that extracts stored Putty and WinSCP host keys from NTUSER hive
- NEW PLUGIN by Hal Pomeranz: winscp_sessions.pl that extracts WinSCP saved session data from NTUSER hive (with password decoding)
- NOTE profiles all-all, ntuser-all, sam-all, security-all, software-all and system-all were updated
- NOTE source code repository was aligned to current release
- NEW PLUGIN by John Lukach: pstools.pl that displays the content for PsTools EULA Agreements
- NEW PLUGIN by K. Johnson (with Harlan Carvey updates): filehistory.pl that parses NTUSER FileHistory Registry keys from Windows 8
- NEW PLUGIN by Elizabeth Schweinsberg: user_runplus.pl that gets contents of the Run, RunOnce, and RunServices keys from NTUSER hive
- NEW PLUGIN by Elizabeth Schweinsberg: soft_runplus.pl that gets contents of the Run, RunOnce, and RunServices keys from SOFTWARE hive
- NEW PLUGIN by Elizabeth Schweinsberg: svc_plus.pl that gets services, displaied in short format, from SYSTEM hive
- tcpflow-1.3.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction.
Tcpflow can also process stored tcpdump packet flows.
Here are the changes in this version:
- src/tcpdemux.cpp (tcpdemux::process_tcp): fixed bug in which myflow.tlast wasn't being set.
- src/main.cpp (main): fixed compile bugs that resulted from adoption of standard DFXML header.
- configure.ac (HAVE_PTHREAD): fixed typo in configure.ac
- src/tcpdemux.h: removed struct ip as it was redundent to struct iphdr
- configure.ac: tcpflow now compiles under mingw for Windows
- src/tcpdemux.cpp: moved tcpdemux class methods into this new file.
- src/tcpip.cpp (tcpip::close_file): added support for FUTIMENS, but I don't yet have a system on which to test it. Hope that it's good.
|
|
August 10, 2012:
The following have been released:
- ghostpdl-9.06-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Ghostpdl is Artifex Software's implementation of the
PCL-5™ and PCL-XL™ family of page description languages. Ghostpdl is used by Xplico. This version attempts to update Xplico's version
of pcl6 - the binary installed as part of ghostpdl - as stored in /opt/xplico/bin if Xplico is installed.
|
|
August 8, 2012:
The following have been released:
- perl-XML-SAX-Base-1.04-1.1.el6.noarch.rpm - perl-XML-SAX-Base is a base class for PerlSAX drivers and filters.
As distributed on RPM Forge, two files (/usr/share/man/man3/XML::SAX::Base.3pm.gz and /usr/share/man/man3/XML::SAX::Exception.3pm.gz) conflict with the files installed
with perl-XML-SAX-0.96-7.el6.noarch from RedHat's EPEL repository. This package was rebuilt to remove these conflicts, and the release number changes from 1 to 1.1 so as to prefer
this package over the RPM Forge package. Thanks to Joern Franz for the report.
|
|
August 7, 2012:
The following have been released:
- guymager-0.6.12-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.6.11):
- Avoiding -O3 / inline compiler bug
- Correct srceen output if no log file is in use
- DD verification: retry with NOATIME switched off if open fails
- DD verification: Do not exit if open fails
- distorm3-3-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Distorm3 is a lightweight,
easy-to-use and fast decomposer library. It disassembles instructions in 16, 32 and 64 bit modes. Supported instruction sets: FPU, MMX, SSE, SSE2,
SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX. Distorm3 is used by
The Volatility Framework.
- ghostpdl-9.05-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Ghostpdl is Artifex Software's implementation of the
PCL-5™ and PCL-XL™ family of page description languages. Ghostpdl is used by Xplico.
- libpff-20120802-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Libpff is a library
and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal
Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
Libpff is used by DFF - the Digital Forensics Framework.
- tcpflow-1.2.8-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction.
Tcpflow can also process stored tcpdump packet flows.
Here are the changes in this version:
- src/main.cpp (main): added calling process_infile(expression,device,"",true) when no files are provided to fix bug of no live capture.
- src/sysdep.h: removed; put code in tcpflow.h for simplicity
- src/datalink.cpp (dl_null): moved ETHERTYPE_IPV6 from sysdep.h to datalink.cpp
- bootstrap.sh: added --add-missing to bootstrap.sh
|
|
July 30, 2012:
The following have been released:
- ssdeep-2.9-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes. See here for the list of changes.
|
|
July 18, 2012:
The following have been released:
- xplico-1.0.0-2.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - xplico is an Internet traffic decoder.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
It also assumes a web server, for example Apache, has been configured and is operational.
Here is the list of changes:
- The postinstall script conditions the /etc/php.ini configuration file for PHP so that xplico works without manual
intervention. The changes are:
- Asserts short_open_tag if it is current set to Off.
- Sets post_max_size to 100M which is the recomended value.
- Sets upload_max_filesize to 100M which is the recomended value.
- Sets date.timezone to US/Eastern. If this is not appropriate for your time zone, you will need to edit /etc/php.ini by hand.
- The preuninstall script undoes the aforementioned change to /etc/php.ini configuration file, but only if the changes were made by the postinstall executed when
xplico was installed or updated.
- The postinstall and preinstall scripts now use systemctl for Fedora 16 and beyond,
- ptk-1.0.5-3.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - PTK is a computer forensic framework for the command line
tools in the SleuthKit plus many more modules. PTK uses MySQL which is assumed to be configured, using the
command line tool mysql_secure_installation or equivalent, and operating.
It also assumes a web server, for example Apache, has been configured and is operational.
Here are the list of changes:
- The postinstall script conditions the /etc/php.ini configuration file for PHP so that ptk works without manual
intervention. The changes are:
- Asserts short_open_tag if it is current set to Off.
- The preuninstall script undoes the aforementioned change to /etc/php.ini configuration file, but only if the changes were made by the postinstall executed when
ptk was installed or updated.
- libguytools-2.0.2-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libguytools is a package of subroutines and header files needed to
build and operate guymager. The changes are:
- Correctly handling decimal point for different locale settings in toolcfg
- Some small signed/unsigned changes for cleaner linting
- Copyright notices cleaned up
- guymager-0.6.11-2.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.6.11 release 1):
- Rebuilt to use libguytools-2.0.2.
|
|
July 12, 2012:
The following have been released:
- guymager-0.6.11-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.6.9):
- Removed bug where section tables might contain only one entry
- New cfg parameter EwfNaming supports 2 methods for naming EWF segment files
- Added warnings for low space on destination path and large number of image files before starting acquisition,
new configuration parameters WarnAboutImageSize and WarnAboutSegmentFileCount
- When opening destination image fails, retry with NOATIME switched off (thus enabling cloning without root rights)
- Removed bug where section tables might contain only one entry.
- python-apsw-3.7.13_r1-1.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - Python-apsw is a Python wrapper for the SQLite embedded
relational database engine. In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
- registrydecoder-20120709-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_84}.rpm - Registrydecoder
is tool for the acquisition, analysis, and reporting of registry contents.
See here for a list of changes.
- aff{lib,lib-devel,tools}-3.7.1-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Afflib is the library and tools to manipulate files
using the Advanced Forensic Format. Please note: as of AFFLIB 3.6, all tool names start with the string aff which marks a change from AFFLIB version 3.5.
See here for the changes.
|
|
July 10, 2012:
The following have been released:
- fred-0.1.0beta4-1.{fc14,fc15,fc16,fc17}.noarch.rpm - Fred Forensic Registry EDitor (fred) is a cross-platform Microsoft
registry hive editor. This project was born out of the need for a reasonably good registry hive viewer for Linux to conduct forensic analysis. Therefore it includes some
functions not found in normal "free" registry editors like a hex viewer with data interpreter and a reporting function that can easily be extended with custom ECMAScript
report templates. The current version contains the following reports: NTUSER_RecentDocs, NTUSER_TypedUrls, SAM_UserAccounts, SOFTWARE_WindowsVersion, SYSTEM_CurrentNetworkSettings,
SYSTEM_SystemTimeInfo and SYSTEM_UsbStorageDevices.
- CERT-Forensics-Tools-1.0-41.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - This package was updated to do the following:
- add fred for Fedora systems only
- tcpflow-1.2.7-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction.
Tcpflow can also process stored tcpdump packet flows.
Here are the changes in this version:
- src/main.cpp (main): -r option now allows for multiple files to be specified.
- src/main.cpp (main): -R option now allows for incomplete tcp connections to be finished.
- src/main.cpp (main): removed global "tcpdemux demux" variable. Now it's passed as *user in the datalink methods, as it should be.
- src/tcpdemux.h (class tcpip): bytes_printed renamed to bytes_processed, as it will be used in packet processing as well.
- pytsk-20120626-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Pytsk is Python bindings for
The Sleuth Kit.
- python-xlwt-0.7.4-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_64}.rpm - Python-xlwt is a library for generating spreadsheet files that
are compatible with Excel 97/2000/XP/2003, OpenOffice.org Calc, and Gnumeric. Python-xlwt has full support for Unicode. Excel spreadsheets can be generated on any platform without
needing Excel or a COM server.
- yaf{,-devel}-2.2.1-2.{el5}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Note that this release of Yaf is only available for CentOS/RHEL 5. All other versions use Yaf-2.2.2 and beyond.
The change is to use libfixbuf-1.1.2-1.
|
|
July 3, 2012:
The following have been released:
- ptk-1.0.5-2.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - PTK is a computer forensic framework for the command line
tools in the SleuthKit plus many more modules. PTK uses MySQL which is assumed to be configured, using the
command line tool mysql_secure_installation or equivalent, and operating. It also assumes a web server, for example
Apache, also assumed to be configured and operational. This package has been rebuilt to correct directory
permissions for the installed files.
- libvshadow{,-devel,-tools}-20120511-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libvshadow is a ibrary and tools used to support
the Volume Service Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
- guymager-0.6.9-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.6.7):
- Releasing all changes of 0.6.8 (switch to new version in order to have test users update their packages correctly)
- AEWF: Considering also 1st chunk base offset when checking if chunk can be added to current sectors section.
- New cfg parameter CheckRootRights
- If source disk can't be opened, give it another try without option NOATIME
- Corrected text output for image hash calculation in info file; Translations updated.
- Error in UtilIsZero removed (leading to wrong image if FifoBlockSizeEwf is set to values above 65536)
- Package no longer recommends gksu, smartmontools and hdparm but depends on them
- No longer exits on write errors on info file or in AEWF module (should already have been done in 0.6.4, but the takeover from trunk wasn't done)
- New cfg parameter EwfCompressionThreshold
- Also include symlinks when searching for libparted
- Changes from Mika (unistd.h)
- SiLK - SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
The changes are the following:
- rwflowpack change
- Modify the log messages produced by libfixbuf to follow the format of other rwflowpack log messages.
- Modify NetFlow v9 support to require libfixbuf-1.1.0.
- flowcap change
- Modify the log messages produced by libfixbuf to follow the format of other rwflowpack log messages.
- Modify NetFlow v9 support to require libfixbuf-1.1.0.
- Building
- Add new configure switch --enable-asa-zero-packet-hack to work around a bug in the NetFlow9 template used by Cisco ASA routers wherein the
template is missing a packetTotalCount field, causing rwflowpack to treat these flows as having 0 packets. When the switch is specified,
SiLK sets the packet count to 1 for flow records having a source IP, a byte count, but no packet count. In addition, if SiLK is compiled
without IPv6 support, the hack causes rwflowpack to a use fully-expanded file format to store IPv4 flow records collected from netflow-v9 probes.
This verison of SiLK has been built with --enable-asa-zero-packet-hack.
The packages added to the repository are:
- silk-analysis-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-common package contains the libraries and configuration files
required by the other parts of SiLK Toolset, as well as generally useful utilities.
- silk-common-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-common package contains the libraries and configuration files
required by the other parts of SiLK Toolset, as well as generally useful utilities.
- silk-devel-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm- The silk-devel package contains the development libraries and headers
for SiLK. This package is required to build additional applications or to build shared libraries for use as plug-ins to The silk analysis tools.
- silk-flowcap-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-flowcap package contains flowcap, a daemon to capture NetFlow
v5 or IPFIX flows (Internet Protocol Flow Information eXport), to store the data temporarily in files on its local disk, and to forward
these files over the network to a machine where rwflowpack processes the data. flowcap is typically used with an rwsender-rwreceiver pair
to move the files across the network.
- silk-rwflowappend-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwflowappend package is used when the final storage location
of SiLK data files is on a different machine than that where the files are created by the rwflowpack daemon (see The silk-rwflowpack
package). rwflowappend watches a directory for SiLK data files and appends those files to the final storage location where The silk
analysis tools (from The silk-analysis package) can process them. To move the files from rwflowpack to rwflowappend, an rwsender-rwreceiver
pair is typically used.
- silk-rwflowpack-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwflowpack package converts NetFlow v5 or IPFIX (Internet
Protocol Flow Information eXport) data to The silk Flow record format, categorizes each flow (e.g., as incoming or outgoing), and stores the
data in binary flat files within a directory tree, with one file per hour-category-sensor tuple.
- silk-rwpollexec-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwpollexec package contains a program (rwpollexec) which
monitors a directory for incoming files. For each file, rwpollexec executes a user-specified command. If the command completes
successfully, the file is either moved to an archive directory or deleted.
- silk-rwreceiver-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwreceiver package contains a program (rwreceiver) which
receives files over the network from one or more rwsender programs. rwsender-rwreceiver pairs are used to move files from a machine
running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.
- silk-rwsender-2.5.0-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwsender package contains a program (rwsender) which
transmits files over the network to one or more rwreceiver programs. rwsender-rwreceiver pairs are used to move files from a machine
running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.
- registrydecoder-20120629-1.{fc14,fc15,fc16,fc17,el5,el6}.{i386,x86_84}.rpm - Registrydecoder
is tool for the acquisition, analysis, and reporting of registry contents. This is version 1.3 of this tool.
See here for a list of changes.
- CERT-Forensics-Tools-1.0-40.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - This package was updated to do the following:
|
|
|
June 28, 2012:
The following have been released:
|
|
June 27, 2012:
The following have been released:
- BEViewer-1.3.006-1.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - BEViwer
is a User Interface for browsing features that have been extracted via the bulk_extractor feature extraction tool.
BEViewer supports browsing multiple images and bookmarking and exporting features.
BEViewer also provides a User Interface for launching bulk_extractor scans.
- ddrescue-1.16-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
See /usr/share/doc/ddrescue-1.16/ChangeLog after the package has been installed.
- dd_rescue-1.28-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue<./TT> does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
- libfixbuf{,-devel}-1.1.2-1.{fc14,fc15,fc16,fc17el5,el6}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
This version contains general bug fixes as well as Netflow V9 bug fixes.
- SiLK - SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
The changes are to use libfixbuf-1.1.2-1.
The packages added to the repository are:
- silk-analysis-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-common package contains the libraries and configuration files
required by the other parts of SiLK Toolset, as well as generally useful utilities.
- silk-common-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-common package contains the libraries and configuration files
required by the other parts of SiLK Toolset, as well as generally useful utilities.
- silk-devel-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm- The silk-devel package contains the development libraries and headers
for SiLK. This package is required to build additional applications or to build shared libraries for use as plug-ins to The silk analysis tools.
- silk-flowcap-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-flowcap package contains flowcap, a daemon to capture NetFlow
v5 or IPFIX flows (Internet Protocol Flow Information eXport), to store the data temporarily in files on its local disk, and to forward
these files over the network to a machine where rwflowpack processes the data. flowcap is typically used with an rwsender-rwreceiver pair
to move the files across the network.
- silk-rwflowappend-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwflowappend package is used when the final storage location
of SiLK data files is on a different machine than that where the files are created by the rwflowpack daemon (see The silk-rwflowpack
package). rwflowappend watches a directory for SiLK data files and appends those files to the final storage location where The silk
analysis tools (from The silk-analysis package) can process them. To move the files from rwflowpack to rwflowappend, an rwsender-rwreceiver
pair is typically used.
- silk-rwflowpack-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwflowpack package converts NetFlow v5 or IPFIX (Internet
Protocol Flow Information eXport) data to The silk Flow record format, categorizes each flow (e.g., as incoming or outgoing), and stores the
data in binary flat files within a directory tree, with one file per hour-category-sensor tuple.
- silk-rwpollexec-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwpollexec package contains a program (rwpollexec) which
monitors a directory for incoming files. For each file, rwpollexec executes a user-specified command. If the command completes
successfully, the file is either moved to an archive directory or deleted.
- silk-rwreceiver-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwreceiver package contains a program (rwreceiver) which
receives files over the network from one or more rwsender programs. rwsender-rwreceiver pairs are used to move files from a machine
running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.
- silk-rwsender-2.4.7-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - The silk-rwsender package contains a program (rwsender) which
transmits files over the network to one or more rwreceiver programs. rwsender-rwreceiver pairs are used to move files from a machine
running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.
- yaf{,-devel}-2.2.2-2.{fc14,fc15,fc16,fc17,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Note that this release of Yaf is not available for CentOS/RHEL 5 due to an outdated version of PCRE.
The changes are to use libfixbuf-1.1.2-1.
- log2timeline-0.64-1.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Log2timeline is a framework for the automatic creation of a super timeline.
Here are the changes in this version:
- [TESTSUITE] Added the first version of a test suite to the tool.
- All tests are located inside the t/ directory.
- Tests should be constructed for ALL possible uses of the tool, not limited to:
- Raw parsing of logs using input modules.
- Correct output for output modules.
- Correct output from each function inside modules/libraries.
- The first TEST suite is raw and not nearly complete, needs loads of stuff to be 'proper' but it is a start.
- [LS_QUARANTINE input] A new input module that parses the LSQuarantineEvents SQLite db in Mac OS X.
- [Log2Timeline library] Added the possibility to use a dot (.) in the exclusion list.
- Changed the exclusion list so it can be easily changed
- Added a call to ->end on each input module if verification failed.
- Minor bug fixes in the main engine.
- Changed wording when an output module is loaded (from "Loading output file" to "Loading output module").
- Added support to detect shortcuts in Windows systems.
- Added the "path_orig" to all input modules (making it possible to "fix" paths).
- [CHROME input] - Slight changes to the output based on the value of the typed_count variable, also updated the path to the code that describes the transition types.
- [SKYPE input] Fixed the verification routine a bit, cleaned it up slightly and fixed a small bug that caused the tool not to include SKYPE data when recursive mode was set on.
- Also fixed UTF-8 support, should properly display UTF-8 by now.
- [PREFETCH input] Small changes to the verification module.
- [WinReg] Fixed a small bug in the code that caused the deleted entries lookup sometimes to loop forever.
- [SQLITE output] Changed the way the SQLite code is written considerably, pre-compiling statements to prevent them being compiled for each insert, using transactions
instead of writing them constantly to the DB, and other minor tweaks to make the DB output faster than before (since it was increadibly slow before).
- [CHROME input] Small bug to fix UTF-8 support.
- [FIREFOX3 input] Small bug to fix UTF-8 support.
- [PREFETCH input] Fixed a bug, added a seekdir so that prefetch information is contained within the timeline if recursive is turned on.
- [RECYCLER input] Fixed a bug, added a seekdir so that recycler information is contained within the timeline if recursive is turned on.
- [LIST files] Added few items into the Windows list files, as well as to create a Mac OS X one.
- [MFT input] Fixed a bug with Unicode support.
- [RECYCLER input] Fixed a small bug (issue 5) with the path not showing the correct path as indicated by -m TEXT
- [SOL input] Fixed a small bug (issue 5) with the path not showing the correct path as indicated by -m TEXT
- [EVTX input] Changed the dependencies to Parse::Evtx2 instead of Parse::Evtx (same library, changed the namespace).
- Issue when Parse::Evtx was installed on SIFT, causing the tool to first load the library from Schuster, and not the slightly changed one
distributed by the tool, causing the module to not work.
- md5deep-4.2-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - This package was updated to reflect the new version of md5deep.
Here are the list of new features:
- Fixed padding in Tiger hashes for large files
- {nmap,ncat,nping,nmap-update,zenmap}-6.01-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Nmap is a free and open source utility for
network exploration or security auditing. See the change log for details.
Nping is a packet generation and response analysis tool.
Ncat is a flexible data transfer, redirection, and debugging tool.
Nmap-update is a tool that gets the latest versions of architecture-independent files, such as scripts and databases, for the installed version of Nmap.
Zenmap is an advanced GUI and results viewer. It replaces nmap-frontend.
See the Changelog for the changes made in this release.
- regripper-25000000-1.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool.
This package is now contains only the version 2.5 of the regripper tool. The plugins are now packaged separately.
- regripper-plugins-20120612-1.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Regripper-plugins are the plugins packaged separately from
the regripper application.
This version includes version 20120612 of the plugins from here.
The plugins added are the following:
- NEW PLUGIN by Jason Hale: typedurlstime.pl that parses and correlates the TypedURLs and TypedURLsTime subkeys
- NEW PLUGIN by Jason Hale: typedurlstime_tln.pl that parses and correlates the TypedURLs and TypedURLsTime subkeys (output in TLN format)
|
|
June 5, 2012:
The following have been released:
- regripper-20120528-2.{fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool.
This version includes version 20120528 of the plugins from here.
The plugins added are the following:
- NEW PLUGIN by Francesco Picasso: "internet_explorer_cu.pl" that parses the Internet Explorer info from NTUSER.DAT registry
- NEW PLUGIN by Francesco Picasso: "internet_settings_cu.pl" that parses the Internet Settings info from NTUSER.DAT registry
- REMOVED plugin "ie_main.pl", since superseded by "internet_explorer_cu.pl"
- REMOVED plugin "iexplore.pl", since superseded by "internet_explorer_cu.pl"
- FIXED plugin "timezone.pl", see Issue14 and see source code comments
- FIXED plugin "userassist2.pl", now it parses Windows7 entries, see source code comments
- ADDED profiles with every plugin listed in alphabetical order: all-all (3), ntuser-all (98), sam-all (1), security-all (3), software-all (56), system-all (46)
- NOTE RegRipperPlugins now counts 207 plugins
- KNOWN ISSUES: comdlg32 does not parse Vista/7 subkeys (Issue 15)
|
|
June 4, 2012:
The following have been released:
- bulk_extractor-1.2.2-3.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Bulk_extractor
has been repackaged, where all of the supporting tools are now installed as distributed by the author. These tools are installed in /usr/bin and
are the following:
- bulk_diff.py - compares two bulk_extractor runs and reports what's changed.
- identify_filenames.py - reads feature files and a DFXML file for a disk image and reports the file from which each feature came
- post_process_exif.py - reads the exif.txt feature file and produces a CSV file from all of the XML-encoded EXIF information
- This directory also contains modules for working with digital forensics XML:
- bulk_extractor.py - a DFXML python module for reading the report.xml file created by bulk_extractor and reading the feature files.
Also allows reading a ZIP file produced from a bulk_extrator output directory as if it were uncompressed.
- dfxml.py - a DFXML python module for reading DFXML files
- fiwalk.py - a DFXML python module for producing DFXML streams using fiwalk
- ttable.py - produces nicely formatted Python tables
- This directory also contains an out-of-date multi-drive correlator; this will be operational by August 1, 2012:
- cda2.py - multi drive correlator
- cda_test.py - test program for multi-drive correlator
- cda_tool.py - another multi-drive correlator
- libewf-{,devel,tools}-20120603-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package.
If the Version 1 API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- ssdeep-2.8-1.{fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes.
|
|
June 1, 2012:
The following have been released:
- bulk_extractor-1.2.2-2.{fc13,fc14,fc15,fc16,fc17,el5,el6}.{i686,x86_64}.rpm - Bulk_extractor was
packaged incorrectly, producing incorrect version installed in /usr/bin/bulk_extractor. This release corrects that problem.
|
|
May 31, 2012:
The following have been released:
- Fedora 17 - The repository now supports Fedora 17
for both the i386 and x86_64 CPU architectures.
- Support for Fedora 13 - Development of repository for Fedora 13 has stopped as of 2012-05-31.
- BEViewer-1.2.1.004-1.{fc13,fc14,fc15,fc16,fc17,el5,el6}.noarch.rpm - BEViwer
is a User Interface for browsing features that have been extracted via the bulk_extractor feature extraction tool.
BEViewer supports browsing multiple images and bookmarking and exporting features.
BEViewer also provides a User Interface for launching bulk_extractor scans.
|
|
May 29, 2012:
The following have been released:
- bulk_extractor-1.2.2-1.{fc13,fc14,fc15,fc16,el5,el6}.{i686,x86_64}.rpm - Bulk_extractor
is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file
system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools.
Bulk_extractor also created a histograms of features that it finds, as features that are more common tend to be more important.
See the ChangeLog file (/usr/share/doc/bulk_extractor-1.2.2/ChangeLog) in the package for a list of changes.
|
|
May 23, 2012:
The following have been released:
- libewf-{,devel,tools}-20120504-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package.
If the Version 1 API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- netsa-python-1.3-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Netsa-python is a
library of Python routines and frameworks that the NetSA team at CERT has found helpful when developing analyses using the SiLK toolkit. Of particular note are the
netsa.script NetSA Scripting Framework, which provides a standard framework for writing scripts that process flow data, and the netsa.util.shell command line
processing system, which provides tools for managing extremely complicated collections of shell processes that should fail or succeed together (extremely useful when working with named pipes).
netsa-python is compatible with Python versions 2.4 and greater.
- rayon-1.3.3-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Rayon is a Python library and set of tools for generating
basic two-dimensional statistical visualizations. Rayon can be used to automate reporting; provide data visualization in command-line, GUI or web applications; or do ad-hoc exploratory data analysis.
Rayon can generate visualizations in PDF, PNG, SVG and PostScript formats using Pycairo. It can also be used in wxPython GUI applications.
Rayon is compatible with Python versions 2.4 and greater, and requires netsa-python and at least one of Pycairo (for static output) or wxPython (for GUI output).
- {nmap,ncat,nping,nmap-update,zenmap}-6.00-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Nmap is a free and open source utility for
network exploration or security auditing. See the change log for details.
Nping is a packet generation and response analysis tool.
Ncat is a flexible data transfer, redirection, and debugging tool.
Nmap-update is a tool that gets the latest versions of architecture-independent files, such as scripts and databases, for the installed version of Nmap.
Zenmap is an advanced GUI and results viewer. It replaces nmap-frontend.
- CERT-Forensics-Tools-1.0-38.{fc13,fc14,fc15,fc16,el5,el6}.noarch.rpm - This package was updated to do the following:
- obsolete nmap-frontend
- add zenmap
- add ncat
- add nping
- add nmap-update
- remove registrydecoder for RHEL/CentOS 5 (it requires too many dependencies)
|
|
May 1, 2012:
The following have been released:
- guymager-0.6.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.6.5):
- Configuration parameter CommandGetAddStateInfo now understands placeholder %local for distinguishing between local and non-local devices
- New configuration parameter QueryDeviceMediaInfo for devices that do not like HPA/DCO querying
- MD5 calculation of destination disk corrected for disks whose size is not a multiple of the block size
- No longer depends on libproc (using libc functions instead)
- New, fast SHA256 and MD5 routines (from package coreutils)
- No longer depends on libcrypto or libcrypto for fast hash functions
|
|
April 23, 2012:
The following have been released:
- libewf-{,devel,tools}-20120416-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package.
If the Version 1 API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- log2timeline-0.63-1.{fc13,fc14,fc15,el5,el6}.noarch.rpm - Log2timeline is a framework for the automatic creation of a super timeline.
Here are the changes in this version:
- ALL modules/files were run through perltidy using the configuration file of dev/perltidy.conf.
- Also several modules have had their documentation updated and code reformed to reflect recent release of a style guide
for the project. perltidy is not enough to enforce that, but at least a start. Rewriting the documentation (pod) is also a vital
portion of making the modules easier to use/understand/develop.
- All libraries within the tool and the main API have been rewritten with this in mind, making 'man' documentation considerably
more useful than it was.
- [SERIALIZE output] JSON::XS used to serialize the timestamp output, a very simple output module that simply stores
- This makes it possible to output using this method and then sorting is simpler since it does not require the module
to read in the csv and change it into something like a hash, since it is already stored as such.
- This might become the default output of the tool, and then run l2t_process on that output, turning that into CSV
instead of using CSV as default and trying to filter that output.
- This also makes it easier to filter, based on certain attributes, instead of at the line level.
the timestamp object without really doing anything to it. Use that for easy sorting in later stages.
- [WIN7 list] Fixed a small bug in Win7 list file (and win7_noreg). The evt module was loaded up and not the evtx one.
- [FIREFOX3 input] Added a check to see if the SQlite database contains a -wal or -shm (in addition to -journal)
And if it does, then do the same procedure as if it was a -journal (read-only database that gets copied to a temp location)
This was pointed to me by Svante
- [PREFETCH input] Changed the default output so that loaded DLLs are not included by default, unless the -d|--detail
option/parameter is used.
- [MFT input] Inside the verification routine a check is made to see if the magic value is FILE0, it should only be FILE.
Fixed that, making the mft module capable of parsing those $MFT files that do not the standard offset to the fixup array.
- [SAM input] Changed the handling of SAM database data, it did not properly parse the SAM database file in certain cases
due to the keys being prefilled with the CMI-CREATE....
- [NTUSER input] Changed a value check in UserAssist key parsing causing UserAssist keys not properly being parsed.
- [WIN_LINK input] The values for mtime and atime got swapped (the correct order is CAM not CMA like it was)
- [SETUPAPI input] Added a 'detailed_time' check, to reduce the text inside the alert by default, unless detail option used.
- [log2timeline] Updated the man page to reflect updates to the 'detailed_time' changes to setupapi input module.
- [WIN library] Added a mapping to map up all Windows use of timezones to the one used in the DateTime library.
- [win_sysinfo PreProc] Updated the pre-processing library so that it checks if a known transform of a Windows named
timezone information is available and if it is it will compare it to the chosen timezone (and change it if they differ).
- [LOG2TIMELINE] Small bug in the log2timeline library, causing input modules list that has more than one - sign in it
not properly verified.
- [IEHISTORY input] Switched time1 and time2, and started to update the module so it adheres to the newly released, not
yet complete, style guide.
- [EVTX input] Updated the EVTX library to the latest release, version 1.1.1 (written by Andreas Schuster)
- Also changed the 50 attempts to 15 (in case of an error in reading an entry), also only output error
message if debug is turned on.
- tcpflow-1.2.6-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction.
Tcpflow can also process stored tcpdump packet flows.
Here are the changes in this version:
- configure.ac: incremented version to 1.2.6 (1.2.5 had a bad tag)
- src/tcpip.cpp (tcpip::print_packet): fixed error in fwrite().
- src/main.cpp (print_usage): fixed misspelling of name
- src/tcpip.cpp (tcpdemux::tcpdemux): default outdir is now "."
|
|
April 10, 2012:
The following have been released:
- python-pefile-1.2.10_114-1.{fc13,fc14,fc15,fc16,el5,el6}.noarch.rpm - Python-pefile is a multi-platform
Python module to read and work with Portable Executable (aka PE) files. Most of the information in the PE Header is accessible, as well as all the sections, section's information and data.
pefile requires some basic understanding of the layout of a PE file. Armed with it it's possible to explore nearly every single feature of the file.
Some of the tasks that pefile makes possible are:
- Modifying and writing back to the PE image
- Header Inspection
- Sections analysis
- Retrieving data
- Warnings for suspicious and malformed values
- Packer detection with PEiD’s signatures
- PEiD signature generation
Please, refer to UsageExamples for starting points on how to use pefile.
To work with authenticated binaries, including Authenticode signatures, please check the project verify-sigs.
- AdobeMalwareClassifier-1.0-1.{fc13,fc14,fc15,fc16,el6}.{i386,x86_64}.rpm - AdobeMalwareClassifier
is a tool that perform quick, easy classification of binaries for malware analysis.
The Adobe Malware Classifier is a command-line tool that lets antivirus analysts, IT administrators, and security researchers quickly and easily determine if a binary file
contains malware so they can develop malware detection signatures faster, reducing the time during which users' systems are vulnerable.
The tool uses machine-learning algorithms to classify Win32 binaries - EXEs and DLLs - into three classes: 0 for "clean," 1 for "malicious," or "UNKNOWN."
The tool extracts seven key features from an unknown binary, feeds them to one of the four classifiers or all of them, and presents its classification of the unknown
binary as "clean," "malicious," or "unknown."
The tool was developed using models resultant from running the J48, J48 Graft, PART, and Ridor machine-learning algorithms on a dataset of approximately 100,000
malicious programs and 16,000 clean programs.
|
|
April 3, 2012:
The following have been released:
- aff{lib,lib-devel,tools}-3.7.0-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Afflib is the library and tools to manipulate files
using the Advanced Forensic Format. Please note: as of AFFLIB 3.6, all tool names start with the string aff which marks a change from AFFLIB version 3.5.
See /usr/share/doc/afflib-3.7.0/ChangeLog after the package has been installed.
- yaf{,-devel}-2.2.2-1.{fc13,fc14,fc15,fc16,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Note that this release of Yaf is not available for CentOS/RHEL 5 due to an outdated version of PCRE.
This release fixes bugs in VLAN tagging.
|
|
March 30, 2012:
The following have been released:
- tcpflow-1.2.3-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction.
Tcpflow can also process stored tcpdump packet flows.
he changes are: bug fixes and performance improvements.
- safecopy-1.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Safecopy is a data recovery tool which
tries to extract as much data as possible from a problematic (i.e. damaged sectors) source - like floppy drives, harddisk partitions, CDs, tape devices, ..., where
other tools like dd would fail doe to I/O errors.
Here are the changes:
- New --forceopen option to wait for removable drives to come back
- New -c (continue) option to resume when copying directly unto devices
- Return codes: (0 for success, 2 for abort/ error, 1 for incomplete copy)
- Adapted test suite to test for these return codes
- Code cleanup
- testdisk-6.13-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
Here are the changes:
- Fix UAC manifests for Windows, so users don't need to use right-click "Run As Administrator"
- TestDisk
- Fix image creation, image.dd file wasn't created (Regression introduced in 6.12)
- Detect Vmware VMFS partition
- Locate lost GFS2 partition but not yet the size
- Log HDD serial number and firmware revision
- List NTFS Alternate Data Streams (ADS)
- PhotoRec
- Session recovery restarts at the previous location
- Better MPEG recovery, there should be less concatenated videos.
- Better JPG recovery, there should be less cases where thumbnails were recovered instead of the picture itself.
- Handle large avi files using "AVIX" or mov files using 64-bit chunk size.
- Rename recovered pdf using the title (not perfect)
- Major cleanup of PhotoRec core code
- libp0f{,-devel}-2.0.8-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Libp0f
is a library implementation of p0f version 2 available from here.
This library splits the core p0f functionality from the p0f application in order to support 3rd-party linkage.
libp0f does not change any of the fingerprinting algorithms from p0f version 2, nor has it upgraded any of the p0f fingerprints.
The library is required for use with Yaf.
To enable p0f in Yaf, configure Yaf with --enable-p0fprinter (see the next item), and run Yaf with --p0fprint.
- yaf{,-devel}-2.2.1-3.{fc13,fc14,fc15,fc16,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Note that this release of Yaf is not available for CentOS/RHEL 5 due to an outdated version of PCRE.
This release was built with the following configuration options enabled:
- enable-applabel - enable the packet payload application label engine
- enable-p0fprinter - enable the p0f based OS finger printing capability
- enable-plugins - enable YAF to load plugin extensions
- enable-ltdl-install=no - do not install files that would otherwise conflict with libtool-ltdl
- SiLK - SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
The changes are to enable adns, the Asynchronous-capable DNS Client Library.
The packages added to the repository are:
- silk-analysis-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-common package contains the libraries and configuration files
required by the other parts of SiLK Toolset, as well as generally useful utilities.
- silk-common-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-common package contains the libraries and configuration files
required by the other parts of SiLK Toolset, as well as generally useful utilities.
- silk-devel-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm- The silk-devel package contains the development libraries and headers
for SiLK. This package is required to build additional applications or to build shared libraries for use as plug-ins to The silk analysis tools.
- silk-flowcap-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-flowcap package contains flowcap, a daemon to capture NetFlow
v5 or IPFIX flows (Internet Protocol Flow Information eXport), to store the data temporarily in files on its local disk, and to forward
these files over the network to a machine where rwflowpack processes the data. flowcap is typically used with an rwsender-rwreceiver pair
to move the files across the network.
- silk-rwflowappend-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwflowappend package is used when the final storage location
of SiLK data files is on a different machine than that where the files are created by the rwflowpack daemon (see The silk-rwflowpack
package). rwflowappend watches a directory for SiLK data files and appends those files to the final storage location where The silk
analysis tools (from The silk-analysis package) can process them. To move the files from rwflowpack to rwflowappend, an rwsender-rwreceiver
pair is typically used.
- silk-rwflowpack-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwflowpack package converts NetFlow v5 or IPFIX (Internet
Protocol Flow Information eXport) data to The silk Flow record format, categorizes each flow (e.g., as incoming or outgoing), and stores the
data in binary flat files within a directory tree, with one file per hour-category-sensor tuple.
- silk-rwpollexec-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwpollexec package contains a program (rwpollexec) which
monitors a directory for incoming files. For each file, rwpollexec executes a user-specified command. If the command completes
successfully, the file is either moved to an archive directory or deleted.
- silk-rwreceiver-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwreceiver package contains a program (rwreceiver) which
receives files over the network from one or more rwsender programs. rwsender-rwreceiver pairs are used to move files from a machine
running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.
- silk-rwsender-2.4.7-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwsender package contains a program (rwsender) which
transmits files over the network to one or more rwreceiver programs. rwsender-rwreceiver pairs are used to move files from a machine
running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.
|
|
March 12, 2012:
The following have been released:
- tcpflow-1.2.1-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction.
Tcpflow can also process stored tcpdump packet flows.
The changes are: bug fixes and performance improvements.
- guymager-0.6.5-1.{fc13,fc14,fc15,fc16,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.6.3):
- Device scan: Assume that a device will not be included more than once in a scan
- New CFG parameter AvoidEncaseProblems for Encase EWF string limitations
- No longer exits on write errors in AEWF module
- No longer exits on info file write errors
- Center info dialog relative to application (not screen)
- yaf{,-devel}-2.2.1-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
The changes are bug fixes.
- reglookup-1.0.1-2.{fc12,fc13,fc14,fc15,el5,el6}.{i686,x86_64}.rpm - Release 2 of the reglookup
package was installed to include the following patches:
- Patch 278: fix for pyregfi install
- Patch 277: incorporated a version of Adam Golebiowski's build patches reworked REGFI_VERSION and began using it in pyregfi installation
- Patch 276: added 1.0.1 target
|
|
March 7, 2012:
The following have been released:
- xplico-1.0.0-1.{fc13,fc14,fc15,fc16,el6}.{i386,x86_64}.rpm - xplico is an Internet traffic decoder.
Note that RHEL/CentOS 5 is not supported due to a lack of Python Version 3 support.
Here is the list of changes:
- SQLite dispatcher performance improved
- Added the PPI dissector
- Added the syslog dissector
- Added "Bogus IP length" correction with checksum verification disabled
- New Facebook Chat dissector for the new Facebook chat protocol
- SIP dissector improved
- IMAP dissector improved and bugs fixed
- DNS dissector PIPI improved
- Yahoo Webmail bugs fixed
- Live/Hotmail WebMail Spanish version
- GeoMap improved
- PCap-over-IP
To build and install this package for CentOS 6, the following were installed in the CentOS/RHEL repository:
- python3-3.1.2-7.fc13.i686.rpm
- python3-libs-3.1.2-7.fc13.i686.rpm
- python3-httplib2-0.6.0-3.fc14.noarch.rpm
|
|
February 24, 2012:
The following have been released:
- regripper-20120224-1.{fc13,fc14,fc15,fc16,el5,el6}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool.
This version includes version 20120224 of the plugins from here.
The plugins added are the following:
- EMDMgt.pl (Brad Reninger) - this plugin parses the EMDMgt registry key located in the SOFTWARE Hive.
This registry key identifies the volume serial number of USB devices.
- ccleaner.pl (Adrian Leong) - this plugin gets CCleaner User's Settings from NTUSER.DAT.
- md5deep-4.1-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - This package was updated to reflect the new version of md5deep.
Here are the list of new features:
- Added expert mode option to parse Windows PE files
and bug fixes:
- Fixed junction point handling on Win32
|
|
February 17, 2012:
The following have been released:
- SiLK - SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for the list of changes.
The packages added to the repository are:
- silk-analysis-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-common package contains the libraries and configuration files
required by the other parts of SiLK Toolset, as well as generally useful utilities.
- silk-common-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-common package contains the libraries and configuration files
required by the other parts of SiLK Toolset, as well as generally useful utilities.
- silk-devel-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm- The silk-devel package contains the development libraries and headers
for SiLK. This package is required to build additional applications or to build shared libraries for use as plug-ins to The silk analysis tools.
- silk-flowcap-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-flowcap package contains flowcap, a daemon to capture NetFlow
v5 or IPFIX flows (Internet Protocol Flow Information eXport), to store the data temporarily in files on its local disk, and to forward
these files over the network to a machine where rwflowpack processes the data. flowcap is typically used with an rwsender-rwreceiver pair
to move the files across the network.
- silk-rwflowappend-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwflowappend package is used when the final storage location
of SiLK data files is on a different machine than that where the files are created by the rwflowpack daemon (see The silk-rwflowpack
package). rwflowappend watches a directory for SiLK data files and appends those files to the final storage location where The silk
analysis tools (from The silk-analysis package) can process them. To move the files from rwflowpack to rwflowappend, an rwsender-rwreceiver
pair is typically used.
- silk-rwflowpack-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwflowpack package converts NetFlow v5 or IPFIX (Internet
Protocol Flow Information eXport) data to The silk Flow record format, categorizes each flow (e.g., as incoming or outgoing), and stores the
data in binary flat files within a directory tree, with one file per hour-category-sensor tuple.
- silk-rwpollexec-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwpollexec package contains a program (rwpollexec) which
monitors a directory for incoming files. For each file, rwpollexec executes a user-specified command. If the command completes
successfully, the file is either moved to an archive directory or deleted.
- silk-rwreceiver-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwreceiver package contains a program (rwreceiver) which
receives files over the network from one or more rwsender programs. rwsender-rwreceiver pairs are used to move files from a machine
running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.
- silk-rwsender-2.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - The silk-rwsender package contains a program (rwsender) which
transmits files over the network to one or more rwreceiver programs. rwsender-rwreceiver pairs are used to move files from a machine
running flowcap and one running rwflowpack, or from the rwflowpack machine to machine(s) running rwflowappend.
|
|
February 15, 2012:
The following have been released:
- bulk_extractor-1.2.0-1.{fc13,fc14,fc15,fc16,el5,el6}.{i686,x86_64}.rpm - Bulk_extractor
is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file
system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools.
Bulk_extractor also created a histograms of features that it finds, as features that are more common tend to be more important.
See this Changelog for a list of changes.
- libewf-{,devel,tools}-20120122-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package.
If the Version 1 API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
|
|
February 7, 2012:
The following have been released:
- dff-1.2.0-3.{fc12,fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - The Digital Forensics Framework (DFF) is both
a digital investigation tool and a development platform. This release adds missing support for Expert Witness Format Compression Format (ewf) files.
- regripper-20120206-1.{fc13,fc14,fc15,fc16,el5,el6}.noarch.rpm - Regripper is a Windows Registry data extraction and correlation tool.
This version includes version 20120206 of the plugins from here. This version adds the filesnottosnapshot.pl
(extracts from SYSTEM registry files and folders not backed up in Volume Shadow Copies) and spp_clients.pl (list volumes currently monitored by
the Volume Shadow Copy Service) plugins.
- xmount-0.4.7-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. This release uses Version 2 of the libewf API.
- Volatility-2.0.1-3.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. This version updates
the plugins from the Malware Analyst's Cookbook to version R134.
See here for the list of recent changes.
- registrydecoder-20120202-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_84}.rpm - Registrydecoder
is tool for the acquisition, analysis, and reporting of registry contents. This is version 1.2 of this tool.
See here for a list of changes.
- tcpflow-1.1.0-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction. tcpflow can also process stored tcpdump
packet flows. The changes are: C++ rewrite, improved performance, and DFXML output.
|
|
January 27, 2012:
The following have been released:
- libewf-{,devel,tools}-20120122-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package. If the Version 1
API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- md5deep-4.0.1-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - This package was updated to reflect the new version of md5deep.
Here are the list of new features:
- Fixed hang on DFXML generation on Win32
- Fixed incorrect hashes via stdin on Win32
- Fixed "Too many open files" error on OS X
- Doc files in Win32 have been corrected.
|
|
January 12, 2012:
The following have been released:
- cert-forensics-tools-release-{13,14,15,16,5.7,6}-7.noarch.rpm - This package was added to provide the new
CERT Forensics Repository Key. The fingerprint for this key is:
AE8F 91D1 5126 5835 B4DE 765D 9198 DA78 51B6 01A4.
You must do the following as root to install this new package before updating
existing packages installed from our repository:
yum update cert-forensics-tools-release
You can then do the following as root to install any other updates for your system:
yum update
In addition, all of the packages in the Fedora 13, 14, 15, 16, and RHEL/CentOS repositories have been resigned with this new key.
- CERT-Forensics-Tools-1.0-36.{fc13,fc14,fc15,fc16,el5,el6}.noarch.rpm - This package was updated to include the following:
- shellbags for Fedora 14, 15, and 16.
- KHracker for Fedora 13, 14, 15, and 16, and CentOS/RHEL 5 and 6.
- md5dump for Fedora 13, 14, 15, and 16, and CentOS/RHEL 5 and 6.
- tcpflow for Fedora 13, 14, 15, and 16, and CentOS/RHEL 5 and 6.
- registrydecoder for Fedora 13, 14, 15, and 16, and CentOS/RHEL 5 and 6.
- xplico for Fedora 13, 14, 15, and 16.
- snort for Fedora 13, 14, 15, and 16.
- snort-sample-rules for Fedora 13, 14, 15, and 16.
- shellbags-0.5.1-2.{fc14,fc15,fc16}.noarch.rpm - Shellbags Microsoft Windows uses a set of
registry keys known as "shellbags" to maintain the size, view, icon, and position of a folder when using Explorer. Shellbags persist information for
directories even after the directory is removed, which means that they can be used to enumerate past mounted volumes, deleted files, and user actions.
See Using shellbag information to reconstruct user activities for an overview of the
investigative value of shellbags. Shellbags is installed in the Fedora 14, 15, and 16 versions of the repository.
- python-registry-0.2.3-1.{fc14,fc15,fc16}.{i386,x86_64}.rpm - Python-registry provides read-only access
to Windows Registry files, such as NTUSER.DAT, userdiff, and SOFTWARE. The interface is two-fold: a high-level interface suitable for most tasks,
and a low level set of parsing objects and methods which may be used for advanced study of the Windows Registry. python-registry is written in pure
Python, making it portable across all major platforms. Python-registry is installed in the Fedora 14, 15, and 16 versions of the repository.
This package is required by shellbags.
- KHracker-0.3-1.noarch.rpm - KHracker is a python-based decryption tool for encrypted known_hosts entries. It will
attempt to decrypt values stored in SSH known_hosts files, if the encryption option has been enabled for that computer. By default, known_hosts
entries are not encrypted, but there is an option to do so. From a forensics perspective, encrypted known_hosts entries can prevent an
investigator from seeing other computers to which a user may have been connecting. Information about the connections made from a system can be integral to
identifying a complete understanding of the systems involved in a network intrusion or incident response case.
- python-netaddr-0.7.6-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64} - python-netaddr is a pure Python network address
representation and manipulation library. provides a Pythonic way of working with:
- IPv4 and IPv6 addresses and subnets
- MAC addresses, OUI and IAB identifiers, IEEE EUI-64 identifiers
- arbitrary (non-aligned) IP address ranges and IP address sets
- various non-CIDR IP range formats such as nmap and glob-style formats
Included are routines for:
- generating, sorting and summarizing IP addresses and networks
- performing easy conversions between address notations and formats
- detecting, parsing and formatting network address representations
- performing set-based operations on groups of IP addresses and subnets
- working with arbitrary IP address ranges and formats
- accessing OUI and IAB organisational information published by IEEE
- accessing IP address and block information published by IANA
This package is required by KHracker.
- md5deep-4.0.0-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - This package was updated to reflect the new version of md5deep.
Here are the list of new features:
- Rewrote most of the program in C++.
- Enabled multiprocessor support on all platforms.
- Removed ten character limit on file size mode.
|
|
January 3, 2012:
The following have been released:
- aff{lib,lib-devel,tools}-3.6.15-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Afflib is the library and tools to manipulate files
using the Advanced Forensic Format. Please note: as of AFFLIB 3.6, all tool names start with the string aff which marks a change from AFFLIB version 3.5.
See /usr/share/doc/afflib-3.6.15/ChangeLog after the package has been installed.
- fiwalk-0.6.16-1.{fc13,fc14,fc15,fc16,el6}.{i386,x86_64}.rpm - Fiwalk
is a program that processes a disk image using the SleuthKit library and outputs its results in
Digital Forensics XML, the Attribute Relationship File Format (ARFF) format used by the
Weka Datamining Toolkit, or an easy-to-read textual format.
See /usr/share/doc/fiwalk-0.6.16/ChangeLog after the package has been installed.
- bulk_extractor-1.1.3-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Bulk_extractor
is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file
system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. bulk_extractor
also created a histograms of features that it finds, as features that are more common tend to be more important.
See /usr/share/doc/bulk_extractor-1.1.3/ChangeLog after the package has been installed.
- tcpflow-1.0.6-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Tcpflow is a program
that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging.
Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction. tcpflow can also process stored tcpdump
packet flows.
- ddrescue-1.15-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
See /usr/share/doc/ddrescue-1.15/ChangeLog after the package has been installed.
- libewf-{,devel,tools}-20111231-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package. If the Version 1
API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- libfixbuf{,-devel}-1.1.1-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
This version contains bug fixes.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-2.4.5-6.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
The only change was to recompile this package to use the libfixbuf{,-devel}-1.1.1 packages.
- yaf{,-devel}-2.1.2-2.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
The only change was to recompile this package to use the libfixbuf{,-devel}-1.1.1 packages.
- perl-Parse-Evtx-1.1.1-1.{fc13,fc14,fc15,fc16,el5,el6}.noarch.rpm - perl-Parse-Evtx
is a Windows Event Log Parser library and tools collection.
- xmount-0.4.6-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. This release uses Version 2 of the libewf API.
|
|
December 8, 2011:
The following have been released:
- Fedora 16 - The repository now supports Fedora 16
for both the i386 and x86_64 CPU architectures.
- registrydecoder-20111108-1.{fc13,fc14,fc15,fc16,el5,el6}.{i386,x86_84}.rpm - registrydecoder
is tool for the acquisition, analysis, and reporting of registry contents.
- regripper-20111118-1.{fc13,fc14,fc15,fc16,el5,el6}.noarch.rpm - regripper is a Windows Registry data extraction and correlation tool.
This version includes version 20111118 of the plugins from here.
- log2timeline-0.62-1.{fc13,fc14,fc15,el5,el6}.noarch.rpm - Log2timeline is a framework for the automatic creation of a super timeline.
Here are the changes in this version:
- [FF_CACHE input] New input module, designed to parse the cache files of Firefox. Contributed by John Ritchie
- [OPENVPN input] New input module, desigend to parse the OpenVPN log files.
- [L2T_PROCESS] Added a few more allowed characters in the keyword list
- [proftpd_xferlog input] Willi Ballenthin added a new module to parse the ProFTPD XFerlog file
- [Log2Timeline library] Fixed a bug, when the 'all' moduiles option is used (or -f is omitted) no modules get loaded
- Added a small change to try to parse the MFT directly even though the $MFT might not be directly visible
- Fixed a small bug whereas the tool would crash if the local timezone was used.
- Fixed a small bug whereas the tool is not able to find the default directory (. does not exist) or if the file in
question does not really exist that the tool is pointing to... that made the tool return a double error instead of
just dying on the first one.
- The tool will now accept a separate output timezone so the tool can output in a different timezone than the hosts one.
- [log2timeline] Added the -Z ZONE parameter so the tool can output in a different timezone than the host timezone.
- [CSV output] Changed the output timezone so it now prints using the -Z definition, so it now supports different output
timezone than the host one.
- [EVTX input] Fixed a bug in where the tool could go into a endless loop in the case where you have a EVTX that is
somehow broken and the function get_next_event dies. If the tool runs into such occurance it returned an empty
timestamp object, that in turn let the tool query for it again, thus possibly getting into an endless loop.
Added a counter so the tool tries to get the next event 50 times, otherwise it will die.
- [log2timeline-sift] Moved the mount command out of the script and into the configuration file
- Changed the mount command, since there were few errors with the previous one
- Added an addional check to see if the $MFT file can be directly called (and if so, skip the icat call)
- xplico-0.7.1-1.{fc13,fc14,fc15,fc16}.{i386,x86_64}.rpm - xplico is an Internet traffic decoder.
See the Xplico website for the list of changes in this version. Note that RHEL/CentOS is not supported due to a lack of
Python Version 3 support.
- guymager-0.6.3-1.{fc13,fc14,fc15,fc16,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.5.9):
- Better HPA/DCO log output
- Bug removed where acquisition hash codes were not shown in info file if verification was aborted.
- Additional State Info added
- New configuration parameter DirectIO
- Setting sectors per chunk correctly for libewf
- Removed full path of image file names from .info file, only show the image filename
- New thread debugging messages
- New EWF module reduces memory footprint significantly.
- Posibility to compute MD5 hashes of the individual image files and write them to the .info file.
- Better log output always contains acquired device
- Bug removed where libewf only did empty block compression (slight API change in libewf20100226)
- Compression problem with libewf20100226 fixed
- Wrong file size check in acquisition dialog corrected
|
|
October 20, 2011:
The following have been released:
- regripper-20111014-1.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - regripper is a Windows Registry data extraction and correlation tool.
This version includes the version 20111014 plugins from here.
|
|
October 13, 2011:
The following have been released:
- daq-0.6.2-1.{fc12,fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - The Data Acquisition Library (Daq) is a library
used by snort.
- snort{,mysql,postgresql,unixODBC}-2.9.1.1-1.{fc12,fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - (Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
- snort-sample-rules-1.0-1.{fc12,fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - These rules are sample rules only and are intended to allow
snort to start successfully. These rules only flag HTTP traffic destined for port 80. Please see the
snort rules page to acquire a current set of snort rules.
- libewf-{,devel,tools}-20111016-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package. If the Version 1
API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- nmap{,-frontend}-5.51-3.{fc12,fc13,fc14,el5,el6}.{i386,x86_64}.rpm - Nmap is a free and open source utility for
network exploration or security auditing. See the change log for details.
- CERT-Forensics-Tools-1.0-33.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - This package was updated to select a correct version of the
libewf-tools package.
|
|
October 13, 2011:
The following have been released:
- dff-1.2.0-2.{fc12,fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - The Digital Forensics Framework (DFF) is both
a digital investigation tool and a development platform. This release fixes incorrect directory permissions and adds python-apsw as a dependency.
- python-apsw-3.6.7_r1.{fc12,fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - Another Python SQL wrapper (python-apsw)
is a Python wrapper for the SQLite embedded relational database engine. In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
|
|
October 12, 2011:
The following have been released:
- libewf-{,devel,tools}-20111011-1.{fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Libewf
is a library for support of the Expert Witness Compression Format (EWF). It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format. Note the following:
- This version provides the development environment for Version 2 of the API using the libewf-devel package. If the Version 1
API is required, install a version of libewf-devel from 2010, for example version 20100226.
- This version provides the runtime environment for both Version 1 and Version 2 of the API. This means that both
libewf.so.1 and libewf.so.2 are provided in this package for all supported operating systems and architectures.
- This version provides the a set of tools (libewf-tools) that replace ewftools.
- xmount-0.4.5-2.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. Release 2 of xmount was made to use Version 2 of the
libewf API.
- sleuthkit-{,devel,libs}-3.2.3-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data. See the included NEWS.txt for a list of
changes. Note that this version has been built using Version 2 of the libewf API.
- dff-1.2.0-1.{fc12,fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - The Digital Forensics Framework (DFF) is both
a digital investigation tool and a development platform. The framework is used by system administrators, law enforcement examinors, digital forensics researchers
and students, and security professionals world-wide. Written in Python and C++, it exclusively uses Open Source technologies. DFF combines an intuitive user
interface with a modular and cross-platform architecture. is a free and Open Source platform dedicated to digital forensic and eDiscovery sciences. Note that this
version requires the Version 2 API of libewf. Note that the CentOS/RHEL 5 is not supported in this release.
- CERT-Forensics-Tools-1.0-32.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - This package was updated to add these packages:
and remove these packages:
|
|
October 4, 2011:
The following have been released:
- bulk_extractor-1.0.7-1.{fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - Bulk_extractor
is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file
system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. bulk_extractor
also created a histograms of features that it finds, as features that are more common tend to be more important.
- reglookup-1.0.1-1.{fc12,fc13,fc14,fc15,el5,el6}.{i686,x86_64}.rpm - The reglookup
package version 1.0.0 was installed for all supported architectures.
- ssdeep-2.7-1.{fc12,fc13,fc14,fc15,el5,el6}.{i686,x86_64}.rpm - ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes.
- yaf{,-devel}-2.1.2-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Here are the changes in this version:
- Added new --plugin-conf switch for adding a configuration file to a plugin
- Added new --p0f-fingerprints switch to give location of p0f fingerprint files
- Bug Fixes
- log2timeline-0.61-2.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - Log2timeline is a framework for the automatic creation of a super timeline.
Here are the changes in this version:
- Bug fixess
- Changes to sqlite output
- User contributed new input modules
|
|
September 13, 2011:
The following have been released:
- libfixbuf{,-devel}-1.0.2-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
This version contains bug fixes.
- silk-*-2.4.5-5.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
The only change was to recompile this package to use the libfixbuf{,-devel}-1.0.2 packages.
- yaf{,-devel}-2.1.1-2.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
The only change was to recompile this package to use the libfixbuf{,-devel}-1.0.2 packages.
|
|
September 9, 2011:
The following have been released:
- regripper-20110830-1.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - regripper is a Windows Registry data extraction and correlation tool.
This version includes the version 20110830 plugins from here.
|
|
August 23, 2011:
The following have been released:
- ataraw-0.2.1-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - ATAraw
allows user-level Linux programs to send arbitrary commands to ATA and SATA devices. The system currently supports programmed IO and DMA modes,
but does not support asynchronous or multiple-queued commands.
- bloom-1.4.6-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Bloom
is an NPS bloom filter package that includes the frag_find utility.
- bulk_extractor-1.0.2-1.{fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - Bulk_extractor
is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file
system structures. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools. bulk_extractor
also created a histograms of features that it finds, as features that are more common tend to be more important.
- bulk_extractor-stoplist-1.0-1.{fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - Bulk_extractor-stoplist
is a context stop list for bulk_extractor.
- fiwalk-0.6.15-1.{fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - Fiwalk
is a program that processes a disk image using the SleuthKit library and outputs its results in
Digital Forensics XML, the Attribute Relationship File Format (ARFF) format used by the
Weka Datamining Toolkit, or an easy-to-read textual format.
- jafat-1.0-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - JAFAT
is an assortment of tools to assist in the forensc investigation of computer systems.
- log2timeline-0.60-2.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - Log2timeline is a framework for the automatic creation of a super timeline.
This version removes perl-Parse-Evtx since that is now a separate package.
- perl-Parse-Evtx-1.0.8-1.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - perl-Parse-Evtx
is a Windows Event Log Parser library and tools collection.
- tln_tools-20110729-1.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - tln_tools
are time line tools.
- Volatility-2.0.1-2.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. This version adds
the following plugins from the Malware Analyst's Cookbook:
- apihooks - API hooks
- callbacks - system-wide notification routines
- devicetree - device tree
- driverirp - IRP hook detection
- gdt - Global Descriptor Table
- idt - Interrupt Descriptor Table
- impscan - a module for imports (API calls)
- ldrmodules - unlinked DLLs
- malfind - hidden and injected code
- psxview - hidden processes with various process listings
- ssdt_ex - Hook Explorer for IDA Pro (and SSDT by thread)
- svcscan - for Windows services
- threads - _ETHREAD and _KTHREADs
These plugins required the following additional packages:
- yara-1.6-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
- yara-python-1.6-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Yara-python is a Python extension that
gives access to YARA's powerful features from Python scripts.
- distorm3-1.0-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Distorm3 is a lightweight,
easy-to-use and fast decomposer library. It disassembles instructions in 16, 32 and 64 bit modes. Supported instruction sets: FPU, MMX, SSE, SSE2,
SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX.
- xmount-0.4.5-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using
FUSE (Filesystem in Userspace)
that contains a virtual representation of the input image. The virtual representation can be in raw DD,
VirtualBox'svirtual disk file format or in
VMware's VMDK file format. Input images can be raw DD,
EWF (Expert Witness Compression Format) or
AFF (Advanced Forensic Format)
files. In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot
acquired harddisk images using QEMU, KVM,
VirtualBox, VMware or alike.
- CERT-Forensics-Tools-1.0-31.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - This package was updated to add these packages:
- ataraw
- bloom
- bulk_extractor (not for Fedora 12 nor CentOS/RHEL 5)
- bulk_extractor-stoplist (not for Fedora 12 nor CentOS/RHEL 5)
- fiwalk (not for Fedora 12 nor CentOS/RHEL 5)
- jafat
- perl-Parse-Evtx
- tln_tools
- xmount
|
|
August 16, 2011:
The following have been released:
- yaf{,-devel}-2.1.1-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Here are the changes in this version:
- Important bug fix for application labeling SSL plugin.
|
|
August 10, 2011:
The following have been released:
- dff-1.1.0-1.{fc12,fc13,fc14,fc15,el6}.{i386,x86_64}.rpm - The Digital Forensics Framework (DFF) is both
a digital investigation tool and a development platform. The framework is used by system administrators, law enforcement examinors, digital forensics researchers
and students, and security professionals world-wide. Written in Python and C++, it exclusively uses Open Source technologies. DFF combines an intuitive user
interface with a modular and cross-platform architecture. is a free and Open Source platform dedicated to digital forensic and eDiscovery sciences. The following
additional packages were change or installed in support of DFF:
- aff{lib,lib-devel,tools}-3.6.12-2.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Afflib is the library and tools to manipulate files
using the Advanced Forensic Format. This version includes static versions of the libraries.
- libpff-20110413-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Libpff is a library
and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal
Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
- libbfio{,devel}-20110625-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access. Static and dynamic versions of the libraries are provided.
- dc3dd-7.1.614.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64} - dc3dd is a patched version of GNU dd that
includes several features useful for computer forensics. New in this version are the following:
- Log output may be sent to multiple job logs and hash logs. Simply specify log=LOG and/or hlog=LOG more than once.
- Verification of an image restored to a device larger than the image is now supported. Specify phod=DEVICE to hash only
the bytes dc3dd writes to the device. Specify fhod=DEVICE to hash both the bytes dc3dd writes to the device and all
the bytes that follow, up to the end of the device.
- CERT-Forensics-Tools-1.0-30.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - This package was updated to add the
DFF package. Note that DFF is not provided for CentOS/RHEL version 5.
|
|
August 3, 2011:
The following have been released:
- Volatility-2.0-2.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm -
The Volatility Framework is a completely open collection of tools, implemented in
Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. This package was updated
because the versions for RHEL/CentOS were incorrectly configured.
- regripper-20110518-2.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - regripper is a Windows Registry data extraction and correlation tool.
This version installs all of the plugins available at this link.
- perl-DateTime-Format-WindowsFileTime-0.02-1.{fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm -
perl-DateTime-Format-WindowsFileTime converts a
Windows FILETIME into a DateTime object. The Windows FILETIME structure holds a date and time associated with a file. The structure identifies a 64-bit integer
specifying the number of 100-nanosecond intervals which have passed since January 1, 1601. This package was built and installed in support of regripper.
|
|
August 1, 2011:
The following has been released:
- Volatility-2.0-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm -
The Volatility Framework is a completely open collection of tools, implemented in
Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely
independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the
techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
See here for the list of changes.
|
|
July 29, 2011:
The following have been released:
- md5deep-3.9.2-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - This package was updated to reflect the new version of md5deep.
- yaf{,-devel}-2.1.0-1.{fc12,fc13,fc14,fc15,el5,el6}.{i386,x86_64}.rpm - Yaf is Yet Another Flowmeter and yaf is a suite of tools to do
flow metering. yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format. It reads packet data from
pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using pcap(3), an Endace DAG capture device, or a Napatech adapter,
aggregates these packets into flows, and exports flow records via IPFIX over SCTP, TCP or UDP, Spread, or into serialized IPFIX message streams (IPFIX
files) on the local file system.
Here are the changes in this version:
- New Information Element exported in every flow record, flowAttributes (CERT PEN 6871, IE 40).
- YAF now checks if a flow has fixed-size packets and exports this flag using the new flowAttributes Information Element (see yaf)
- Reset Application Label on UDP-uniflows for Deep Packet Inspection
- Fixed yafscii invalid parameter bug that may have existed on certain platforms
- Added VNC (RFB Protocol) application label
- DPI Enhancements
- FlowEndReason IPFIX field is now set to 31 for udp-uniflows
- For Cygwin: Added support for getting the yaf config directory via the Windows Registry
- Several other bug fixes
|
|
July 8, 2011:
The following has been released:
- guymager-0.5.9-1.{fc13,fc14,fc15,el5,el6}.{i686,x86_64}.rpm - Guymager is a forensic imaging package. Here are the changes
since the last release (0.5.7):
- The 2GiB limit for EWF files no longer exists (the max. size now is 8EiB)
- A new AutoExit function has been added. If activated, guymager ends as soon as all acquisitions terminated successfully.
By means of the program's exit code, a script might decide, for instance, to shut down the system. This feature is
interesting for acquisitions taking place overnight or during the weekend.
- A new menu point in Gnome allows for launching Guymager from the menu Application / System tools.
- The problems with UDisks under KDE / Kubuntu no longer exist.
|
|
June 23, 2011:
The following have been released:
- DropboxReader-1.0-1.{fc11,fc12,fc13,fc14,fc15,el5,el6}.noarch.rpm - The DropboxReader
package version 1.0 was installed for all supported architectures. Dropbox Reader is a suite of command-line tools for parsing configuration and cache files associated with
the Dropbox cloud storage software.
- CERT-Forensics-Tools-1.0-29.{fc11,fc12,fc13,fc14,fc15,el6,el6}.noarch.rpm - This package was updated to add the
DropboxReader package.
|
|
June 22, 2011:
The following have been released:
- grokevt-0.5.0-2.{fc11,fc12,fc13,fc14,fc15,el5,el6}.{i686,x86_64}.rpm - The grokevt
package version 0.5.0 was installed for all supported architectures.
Here are the changes since the previous version (0.4.1):
|
|
|
