March 27, 2020:
The following changes have been made:
- python{2,3}‑elasticsearch‑7.6.0‑1{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, python{2,36}‑elasticsearch‑7.6.0‑1.el7.x86_64.rpm, and python{2,3}‑elasticsearch‑7.6.0‑1.{fc31,el8}.x86_64.rpm -
ElasticSearch is the official low-level client for Elasticsearch.
Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
- python3-zmq{,-tests}-19.0.0-el8.x86_64.rpm -
ZMQ is the Python bindings for ØMQ. This documentation currently contains notes on some important aspects of developing PyZMQ and an overview of what the ØMQ API looks like in Python.
For information on how to use ØMQ in general, see the many examples in the excellent ØMQ Guide, all of which have a version in Python.
- pfring‑7.6.0‑2887.{el6,el7,el8}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.6.
- pfring‑dkms‑7.6.0‑2887.{el6,el7,el8}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.2.0‑2340.{el6,el7,el8}.x86_64.rpm -
ndpi is an open source LGPLv3 library for deep-packet inspection.
- yaf{,‑devel}‑2.11.0-4.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and yaf{,‑devel}-2.11.0-4.{fc31,el7,el8}.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
Note that for CentOS 6 and 7 for the x86_64 architecture, yaf has been built to use PF_Ring.
- snort-2.9.15.1-2.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-2.9.15.1-2.{fc31,el7,el8}.x86_64.rpm -
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
This release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture.
- snort-openappid-2.9.1.15-2.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.15.1-2.{fc31,el7,el8}.x86_64.rpm -
This is the snort package built with the following additions:
To install snort-openappid on your system, you must first remove snort.
Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi
sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
This release includes support for PF_Ring for CentOS/RHEL 6, 7, and 8 for the x86_64 architecture.
- fmem-kernel-modules-fc31-x86_64-1.6-1.16.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc31-x86_64-1.1.r17-16.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.34.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-34.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
March 21, 2020:
The following changes have been made:
- ddrescue-1.25-1.{fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm -
Ddrescue is a data recovery tool.
It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
See here for the changes since the last version (1.24) released to this repository.
- cutter-1.10.1-1.fc30.{i686,x86_64}.rpm and cutter-1.10.1-1.fc31.x86_64.rpm -
Cutter is a Qt and C++
GUI for radare2 reverse engineering framework.
These packages have been removed from the repository because they are now provided by Fedora by a package named cutter-re
- cutter-1.10.1-1.{fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and cutter-1.10.1-1.{el7,el8}.x86_64.rpm -
Cutter is a Qt and C++
GUI for radare2 reverse engineering framework.
These packages have been removed from the repository because they are now provided by a package named cutter-re to be consistent with the packages provided by Fedora.
- cutter-re-1.7.3-2.{fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and cutter-re-1.7.3-1.{el7,mel8}.x86_64.rpm -
Cutter is a Qt and C++
GUI for radare2 reverse engineering framework.
Its goal is making an advanced, customizable, and FOSS (free and open-source software) reverse-engineering platform while keeping the user experience at mind.
Cutter is created by reverse engineers for reverse engineers.
This version of cutter is based on the code dated 2019-01-15 which was built to embed radare2 version 2.6.0 in it.
This release provides the same files as cutter-1.7.3-1 except that the package is renamed to be consistent with the packages provided by Fedora.
- CERT-Forensics-Tools-1.0-88.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-88.{fc31,el7,el8}.x86_64.rpm -
This relese does the following:
- Obsoletes cutter.
- Added cutter-re
- aeskeyfind-1.0-3.{fc31,el7,el8}.x86_64.rpm and aeskeyfind-1.0-3.fc30.{i686,x86_64}.rpm -
Aeskeyfind
illustrates automatic techniques for locating 128-bit and 256-bit AES keys in a captured memory image.
This package has been removed form the repository because it is now provided by Fedora.
- fmem-kernel-modules-fc31-x86_64-1.6-1.15.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc31-x86_64-1.1.r17-15.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.33.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-33.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.64.noarch.rpm -
Due to configuration errors, support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-64.noarch.rpm -
Due to configuration errors, support for the following kernels were added for LiME:
|
|
March 13, 2020:
The following changes have been made:
- pfring‑7.6.0‑2867.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.6.
- pfring‑dkms‑7.6.0‑2867.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.2.0‑2314.{el6,el7}.x86_64.rpm -
ndpi is an open source LGPLv3 library for deep-packet inspection.
- pfring‑7.6.0‑2867.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.6.
- pfring‑dkms‑7.6.0‑2867.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.2.0‑2314.{el6,el7}.x86_64.rpm -
ndpi is an open source LGPLv3 library for deep-packet inspection.
- fmem-kernel-modules-fc31-x86_64-1.6-1.14.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc31-x86_64-1.1.r17-14.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.32.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-32.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.63.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-63.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 4, 2020:
The following changes have been made:
- python3‑dfvfs-20200211-1.{fc26,fc27,fc28,fc29,fc30,fc31,el8}.noarch.rpm and python36‑dfvfs‑20200211‑1.el7.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to
file-system objects from various storage media types and file formats.
- plaso‑20200227‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso‑20200227‑1.{fc31,el7,el8}.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
- pfring‑7.6.0‑2853.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.6.
- pfring‑dkms‑7.6.0‑2853.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.2.0‑2295.{el6,el7}.x86_64.rpm -
ndpi is an open source LGPLv3 library for deep-packet inspection.
- fmem-kernel-modules-fc31-x86_64-1.6-1.13.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.5.7-200 for FC31
- 5.5.6-201 for FC31
- lime-kernel-modules-fc31-x86_64-1.1.r17-13.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.5.7-200 for FC31
- 5.5.6-201 for FC31
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.31.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.5.7-100 for FC30
- 5.5.6-100 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-31.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.5.7-100 for FC30
- 5.5.6-100 for FC30
|
|
February 28, 2020:
The following changes have been made:
- libfsntfs{,‑devel,‑python3}‑20200223‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2}‑20200223‑1.el6.{i686,x86_64}.rpm,libfsntfs{,‑devel,‑python36}‑20200223‑1.el7.x86_64.rpm, and libfsntfs{,‑devel,‑python3}‑20200223‑1.{fc31,el8}.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
- python3-xlsxwriter-1.2.8-1.{fc26,fc27,fc28,fc29,fc30,el8}.noarch.rpm and python36-xlsxwriter-1.2.8-1.el7.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
Note that the Python 2 version is no longer provided.
- python{2,3}-future-0.18.2-1.{fc31,el8}.noarch.rpm -
Python-Future is the missing compatibility layer between Python 2 and Python 3.
It allows you to use a single, clean Python 3.x-compatible codebase to support both Python 2 and Python 3 with minimal overhead.
This package was built to support the packaging of Python-PEFile
which in turn is needed to support the packaging of Volatility-community-plugins.
- python3-idna-2.9-1.{fc26,fc27,fc28,el7,el8}.noarch.rpm -
IDNA provides support for the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891.
This is the latest version of the protocol and is sometimes referred to as “IDNA 2008”.
- python36-psutil-5.7.0-1.el7.x86_64.rpm -
Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network)in Python.
Note that the Python 2 version is no longer provided.
- python{2,3}-requests-2.23.0-1.fc26.{i686,x86_64}.rpm and python36-requests-2.23.0-1.el7.x86_64.rpm -
Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings.
Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web.
It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.19.0‑3.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.19.0‑3.{fc31,el7,el8}.x86_64.rpm and -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
Note: The version of SiLK that was released on 2019-10-24 contained some bugs that were fixed in the version dated 2019-10-28.
This release contains those fixes.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.19.0‑4.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.19.0‑4.{fc31,el6,el7,el8}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
Note: The version of SiLK that was released on 2019-10-24 contained some bugs that were fixed in the version dated 2019-10-28.
This release contains those fixes.
- analysis‑pipeline‑5.11.3-3.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and analysis‑pipeline‑5.11.3-3.{fc31,el7,el8}.x86_64.rpm -
The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
This package was rebuilt to use silk 3.19.0 release 3.
- prism-1.2-8.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and prism-1.2-8.{fc31,el7,el8}.x86_64.rpm -
The prism trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool.
The script can be used directly, or might be used as a component in other more specialized scripts.
In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup.
This package was rebuilt to use silk 3.19.0.
- super_mediator‑1.7.1‑2.{fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator‑1.7.1‑2.{fc31,el7,el8}.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
See here for a list of changes in this version.
- fmem-kernel-modules-common-1.6-1.5.noarch.rpm -
Fmem is kernel module that creates device /dev/fmem, similar to /dev/mem but without limitations.
This package contains the source code for making the FMEM kernel modules and the install-fmem script.
The changes are the following:
- LiME code up to date as of February 28, 2020 which incorporates changes for Linux 5.5 kernels.
- pfring‑7.6.0‑2852.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.6.
- pfring‑dkms‑7.6.0‑2852.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.2.0‑2295.{el6,el7}.x86_64.rpm -
ndpi is an open source LGPLv3 library for deep-packet inspection.
- fmem-kernel-modules-fc31-x86_64-1.6-1.12.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc31-x86_64-1.1.r17-12.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.30.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-30.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
February 21, 2020:
The following changes have been made:
- cutter-1.10.1-1.fc30.{i686,x86_64}.rpm and cutter-1.10.1-1.fc31.x86_64.rpm -
Cutter is a Qt and C++
GUI for radare2 reverse engineering framework.
Its goal is making an advanced, customizable, and FOSS (free and open-source software) reverse-engineering platform while keeping the user experience at mind.
Cutter is created by reverse engineers for reverse engineers.
Note that this release is only available for Fedora 30 and 31 because it relies on Qt version 5.12.
- ghidra-9.1.2-PUBLIC_20200212.1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and ghidra-9.1.2-PUBLIC_20200212.1{fc26,fc31,el7,el8}.x86_64.rpm -
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms
including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features.
Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes.
Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.
See the list of changes and improvement here.
- pfring‑7.6.0‑2845.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.6.
- pfring‑dkms‑7.6.0‑2845.{el6,el7}.x86_64.rpm -
PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.2.0‑2284.{el6,el7}.x86_64.rpm -
ndpi is an open source LGPLv3 library for deep-packet inspection.
- fmem-kernel-modules-fc31-x86_64-1.6-1.11.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.4.20-200 for FC31
- 5.4.19-200 for FC31
- lime-kernel-modules-fc31-x86_64-1.1.r17-11.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.4.20-200 for FC31
- 5.4.19-200 for FC31
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.29.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-29.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
February 17, 2020:
The following changes have been made:
- Volatility-community-plugins-20190729-4.{fc26,fc27,fc28,fc29,fc30,fc31,el6,el7,el8}.noarch.rpm -
The Volatility Community Plugins is a collection of Volatility plugins written and maintained by authors in the forensics community.
This package was updated to reflect the removal of python2-simplejson from EPEL for CentOS/RHEL 8.
No changes were made for any of the other provided systems.
|
|
February 14, 2020:
The following changes have been made:
- python3‑artifacts‑20200118‑2.{fc26,fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm, artifacts‑data‑20200118‑2.{fc26,fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm,
python36‑artifacts‑20200118‑2.el7.x86_64.rpm, artifacts‑data‑20200118‑2.el7.x86_64.rpm, -
python3‑artifacts‑20200118‑2.{fc31,el8}.x86_64.rpm, artifacts‑data‑20200118‑2.{fc31,el8}.x86_64.rpm, -
Artifacts is a free, community-sourced,
machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
Note that the Python 2 version is no longer provided.
- python{2,3}-cffi-1.14.0-1.el8.x86_64.rpm and cffi-doc-1.14.0-1.el8.noarch.rpm -
Python-CFFI is a C Foreign Function Interface for Python.
Interact with almost any C code from Python, based on C-like declarations that you can often copy-paste from header files or documentation.
- python3‑dfdatetime‑20200121‑2.{fc26,fc27,fc28,fc29,fc30,fc31,el8}.noarch.rpm and python36‑dfdatetime‑20200121‑2.el7.noarch.rpm -
dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
Note that the Python 2 version is no longer provided.
- python3‑dfvfs-20200121-2.{fc26,fc27,fc28,fc29,fc30,fc31,el8}.noarch.rpm and python36‑dfvfs‑20200121‑2.el7.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to
file-system objects from various storage media types and file formats.
Note that the Python 2 version is no longer provided.
- python3‑dfwinreg‑20200121‑2.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36‑dfwinreg‑20190714‑2.el7.x86_64.rpm, and python3‑dfwinreg‑20190714‑2.{fc31,el8}.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
Note that the Python 2 version is no longer provided.
- python3‑dfwinreg‑20200121‑2.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36‑dfwinreg‑20190714‑2.el7.x86_64.rpm, and python3‑dfwinreg‑20190714‑2.{fc31,el8}.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
Note that the Python 2 version is no longer provided.
- python3‑dtfabric‑20200119‑2.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36‑dtfabric‑20200119‑2.el7.x86_64.rpm, and python3‑dtfabric‑20200119‑2.{fc31,el8}.x86_64.rpm -
Dtfabric is a project to manage data types and structures,
as used in the libyal projects.
Note that the Python 2 version is no longer provided.
- libfsntfs{,‑devel,‑python3}‑20200201‑2.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2}‑20200201‑2.el6.{i686,x86_64}.rpm,libfsntfs{,‑devel,‑python36}‑20200201‑2.el7.x86_64.rpm, and libfsntfs{,‑devel,‑python3}‑20200201‑2.{fc31,el8}.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
Note that the Python 2 version is no longer provided.
- zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-3.0.1-0.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libbroker-devel-3.0.1-0.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, zeek{,-core,ctl,-debugsource,-devel,-libcaf-devel}-3.0.1-0.{fc31,el7,el8}.x86_64.rpm, and libbroker-devel-3.0.1-0.{fc31,el7,el8}.x86_64.rpm -
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well.
Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception.
Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
Zeek was originally developed by Vern Paxson.
Robin Sommer now leads the project, jointly with a core team of researchers and developers at the
International Computer Science Institute in Berkeley, CA; and the
National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: zeeo packages install files in /opt/zeeo.
To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/zeeo/bin && ! "$PATH" =~ /opt/zeeo/bin ]] && PATH=$PATH:/opt/zeeo/bin
[[ -d /opt/zeeo/share/man && ! "$MANPATH" =~ /opt/zeeo/share/man ]] && MANPATH=$MANPATH:/opt/zeeo/share/man
Then run:
. ~/.bashrc
- python{2,3}‑elasticsearch‑7.5.1‑1{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, python{2,36}‑elasticsearch‑7.5.1‑1.el7.x86_64.rpm, and python{2,3}‑elasticsearch‑7.5.1‑1.{fc31,el8}.x86_64.rpm -
ElasticSearch is the official low-level client for Elasticsearch.
Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
- libluksde{,‑devel,‑python3,‑tools}‑20200205‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libluksde{,‑devel,‑python2,‑tools}‑20200205‑1.el6.{i686,x86_64}.rpm, libluksde{,‑devel,‑python36,‑tools}‑20200205‑1.el7.x86_64.rpm, and libluksde{,‑devel,‑python3,‑tools}‑20200205‑1.{fc31,el8}.x86_64.rpm -
Libluksde is a library and tools used to access LUKS Disk Encryption encrypted volumes.
Note that the Python 2 version is only provided for CentOS/RHEL 6.
- libsmdev{,‑devel,‑python3}‑20200210‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2}‑20200210‑1.el6.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python36}‑20200210‑1.el7.x86_64.rpm, and libsmdev{,‑devel,‑python3}‑20200210‑1.{fc31,el8}.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
Note that the Python 2 version is only provided for CentOS/RHEL 6.
- python36-lz4-3.0.2-1.el7.x86_64.rpm -
LZ4 contains the python bindings for the lz4 compression library.
Note that the Python 2 version is no longer provided.
- sleuthkit{,‑devel,‑libs}‑4.8.0‑1.1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and sleuthkit{,‑devel,‑libs}‑4.8.0‑1.1.{fc31,el7.x86_64.rpm -
The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
Note that CentOS/RHEL 6 is no longer being udpated.
- autopsy-4.14.0-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and autopsy-4.14.0-1.{fc31,el7,el8}.x86_64.rpm -
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer.
You can even use it to recover photos from your camera's memory card.
Note: this release no longer requires JDK from Oracle for Fedora 25 through 30, relying instead on version 1.8.0 of OpenJDK version provided by Fedora, along with version 1.8.0 of OpenJFX, also provided by Fedora.
However, for CentOS/RHEL 7 and 8,the latest version of JDK 8 from Oracle is required and this package has been added to the appropriate repositories.
In addition, this release also contains a autopsy.desktopfile that supports the GNOME and Mate Window managers.
Further, note that CentOS/RHEL 6 is no longer being udpated.
- python3-pytsk3‑20200117‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python36-pytsk3‑20200117-1.el7.x86_64.rpm, and python3-pytsk3‑20200117-1.{fc31,el7,el8}.x86_64.rpm -
Pytsk is Python bindings for The Sleuth Kit.
- python3-idna-2.8-1.{fc26,fc27,fc28,el7,el8}.noarch.rpm -
IDNA provides support for the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891. This is the latest version of the protocol and is sometimes referred to as “IDNA 2008”.
- python{2,3}-requests-2.22.0-3.fc26.{i686,x86_64}.rpm and python36-requests-2.22.0-3.el7.x86_64.rpm -
Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings.
Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web.
It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
- plaso‑20200121‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso‑20200121‑1.{fc31,el7,el8}.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
- CERT-Forensics-Tools-1.0-87.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-87.{fc31,el7,el8}.x86_64.rpm -
The registerydecoder package was removed due to its dependence on Python 2.
- pfring‑7.4.0‑2835.el7.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2835.el7.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
Here is the announcement of PF_Ring 7.4.
- pfring‑7.4.0‑2836.el6.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2836.el6.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2242.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
- fmem-kernel-modules-fc31-x86_64-1.6-1.10.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.4.18-200 for FC31
- 5.4.17-200 for FC31
- 5.4.15-200 for FC31
- 5.4.14-200 for FC31
- 5.4.13-201 for FC31
- 5.4.12-200 for FC31
- lime-kernel-modules-fc31-x86_64-1.1.r17-10.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.4.18-200 for FC31
- 5.4.17-200 for FC31
- 5.4.15-200 for FC31
- 5.4.14-200 for FC31
- 5.4.13-201 for FC31
- 5.4.12-200 for FC31
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.28.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.4.18-100 for FC30
- 5.4.17-100 for FC30
- 5.4.14-100 for FC30
- 5.4.12-100 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-28.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.4.18-100 for FC30
- 5.4.17-100 for FC30
- 5.4.14-100 for FC30
- 5.4.12-100 for FC30
- fmem-kernel-modules-el7-x86_64-1.6-1.63.noarch.rpm -
Due to configuration errors, support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-63.noarch.rpm -
Due to configuration errors, support for the following kernels were added for LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.62.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-62.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
January 17, 2020:
The following changes have been made:
- fmem-kernel-modules-fc31-x86_64-1.6-1.9.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc31-x86_64-1.1.r17-9.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.27.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-27.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el8-x86_64-1.6-1.4.noarch.rpm -
Support for the following kernels were added for Fmem:
- 4.18.0-147.3.1 for EL8
- 4.18.0-147.0.3 for EL8
- 4.18.0-147 for EL8
- lime-kernel-modules-el8-x86_64-1.1.r17-4.noarch.rpm -
Support for the following kernels were added for LiME:
- 4.18.0-147.3.1 for EL8
- 4.18.0-147.0.3 for EL8
- 4.18.0-147 for EL8
|
|
January 10, 2020:
The following changes have been made:
- snort-2.9.15.1-1.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-2.9.15.1-1.{fc31,el7,el8}.x86_64.rpm -
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
This release includes support for PF_Ring for CentOS/RHEL 6 and 7 for the x86_64 architecture.
- snort-sample-rules-2.9.15.1-1.{fc26,fc27,fc28,fc29,fc30,fc31,el6,el7,el8}.noarch.rpm -
These rules are sample rules only and are intended to allow snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- snort-openappid-2.9.1.15-1.{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.15.1-1.{fc31,el7,el8}.x86_64.rpm -
This is the snort package built with the following additions:
To install snort-openappid on your system, you must first remove snort.
Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi
sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
- pfring‑7.4.0‑2804.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2804.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2155.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
- fmem-kernel-modules-fc31-x86_64-1.6-1.8.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.4.8-200 for FC31
- 5.4.7-200 for FC31
- lime-kernel-modules-fc31-x86_64-1.1.r17-8.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.4.8-200 for FC31
- 5.4.7-200 for FC31
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.26.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-26.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
January 3, 2020:
The following changes have been made:
- libluksde{,‑devel,‑python2,‑python3,‑tools}‑20200101‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libluksde{,‑devel,‑python2,‑tools}‑20200101‑1.el6.{i686,x86_64}.rpm, libluksde{,‑devel,‑python2,‑python36,‑tools}‑20200101‑1.el7.x86_64.rpm, and libluksde{,‑devel,‑python2,‑python3,‑tools}‑20200101‑1.{fc31,el8}.x86_64.rpm -
Libluksde is a library and tools used to access LUKS Disk Encryption encrypted volumes.
- libvslvm{,‑devel,‑python2,‑python3}‑20200102‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python2}‑20200102‑1.el6.{i686,x86_64}.rpm , libvslvm{,‑devel,‑python2,‑python36}‑20200102‑1.el7.x86_64.rpm, and libvslvm{,‑devel,‑python2,‑python3}‑20200102‑1.{fc31,el8}.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
|
|
December 27, 2019:
The following changes have been made:
- libbde{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libbde{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libbde{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libbde{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
- libesedb{,‑devel,‑python2,‑python3}‑20192120‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libesedb{,‑devel,‑python2}‑20192120‑1.el6.{i686,x86_64}.rpm , libesedb{,‑devel,‑python2,‑python36}‑20192120‑1.el7.x86_64.rpm, and libesedb{,‑devel,‑python2,‑python3}‑20192120‑1.{fc31,el8}.x86_64.rpm -
Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
- libevt{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevt{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libevt{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libevt{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
- libevtx{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libevtx{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libevtx{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
- libexe{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libexe{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libexe{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libexe{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libexe is a library and tools to access the executable (EXE) format.
- libfsapfs{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libfsapfs{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libfsapfs{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
- libfsntfs{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libfsntfs{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libfsntfs{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
- libfvde{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfvde{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libfvde{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libfvde{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libfvde is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
- libfwnt{,‑devel,‑python2,‑python3}‑20191222‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python2}‑20191222‑1.el6.{i686,x86_64}.rpm , libfwnt{,‑devel,‑python2,‑python36}‑20191222‑1.el7.x86_64.rpm, and libfwnt{,‑devel,‑python2,‑python3}‑20191222‑1.{fc31,el8}.x86_64.rpm -
LibFWNT is a library for Windows NT data types.
- libfwps{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwps{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libfwps{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libfwps{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
LibFWPS is a library for Windows Property Store data types.
- libfwsi{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libfwsi{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libfwsi{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
- liblnk{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , liblnk{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and liblnk{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
- libmsiecf{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libmsiecf{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libmsiecf{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
- libolecf{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libolecf{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libolecf{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
- libqcow{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libqcow{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libqcow{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
- libregf{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libregf{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libregf{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libregf{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- libsigscan{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libsigscan{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libsigscan{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libsigscan is a library and tools used to binary signature scanning.
- libsmdev{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libsmdev{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libsmdev{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
- libsmraw{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libsmraw{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libsmraw{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
- libvhdi{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libvhdi{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libvhdi{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
- libvmdk{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libvmdk{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libvmdk{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
- libvshadow{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libvshadow{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libvshadow{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
- libvslvm{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libvslvm{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libvslvm{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
- libwrc{,‑devel,‑python2,‑python3}‑20191221‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libwrc{,‑devel,‑python2}‑20191221‑1.el6.{i686,x86_64}.rpm , libwrc{,‑devel,‑python2,‑python36}‑20191221‑1.el7.x86_64.rpm, and libwrc{,‑devel,‑python2,‑python3}‑20191221‑1.{fc31,el8}.x86_64.rpm -
Libwrc is a library and tools to access the Windows Resource Compiler (WRC) format.
- plaso‑20191203‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso‑20191203‑1.{fc31,el7,el8}.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
- python{2,3}-xlsxwriter-1.2.7-1.{fc26,fc27,fc28,fc29,fc30,el8}.noarch.rpm and python{2,36}-xlsxwriter-1.2.7-1.el7.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- libscca{,‑devel,‑python2,‑python3,‑tools}‑20191222‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, ibscca{,‑devel,‑python2,‑tools}‑20191222‑1.el6.{i686,x86_64}.rpm, libscca{,‑devel,‑python2,‑python36,‑tools}‑20191222‑1.el7.x86_64.rpm, and libscca{,‑devel,‑python2,‑python3,‑tools}‑20191222‑1.{fc31,el8}.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
- python{2,3}-pyparsing-2.4.6-1.{fc26,fc27,fc28,fc29,fc30,fc31,,el8}.noarch.rpm, python{2,36}-pyparsing-2.4.6-1.el7.noarch.rpm, and pyparsing-doc-2.4.6-1.{fc26,fc27,fc28,fc29,fc30,fc31,el7,el8}.noarch.rpm -
Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
The pyparsing module provides a library of classes that client code uses to construct the grammar directly in Python code.
- pfring‑7.4.0‑2795.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2795.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2144.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.61.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-61.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
December 20, 2019:
The following changes have been made:
- libfwnt{,‑devel,‑python2,‑python3}‑20191219‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python2}‑20191219‑1.el6.{i686,x86_64}.rpm , libfwnt{,‑devel,‑python2,‑python36}‑20191219‑1.el7.x86_64.rpm, and libfwnt{,‑devel,‑python2,‑python3}‑20191219‑1.{fc31,el8}.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
- libfsntfs{,‑devel,‑python2,‑python3,‑tools}‑20191218‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2,‑tools}‑20191218‑1.el6.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2,‑python36,‑tools}‑20191218‑1.el7.x86_64.rpm, and libfsntfs{,‑devel,‑python2,‑python3,‑tools}‑20191218‑1.{fc31,el8}.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
- fmem-kernel-modules-fc31-x86_64-1.6-1.7.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc31-x86_64-1.1.r17-7.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.25.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-25.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.62.noarch.rpm -
Due to configuration errors, support for the following kernels were added for Fmem:
- 3.10.0-1062.9.1 for EL7
- 3.10.0-1062.7.1 for EL7
- 3.10.0-1062.4.2 for EL7
- lime-kernel-modules-el7-x86_64-1.1.r17-62.noarch.rpm -
Due to configuration errors, support for the following kernels were added for LiME:
- 3.10.0-1062.9.1 for EL7
- 3.10.0-1062.7.1 for EL7
- 3.10.0-1062.4.2 for EL7
|
|
December 12, 2019:
The following changes have been made:
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20191209-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20191209-1.el6.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑python36,‑tools}-20191209-1.el7.x86_64.rpm, liblnk{,‑devel,‑python2,‑python3,‑tools}-20191209-1.{fc31,el8}.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
- pfring‑7.4.0‑2780.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2780.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2120.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc31-x86_64-1.6-1.6.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc31-x86_64-1.1.r17-6.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.24.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.3.15-200 for FC30
- 5.3.14-200 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-24.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.3.15-200 for FC30
- 5.3.14-200 for FC30
- fmem-kernel-modules-el7-x86_64-1.6-1.61.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-61.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
December 7, 2019:
The following changes have been made:
- pfring‑7.4.0‑2774.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2774.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2104.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
|
|
December 6, 2019:
The following changes have been made:
- certifi‑2019.11.28‑1.{fc26,fc27,fc28,fc29,fc30,fc31,el7,el8}.noarch.rpm -
Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
- libfsntfs{,‑devel,‑python2,‑python3,‑tools}‑20191201‑1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2,‑tools}‑20191201‑1.el6.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2,‑python36,‑tools}‑20191201‑1.el7.x86_64.rpm, and libfsntfs{,‑devel,‑python2,‑python3,‑tools}‑20191201‑1.{fc31,el8}.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20191203-1.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20191203-1.el6.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑python36,‑tools}-20191203-1.el7.x86_64.rpm, liblnk{,‑devel,‑python2,‑python3,‑tools}-20191203-1.{fc31,el8}.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
- fmem-kernel-modules-fc31-x86_64-1.6-1.5.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.3.14-300 for FC31
- 5.3.13-300 for FC31
- lime-kernel-modules-fc31-x86_64-1.1.r17-5.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.3.14-300 for FC31
- 5.3.13-300 for FC31
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.23.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-23.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.60.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-60.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
|
November 27, 2019:
The following changes have been made:
python{2,3}-psutil-5.6.7-1.el7.x86_64.rpm -
Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network)in Python.
pfring‑7.4.0‑2768.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
pfring‑dkms‑7.4.0‑2768.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
ndpi‑3.0.0‑2086.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
fmem-kernel-modules-fc31-x86_64-1.6-1.4.noarch.rpm -
Support for the following kernels were added for Fmem:
lime-kernel-modules-fc31-x86_64-1.1.r17-4.noarch.rpm -
Support for the following kernels were added for LiME:
fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.22.noarch.rpm -
Support for the following kernels were added for Fmem:
lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-22.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
November 22, 2019:
The following changes have been made:
- python{2,3}‑elasticsearch‑7.1.0‑1.i{fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, python{2,36}‑elasticsearch‑7.1.0‑1.el7.x86_64.rpm, and python{2,3}‑elasticsearch‑7.1.0‑1.{fc31,el8}.x86_64.rpm -
ElasticSearch is the official low-level client for Elasticsearch.
Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
- python{2,3}-xlsxwriter-1.2.6-1.{fc26,fc27,fc28,fc29,fc30,el7,el8}.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- python3-zmq{,-tests}-18.1.1-el8.x86_64.rpm and zmq{,-tests}-18.1.1-el8.x86_64.rpm -
ZMQ is the Python bindings for ØMQ. This documentation currently contains notes on some important aspects of developing PyZMQ and an overview of what the ØMQ API looks like in Python.
For information on how to use ØMQ in general, see the many examples in the excellent ØMQ Guide, all of which have a version in Python.
- python2-haystack-0.42-3.{fc25,fc26,fc26,fc27,fc28,fc29,fc30,fc31,el6,el7,el8}.noarch.rpm -
Python-Haystack is an heap analysis framework, focused on searching and reversing of C structure in allcoated memory.
- libffi{,-devel}-3.1-19.el8.x86_64.rpm -
Libffi is a portable foreign function interface library.
This package was built to support the packaging of python-cffi.
- python{2,3}-ply-3.11-2.el8.noarch.rpm -
Python-PLY is an implementation of lex and yacc parsing tools for Python.
This package was built to support the packaging of Python-PYCParser.
- python{2,3}-pycparser-2.14-18.el8.noarch.rpm -
Python-PYCParser is a complete C99 parser in pure Python.
This package was built to support the packaging of Python-CFFI.
- python{2,3}-cffi-1.11.5-7.el8.x86_64.rpm and python-cffi-doc-1.11.5-7.el8.noarch.rpm -
Python-CFFI is a C Foreign Function Interface for Python.
Interact with almost any C code from Python, based on C-like declarations that you can often copy-paste from header files or documentation.
This package was built to support the packaging of python-ssdeep.
- python{2,3}-ssdeep-3.2-1.el8.x86_64.rpm -
Python-SSDeep is a Python wrapper for SSDeep fuzzy hashing library.
This package was built to support the packaging of Volatility-community-plugins.
- python2-dpapick-0.3-1.{fc25,fc26,fc26,fc27,fc28,fc29,fc30,fc31,el6,el7,el8}.noarch.rpm -
Python-DPAPick is a Python toolkit to provide a platform-independant implementation of Microsoft's cryptography subsytem called DPAPI (Data Protection API).
This package was built to support the packaging of Volatility-community-plugins.
- python2-ioc_writer-0.3.3-1.{fc25,fc26,fc26,fc27,fc28,fc29,fc30,fc31,el6,el7,el8}.noarch.rpm -
Python-IOCWriter is a Python library that provides a limited CRUD for manipulating OpenIOC formatted Indicators of Compromise.
This package was built to support the packaging of Volatility-community-plugins.
- python2-pycoin-0.77-0.{fc25,fc26,fc26,fc27,fc28,fc29,fc30,fc31,el6,el7,el8}.noarch.rpm -
Python-PYCoin is a Python library implements many of utilities useful when dealing with bitcoin and some bitcoin-like alt-coins.
It has been tested with Python 2.7, 3.6 and 3.7.
This package was built to support the packaging of Volatility-community-plugins.
- python2-colorama-0.3.9-4.el8.noarch.rpm -
Python-Colorama is a Python library that makes ANSI escape character sequences (for producing colored terminal text and cursor positioning) work under MS Windows.
This package was built to support the packaging of Volatility-community-plugins.
- python{2,3}-m2crypto-0.30.1-2.el8.x86_64.rpm -
M2Crypto is a Python library that allows you to call OpenSSL functions from Python 2 and 3 scripts.
This package was built to support the packaging of Python-Typing.
- python2-typing-3.6.2-4.el8.noarch.rpm -
Python-Typing is a Python library that defines a standard notation for type annotations.
This package was built to support the packaging of Volatility-community-plugins.
- python{2,3}-future-0.16.0-4.el8.noarch.rpm -
Python-Future is the missing compatibility layer between Python 2 and Python 3.
It allows you to use a single, clean Python 3.x-compatible codebase to support both Python 2 and Python 3 with minimal overhead.
This package was built to support the packaging of Python-PEFile
which in turn is needed to support the packaging of Volatility-community-plugins.
- Volatility-community-plugins-20190729-3.el8.noarch.rpm -
The Volatility Community Plugins is a collection of Volatility plugins written and maintained by authors in the forensics community.
This packages was added to CentOS/RHEL 8.
- python{2,3}-pyfixbuf-0.8.1-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, python2-pyfixbuf-0.8.1-1.el6.{i686,x86_64}.rpm, python{2,36}-pyfixbuf-0.8.1-1.el7.x86_64.rpm -
Pyfixbuf is a Python API for libfixbuf,
an implementation of the IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this and all releases.
- ghidra-9.1-PUBLIC_20191023.1.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and ghidra-9.1-PUBLIC_20191023.1.{fc25,fc26,fc31,el7,el8}.x86_64.rpm -
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms
including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features.
Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes.
Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.
See the list of changes and improvement here.
- python{2,3}-requests-2.22.0-2.fc26.{i686,x86_64}.rpm and python36-requests-2.22.0-2.el7.x86_64.rpm -
Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings.
Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web.
It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
In this release, the dependencies for urllib3 were updated.
- plaso‑20190916‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso‑20190708‑1.{fc31,el7,el8}.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release uses Python 3 instead of Python 2.
Please note that for Fedora 25, of all of the ancillary packages needed by plaso use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
For Fedora 25, this package contains a program named update-plaso, the purpose of which is to update the packages that plaso depends upon.
Note that this updates the dependent packages but not plaso.
The recommendation is to run update-plaso routinely to keep the plaso dependencies updated.
|
|
November 15, 2019:
The following changes have been made:
- python{2,3}-xlsxwriter-1.2.5-1.{fc26,fc27,fc28,fc29,fc30,fc31,el7,el8}.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- python{2,3}-pyparsing-2.4.5-1.{fc26,fc27,fc28,fc29,el8}.noarch.rpm, python2-pyparsing-2.4.4-1.el6.noarch.rpm, and pyparsing-doc-2.4.4-1.{fc26,fc27,fc28,fc29,el6,el8}.noarch.rpm -
Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
The pyparsing module provides a library of classes that client code uses to construct the grammar directly in Python code.
- libesedb{,‑devel,‑python2,‑python3,‑tools}‑20191111‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libesedb{,‑devel,‑python2,‑tools}‑20191111‑1.el6.{i686,x86_64}.rpm, libesedb{,‑devel,‑python2,‑python36,‑tools}‑20191111‑1.el7.x86_64.rpm, and libesedb{,‑devel,‑python2,‑python3,‑tools}‑20191111‑1.el8.x86_64.rpm -
Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
- libsmdev{,‑devel,‑python2,‑python3,‑tools}‑20191112‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑tools}‑20191112‑1.el6.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑python36,‑tools}‑20191112‑1.el7.x86_64.rpm, and libsmdev{,‑devel,‑python2,‑python3,‑tools}‑20191112‑1.el8.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
- pfring‑7.4.0‑2751.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2751.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2057.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc31-x86_64-1.6-1.3.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.3.11-300 for FC31
- 5.3.9-300 for FC31
- lime-kernel-modules-fc31-x86_64-1.1.r17-3.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.3.11-300 for FC31
- 5.3.9-300 for FC31
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.21.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-21.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.37.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-37.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.59.noarch.rpm -
Support for the following kernels were added for Fmem:
- 3.10.0-1062.4.3 for EL7
- 3.10.0-1062.4.2 for EL7
- lime-kernel-modules-el7-x86_64-1.1.r17-59.noarch.rpm -
Support for the following kernels were added for LiME:
- 3.10.0-1062.4.3 for EL7
- 3.10.0-1062.4.2 for EL7
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.60.noarch.rpm - Support for the following kernels were added for
Fmem:
- 2.6.32-754.23.3 for EL6
- 2.6.32-754.23.2 for EL6
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-60.noarch.rpm - Support for the following kernels were added for
LiME:
- 2.6.32-754.23.3 for EL6
- 2.6.32-754.23.2 for EL6
|
|
November 8, 2019:
The following changes have been made:
- daq{,‑devel,‑modules}‑2.0.6‑8.1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and daq{,‑devel,‑modules}‑2.0.6‑8.1.{el7,el8}.x86_64.rpm -
The Data Acquisition Library (Daq) is a library used by snort.
- libregf{,‑devel,‑python2,‑python3,‑tools}‑20191102‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libregf{,‑devel,‑python2,‑tools}‑20191102‑1.el6.{i686,x86_64}.rpm, libregf{,‑devel,‑python2,‑python36‑tools}‑20191102‑1.el7.x86_64.rpm, and libregf{,‑devel,‑python2,‑python3‑tools}‑20191102‑1.el8.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- libsmdev{,‑devel,‑python2,‑python3,‑tools}‑20191103‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑tools}‑20191103‑1.el6.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑python36,‑tools}‑20191103‑1.el7.x86_64.rpm, and libsmdev{,‑devel,‑python2,‑python3,‑tools}‑20191103‑1.el8.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
- libsmraw{,‑devel,‑python2,‑python3,‑tools}‑20191103‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python2,‑tools}‑20191103‑1.el6.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python2,‑python36,‑tools}‑20191103‑1.el7.x86_64.rpm, and libsmraw{,‑devel,‑python2,‑python3,‑tools}‑20191103‑1.el8.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
- libvshadow{,‑devel,‑python2,‑python3,‑tools}‑20191103‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python2,‑tools}‑20191103‑1.el6.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python2,‑python36,‑tools}‑20191103‑1.el7.x86_64.rpm, and libvshadow{,‑devel,‑python2,‑python3,‑tools}‑20191103‑1.el8.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
- libqcow{,‑devel,‑python2,‑python3,‑tools}‑20191103‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python2,‑tools}‑20191103‑1.el6.{i686,x86_64}.rpm, libqcow{,‑devel,‑python2,‑python36,‑tools}‑20191103‑1.el7.x86_64.rpm, and libqcow{,‑devel,‑python2,‑python3,‑tools}‑20191103‑1.el8.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
- libfsapfs{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2,‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2,‑python36,‑tools}‑20191104‑1.el7.x86_64.rpm, and libfsapfs{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.el8.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
- libfvde{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfvde{,‑devel,‑python2,‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm, libfvde{,‑devel,‑python2,‑python36,‑tools}‑20191104‑1.el7.6_64.rpm, and libfvde{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.el7.6_64.rpm -
Libfvde is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
- libfwnt{,‑devel,‑python2,‑python3}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python2}‑20191104‑1.el6.{i686,x86_64}.rpm , libfwnt{,‑devel,‑python2,‑python36}‑20191104‑1.el7.x86_64.rpm, and libfwnt{,‑devel,‑python2,‑python3}‑20191104‑1.el8.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
- libmsiecf{,‑devel,‑python2,‑python3,‑tools}-29101104-1.{fc25,fc26,fc26,fc27,fc29,fc30}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python2,‑tools}-29101104-1.el6.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python2,‑python36,‑tools}-29101104-1.el7.x86_64.rpm, and libmsiecf{,‑devel,‑python2,‑python3,‑tools}-29101104-1.el8.x86_64.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
- libolecf{,‑devel,‑python2,‑python3,‑tools}-20191104-1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python2,‑tools}-20191104-1.el6.{i686,x86_64}.rpm, libolecf{,‑devel,‑python2,‑python36,‑tools}-20191104-1.el7.x86_64.rpm, and libolecf{,‑devel,‑python2,‑python3,‑tools}-20191104-1.el8.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
- libscca{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, ibscca{,‑devel,‑python2,‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm, libscca{,‑devel,‑python2,‑python36,‑tools}‑20191104‑1.el7.x86_64.rpm, and libscca{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.el8.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
- libvhdi{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python2‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm , libvhdi{,‑devel,‑python2,‑python36,‑tools}‑20191104‑1.el7.x86_64.rpm, and libvhdi{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.el8.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
- libvmdk{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python2,‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python2,‑python36,‑tools}‑20191104‑1.el7.x86_64.rpm, and libvmdk{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.el8.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
- libbde{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libbde{,‑devel,‑python2,‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm, , libbde{,‑devel,‑python2,‑python36,‑tools}‑20191104‑1.el7.x86_64.rpm, and libbde{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.el8.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
- libevt{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevt{,‑devel,‑python2,‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm, libevt{,‑devel,‑python2,‑python36,‑tools}‑20191104-5.el7.x86_64.rpm, and libevt{,‑devel,‑python2,‑python3,‑tools}‑20191104-5.el8.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
- libevtx{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python2,‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm, libevtx{,‑devel,‑python2,‑python36,‑tools}‑20191104‑1.el7.x86_65.rpm, and libevtx{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.el8.x86_65.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
- libvslvm{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python2‑tools}‑20191104‑1.el6.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python2,‑python36,‑tools}‑20191104‑1.el7.x86_64.rpm, and libvslvm{,‑devel,‑python2,‑python3,‑tools}‑20191104‑1.el8.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
- Volatility-community-plugins-20190729-3.{fc25,fc26,fc27,fc28,fc29,fc30,el6,el7}.noarch.rpm -
The Volatility Community Plugins is a collection of Volatility plugins written and maintained by authors in the forensics community.
This package was updated to change dependencies.
- python2-haystack-0.42-2.{fc25,fc26,fc26,fc27,fc28,fc29,fc30,el6,el7}.noarch.rpm -
Python-Haystack is an heap analysis framework, focused on searching and reversing of C structure in allcoated memory.
- rifiuti2-0.7.0-3.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and rifiuti2-0.7.0-2.el7.x86_64.rpm -
rifiuti2 is a rewrite of rifiuti, a tool for analyzing Windows Recycle Bin INFO2 file.
This package was updated to avoid a conflict with the rifiuti package.
- python{2,3}-pyparsing-2.4.4-1.{fc26,fc27,fc28,fc29,el8}.noarch.rpm, python2-pyparsing-2.4.4-1.el6.noarch.rpm, and pyparsing-doc-2.4.4-1.{fc26,fc27,fc28,fc29,el6,el8}.noarch.rpm -
Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
The pyparsing module provides a library of classes that client code uses to construct the grammar directly in Python code.
- python{2,3}-psutil-5.6.5-1.el7.x86_64.rpm -
Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network)in Python.
- python{2,3}-xlsxwriter-1.2.3-1.{fc26,fc27,fc28,fc29,fc30,el7,el8}.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- pfring‑7.4.0‑2741.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2741.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2048.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc31-x86_64-1.6-1.2.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc31-x86_64-1.1.r17-2.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.20.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-20.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-1.6-1.17.noarch.rpm -
This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 31 x86_64 architecture was added.
- lime-kernel-modules-1.1.r17-18.noarch.rpm -
This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 31 x86_64 architecture was added.
- Fedora 31 - The repository now supports Fedora 31
for the x86_64 CPU architecture.
Here is the list of tools provided for Fedora 31:
|
|
November 1, 2019:
The following changes have been made:
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.19.0‑1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.19.0‑1.{el7,el8}.x86_64.rpm and -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- libipa{,-devel,python}-0.5.2-3.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and libipa{,-devel,python}-0.5.2-3.{el6,el7,el8}.x86_64.rpm -
LibIPA an IP address annotation system.
IPA provides a flexible and efficient repository of IP address information, tools for querying and maintaining the data, and shared libraries and modules for data access.
For more information, read the IPA documentation.
Note: this release provides no new functionality.
This package was rebuild to change the name from ipa to libipa to address a conflict with CentOS/RHEL 8.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.19.0‑2.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.19.0‑2.{el6,el7,el8}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis‑pipeline‑5.11.3-2.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and analysis‑pipeline‑5.11.3-2.{el7,el8}.x86_64.rpm -
The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
This package was rebuilt to use silk 3.19.0.
- prism-1.2-7.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and prism-1.2-7.{el7,el8}.x86_64.rpm -
The prism trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool.
The script can be used directly, or might be used as a component in other more specialized scripts.
In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup.
This package was rebuilt to use silk 3.19.0.
- super_mediator‑1.7.1‑1.{fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator‑1.7.1‑1.{el7,el8}.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
See here for a list of changes in this version.
- libfwsi{,‑devel,‑python2,‑python3}-20191025-1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2}-20191025-1.el6.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2,‑python36}-20191025-1.el7.x86_64.rpm, and libfwsi{,‑devel,‑python2,‑python36}-20191025-1.el8.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20191027-1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20191027-1.el6.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑python36,‑tools}-20191027-1.el7.x86_64.rpm, and liblnk{,‑devel,‑python2,‑python36,‑tools}-20191027-1.el8.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
- python{2,3}-yara-3.11.0-1.{i386,x86_64}.fc30.rpm, python2-yara-3.11.0-1.{i386,x86_64}.el6.rpm, and python{2,3}-yara-3.11.0-1.x86_64.el8.rpm -
Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.
- libregf{,‑devel,‑python2,‑python3,‑tools}‑20191029‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑tools}‑20191029‑1.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑python36‑tools}‑20191029‑1.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- libscca{,‑devel,‑python2,‑python3,‑tools}‑20191029‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and libscca{,‑devel,‑python2,‑python36,‑tools}‑20191029‑1.el7.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
- pfring‑7.4.0‑2736.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2736.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2011.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.19.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-19.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.36.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-36.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.58.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-58.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
October 25, 2019:
The following changes have been made:
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.18.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-18.noarch.rpm -
Modules for the following kernels were rebuilt to use the latest version of LiME:
5.3.6-200
5.3.5-200
5.2.18-200
5.2.17-200
|
5.2.16-200
5.2.15-200
5.2.14-200
5.2.13-200
|
5.2.11-200
5.2.9-200
5.2.8-200
5.2.7-200
|
5.2.6-200
5.2.5-200
5.1.20-300
5.1.19-300
|
5.1.18-300
5.1.17-300
5.1.16-300
5.1.15-300
|
5.1.12-300
5.1.11-300
5.1.9-300
5.1.8-300
|
5.1.7-300
5.1.6-300
5.1.5-300
5.0.17-300
|
5.0.16-300
5.0.14-300
5.0.13-300
5.0.11-300
|
5.0.10-300
5.0.9-301
|
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.35.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-35.noarch.rpm -
Support for the following kernels were added for LiME:
5.2.7-100
5.2.18-100
5.2.17-100
5.2.11-100
5.1.9-200
5.1.8-200
|
5.1.6-200
5.1.21-200
5.1.20-200
5.1.18-200
5.1.16-200
5.1.15-200
|
5.1.11-200
5.0.9-200
5.0.8-200
5.0.7-200
5.0.6-200
5.0.5-200
|
5.0.4-200
5.0.3-200
5.0.19-200
5.0.17-200
5.0.16-200
5.0.14-200
|
5.0.13-200
5.0.11-200
5.0.10-200
4.20.8-200
4.20.7-200
4.20.6-200
|
4.20.5-200
4.20.4-200
4.20.3-200
4.20.16-200
4.20.15-200
4.20.14-200
|
4.20.13-200
4.20.12-200
4.20.11-200
4.20.10-200
4.19.9-300
4.19.8-300
|
4.19.7-300
4.19.6-300
4.19.5-300
4.19.4-300
4.19.3-300
4.19.2-301
|
4.19.2-300
4.19.15-300
4.19.14-300
4.19.13-300
4.19.12-301
4.19.10-300
|
4.18.18-300
4.18.17-300
4.18.16-300
4.18.14-300
|
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.42.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-42.noarch.rpm -
Support for the following kernels were added for LiME:
5.0.9-100
5.0.8-100
5.0.7-100
5.0.6-100
5.0.5-100
5.0.16-100
5.0.13-100
|
5.0.11-100
4.20.8-100
4.20.7-100
4.20.6-100
4.20.5-100
4.20.4-100
4.20.17-100
|
4.20.16-100
4.20.15-100
4.20.14-100
4.20.11-100
4.19.8-200
4.19.7-200
4.19.6-200
|
4.19.5-200
4.19.4-200
4.19.3-200
4.19.2-200
4.19.16-200
4.19.15-200
4.19.14-200
|
4.19.13-200
4.19.12-200
4.19.10-200
4.18.9-200
4.18.8-200
4.18.7-200
4.18.5-200
|
4.18.18-200
4.18.17-200
4.18.16-200
4.18.14-200
4.18.13-200
4.18.12-200
4.18.10-200
|
4.17.9-200
4.17.7-200
4.17.6-200
4.17.5-200
4.17.4-200
4.17.3-200
4.17.2-200
|
4.17.19-200
4.17.18-200
4.17.17-200
4.17.14-202
4.17.12-200
4.17.11-200
4.16.9-300
|
4.16.8-300
4.16.7-300
4.16.6-302
4.16.5-300
4.16.3-301
4.16.16-300
4.16.15-300
|
4.16.14-300
4.16.13-300
4.16.12-300
4.16.11-300
4.16.10-300
|
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.44.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-44.noarch.rpm -
Support for the following kernels were added for LiME:
4.18.9-100
4.18.7-100
4.18.19-100
4.18.18-100
4.18.16-100
4.18.15-100
4.18.13-100
|
4.18.12-100
4.18.10-100
4.17.9-100
4.17.7-100
4.17.6-100
4.17.5-100
4.17.3-100
|
4.17.2-100
4.17.19-100
4.17.17-100
4.17.14-102
4.17.12-100
4.17.11-100
4.16.9-200
|
4.16.7-200
4.16.6-202
4.16.5-200
4.16.4-200
4.16.3-200
4.16.16-200
4.16.15-200
|
4.16.14-200
4.16.13-200
4.16.12-200
4.16.11-200
4.15.9-300
4.15.8-300
4.15.7-300
|
4.15.6-300
4.15.4-300
4.15.3-300
4.15.17-300
4.15.16-300
4.15.15-300
4.15.14-300
|
4.15.13-300
4.15.12-301
4.15.10-300
4.14.8-300
4.14.7-300
4.14.6-300
4.14.5-300
|
4.14.3-300
4.14.18-300
4.14.16-300
4.14.14-300
4.14.13-300
4.14.11-300
4.13.9-300
|
4.13.16-302
4.13.16-300
4.13.15-300
4.13.13-300
4.13.12-300
|
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.38.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-38.noarch.rpm -
Support for the following kernels were added for LiME:
4.16.7-100
4.16.11-100
4.15.9-200
4.15.7-200
4.15.6-200
|
4.15.4-200
4.15.3-200
4.15.17-200
4.15.16-200
4.15.15-200
|
4.15.14-200
4.15.12-201
4.15.10-200
4.14.8-200
4.14.6-200
|
4.14.5-200
4.14.4-200
4.14.18-200
4.14.16-200
4.14.14-200
|
4.14.13-200
4.14.11-200
4.13.9-200
4.13.8-200
4.13.5-200
|
4.13.4-200
4.13.16-202
4.13.16-200
4.13.15-200
4.13.13-200
|
4.13.12-200
4.13.11-200
4.13.10-200
4.12.9-300
4.12.8-300
|
4.12.5-300
4.12.14-300
4.12.13-300
4.12.12-300
4.12.11-300
|
4.11.9-300
4.11.8-300
4.11.11-300
4.11.10-300
|
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.50.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-50.noarch.rpm -
Support for the following kernels were added for LiME:
4.13.16-100
4.13.15-100
4.13.13-100
4.13.12-100
4.13.11-100
|
4.13.10-100
4.13.8-100
4.13.5-100
4.12.14-200
4.12.13-200
|
4.12.11-200
4.12.9-200
4.12.8-200
4.11.12-200
4.11.11-200
|
4.11.10-200
4.11.9-200
4.11.8-200
4.11.7-200
4.11.6-201
|
4.11.5-200
4.11.4-200
4.11.3-200
4.11.3-202
4.10.17-200
|
4.10.16-200
4.10.15-200
4.10.10-200
4.10.9-200
4.10.8-200
|
4.10.6-200
4.10.5-200
4.9.14-200
4.9.13-200
4.9.13-201
|
4.9.12-200
4.9.11-200
4.9.10-200
4.9.9-200
4.9.8-201
|
4.9.7-201
4.9.6-200
4.9.5-200
4.9.4-201
4.9.3-200
|
4.8.16-300
4.8.15-300
4.8.14-300
4.8.13-300
4.8.12-300
|
4.8.11-300
4.8.10-300
4.8.8-300
4.8.6-300
|
- fmem-kernel-modules-el8-x86_64-1.6-1.3.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-el8-x86_64-1.1.r17-3.noarch.rpm -
Support for the following kernels were added for LiME:
4.18.0-80.11.2
|
4.18.0-80.11.1
|
4.18.0-80.7.2
|
4.18.0-80.7.1
|
4.18.0-80.4.2
|
4.18.0-80.1.2
|
4.18.0-80
|
- fmem-kernel-modules-el7-x86_64-1.6-1.57.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-el7-x86_64-1.1.r17-57.noarch.rpm -
Support for the following kernels were added for LiME:
3.10.0-1062.1.2
3.10.0-1062.1.1
3.10.0-1062
3.10.0-957.5.1
3.10.0-957.27.2
3.10.0-957.21.3
3.10.0-957.21.2
3.10.0-957.1.3
3.10.0-957.12.2
3.10.0-957.12.1
3.10.0-957.10.1
3.10.0-957
|
3.10.0-862.3.3
3.10.0-862.9.1
3.10.0-862.6.3
3.10.0-862.3.2
3.10.0-862.2.3
3.10.0-862.14.4
3.10.0-862.11.6
3.10.0-862
3.10.0-693.5.2
3.10.0-693.2.2
3.10.0-693.21.1
3.10.0-693.2.1
|
3.10.0-693.17.1
3.10.0-693.11.6
3.10.0-693.11.1
3.10.0-693.1.1
3.10.0-693
3.10.0-514.6.2
3.10.0-514.6.1
3.10.0-514.26.2
3.10.0-514.26.1
3.10.0-514.2.2
3.10.0-514.21.2
3.10.0-514.21.1
|
3.10.0-514.16.1
3.10.0-514.10.2
3.10.0-514
3.10.0-327.4.5
3.10.0-327.4.4
3.10.0-327.36.3
3.10.0-327.36.2
3.10.0-327.36.1
3.10.0-327.3.1
3.10.0-327.28.3
3.10.0-327.28.2
3.10.0-327.22.2
|
3.10.0-327.18.2
3.10.0-327.13.1
3.10.0-327.10.1
3.10.0-327
3.10.0-229.7.2
3.10.0-229.4.2
3.10.0-229.20.1
3.10.0-229.14.1
3.10.0-229.1.2
3.10.0-229.11.1
3.10.0-229
3.10.0-123.9.3
|
3.10.0-123.9.2
3.10.0-123.8.1
3.10.0-123.6.3
3.10.0-123.4.4
3.10.0-123.4.2
3.10.0-123.20.1
3.10.0-123.13.2
3.10.0-123.13.1
3.10.0-123.1.2
3.10.0-123
|
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.59.noarch.rpm -
No additional modules were added for Fmem.
This package was only updates for revision number equality with LiME.
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-59.noarch.rpm -
Support for the following kernels were added for LiME:
2.6.32-754.23.1
2.6.32-754.22.1
2.6.32-754.18.2
2.6.32-754.17.1
2.6.32-754.15.3
2.6.32-754.14.2
2.6.32-754.12.1
2.6.32-754.11.1
2.6.32-754.10.1
2.6.32-754.9.1
2.6.32-754.6.3
2.6.32-754.3.5
2.6.32-754.2.1
2.6.32-754
|
2.6.32-696.30.1
2.6.32-696.28.1
2.6.32-696.23.1
2.6.32-696.20.1
2.6.32-696.18.7
2.6.32-696.16.1
2.6.32-696.13.2
2.6.32-696.10.3
2.6.32-696.10.2
2.6.32-696.10.1
2.6.32-696.6.3
2.6.32-696.3.2
2.6.32-696.3.1
2.6.32-696.1.1
|
2.6.32-696
2.6.32-642.15.1
2.6.32-642.13.2
2.6.32-642.13.1
2.6.32-642.11.1
2.6.32-642.6.2
2.6.32-642.6.1
2.6.32-642.4.2
2.6.32-642.3.1
2.6.32-642.1.1
2.6.32-642
2.6.32-573.26.1
2.6.32-573.22.1
2.6.32-573.18.1
|
2.6.32-573.12.1
2.6.32-573.8.1
2.6.32-573.7.1
2.6.32-573.3.1
2.6.32-573.1.1
2.6.32-573
2.6.32-504.30.3
2.6.32-504.23.4
2.6.32-504.16.2
2.6.32-504.12.2
2.6.32-504.8.1
2.6.32-504.3.3
2.6.32-504.1.3
2.6.32-504
|
2.6.32-431.29.2
2.6.32-431.23.3
2.6.32-431.20.5
2.6.32-431.20.3
2.6.32-431.17.1
2.6.32-431.11.2
2.6.32-431.5.1
2.6.32-431.3.1
2.6.32-431.1.2.0.1
2.6.32-431
2.6.32-358.23.2
2.6.32-358.18.1
2.6.32-358.14.1
2.6.32-358.11.1
|
2.6.32-358.6.2
2.6.32-358.6.1
2.6.32-358.2.1
2.6.32-358.0.1
2.6.32-358
2.6.32-279
2.6.32-220
2.6.32-131.0.15
2.6.32-71.29.1
2.6.32-71.24.1
2.6.32-71.18.2
2.6.32-71.18.1
2.6.32-71.14.1
2.6.32-71.7.1
2.6.32-71
|
- lime-kernel-modules-common-1.1.r17-5.noarch.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
This package contains only the source code for making the LiME kernel modules, the CaptureMemoryWithLime script and the corresponding manual page.
The changes are the following:
- LiME code up to date as of October 21, 2019.
- CaptureMemoryWithLime fixes an error where the image file name contained spaces.
- fmem-kernel-modules-common-1.6-1.4.noarch.rpm - Fmem is kernel module that creates
device /dev/fmem, similar to /dev/mem but without limitations.
This package contains the source code for making the FMEM kernel modules and the install-fmem script.
The changes are the following:
- LiME code up to date as of October 21, 2019.
- install-mem fixes an error where the path to the kernel modules was wrong.
- pfring‑7.4.0‑2734.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2734.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑2002.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- python{2,3}-distorm3-3.4.1-2.{fc25,fc26,fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm, python2-distorm3-3.4.1-2.el6.{i386,x86_64}.rpm, python{2,36}-distorm3-3.4.1-2.el7.x86_64.rpm, and python{2,3}-distorm3-3.4.1-2.el8.x86_64.rpm -
Distorm3 is a lightweight, easy-to-use and fast decomposer library.
It disassembles instructions in 16, 32 and 64 bit modes.
Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX.
Distorm3 is used by The Volatility Framework.
|
|
October 18, 2019:
The following changes have been made:
- libfwsi{,‑devel,‑python2,‑python3}-20191012-1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2}-20191012-1.el6.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2,‑python36}-20191012-1.el7.x86_64.rpm, and libfwsi{,‑devel,‑python2,‑python3}-20191012-1.el8.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
- ADIA -
This item is the VMware and Virtual Box-based appliances built with CentOS 7.7.1908 for the x86_64 architecture.
See here for more details.
The release consists of the following:
- python{2,3}-xlsxwriter-1.2.2-1.{fc26,fc27,fc28,fc29,fc30}.noarch.rpm and {python2,36}-xlsxwriter-1.2.2-1.el7.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- pfring‑7.4.0‑2710.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2710.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑1979.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.17.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.3.6-200 for FC30
- 5.3.5-200 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-17.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.3.6-200 for FC30
- 5.3.5-200 for FC30
- fmem-kernel-modules-el8-x86_64-1.6-1.2.noarch.rpm -
Support for the following kernels were added for Fmem:
- 4.18.0-80.11.2 for EL8
- 4.18.0-80.11.1 for EL8
- 4.18.0-80.7.2 for EL8
- 4.18.0-80.7.1 for EL8
- 4.18.0-80.4.2 for EL8
- 4.18.0-80.1.2 for EL8
- lime-kernel-modules-el8-x86_64-1.1.r17-2.noarch.rpm -
Support for the following kernels were added for LiME:
- 4.18.0-80.11.2 for EL8
- 4.18.0-80.11.1 for EL8
- 4.18.0-80.7.2 for EL8
- 4.18.0-80.7.1 for EL8
- 4.18.0-80.4.2 for EL8
- 4.18.0-80.1.2 for EL8
|
|
October 11, 2019:
The following changes have been made:
- CentOS 8.0.1905 - The repository now supports CentOS 8
for the x86_64 CPU architecture.
Here is the list of tools provided for CentOS 8:
The following tools have been provided for CentOS/RHEL 7 but are unavailable for CentOS/RHEL 8 at this time:
- aimage
- bloom
- bulk_extractor
- bulk_extractor-stoplist
- dff
- etherape
- frag_find
- hachoir-urwid
- hachoir-wx
- KHracker
- kracked
- log2timeline
- perl-Data-Hexify
- perl-File-Mork
- perl-Mac-PropertyList
- perl-Parse-Evtx
- perl-Wx
- ptk
- python-apsw
- python-haystack
- python-poppler-qt4
- python-rarfile
- python-ssdeep
- python-xlwt
- recoll
- registrydecoder
- vinetto
- Volatility-community-plugins
Here are the other changes this week:
- lime-kernel-modules-1.1.r17-17.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for CentOS/RHEL 8 x86_64 architecture was added.
- fmem-kernel-modules-1.6-1.17.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for CentOS/RHEL 8 x86_64 architecture was added.
- ghostpdl-9.27-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and ghostpdl-9.27-1.{el7,el8}.x86_64.rpm -
Ghostpdl is Artifex Software's implementation of the PCL-5™ and PCL-XL™ family of page description languages.
Ghostpdl is used by Xplico.
- python{2,3}‑elasticsearch‑7.0.5‑1.i{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python{2,36}‑elasticsearch‑7.0.5‑1.el7.x86_64.rpm, and python{2,3}‑elasticsearch‑7.0.5‑1.el8.x86_64.rpm -
ElasticSearch is the official low-level client for Elasticsearch.
Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
- libfwsi{,‑devel,‑python2,‑python3}-20191006-1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2}-20191006-1.el6.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2,‑python36}-20191006-1.el7.x86_64.rpm, and libfwsi{,‑devel,‑python2,‑python3}-20191006-1.el8.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20191006-1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20191006-1.el6.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑python36,‑tools}-20191006-1.el7.x86_64.rpm, and liblnk{,‑devel,‑python2,‑python3,‑tools}-20191006-1.el8.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
- libsigscan{,‑devel,‑python2,‑python3,‑tools}‑20191006‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python2,‑tools}‑20191006‑1.el6.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python2,‑python36,‑tools}‑20191006‑1.el7.x86_64.rpm, and libsigscan{,‑devel,‑python2,‑python3,‑tools}‑20191006‑1.el8.x86_64.rpm -
Libsigscan is a library and tools used to binary signature scanning.
- libpst{,‑devel,‑devel-doc,‑doc,‑libs,‑python}-0.6.72-1.{fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libpst{,‑devel,‑devel-doc,‑doc,‑libs,‑python36}-0.6.72-1.el7.x86_64.rpm, and libpst{,‑devel,‑devel-doc,‑doc,‑libs,‑python3}-0.6.72-1.el8.x86_64.rpm -
The libpst utilities convert Outlook .pst files to other formats.
See here for the list of changes.
- ntfs-3g{,-devel}-2017.3.23-11.el6.{i686,x86_64}.rpm and ntfs-3g{,-devel}-2017.3.23-11.{el7,el8}.x86_64.rpm -
NTFS-3g is a stable, full-featured, read-write NTFS driver for Linux, Android, Mac OS X, FreeBSD, NetBSD, OpenSolaris, QNX, Haiku, and other operating systems.
It provides safe handling of the Windows XP, Windows Server 2003, Windows 2000, Windows Vista, Windows Server 2008, Windows 7, Windows 8 and Windows 10 NTFS file systems.
- snort-2.9.15-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-2.9.15-1.el7.x86_64.rpm -
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
This release includes support for PF_Ring for CentOS/RHEL 6 and 7 for the x86_64 architecture.
- snort-sample-rules-2.9.15-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6,el7}.noarch.rpm -
These rules are sample rules only and are intended to allow snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- snort-openappid-2.9.15-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.15-1.el7.x86_64.rpm -
This is the snort package built with the following additions:
To install snort-openappid on your system, you must first remove snort.
Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi
sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
- pfring‑7.4.0‑2707.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2707.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑3.0.0‑1978.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.16.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-16.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.34.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-34.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
October 4, 2019:
The following changes have been made:
- pfring‑7.4.0‑2700.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2700.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1951.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.33.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-33.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.56.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-56.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
|
September 27, 2019:
The following changes have been made:
- pfring‑7.4.0‑2682.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2682.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1885.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.15.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.2.17-200 for FC30
- 5.2.16-200 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-15.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.2.17-200 for FC30
- 5.2.16-200 for FC30
|
|
September 20, 2019:
The following changes have been made:
- python{2,3}-xlsxwriter-1.2.1-1.{fc26,fc27,fc28,fc29,fc30}.noarch.rpm and {python2,36}-xlsxwriter-1.2.1-1.el7.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- analysis‑pipeline‑5.11.3-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and analysis‑pipeline‑5.11.3-1.el7.x86_64.rpm -
The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes.
- pfring‑7.4.0‑2675.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2675.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1875.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.14.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.2.15-200 for FC30
- 5.2.14-200 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-14.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.2.15-200 for FC30
- 5.2.14-200 for FC30
- fmem-kernel-modules-el7-x86_64-1.6-1.55.noarch.rpm -
Support for the following kernels were added for Fmem:
- 3.10.0-1062.1.1 for EL7
- 3.10.0-1062 for EL7
- lime-kernel-modules-el7-x86_64-1.1.r17-55.noarch.rpm -
Support for the following kernels were added for LiME:
- 3.10.0-1062.1.1 for EL7
- 3.10.0-1062 for EL7
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.57.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-57.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 13, 2019:
The following changes have been made:
- libvslvm{,‑devel,‑python2,‑python3,‑tools}‑20181227‑5.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python2‑tools}‑20181227‑5.el6.{i686,x86_64}.rpm, and libvslvm{,‑devel,‑python2,‑python36,‑tools}‑20181227‑5.el7.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
Note: This is a repackaging of the libvslvm tools version 20160110.
- certifi‑2019.9.11‑1.{fc26,fc27,fc28,fc29,fc30,el7}.noarch.rpm -
Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
- pfring‑7.4.0‑2658.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2658.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1848.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.13.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-13.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
September 6, 2019:
The following changes have been made:
- ADIA -
This item is the VMware and Virtual Box-based appliances built with CentOS 7.6.1810 for the x86_64 architecture.
See here for more details.
The release consists of the following:
- pfring‑7.4.0‑2643.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2643.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1820.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.12.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-12.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.32.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-32.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
August 30, 2019:
The following changes have been made:
- python{2,3}-xlsxwriter-1.2.0-1.{fc26,fc27,fc28,fc29,fc30}.noarch.rpm and {python2,36}-xlsxwriter-1.2.0-1.el7.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- CERT-Forensics-Tools-1.0-86.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-86.el7.x86_64.rpm -
Removed the dependency of the kernel-PAE-modules-extra package for Fedora 28 and beyond.
- libewf{,‑devel,‑tools,‑python2,‑python3,‑tools}‑20160718‑20140806.4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libewf{,‑devel,‑tools,‑python2,‑tools}‑20160718‑20140806.4.el6.{i686,x86_64}.rpm, and
libewf{,‑devel,‑tools,‑python2,‑python36,‑tools}‑20160718‑20140806.4.el7.x86_64.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
This package is built from the libewf source code dated 20140806 but to make it the latest version, the version number was changed to the build date (20160718)
and the release number changed to include the source code release date (20140806).
This release obsoletes (which causes the removal of) the ewftools package which is provided by Fedora.
- libfixbuf{,‑devel}-2.4.0-1.{,fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and libfixbuf{,‑devel}-2.4.0-1.el7.x86_64.rpm -
Libfixbuf is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.3‑1.{fc25,fc26,fc27,fc28,fc29,fc30,fc30,el6}.{i686,x86_64}.rpm and silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.3‑1.el7.x86_64.rpm and -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.3‑2.{fc25,fc26,fc27,fc28,fc29,fc30,fc30}.{i686,x86_64}.rpm and silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.3‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
See here for a list of changes in this version.
- libschemaTools{,‑devel}‑1.3‑6.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and libschemaTools{,‑devel}‑1.3‑6.el7.x86_64.rpm -
libschemaTools is a library that provides a standard representation of data records.
It is built on fixbuf, using IPFIX information elements.
It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source.
SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records.
This package was rebuilt to use libfixbuf 2.4.0.
- python{2,3}-pyfixbuf-0.8.0-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, python2-pyfixbuf-0.8.0-1.el6.{i686,x86_64}.rpm, and python{2,36}-pyfixbuf-0.8.0-1.el7.x86_64.rpm -
Pyfixbuf is a Python API for libfixbuf,
an implementation of the IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this and all releases.
- analysis‑pipeline‑5.11.2-2.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and analysis‑pipeline‑5.11.2-2.el7.x86_64.rpm -
The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
This package was rebuilt to use libfixbuf 2.4.0.
- super_mediator‑1.7.0‑4.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and super_mediator‑1.7.0‑4.el7.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
This package was rebuilt to use libfixbuf 2.4.0.
- yaf{,‑devel}‑2.11.0-3.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and yaf{,‑devel}-2.11.0-3.el7.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
Note that for CentOS 6 and 7 for the x86_64 architecture, yaf has been built to use PF_Ring.
This package was rebuilt to use libfixbuf 2.4.0.
- pfring‑7.4.0‑2623.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2623.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1797.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
|
|
August 23, 2019:
The following changes have been made:
- jdk-12.0.2_linux-x64_bin.rpm -
JDK is the Java SE Development Kit 12.0.2 from Oracle.
This package has been installed in the Fedora 25 and 26 and CentOS/RHEL 7 repositories for the x86_64 architecture.
- ghidra-9.0.4-PUBLIC_20190516.3.{fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and ghidra-9.0.4-PUBLIC_20190516.3.{fc25,fc26,el7}.x86_64.rpm -
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms
including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features.
Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes.
Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.
See the list of changes and improvement here.
Note: this release no longer requires JDK from Oracle for Fedora 27 through 30, relying instead on the latest version of OpenJDK provided by Fedora, specified as java-latest for Fedora 28 and beyond and java-11 for Fedora 27.
However, for Fedora 25 and 26 and CentOS/RHEL 7, JDK Version 11 or higher is required and this package has been added to the appropriate repositories.
In addition, this release also contains a ghidra.desktopfile that supports the GNOME and Mate Window managers.
- sleuthkit{,‑devel,‑libs}‑4.6.7‑1.1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and sleuthkit{,‑devel,‑libs}‑4.6.7‑1.1.el7.x86_64.rpm -
The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
- jdk-8u221-linux-x64.rpm -
JDK is the Java SE Development Kit 8, Update 221 from Oracle.
This package has been installed in the CentOS/RHEL 7 repository for the x86_64 architecture and in the CentOS/RHEL 6 repoositories for the i386 and x86_64 architectures.
- autopsy-4.12.0-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and autopsy-4.12.0-1.el7.x86_64.rpm -
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer.
You can even use it to recover photos from your camera's memory card.
Note: this release no longer requires JDK from Oracle for Fedora 25 through 30, relying instead on version 1.8.0 of OpenJDK version provided by Fedora, along with version 1.8.0 of OpenJFX, also provided by Fedora.
However, for CentOS/RHEL 6 and 7, the latest version of JDK 8 from Oracle is required and this package has been added to the appropriate repositories.
In addition, this release also contains a autopsy.desktopfile that supports the GNOME and Mate Window managers.
- python{2,3}-xlsxwriter-1.1.9-1.{fc26,fc27,fc28,fc29,fc30}.noarch.rpm and {python2,36}-xlsxwriter-1.1.9-1.el7.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- bro{,-core,ctl,-debugsource,-devel,-libcaf-devel}-2.6.3-0.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libbroker-devel-2.6.3-0.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, bro{,-core,ctl,-debugsource,-devel,-libcaf-devel}-2.6.3-0.el7.x86_64.rpm, and libbroker-devel-2.6.3-0.el7.x86_64.rpm -
Bro (nee Zeek) is a powerful network analysis framework that is much different from the typical IDS you may know.
(Zeek is the new name for the long-established Bro system. Note that parts of the system retain the "Bro" name, and it also often appears in the documentation and distributions.)
While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well.
Well grounded in more than 20 years of research, Zeek has successfully bridged the traditional gap between academia and operations since its inception.
Today, it is relied upon operationally by both major companies and numerous educational and scientific institutions for securing their cyberinfrastructure.
Zeek was originally developed by Vern Paxson.
Robin Sommer now leads the project, jointly with a core team of researchers and developers at the
International Computer Science Institute in Berkeley, CA; and the
National Center for Supercomputing Applications in Urbana-Champaign, IL.
Please note: bro packages install files in /opt/bro.
To use these files, add the following to your ~/.bashrc file:
[[ -d /opt/bro/bin && ! "$PATH" =~ /opt/bro/bin ]] && PATH=$PATH:/opt/bro/bin
[[ -d /opt/bro/share/man && ! "$MANPATH" =~ /opt/bro/share/man ]] && MANPATH=$MANPATH:/opt/bro/share/man
Then run:
. ~/.bashrc
- python{2,3}‑elasticsearch‑7.0.4‑1.i{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and python{2,36}‑elasticsearch‑7.0.4‑1.el7.x86_64.rpm -
ElasticSearch is the official low-level client for Elasticsearch.
Its goal is to provide common ground for all Elasticsearch-related code in Python; because of this it tries to be opinion-free and very extendable.
- pfring‑7.4.0‑2612.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2612.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1770.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.11.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.2.9-200 for FC30
- 5.2.8-200 for FC30
- 5.2.7-200 for FC30
- 5.2.6-200 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-11.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.2.9-200 for FC30
- 5.2.8-200 for FC30
- 5.2.7-200 for FC30
- 5.2.6-200 for FC30
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.31.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-31.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.56.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-56.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 8, 2019:
The following changes have been made:
- libregf{,‑devel,‑python2,‑python3,‑tools}‑20190805‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑tools}‑20190805‑1.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑python36,‑tools}‑20190805‑1.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- snort-2.9.14.1-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-2.9.14.1-1.el7.x86_64.rpm -
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
This release includes support for PF_Ring for CentOS/RHEL 6 and 7 for the x86_64 architecture.
- snort-sample-rules-2.9.14.1-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6,el7}.noarch.rpm -
These rules are sample rules only and are intended to allow snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- snort-openappid-2.9.14.1-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.14.1-1.el7.x86_64.rpm -
This is the snort package built with the following additions:
To install snort-openappid on your system, you must first remove snort.
Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi
sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
This release includes support for PF_Ring for CentOS/RHEL 6 and 7 for the x86_64 architecture.
- ghidra-9.0.4-PUBLIC_20190516.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and ghidra-9.0.4-PUBLIC_20190516.el7.x86_64.rpm -
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms
including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features.
Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes.
Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.
See the list of changes and improvement here.
Please note that you must install the JDK for Ghidra to work.
In testing, The Java Development Kit (JDK) version 11.0.2 was used and worked successfully.
Ghidra expects a program named java to be available in the directories named in the PATH variable.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.10.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-10.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.30.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-30.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.1.21-200 for FC29
- 5.1.18-200 for FC29
|
|
August 2, 2019:
The following changes have been made:
- python{2,3}-pyparsing-2.4.2-1.{fc26,fc27,fc28,fc29}.noarch.rpm, python2-pyparsing-2.4.2-1.el6.noarch.rpm, and pyparsing-doc-2.4.2-1.{fc26,fc27,fc28,fc29,el6}.noarch.rpm -
Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
The pyparsing module provides a library of classes that client code uses to construct the grammar directly in Python code.
- python-yara-3.9.0-2.{i386,x86_64}.el6.rpm -
Python-yara is a Python extension that gives access to Yara's powerful features from Python scripts.
- fmem-kernel-modules-el7-x86_64-1.6-1.54.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-54.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
July 31, 2019:
The following changes have been made:
- python{2,3}‑dfvfs-20190714-1.{fc25,fc26,fc27,fc28,fc29,fc30}.noarch.rpm and python{2,36}‑dfvfs‑20190714‑1.el7.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to
file-system objects from various storage media types and file formats.
- libregf{,‑devel,‑python2,‑python3,‑tools}‑20190714‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑tools}‑20190714‑1.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑python36,‑tools}‑20190714‑1.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- plaso‑20190708‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso‑20190708‑1.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release uses Python 3 instead of Python 2.
Please note that for Fedora 25, of all of the ancillary packages needed by plaso use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
For Fedora 25, this package contains a program named update-plaso, the purpose of which is to update the packages that plaso depends upon.
Note that this updates the dependent packages but not plaso.
The recommendation is to run update-plaso routinely to keep the plaso dependencies updated.
- testdisk-7.1-1.1.el6.{i686,x86_64}.rpm and qphotorec-7.0-4.1.el6.{i386,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
These releases were built to use the latest version of libewf that is installed in this repository.
- analysis‑pipeline‑5.11.2-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and analysis‑pipeline‑5.11.2-1.el7.x86_64.rpm -
The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
- apfs-fuse-20190723-1.{fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm and apfs-fuse-20190723-1.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental.
It may not be able to read all files, it may return wrong data, or it may simply crash.
Use at your own risk.
But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far).
Thus, the driver may return compressed files instead of uncompressed ones.
Although most of the time it should just report an error.
- cutter-1.8.3-20190701.fc30.{i686,x86_64}.rpm -
Cutter is a Qt and C++
GUI for radare2 reverse engineering framework.
Its goal is making an advanced, customizable, and FOSS (free and open-source software) reverse-engineering platform while keeping the user experience at mind.
Cutter is created by reverse engineers for reverse engineers.
This version is built with the source code that is available on 2019-05-14.
Note that this release is only available for Fedora 30 because it relies on Qt version 5.12.
- python{2,3}‑dfwinreg‑20190714‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and python{2,36}‑dfwinreg‑20190714‑1.el7.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
- libguytools-2.1.0-1.{fc25,fc26,fc27,fc28,fc28,fc30}.{i686,x86_64}.rpm and libguytools-2.1.0-1.el7.x86_64,rpm -
Libguytools is a package of subroutines and header files needed to
build and operate guymager.
The changes are:
- Cleaned up for C++14, some minor prototype changes to ensure same bit widths on different architectures
- Some debugging (handling user errors in configuration files)
- Understands # at beginning of line (first non-blank char) for remarks (REM still remains valid)
- guymager-0.8.11-1.{fc25,fc26,fc27,fc28.fc29,fc30,el6}.{i686,x86_64}.rpm and guymager-0.8.11-1.el7.x86_64.rpm -
Guymager is a forensic imaging package.
See here for the list of changes.
- libmodi{,‑devel,‑python2,‑python3,‑tools}‑20190513‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libmodi{,‑devel,‑python2,‑tools}‑20190513‑1.el6.{i686,x86_64}.rpm, and libmodi{,‑devel,‑python2,‑python36,‑tools}‑20190513‑1.el7.x86_64.rpm -
Libmodi is a lbrary and tools to access the Mac OS disk image formats.
- libphdi{,‑devel,‑python,‑python3,‑tools}-20190506-1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libphdi{,‑devel,‑python,‑tools}-20190506-1.el6.{i686,x86_64}.rpm, and libphdi{,‑devel,‑python,‑python36,‑tools}-20190506-1.el7.x86_64.rpm -
Libphdi is a library to access the Parallels Hard Disk image format.
- Volatility-2.6.1-3.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i386,x86_64}.rpm and Volatility-2.6.1-3.el7.x86_64.rpm -
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.6.1 that has been patched to July 29, 2019.
You can read about this version here
To install this update on Fedora 25 and CentOS/RHEL 6 and 7, you must first do the following:
sudo rpm -ev yara-python --nodeps
- Volatility-community-plugins-20190729-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6,el7}.noarch.rpm -
The Volatility Community Plugins is a collection of Volatility plugins written and maintained by authors in the forensics community.
Many of these are the result of the last 3 years of Volatility plugin contests, but some were just written for fun.
Either way, it's an entire arsenal of plugins that you can easily extend into your existing Volatility installation.
These plugins are installed in /usr/share/volatility/plugins/community/ and to use them you need to specify this location on the command line thusly:
volatility --plugins=/usr/share/volatility/plugins/community ...
Note: The following plugins were removed all systems: AlexanderTarasenko, ThomasWhite, ProcessFuzzyHash, AFF4, JavierVallejo, PeterCasey, LorenzLiebler, Citronneur, AlizHammon, and TranVienHa,
and the following were also removed for el6: BartoszInglot, DaveLasalle, ESET_Browserhooks, FrankBlock, LoicJaquemet, PhilipHuppert, ThomasChopitea, TranVienHa, and YingLi.
- pfring‑7.4.0‑2604.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2604.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1753.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.9.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.1.20-300 for FC30
- 5.1.19-300 for FC30
- 5.1.18-300 for FC30
- 5.1.17-300 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-9.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.1.20-300 for FC30
- 5.1.19-300 for FC30
- 5.1.18-300 for FC30
- 5.1.17-300 for FC30
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.29.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.1.20-200 for FC29
- 5.1.18-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-29.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.1.20-200 for FC29
- 5.1.18-200 for FC29
|
|
July 12, 2019:
The following changes have been made:
- pfring‑7.4.0‑2598.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2598.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1645.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.8.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-8.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.28.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-28.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
July 3, 2019:
The following changes have been made:
- libsigscan{,‑devel,‑python2,‑python3,‑tools}‑20190629‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python2,‑tools}‑20190629‑1.el6.{i686,x86_64}.rpm, and libsigscan{,‑devel,‑python2,‑python36,‑tools}‑20190629‑1.el7.x86_64.rpm -
Libsigscan is a library and tools used to binary signature scanning.
- libevtx{,‑devel,‑python2,‑python3,‑tools}‑20190619‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python2,‑tools}‑20190619‑1.el6.{i686,x86_64}.rpm, and libevtx{,‑devel,‑python2,‑python36,‑tools}‑20190619‑1.el7.x86_65.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
- libbde{,‑devel,‑python2,‑python3,‑tools}‑20190701‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libbde{,‑devel,‑python2,‑tools}‑20190701‑1.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python2,‑python36,‑tools}‑20190701‑1.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
- pfring‑7.4.0‑2595.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2595.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1641.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- rifiuti2-0.7.0-2.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and rifiuti2-0.7.0-2.el7.x86_64.rpm -
rifiuti2 is a rewrite of rifiuti, a tool for analyzing Windows Recycle Bin INFO2 file.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.7.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-7.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.27.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-27.noarch.rpm -
Support for the following kernels were added for LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.55.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-55.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 28, 2019:
The following changes have been made:
- libewf‑experimental{,‑devel,‑tools,‑python2,‑python3,‑tools}‑20190317‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libewf‑experimental{,‑devel,‑tools,‑python2,‑tools}‑20190317‑1.el6.{i686,x86_64}.rpm, and
libewf‑experimental{,‑devel,‑tools,‑python2,‑python36,‑tools}‑20190317‑1.el7.x86_64.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
See this page for the list of supported and unsupported formats.
Libewf-Experimental installs packages in /usr/local so that it can be optionally installed along with the conventional Libewf packages, where package contents are installed in /usr.
Further, the Libewf-Experimental packages have been installed in the forensics-test repository.
You will need to enable this repository with this command for Fedora:
sudo dnf config‑manager ‑‑set‑enabled forensics‑test
or this command for CentOS/RHEL:
sudo yum‑config‑manager ‑‑enable forensics‑test
- pfring‑7.4.0‑2580.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2580.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1619.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.6.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-6.noarch.rpm -
Support for the following kernels were added for LiME:
|
|
June 21, 2019:
The following changes have been made:
- certifi‑2019.6.16‑1.{fc25,fc26,fc27,fc28,fc29,fc30,el7}.noarch.rpm -
Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
- python{2,3}‑dfvfs-20190609-1.{fc25,fc26,fc27,fc28,fc29,fc30}.noarch.rpm and python{2,36}‑dfvfs‑20190609‑1.el7.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to
file-system objects from various storage media types and file formats.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.2‑1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.2‑1.el7.x86_64.rpm and -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.2‑2.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm,
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.2‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis‑pipeline‑5.11.1-2.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and analysis‑pipeline‑5.11.1-2.el7.x86_64.rpm -
The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
Note: This release was built to add JSON alerting capabilities.
- prism-1.2-6.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and prism-1.2-6.el7.x86_64.rpm -
The prism trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool.
The script can be used directly, or might be used as a component in other more specialized scripts.
In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup.
This package was rebuilt to use silk 3.18.2.
- super_mediator‑1.7.0‑3.{fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator‑1.7.0‑3.el7.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
This package was rebuilt to use libfixbuf 3.18.2.
- plaso‑20190531‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso‑20190531‑1.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release uses Python 3 instead of Python 2.
Please note that for Fedora 25, of all of the ancillary packages needed by plaso use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
For Fedora 25, this package contains a program named update-plaso, the purpose of which is to update the packages that plaso depends upon.
Note that this updates the dependent packages but not plaso.
The recommendation is to run update-plaso routinely to keep the plaso dependencies updated.
- snort-2.9.13-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-2.9.13-1.el7.x86_64.rpm -
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for .the changes in this version.
This release includes support for PF_Ring for CentOS/RHEL 6 and 7 for the x86_64 architecture.
- snort-sample-rules-2.9.13-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6,el7}.noarch.rpm -
These rules are sample rules only and are intended to allow snort to start successfully.
These rules only flag HTTP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- snort-openappid-2.9.13-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.13-1.el7.x86_64.rpm -
This is the snort package built with the following additions:
To install snort-openappid on your system, you must first remove snort.
Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi
sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
This release includes support for PF_Ring for CentOS/RHEL 6 and 7 for the x86_64 architecture.
- pfring‑7.4.0‑2567.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2567.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1601.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.5.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.1.11-300 for FC30
- 5.1.9-300 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-5.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.1.11-300 for FC30
- 5.1.9-300 for FC30
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.26.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.1.11-200 for FC29
- 5.1.9-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-26.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.1.11-200 for FC29
- 5.1.9-200 for FC29
- fmem-kernel-modules-el7-x86_64-1.6-1.53.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-53.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.54.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-54.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 14, 2019:
The majority of changes made in this announcement rename packages for CentOS/RHEL to conform to the CentOS/RHEL standard of Python 3 packages including
the Python version in the package name.
For example, where the package for Fedora 30 is named python3-artifacts, the CentOS/RHEL version is named python36-artifacts.
For version and release consistency, the Fedora packages have been updated even though they contain no new functionality.
With this release, Plaso is now provided as conventional package rather than as a Python virtual environment for CentOS/RHEL 7 and
Fedora 26.
In addition, the CentOS/RHEL repositories were audited and packages that are provided by CentOS/RHEL, EPEL, or are no longer needed have been archived.
These packages have been removed from the CentOS/RHEL repository as the result of an audit:
- aff{lib,lib-devel,tools}-3.7.4-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- bokken-1.8-3.el7.x86_64.rpm - Removed: No longer needed.
- capstone{,-python2,-python3}-3.0.4-6.el7.x86_64.rpm - Removed: Provided by EPEL.
- catdoc-0.94.2-6.el7.x86_64.rpm - Removed: Provided by EPEL.
- daemonize-1.7.3-7.el7.x86_64.rpm - Removed: Provided by EPEL.
- dcfldd-1.3.4.1-2.el7.x86_64.rpm - Removed: Provided by EPEL.
- dd_rescue-1.99.8-1.el7.x86_64.rpm - Removed: Provided by EPEL.
- dino-1.5-2.el7.noarch.rpm - Removed: Provided by EPEL.
- dislocker{,-libs}-0.7.1-1.el7.x86_64.rpm and fuse-dislocker-0.7.1-1.el7.86_64.rpm - Removed: Provided by EPEL.
- dummy-1.0-2.el7.x86_64.rpm - Removed: No longer needed.
- efilter-1-1.5-1.el7.x86_64.rpm - Removed: No longer needed.
- fontawesome-fonts-4.1.0-1.el7.noarch.rpm - Removed: No longer needed.
- fontawesome-fonts-web-4.1.0-1.el7.noarch.rpm - Removed: No longer needed.
- fred-0.1.1-1.el7.x86_64.rpm - Removed: No longer needed.
- fuse-exfat-1.0.1-1.el7.x86_64.rpm - Removed: No longer needed.
- fuseext2-0.3-1.el7.x86_64.rpm - Removed: No longer needed.
- ghex{,-devel,-libs}-3.18.0-1.el7.x86_64.rpm - Removed: No longer needed.
- hashcat-3.00-1.el7.x86_64.rpm - Removed: No longer needed.
- jansson{,-devel,-devel-doc}-2.9-1.el7.x86_64.rpm - Removed: No longer needed.
- lame{,-devel,-libs,-mp3x}-3.99.5-1.el7.x86_64.rpm - Removed: Provided by EPEL.
- LogAnalysisToolKit-1.7-1.el7.noarch.rpm - Removed: No longer needed.
- luajit{,-devel}-2.0.2-9.el7.x86_64.rpm - Removed: Provided by EPEL.
- mac-robber-1.02-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- mathjax-2.2-4.el7.noarch.rpm - Removed: Provided by CentOS/RHEL.
- md5deep-4.4-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- mdbtools{,-devel,-gui,-libs}-0.7-43.13.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- null-package-1.0-4.el7.noarch.rpm - Removed: No longer needed.
- partclone-0.3.6-2.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- perl-Alien-wxWidgets-0.67-6.el7.x86_64.rpm - Removed: No longer needed.
- perl-Carp-Assert-0.20-4.el7.noarch.rpm - Removed: Provided by EPEL.
- perl-Digest-CRC-0.16-1.el7.x86_64.rpm - Removed: Provided by EPEL.
- perl-Digest-Crc32-0.01-1.el7.noarch.rpm - Removed: No longer needed.
- perl-Image-ExifTool-8.50-1.el7.noarch.rpm - Removed: Provided by EPEL.
- perl-Net-Pcap-0.16-2.el7.x86_64.rpm - Removed: Provided by EPEL.
- protobuf-2.5.0-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- protobuf-compiler-2.5.0-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- protobuf-devel-2.5.0-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- protobuf-lite-2.5.0-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- protobuf-lite-devel-2.5.0-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- protobuf-lite-static-2.5.0-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- protobuf-python-2.5.0-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- protobuf-static-2.5.0-1.el7.x86_64.rpm - Removed: Provided by EPEL.
- protobuf-vim-2.5.0-1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- protobuf-c{,-devel}-0.15-2.1.el7.x86_64.rpm - Removed: Provided by CentOS/RHEL.
- psycopg2-2.8.1-1.el7.x86_64.rpm - Removed: No longer needed.
- pyew-2.3.0.0-2.el7.x86_64.rpm - Removed: No longer needed.
- pygtksourceview{,-devel,-doc}-2.8.0-1.el7.x86_64.rpm - Removed: Provided by EPEL.
- pyparsing{,-doc}-2.4.0-1.el7.noarch.rpm - Removed: Provided by CentOS/RHEL.
- pyPdf-1.12-4.el7.noarch.rpm - Removed: No longer needed.
- python2-certifi-2019.3.9-2.el7.noarch.rpm - Removed: No longer needed.
- python2-efilter-1.5-1.el7.noarch.rpm - Removed: No longer needed.
- python2-elasticsearch5-5.5.5-2.el7.x86_64.rpm - Removed: No longer needed.
- python2-idna-2.5-1.el7.noarch.rpm - Removed: No longer needed.
- python2-scapy-2.4.0-5.el7.noarch.rpm - Removed: No longer needed.
- python3-certifi-2019.3.9-2.el7.noarch.rpm - Removed: No longer needed.
- python3-idna-2.5-1.el7.noarch.rpm - Removed: No longer needed.
- python3-psycopg2-2.8.1-1.el7.x86_64.rpm - Removed: No longer needed.
- python3-pyparsing-2.4.0-1.el7.noarch.rpm - Removed: No longer needed.
- python3-scapy-2.4.0-5.el7.noarch.rpm - Removed: No longer needed.
- python3shim-1.0-1.el7.noarch.rpm - Removed: No longer needed.
- python-dpkt-1.8-2.el7.noarch.rpm - Removed: No longer needed.
- python-elasticsearch5-5.5.5-1.el7.x86_64.rpm - Removed: No longer needed.
- python-httplib2-0.7.7-3.el7.noarch.rpm - Removed: No longer needed.
- python-ipython-2.2.0-1.el7.noarch.rpm - Removed: No longer needed.
- python-ipython-console-2.2.0-1.el7.noarch.rpm - Removed: No longer needed.
- python-ipython-doc-2.2.0-1.el7.noarch.rpm - Removed: No longer needed.
- python-ipython-gui-2.2.0-1.el7.noarch.rpm - Removed: No longer needed.
- python-ipython-notebook-2.2.0-1.el7.noarch.rpm - Removed: No longer needed.
- python-ipython-sphinx-2.2.0-1.el7.noarch.rpm - Removed: No longer needed
- python-ipython-tests-2.2.0-1.el7.noarch.rpm - Removed: No longer needed.
- python-M2Crypto-0.26.0-0.x86_64.rpm - Removed: No longer needed.
- python-path-3.0.1-2.el7.noarch.rpm - Removed: No longer needed.
- python-prettytable-0.7.2-4.el7.noarch.rpm - Removed: No longer needed.
- python-psycopg2{,-doc}-2.5.1-3.el7.x86_64.rpm - Removed: No longer needed.
- python-radare-2.1.6.0-1.el7.x86_64.rpm - Removed: No longer needed.
- python-radare2-2.9.0-1.el7.x86_64.rpm - Removed: Provided by EPEL.
- python-tidy-0.2-1.1.el7.noarch.rpm - Removed: No longer needed.
- python-tornado{,-doc}-3.2.1-3.el7.x86_64.rpm - Removed: No longer needed.
- pytsk-20150406-4.el7.x86_64.rpm - Removed: Removed - replaced by pytsk3.
- radare{,-devel,-extras}-2.1.6.0-1.el7.x86_64.rpm - Removed: No longer needed.
- radare2{,-common,-devel}-2.9.0-1.el7.x86_64.rpm - Removed: No longer needed.
- scalpel-2.0-2.el7.x86_64.rpm - Removed: Provided by EPEL.
- socat-1.7.3.2-1.1.el7.x86_64.rpm - Removed: Provided by EPEL.
- ssdeep-2.14.1-1.el7.x86_64.rpm - Removed: Provided by EPEL.
- tcpflow-1.4.4-12.el7.x86_64.rpm - Removed: Provided by EPEL.
- tcpxtract-1.0.1-10.el7.2.x86_64.rpm - Removed: Provided by EPEL.
- ttembed-1.1-3.el7.x86_64.rpm - Removed: Provided by EPEL.
- testdisk-6.14-3.3.el7.x86_64.rpm - Removed: Provided by EPEL.
- umview-0.8.2-1.1.el7.x86_64.rpm - Removed: No longer needed.
- valabind-0.10.0-4.el7.x86_64.rpm - Removed: No longer needed.
- xapian-core{,-devel,-libs}-1.2.7-2.el7.x86_64.rpm - Removed: No longer needed.
- xmount-0.7.6-3.el7.x86_64.rpm - Removed: Provided by EPEL.
- xrdp-0.5.0-0.13.el7.x86_64.rpm - Removed: Provided by EPEL.
- yara{,-devel,-doc}-3.5.0-7.1.el7.x86_64.rpm - Removed: Provided by EPEL.
- zeromq{,-devel}-2.2.0-4.el7.x86_64.rpm - Removed: Provided by EPEL.
These changes were also made:
- python{2,3}‑artifacts‑20190320‑2.{fc26,fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm, artifacts‑data‑20190320‑2.{fc26,fc27,fc28,fc29,fc30}.{i386,x86_64}.rpm,
python{2,36}‑artifacts‑20190320‑2.el7.x86_64.rpm, and artifacts‑data‑20190320‑2.el7.x86_64.rpm -
Artifacts is a free, community-sourced,
machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-artifacts and python36-artifacts.
The package names for Fedora are unchanged.
- python{2,3}‑bencode‑2.1.0‑1.{fc26,fc27,fc28,fc29,fc30}.noarch.rpm and python{2,36}‑bencode-2.1.0-1.el7.noarch.rpm -
Bencode re-packages the existing bencoding
and bdecoding implemention from the ‘official’ BitTorrent client as a separate, light-weight package for re-using them without having the entire BitTorrent software as a dependency.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-bencode and python36-bencode.
The package names for Fedora are unchanged.
- python{2,3}‑biplist-1.0.3-3.{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and python{2,36}‑biplist-1.0.3-3.el7.x86_64.rpm -
Biplist is a library for reading/writing binary plists.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-biplist and python36-biplist.
The package names for Fedora are unchanged.
- python{2,3}‑chardet-3.0.4-3.fc26.{i686,x86_64}.rpm and python{2,36}‑chardet-3.0.4-3.el7.x86_64.rpm -
Chardet is a universal character encoding detector.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-chardet and python36-chardet.
The package names for Fedora are unchanged.
- python{2,3}‑dfdatetime‑20190517‑2.{fc25,fc26,fc27,fc28,fc29,fc30}.noarch.rpm and python{2,36}‑dfdatetime‑20190517‑2.el7.noarch.rpm -
dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-dfdatetime and python36-dfdatetime.
The package names for Fedora are unchanged.
- python{2,3}‑dfvfs-20190511-1.{fc25,fc26,fc27,fc28,fc29,fc30}.noarch.rpm and python{2,36}‑dfvfs‑20190511‑1.el7.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to
file-system objects from various storage media types and file formats.
Note: The package for CentOS/RHEL 7 are named python2-dfvfs and python36-dfvfs.
- python{2,3}‑dfwinreg‑20190517‑2.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and python{2,36}‑dfwinreg‑20190329‑2.el7.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-dfwinreg and python36-dfwinreg.
The package names for Fedora are unchanged.
- python{2,3}‑dpkt‑1.9.2‑2.fc26.{i686,x86_64}.rpm and python{2,36}‑dpkt‑1.9.2‑2.el7.x86_64.rpm -
Python-dpkt is a fast, simple packet creator and parser, with definitions for the basic TCP/IP protocols, for Python.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-dpkt and python36-dpkt.
The package names for Fedora are unchanged.
- python{2,3}‑dtfabric‑20190120‑3.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and python{2,36}‑dtfabric‑20190120‑3.el7.x86_64.rpm -
Dtfabric is a project to manage data types and structures,
as used in the libyal projects.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-dtfabric and python36-dtfabric.
The package names for Fedora are unchanged.
- python{2,3}‑elasticsearch‑7.0.2‑1.i{fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and python{2,36}‑elasticsearch‑7.0.2‑1.el7.x86_64.rpm -
ElasticSearch is the official low-level client for
Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python;
because of this it tries to be opinion-free and very extendable.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-elasticsearch and python36-elasticsearch.
The package names for Fedora are unchanged.
- libbde{,‑devel,‑python2,‑python3,‑tools}‑20190317‑3.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libbde{,‑devel,‑python2,‑tools}‑20190317‑3.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python2,‑python36,‑tools}‑20190317‑3.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libbde and python36-libbde.
All other package names are unchanged.
- libesedb{,‑devel,‑python2,‑python3,‑tools}‑20181229‑5.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libesedb{,‑devel,‑python2,‑tools}‑20181229‑5.el6.{i686,x86_64}.rpm, and libesedb{,‑devel,‑python2,‑python36,‑tools}‑20181229‑5.el7.x86_64.rpm -
Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libesedb and python36-libesedb.
All other package names are unchanged.
- libevt{,‑devel,‑python2,‑python3,‑tools}‑20181227‑5.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevt{,‑devel,‑python2,‑tools}‑20181227‑5.el6.{i686,x86_64}.rpm, and libevt{,‑devel,‑python2,‑python36,‑tools}‑20181227-5.el7.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libevt and python36-libevt.
All other package names are unchanged.
- libevtx{,‑devel,‑python2,‑python3,‑tools}‑20181227‑5.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python2,‑tools}‑20181227‑5.el6.{i686,x86_64}.rpm, and libevtx{,‑devel,‑python2,‑python36,‑tools}‑20181227‑5.el7.x86_65.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libevtx and python36-libevtx.
All other package names are unchanged.
- libewf{,‑devel,‑tools,‑python2,‑python3,‑tools}‑20160718‑20140806.3.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libewf{,‑devel,‑tools,‑python2,‑tools}‑20160718‑20140806.3.el6.{i686,x86_64}.rpm, and
libewf{,‑devel,‑tools,‑python2,‑python36,‑tools}‑20160718‑20140806.3.el7.x86_64.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
This package is built from the libewf source code dated 20140806 but to make it the latest version, the version number was changed to the build date (20160718)
and the release number changed to include the source code release date (20140806).
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libevtx and python36-libevtx.
All other package names are unchanged.
- libfsapfs{,‑devel,‑python2,‑python3,‑tools}‑20190510‑2.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2,‑tools}‑20190510‑2.el6.{i686,x86_64}.rpm, and libfsapfs{,‑devel,‑python2,‑python36,‑tools}‑20190510‑2.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libfsapfs and python36-libfsapfs.
All other package names are unchanged.
- libfsntfs{,‑devel,‑python2,‑python3,‑tools}‑20190104‑5.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2,‑tools}‑20190104‑5.el6.{i686,x86_64}.rpm, and libfsntfs{,‑devel,‑python2,‑python36,‑tools}‑20190104‑5.el7.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libfsntfs and python36-libfsntfs.
All other package names are unchanged.
- libfvde{,‑devel,‑python2,‑python3,‑tools}‑20190104‑4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfvde{,‑devel,‑python2,‑tools}‑20190104‑4.el6.{i686,x86_64}.rpm, and libfvde{,‑devel,‑python2,‑python36,‑tools}‑20190104‑4.el7.6_64.rpm -
Libfvde is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libfvde and python36-libfvde.
All other package names are unchanged.
- libfwnt{,‑devel,‑python2,‑python3}‑20181227‑4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python2}‑20181227‑4.el6.{i686,x86_64}.rpm and libfwnt{,‑devel,‑python2,‑python36}‑20181227‑4.el7.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libfwnt and python36-libfwnt.
All other package names are unchanged.
- libfwsi{,‑devel,‑python2,‑python3}-20181227-4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2}-20181227-4.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python2,‑python36}-20181227-4.el7.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libfwsi and python36-libfwsi.
All other package names are unchanged.
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20181227-4.el6.{i686,x86_64}.rpm, and liblnk{,‑devel,‑python2,‑python36,‑tools}-20181227-4.el7.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-liblnk and python36-liblnk.
All other package names are unchanged.
- libmsiecf{,‑devel,‑python2,‑python3,‑tools}-20181227-4.{fc25,fc26,fc26,fc27,fc29,fc30}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python2,‑tools}-20181227-4.el6.{i686,x86_64}.rpm, and libmsiecf{,‑devel,‑python2,‑python36,‑tools}-20181227-4.el7.x86_64.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libmsiecf and python36-libmsiecf.
All other package names are unchanged.
- libolecf{,‑devel,‑python2,‑python3,‑tools}-20181231-4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python2,‑tools}-20181231-4.el6.{i686,x86_64}.rpm, and libolecf{,‑devel,‑python2,‑python36,‑tools}-20181231-4.el7.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libolecf and python36-libolecf.
All other package names are unchanged.
- libqcow{,‑devel,‑python2,‑python3,‑tools}‑20181227‑5.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python2,‑tools}‑20181227‑5.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python2,‑python36,‑tools}‑20181227‑5.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libqcow and python36-libqcow.
All other package names are unchanged.
- libregf{,‑devel,‑python2,‑python3,‑tools}‑20190303‑3.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑tools}‑20190303‑3.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑python36,‑tools}‑20190303‑3.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libregf and python36-libregf.
All other package names are unchanged.
- libscca{,‑devel,‑python2,‑python3,‑tools}‑20190605‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libscca{,‑devel,‑python2,‑tools}‑20190605‑1.el6.{i686,x86_64}.rpm, and libscca{,‑devel,‑python2,‑python36,‑tools}‑20190605‑1.el7.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
Note: The package for CentOS/RHEL 7 are named python2-libscca and python36-libscca.
- libsigscan{,‑devel,‑python2,‑python3,‑tools}‑20190103‑4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python2,‑tools}‑20190103‑4.el6.{i686,x86_64}.rpm, and libsigscan{,‑devel,‑python2,‑python36,‑tools}‑20190103‑4.el7.x86_64.rpm -
Libsigscan is a library and tools used to binary signature scanning.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libsigscan and python36-libsigscan.
All other package names are unchanged.
- libsmdev{,‑devel,‑python2,‑python3,‑tools}‑20190315‑3.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑tools}‑20190315‑3.el6.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python2,‑python36,‑tools}‑20190315‑23el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libsmdev and python36-libsmdev.
All other package names are unchanged.
- libsmraw{,‑devel,‑python2,‑python3,‑tools}‑20181227‑5.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python2,‑tools}‑20181227‑5.el6.{i686,x86_64}.rpm, and libsmraw{,‑devel,‑python2,‑python36,‑tools}‑20181227‑5.el7.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libsmraw and python36-libsmraw.
All other package names are unchanged.
- libvhdi{,‑devel,‑python2,‑python3,‑tools}‑20181227‑5.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python2‑tools}‑20181227‑5.el6.{i686,x86_64}.rpm and libvhdi{,‑devel,‑python2,‑python36,‑tools}‑20181227‑5.el7.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libvhdi and python36-libvhdi.
All other package names are unchanged.
- libvmdk{,‑devel,‑python2,‑python3,‑tools}‑20181227‑5.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python2,‑tools}‑20181227‑5.el6.{i686,x86_64}.rpm, and libvmdk{,‑devel,‑python2,‑python36,‑tools}‑20181227‑5.el7.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libvmdk and python36-libvmdk.
All other package names are unchanged.
- libvshadow{,‑devel,‑python2,‑python3,‑tools}‑20190323‑3.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python2,‑tools}‑20190323‑3.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python2,‑python36,‑tools}‑20190323‑3.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libvshadow and python36-libvshadow.
All other package names are unchanged.
- libvslvm{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python2‑tools}‑20181227‑4.el6.{i686,x86_64}.rpm, and libvslvm{,‑devel,‑python2,‑python36,‑tools}‑20181227‑4.el7.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libvslvm and python36-libvslvm.
All other package names are unchanged.
- python{2,3}-pefile‑2019.4.18‑2.{fc26,fc27,fc28,fc29,fc30}.noarch.rpm and python{2,36}-pefile‑2019.4.18‑2.el7.noarch.rpm -
PEFile is a Portable Executable reader module.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-pefile and python36-pefile.
The package names for Fedora are unchanged.
- python36-urllib3-1.24.1-1.el7.x86_64.rpm -
Python-urllib3 is a powerful, sanity-friendly HttP client for Python.
Much of the Python ecosystem already uses urllib3.
urllib3 brings many critical features that are missing from the Python standard libraries:
- Thread safety.
- Connection pooling.
- Client-side SSL/TLS verification.
- File uploads with multipart encoding.
- Helpers for retrying requests and dealing with HttP redirects.
- Support for gzip and deflate encoding.
- Proxy support for HttP and SOCKS.
- 100% test coverage.
This package was built to support plaso.
- python{2,36}-lz4-0.10.0-1.el7.x86_64.rpm -
LZ4 contains the python bindings for the lz4 compression library.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-lz4 and python36-lz4.
The package names for Fedora are unchanged.
- python{2,36}-psutil-5.4.3-4.el7.x86_64.rpm -
Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network)in Python.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-psutil and python36-psutil.
- python{2,3}-pytsk3‑20190507‑2.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, python2-pytsk3‑20190507‑2.el6.{i686,x86_64}.rpm, and python{2,36}-pytsk3‑20190507-2.el7.x86_64.rpm -
Pytsk is Python bindings for The Sleuth Kit.
- python{2,3}-requests-2.22.0-1.fc26.{i686,x86_64}.rpm and python36-requests-2.22.0-1.el7.x86_64.rpm -
Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings.
Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web.
It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
- python{2,3}-xlsxwriter-1.1.8-2.{fc26,fc27,fc28,fc29,fc30}.noarch.rpm and {python2,36}-xlsxwriter-1.1.8-2.el7.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-xlsxwriter and python36-xlsxwriter.
The package names for Fedora are unchanged.
- plaso‑20190429‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso‑20190429‑1.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release uses Python 3 instead of Python 2.
Please note that for Fedora 25, of all of the ancillary packages needed by plaso use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
For Fedora 25, this package contains a program named update-plaso, the purpose of which is to update the packages that plaso depends upon.
Note that this updates the dependent packages but not plaso.
The recommendation is to run update-plaso routinely to keep the plaso dependencies updated.
Finally, for CentOS/RHEL 7, plaso no longer relies on a Python
Virtual Environment.
- sleuthkit{,‑devel,‑libs}‑4.6.6‑1.1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and sleuthkit{,‑devel,‑libs}‑4.6.6‑1.1.el7.x86_64.rpm -
The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
This version was built with a higher revision than that provided by Fedora.
- winreg‑kb‑20190507‑1.el7.x86_64.rpm -
Winreg-kb-kb winreg-kb is a project to build a Windows Registry Knowledge Base.
winregrc is a Python module part of winreg-kb to allow reuse of Windows Registry Resources.
See these scripts that make use of package.
- winevt‑kb‑20190507-1.el7.x86_64.rpm -
Winevt-kb is a project to build a Windows Event Log knowledge base.
winevtrc is the Python module part of winevt-kb to allow reuse of Windows Event Log resources.
See this resource for an explanation of the scripts included with this package - export.py, extract.py, query.py - and how to use them.
This version uses Python 3.
- libwrc{,‑devel,‑python2,‑python3,‑tools}‑20181203‑4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libwrc{,‑devel,‑python2,‑tools}‑20181203‑4.el6.{i686,x86_64}.rpm, and libwrc{,‑devel,‑python2,‑python36,‑tools}‑20181203‑3.el7.x86_64.rpm -
Libwrc is a library and tools to access the Windows Resource Compiler (WRC) format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libwrc and python36-libwrc.
All other package names are unchanged.
- libexe{,‑devel,‑python2,‑python3,‑tools}‑20181128‑4.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm, libexe{,‑devel,‑python2,‑tools}‑20181128‑4.el6.{i686,x86_64}.rpm, and libexe{,‑devel,‑python2,‑python36,‑tools}‑20181128‑4.el7.x86_64.rpm -
Libexe is a library and tools to access the executable (EXE) format.
Note: This release contains no new capabilities.
The only differences is that the packages for CentOS/RHEL 7 are named python2-libexe and python36-libexe.
All other package names are unchanged.
- python{2,3}‑construct‑2.5.2‑4.{fc25,fc26,fc27,fc28,fc29}.noarch.rpm, python2‑construct‑2.5.2‑4.el6.noarch.rpm, and python{2,36}‑construct‑2.5.2‑4.el7.noarch.rpm -
Python-construct is a powerful declarative parser (and builder) for binary data.
- rekall-forensics-1.7.2.rc1-1.{fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and rekall-forensics-1.7.2.rc1-1.el7.x86_64.rpm -
Rekall is an advanced forensic and incident response framework.
While it began life purely as a memory forensic framework, it has now evolved into a complete platform.
Rekall implements the most advanced analysis techniques in the field, while still being developed in the open, with a free and open source license. Many of the innovations implemented within Rekall have been published in
peer reviewed papers.
The program to run is named rekall.py.
Please note that the installation of all of these ancillary packages neede by rekall use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
- vmfs-tools-0.2.5-3.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, vmfs-tools-0.2.5-3.el7.x86_64.rpm, libvmfs-devel-0.2.5-3.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, and libvmfs-devel-0.2.5-3.el7.x86_64.rpm -
VMfs-tools is a collection of command-line tools for operating on VMware's VMFS file system.
Included in this release is limited VMFS version 5 support.
Note: The tools in the vmfs-tools package are named debugvmfs, fsck.vmfs, vmfs-fuse, vmfs-lvm.
The tools installed are also named debugvmfs5, fsck.vmfs5, vmfs5-fuse, vmfs5-lvm.
- vmfs6-tools-0.0.0.844.1195-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, vmfs6-tools-0.0.0.844.1195-1.el7.x86_64.rpm, libvmfs6-devel-0.0.0.844.1195-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm, and libvmfs6-devel-0.0.0.844.1195-1.el7.x86_64.rpm -
VMFS6-tools is a collection of command-line tools for operating on VMware's VMFS file system.
Included in this release is limited VMFS version 6 support.
Note: The tools in the vmfs6-tools package are named debugvmfs6, fsck.vmfs6, vmfs6-fuse, vmfs6-lvm.
- xva-img-1.3-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and xva-img-1.3-1.el7.x86_64.rpm -
XVA-IMG is a tool for working with Citrix XEN disk images.
Citrix Xen uses a custom virtual appliance format for import/export called "XVA".
It's basically a strangely crafted tar-file.
You don't need this program to unpack this tar-file, just use your favourite tar unpacker (tar, gtar, bsdtar).
Once unpacked you will end up with a lot of different files, ova.xml (which contains the settings for the virtual appliance, think VMware vmx) and a number of folders called Ref:/, this is your disks.
Each of these folders contain hundreds of files named 00000000, 00000001 with a accompanying .CHECKSUM file (SHA1).
Each file is a 1MB slice of the disk, but some of the files in the sequence will probably be missing this is because XVA do not use compression; instead it will exclude slices of the disk that only contains zeros (are empty).
This tool can assemble the disk for you (you will end up with a RAW disk) that can easily be mounted and modified.
It can then also split the file again and generate checksum.
Once ready, you will probably want to use the "package" command to rebuild the XVA file.
- CERT-Forensics-Tools-1.0-85.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm
and CERT-Forensics-Tools-1.0-85.el7.x86_64.rpm -
The changes since the last release (1.0-84) are the following:
- cert-forensics-tools-release-{25,26,27,28,29,30,6,7}-14.noarch.rpm -
cert-forensics-tools-release is the package that connects a Fedora-based computer system to the CERT Linux Forensics Tools Repository (LiFTeR).
This package has been changed to require either a Fedora release or a Generic release to be able to install this package.
- autopsy-4.11.0-1.{fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and autopsy-4.11.0-1.el7.x86_64.rpm -
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer.
You can even use it to recover photos from your camera's memory card.
In addition, the Java™ Platform, Standard Edition Development Kit (JDK™) from Oracle also needs to be installed before running autopsy.
That package can be found here.
Testing has been verified to work with JDK 11.0.2.
- pfring‑7.4.0‑2553.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2553.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1596.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.4.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.1.8-300 for FC30
- 5.1.7-300 for FC30
- 5.1.6-300 for FC30
- 5.1.5-300 for FC30
- 5.0.17-300 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-4.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.1.8-300 for FC30
- 5.1.7-300 for FC30
- 5.1.6-300 for FC30
- 5.1.5-300 for FC30
- 5.0.17-300 for FC30
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.25.noarch.rpm -
Support for the following kernels were added for Fmem:
- 5.1.6-200 for FC29
- 5.0.19-200 for FC29
- 5.0.17-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-25.noarch.rpm -
Support for the following kernels were added for LiME:
- 5.1.6-200 for FC29
- 5.0.19-200 for FC29
- 5.0.17-200 for FC29
- fmem-kernel-modules-el7-x86_64-1.6-1.52.noarch.rpm -
Support for the following kernels were added for Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-52.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
May 10, 2019:
The following changes have been made:
- Fedora 30 - The repository now supports Fedora 30
for the x86_64 and i386 CPU architectures.
Here is the list of tools provided for Fedora 30:
- lime-kernel-modules-1.1.r17-16.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 30 x86_64 and i386 architectures was added.
- fmem-kernel-modules-1.6-1.16.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 30 x86_64 and i386 architectures was added.
- CERT-Forensics-Tools-1.0-84.{fc24,fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-84.el7.x86_64.rpm -
The changes since the last release (1.0-83) are the following:
- The dff package is not installed on Fedora 30.
- The kracked package is not installed on Fedora 30.
- python{2,3}-xlsxwriter-1.1.8-1.{fc24,fc25,fc26,fc27,fc28,fc29,fc30,el7}.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.1.7).
- libfsapfs{,‑devel,‑python2,‑python3,‑tools}‑20190510‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2,‑tools}‑20190510‑1.el6.{i686,x86_64}.rpm, and libfsapfs{,‑devel,‑python2,‑python3,‑tools}‑20190510‑1.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
- sleuthkit{,‑devel,‑libs}‑4.6.6‑1.{fc24,fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and sleuthkit{,‑devel,‑libs}‑4.6.6‑1.el7.x86_64.rpm -
The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.6.5) released to this repository.
- pytsk3‑20190507‑1.{fc24,fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and pytsk3‑20190507-1.el7.x86_64.rpm -
Pytsk is Python bindings for The Sleuth Kit.
- python{2,3}‑dpkt‑1.9.2‑1.fc26.{i686,x86_64}.rpm -
Python-dpkt is a fast, simple packet creator and parser, with definitions for the basic TCP/IP protocols, for Python.
This package was built to support plaso.
- plaso‑20190331‑2.{fc24,fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm and plaso‑20190331‑2.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This release uses Python 3 instead of Python 2.
Please note that for Fedora 24 and 25 and CentOS/RHEL 7, of all of the ancillary packages needed by plaso use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
For Fedora 24 and 25 and CentOS/RHEL 7, this package contains a program named update-plaso, the purpose of which is to update the packages that plaso depends upon.
Note that this updates the dependent packages but not plaso.
The recommendation is to run update-plaso routinely to keep the plaso dependencies updated.
- winreg‑kb‑20190507‑1.{fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm -
Winreg-kb-kb winreg-kb is a project to build a Windows Registry Knowledge Base.
winregrc is a Python module part of winreg-kb to allow reuse of Windows Registry Resources.
See these scripts that make use of package.
Note that winreg-kb is not available for CentOS/RHEL 6 because of the old version of Python 2.
This version uses Python 3.
- winevt‑kb‑20190507-1.{fc24,fc25,fc26,fc27,fc28,fc29,fc30}.{i686,x86_64}.rpm -
Winevt-kb is a project to build a Windows Event Log knowledge base.
winevtrc is the Python module part of winevt-kb to allow reuse of Windows Event Log resources.
See this resource for an explanation of the scripts included with this package - export.py, extract.py, query.py - and how to use them.
This version uses Python 3.
- daq{,‑devel,‑modules}‑2.0.6‑7.1.{fc24,fc25,fc26,fc27,fc28,fc29,fc30,el6}.{i686,x86_64}.rpm and daq{,‑devel,‑modules}‑2.0.6‑7.1.el7.x86_64.rpm -
The Data Acquisition Library (Daq) is a library used by snort.
- pfring‑7.4.0‑2504.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring‑dkms‑7.4.0‑2504.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi‑2.8.0‑1564.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- guymager-0.8.8-2.{fc24,fc25,fc26,fc27,fc28.fc29,fc30,el6}.{i686,x86_64}.rpm and guymager-0.8.8-2.el7.x86_64.rpm -
Guymager is a forensic imaging package.
See here for the list of changes.
This release contains no new functionality and was rebuilt to include a patch for GCC 8 which is standard on Fedora 28, 29, and 30.
- fmem-kernel-modules-fc30-{i386,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- 5.0.13-300 for FC30
- 5.0.11-300 for FC30
- lime-kernel-modules-fc30-{i386,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- 5.0.13-300 for FC30
- 5.0.11-300 for FC30
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- 5.0.13-200 for FC29
- 5.0.11-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- 5.0.13-200 for FC29
- 5.0.11-200 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.40.noarch.rpm - Support for the following kernels were added for
Fmem:
- 5.0.13-100 for FC28
- 5.0.11-100 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-40.noarch.rpm - Support for the following kernels were added for
LiME:
- 5.0.13-100 for FC28
- 5.0.11-100 for FC28
|
|
May 3, 2019:
The following changes have been made:
- httplib2‑0.12.3‑1.el7.noarch.rpm - Httpib2 is comprehensive HttP client library, httplib2 supports many features left out of other HttP libraries.
This package was installed for CentOS/RHEL 7 to support xplico.
Please note that for CentOS/RHEL 7, this package was built incorrectly and was not usable.
These build problems have been fixed in this release.
- nDPI{,‑devel}‑2.9.0‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and nDPI{,‑devel}‑2.9.0‑1.el7.x86_64.rpm -
nDPI is a ntop-maintained superset of the popular OpenDPI library.
Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available only on the paid version of OpenDPI.
In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
- xplico-1.2.2-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and xplico-1.2.2-2.el7.x86_64.rpm -
xplico is an Internet traffic decoder.
The changes include:
- CakePHP updated to 2.10.17
- Migration from GeoIP to GeoIP2
- nDPI updated to 2.9
- ghidra-9.0.2-PUBLIC_20190403.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and ghidra-9.0.2-PUBLIC_20190403.el7.x86_64.rpm -
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms
including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features.
Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes.
Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.
See the list of changes and improvement here.
Please note that you must install the JDK for Ghidra to work.
In testing, The Java Development Kit (JDK) version 11.0.2 was used and worked successfully.
Ghidra expects a program named java to be available in the directories named in the PATH variable.
- python{2,3}‑bencode-2.0.0-2.el7.noarch.rpm -
Bencode re-packages the existing bencoding
- python{2,3}‑biplist-1.0.3-2.el7.x86_64.rpm -
Biplist is a library for reading/writing binary plists.
Binary Property List (plist) files provide a faster and smaller serialization format for property lists on OS X.
This is a library for generating binary plists which can be read by OS X, iOS, or other clients.
- python{2,3}‑dfdatetime-20190116-2.el7.noarch.rpm - dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- python{2,3}-dfwinreg-20190329-1.el7.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- python2-dtfabric-20190120-2.el7.x86_64.rpm -
Dtfabric is a project to manage data types and structures, as used in the libyal projects.
- python{2,3}-elasticsearch-6.3.1-2.el7.x86_64.rpm -
ElasticSearch is the official low-level client for
Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python;
because of this it tries to be opinion-free and very extendable. For a more high level client library with more limited scope, have a
look at elasticsearch-dsl - a more pythonic library sitting on top of elasticsearch-py. It provides a more convenient and idiomatic way
to write and manipulate queries. It stays close to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the
whole range of the DSL from Python either directly using defined classes or a queryset-like expressions. It also provides an optional
persistence layer for working with documents as Python objects in an ORM-like fashion: defining mappings, retrieving and saving documents,
wrapping the document data in user-defined classes.
- idna-2.5-1.el7.noarch.rpm -
IDNA provides support for the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891. This is the latest version of the protocol and is sometimes referred to as “IDNA 2008”.
|
|
April 26, 2019:
The following changes have been made:
- python{2,3}‑dfvfs-20190301-1.{fc25,fc26,fc27,fc28,fc29,fc30}.noarch.rpm and python2‑dfvfs‑20190301‑1.el7.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation of the various storage media types,
volume systems and file systems.
- python{2,3}-xlsxwriter-1.1.7-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.1.5).
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- 5.0.9-200 for FC29
- 5.0.8-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- 5.0.9-200 for FC29
- 5.0.8-200 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.39.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-39.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
April 19, 2019:
The following changes have been made:
- pfring-7.4.0-2489.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
To install this package, you must first do the following:
sudo rpm -ev pfring pfring-dkms --nodeps
followed by:
sudo yum -y install pfring pfring-dkms
- pfring-dkms-7.4.0-2489.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
To install this package, you must first do the following:
sudo rpm -ev pfring pfring-dkms --nodeps
followed by:
sudo yum -y install pfring pfring-dkms
- ndpi-2.8.0-1540.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- python{2,3}-pefile‑2019.4.18‑1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm -
PEFile is a Portable Executable reader module.
- python{2,3}‑artifacts‑20190320‑1.el7.x86_64.rpm and artifacts‑data‑20190320‑1.el7.x86_64.rpm -
Artifacts is a free, community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
- libfixbuf{,‑devel}-2.3.1-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and libfixbuf{,‑devel}-2.3.1-1.el7.x86_64.rpm -
Libfixbuf is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.1‑3.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.1‑3.el7.x86_64.rpm and -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
This package was rebuilt to use libfixbuf 2.3.1.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.1‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm,
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.1‑4.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
This package was rebuilt to use libfixbuf 2.3.1.
- libschemaTools{,‑devel}‑1.3‑5.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and libschemaTools{,‑devel}‑1.3‑5.el7.x86_64.rpm -
libschemaTools is a library that provides a standard representation of data records.
It is built on fixbuf, using IPFIX information elements.
It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source.
SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records.
This package was rebuilt to use libfixbuf 2.3.1.
- pyfixbuf-0.7.0-2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and pyfixbuf-0.7.0-2.el7.x86_64.rpm -
Pyfixbuf is a Python API for libfixbuf,
an implementation of the IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this and all releases.
This package was rebuilt to use libfixbuf 2.3.1.
- analysis‑pipeline‑5.10-2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and analysis‑pipeline‑5.10-2.el7.x86_64.rpm -
The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
This package was rebuilt to use libfixbuf 2.3.1.
- super_mediator‑1.7.0‑2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator‑1.7.0‑2.el7.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
This package was rebuilt to use libfixbuf 2.3.1.
- yaf{,‑devel}‑2.11.0-2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and yaf{,‑devel}-2.11.0-2.el7.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
Note that for CentOS 6 and 7 for the x86_64 architecture, yaf has been built to use PF_Ring.
This package was rebuilt to use libfixbuf 2.3.1.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.38.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-38.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
April 12, 2019:
The bulk of the changes this week deal with the release of Python 3.6 in the Extra Packages for Enterprise Linux (EPEL) repository for CentOS/RHEL 7.
This release is the preferred package which obsoletes Python 3.3.2 that was previously provided in LiFTeR.
To that end, Python 3.3.2 was removed from LiFTeR and most of the following packages have been rebuilt to use Python 3.6 for CentOS/RHEL 7.
For all other releases, these same packages were simply rebuilt to maintain release numbering consistency and contain no new functionality.
The following changes have been made:
- pfring-7.4.0-2489.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2489.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.8.0-1537.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- capstone{,‑devel}‑3.0.5‑1.el6.{i386,x86_64}.rpm and python2-capstone‑3.0.5‑1.el6.{i386,x86_64}.rpm -
Capstone is a lightweight multi-platform, multi-architecture disassembly framework.
See here for the list of changes and future features.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- pyew‑2.3.0.0‑2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and pyew‑2.3.0.0‑2.el7.x86_64.rpm -
Pyew is a (command line) python tool to analyse malware.
It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits), PE and ELF file formats (it performs code analysis and let you write scripts using an
API to perform many types of analysis), follows direct call/jmp instructions in the interactive command line, displays function names and string data references; supports
OLE2 format, PDF format and more.
It also supports plugins to add more features to the tool.
This package was rebuilt for CentOS/RHEL 6 because of the new capstone package. The other systems were rebuilt to maintain release numbering consistency.
- libcreg{,‑devel,‑python2,‑python3,‑tools}‑20181101‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libcreg{,‑devel,‑python2,‑tools}‑20181101‑2.el6.{i686,x86_64}.rpm, and libcreg{,‑devel,‑python2,‑python3,‑tools}‑20181101‑2.el7}.x86_64.rpm -
Libcreg is a library and tools to access the Windows 9x/Me Registry File (CREG) format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- libesedb{,‑devel,‑python2,‑python3,‑tools}‑20181229‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libesedb{,‑devel,‑python2,‑tools}‑20181229‑4.el6.{i686,x86_64}.rpm, and libesedb{,‑devel,‑python2,‑python3,‑tools}‑20181229‑3.el7}.x86_64.rpm -
Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libevt{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libevt{,‑devel,‑python2,‑tools}‑20181227‑4.el6.{i686,x86_64}.rpm, and libevt{,‑devel,‑python2,‑python3,‑tools}‑20181227-4.el7.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libevtx{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python2,‑tools}‑20181227‑4.el6.{i686,x86_64}.rpm, and libevtx{,‑devel,‑python2,‑python3,‑tools}‑20181227‑5.el7.x86_64.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libewf{,‑devel,‑tools,‑python2,‑python3,‑tools}‑20160718‑20140806.2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libewf{,‑devel,‑tools,‑python2,‑tools}‑20160718‑20140806.2.el6.{i686,x86_64}.rpm, and libewf{,‑devel,‑tools,‑python2,‑python3,‑tools}‑20160718‑20140806.2.el7.x86_64.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
This package is built from the libewf source code dated 20140806 but to make it the latest version, the version number was changed to the build date (20160718)
and the release number changed to include the source code release date (20140806).
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libexe{,‑devel,‑python2,‑python3,‑tools}‑20181128‑3.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libexe{,‑devel,‑python2,‑tools}‑20181128‑3.el6.{i686,x86_64}.rpm, and libexe{,‑devel,‑python2,‑python3,‑tools}‑20181128‑3.el7.x86_64.rpm -
Libexe is a library and tools to access the executable (EXE) format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libfsapfs{,‑devel,‑python2,‑python3,‑tools}‑20190210‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2,‑tools}‑20190210‑3.el6.{i686,x86_64}.rpm, and libfsapfs{,‑devel,‑python2,‑python3,‑tools}‑20190210‑3.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libfsext{,‑devel,‑python2,‑python3,‑tools}‑20190115‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsext{,‑devel,‑python2,‑tools}‑20190115‑2.el6.{i686,x86_64}.rpm, and libfsext{,‑devel,‑python2,‑python3,‑tools}‑20190115‑2.el7.x86_64.rpm -
Libfsext is a lbrary and tools to access the Extended File System (EXT).
Note that this project currently only focuses on the analysis of the format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- libfshfs{,‑devel,‑python2,‑python3,‑tools}‑20181101‑4.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.{i686,x86_64}.rpm, libfshfs{,‑devel,‑python2,‑tools}‑20181101‑4.el6.{i686,x86_64}.rpm, and libfshfs{,‑devel,‑python2,‑python3,‑tools}‑20181101‑3.el7.x86_64.rpm -
Libfshfs is a lbrary and tools to access the Hierarchical File System (HFS).
Note that this project currently only focuses on the analysis of the format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libfsntfs{,‑devel,‑python2,‑python3,‑tools}‑20190104‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2,‑tools}‑20190104‑4.el6.{i686,x86_64}.rpm, and libfsntfs{,‑devel,‑python2,‑python3,‑tools}‑20190104‑4.el7.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libfvde{,‑devel,‑python2,‑python3,‑tools}‑20190104‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfvde{,‑devel,‑python2,‑tools}‑20190104‑3.el6.{i686,x86_64}.rpm, and libfvde{,‑devel,‑python2,‑python3,‑tools}‑20190104‑3.el7.6_64.rpm -
Libfvde is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libfwnt{,‑devel,‑python2,‑python3}‑20181227‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python2}‑20181227‑3.el6.x86_64.rpm, and libfwnt{,‑devel,‑python2,‑python3}‑20181227‑3.el7.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libluksde{,‑devel,‑python2,‑python3,‑tools}‑20180514‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libluksde{,‑devel,‑python2,‑python3,‑tools}‑20180514‑1.el7.x86_64.rpm, and libluksde{,‑devel,‑python,‑tools}‑20180514‑1.el6.{i686,x86_64}.rpm -
Libluksde is a library and tools used to access LUKS Disk Encryption encrypted volumes.
See here for the list of changes.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- libmodi{,‑devel,‑python2,‑python3,‑tools}‑20181101‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libmodi{,‑devel,‑python2,‑tools}‑20181101‑2.el6.{i686,x86_64}.rpm, and libmodi{,‑devel,‑python2,‑python3,‑tools}‑20181101‑2.el7.x86_64.rpm -
Libmodi is a lbrary and tools to access the Mac OS disk image formats.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- libnk2{,‑devel,‑python2,‑python3,‑tools}‑20181101‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libnk2{,‑devel,‑python2,‑tools}‑20181101‑2.el6.{i686,x86_64}.rpm, and libnk2{,‑devel,‑python2,‑python3,‑tools}‑20181101‑2.el7.x86_64.rpm -
Libnk2 is a lbrary and tools to access Microsoft Outlook Nickfile (NK2) format files.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- libpff{,‑devel,‑python2,‑python3,‑tools}‑20180714‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libpff{,‑devel,‑python2,‑tools}‑20180714‑4.{i686,x86_64}.rpm, and libpff{,‑devel,‑python2,‑python3,‑tools}‑20180714‑4.el7.x86_64.rpm -
Libpff is a library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.
PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- libphdi{,‑devel,‑python2,‑python3,‑tools}‑20181101‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libphdi{,‑devel,‑python2,‑tools}‑20181101‑1.el6.{i686,x86_64}.rpm, and libphdi{,‑devel,‑python2,‑python3,‑tools}‑20181101‑2.el7.x86_64.rpm -
Libphdi is a library to access the Parallels Hard Disk image format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- libqcow{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python2,‑tools}‑20181227‑4.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libregf{,‑devel,‑python2,‑python3,‑tools}‑20190303‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libregf{,‑devel,‑python2,‑tools}‑20190303‑2.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑python3,‑tools}‑20190303‑2.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libscca{,‑devel,‑python2,‑python3,‑tools}‑20181227‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libscca{,‑devel,‑python2,‑tools}‑20181227‑3.el6.{i686,x86_64}.rpm, and libscca{,‑devel,‑python2,‑python3,‑tools}‑20181227‑3.el7.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libsigscan{,‑devel,‑python2,‑python3,‑tools}‑20190103‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python2,‑tools}‑20190103‑3.el6.{i686,x86_64}.rpm, and libsigscan{,‑devel,‑python2,‑python3,‑tools}‑20190103‑3.el7.x86_64.rpm -
Libsigscan is a library and tools used to binary signature scanning.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libsmdev{,‑devel,‑python2,‑python3,‑tools}‑20190315‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑tools}‑20190315‑2.el6}.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python2,‑python3,‑tools}‑20190315‑2.el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libsmraw{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python2,‑tools}‑20181227‑4.el6.{i686,x86_64}.rpm and libsmraw{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.el7.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libvhdi{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python2,‑tools}‑20181227‑4.el6.{i686,x86_64}.rpm, and libvhdi{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.el7.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libvmdk{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python2,‑tools}‑20181227‑4.el6.{i686,x86_64}.rpm, and libvmdk{,‑devel,‑python2,‑python3,‑tools}‑20181227‑4.el7.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libvshadow{,‑devel,‑python2,‑python3,‑tools}‑20190323‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python2,‑tools}‑20190323‑2.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python2,‑python3,‑tools}‑20190323‑2.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libvslvm{,‑devel,‑python2,‑python3,‑tools}‑20181227‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python2,‑tools}‑20181227‑3.el6.{i686,x86_64}.rpm, and libvslvm{,‑devel,‑python2,‑python3,‑tools}‑20181227‑3.el7.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- libvsmbr{,‑devel,‑python2,‑python3,‑tools}‑20180731‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvsmbr{,‑devel,‑python2,‑tools}‑20180731‑2.el6.{i686,x86_64}.rpm, and libvsmbr{,‑devel,‑python2,‑python3,‑tools}‑20180731‑2.el7.x86_64.rpm -
Libvsmbr is a library and tools to access the Master Boot Record (MBR) volume system.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
This release also renames the Python package as -python2 and provides backward compatibility to the -python named package.
- libwrc{,‑devel,‑python2,‑python3,‑tools}‑20181203‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libwrc{,‑devel,‑python2,‑tools}‑20181203‑3.el6.{i686,x86_64}.rpm, and libwrc{,‑devel,‑python2,‑python3,‑tools}‑20181203‑3.el7.x86_64.rpm -
Libwrc is a library and tools to access the Windows Resource Compiler (WRC) format.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- certifi‑2019.3.9‑2.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm - Certifi is a
carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- python{2,3}‑construct‑2.5.2‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.noarch.rpm, python2‑construct‑2.5.2‑3.el6.noarch.rpm, and python{2,36}‑construct‑2.5.2‑3.el7.noarch.rpm -
Python-construct is a powerful declarative parser (and builder) for binary data.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- python{2,3}-pefile‑2018.8.8‑2.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm -
PEFile is a Portable Executable reader module.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- pyparsing{,‑doc}‑2.4.0‑1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.noarch.rpm, python3‑pyparsing‑2.4.0‑1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.noarch.rpm, pyparsing{,‑doc}‑2.4.0‑1.el7.noarch.rpm, python3‑pyparsing‑2.4.0‑1.el7.noarch.rpm -
Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
The pyparsing module provides a library of classes that client code uses to construct the grammar directly in Python code.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- pytsk3‑20190316‑2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and pytsk3‑20190316-2.el7.x86_64.rpm -
Pytsk is Python bindings for The Sleuth Kit.
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- python{2,3}-xlsxwriter-1.1.6-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.1.5).
This release now references Python 3.6 from the EPEL repository for CentOS/RHEL 7. The other systems were rebuilt to maintain release numbering consistency.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.37.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-37.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.52.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-52.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
April 8, 2019:
EMERGENCY RELEASE: CentOS/RHEL 7 now includes Python 3.6 in the EPEL library for CentOS and RHEL.
To install the changes noted below, the following must be done first:
sudo rpm -ev python3 python3-libs --nodeps
The following changes have been made:
- httplib2-0.12.1-1.el7.noarch.rpm - Httpib2 is comprehensive HttP client library, httplib2 supports many features left out of other HttP libraries.
This package was installed for CentOS/RHEL 7 to support xplico.
Note: the packages installed are named python2-httplib2 and python3-httplib2.
- psycopg2{,‑debug,‑docs}-2.8.1-1.el7.x86_64.rpm - Python-psycopg2 is a PostgreSQL adapter for the Python programming language.
At its core it fully implements the Python DB API 2.0 specifications.
Several extensions allow access to many of the features offered by PostgreSQL.
This package was installed for CentOS/RHEL 7 to support xplico.
Note: the packages installed are named python2-psycopg2 and python3-psycopg2.
- xplico-1.2.1-2.el7.x86_64.rpm - xplico is an Internet traffic decoder.
This package was rebuilt because of the inclusion of Python 3.6 in the EPEL library.
- libfwsi{,‑devel,‑python2,‑python3}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2}-20181227-3.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python2,‑python3}-20181227-3.el7.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
This release fixes a package revision error.
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm, -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
This release fixes a package revision error.
- libmsiecf{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc26,fc27,fc29}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and libmsiecf{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
This release fixes a package revision error.
- libolecf{,‑devel,‑python2,‑python3,‑tools}-20181231-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python2,‑tools}-20181231-3.el6.{i686,x86_64}.rpm, and libolecf{,‑devel,‑python2,‑python3,‑tools}-20181231-3.el7.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
This release fixes a package revision error.
- scapy-2.4.0-5.el7.noarch.rpm - Scapy is a powerful interactive packet manipulation program.
It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more.
It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping,
tcpdump, tethereal, p0f, etc.).
It also performs very well at a lot of other specific tasks that most other tools can’t handle, like sending invalid frames, injecting your own 802.11 frames,
combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, …), etc.
This package was rebuilt because of the inclusion of Python 3.6 in the EPEL library.
|
|
April 5, 2019:
The following changes have been made:
- pfring-7.4.0-2483.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2483.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.8.0-1534.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- python{2,3}‑dfwinreg‑20190329‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- certifi-2019.3.9-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm - Certifi is a
carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
Note: the packages installed are named python2-certifi and python3-certifi for Fedora 24 through 29 and CentOS/RHEL 7.
- python{2,3}-requests-2.21.0-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm -
Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings.
Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web.
It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
- Volatility-2.6.1-2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i386,x86_64}.rpm and Volatility-2.6.1-2.el7.x86_64.rpm -
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.6.1 that has been patched to April 3, 2019.
You can read about this version here
- plaso-20190331-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and plaso-20190331-1.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
The changes to this release are noted here.
Please note that for Fedora 24, 25, and 26, and CentOS/RHEL 7, of all of the ancillary packages needed by plaso use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
For Fedora 24, 25, 26, and CentOS/RHEL 7, this package contains a program named update-plaso, the purpose of which is to update the packages that plaso depends upon.
Note that this updates the dependent packages but not plaso.
The recommendation is to run update-plaso routinely to keep the plaso dependencies updated.
For Fedora 27, 28, and 29, this version of plaso no longer requires either elasticsearch5 or efilter.
They may be safely removed with the following
sudo dnf remove python{,2}-elasticsearch5 python{,2}-efilter
Note that for Fedora 24, 25, 26 and CentOS/RHEL 7, these packages are automatically removed from the Python Virtual Environment.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 29, 2019:
The following changes have been made:
- libbde{,‑devel,‑python2,‑python3,‑tools}‑20190317‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libbde{,‑devel,‑python2,‑tools}‑20190317‑1.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python2,‑python3,‑tools}‑20190317‑1.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
- libsmdev{,‑devel,‑python2,‑python3,‑tools}-20190315-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑tools}-20190315-1.el6}.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python2,‑python3,‑tools}-20190315-1.el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
- pytsk3-20190316-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and pytsk3-20190316-1.el7.x86_64.rpm -
Pytsk is Python bindings for The Sleuth Kit.
Note: the packages installed are named python2-pytsk3 and python3-pytsk3 for Fedora 24 through 29 and CentOS/RHEL 7 but there is no Python 3 version for CentOS/RHEL 6.
- pfring-7.4.0-2468.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2468.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.8.0-1527.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- python{2,3}‑artifacts‑20190320‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm and artifacts‑data‑20190320‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm -
Artifacts is a free, community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
- libvshadow{,‑devel,‑python2,‑python3,‑tools}-20190323-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python2,‑tools}-20190323-1.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python2,‑python3,‑tools}-20190323-1.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
- libfixbuf{,‑devel}-2.3.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and libfixbuf{,‑devel}-2.3.0-1.el7.x86_64.rpm -
Libfixbuf is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- pyfixbuf-0.7.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and pyfixbuf-0.7.0-1.el7.x86_64.rpm -
Pyfixbuf is a Python API for libfixbuf,
an implementation of the IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this and all releases.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.18.1-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.18.1-1.el7.x86_64.rpm and -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.1‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm,
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.1‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- libschemaTools{,‑devel}-1.3-4.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and libschemaTools{,‑devel}-1.3-4.el7.x86_64.rpm -
libschemaTools is a library that provides a standard representation of data records.
It is built on fixbuf, using IPFIX information elements.
It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source.
SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records.
See here for the list of changes for this release.
This package was rebuilt to use libfixbuf 2.3.0.
- analysis-pipeline-5.10-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.10-1.el7.x86_64.rpm -
The analysis-pipeline
processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes.
- super_mediator-1.7.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator-1.7.0-1.el7.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
- yaf{,‑devel}-2.11.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and yaf{,‑devel}-2.11.0-1.el7.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
Note that for CentOS 6 and 7 for the x86_64 architecture, yaf has been built to use PF_Ring.
- dcp-1.0.6-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and dcp-1.0.6-1.el7.x86_64.rpm -
Dcp combines cp, stat, md5sum and shasum to streamline mirroring and gathering information about all the files copied.
All information gathered is written to an output file.
The output file can be fed back into dcp when copying snapshots of a directory, this allows only files which differ in location or hash to be copied.
- femto-1.3.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and femto-1.3.0-1.el7.x86_64.rpm -
FEMTO is an indexing and search system for queries on sequences of bytes.
FEMTO stands for the FM-index for External Memory with Throughput Optimizations.
This tool supports building large indexes in parallel with MPI and then searching large indexes with a multithreaded server.
- ghidra-9.0-PUBLIC_20190228.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and ghidra-9.0-PUBLIC_20190228.el7.x86_64.rpm -
Ghidra is a software reverse engineering (SRE) framework created and maintained by the
National Security Agency Research Directorate.
This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms
including Windows, macOS, and Linux. Capabilities include disassembly, assembly, decompilation, graphing, and scripting, along with hundreds of other features.
Ghidra supports a wide variety of processor instruction sets and executable formats and can be run in both user-interactive and automated modes.
Users may also develop their own Ghidra plug-in components and/or scripts using Java or Python.
Please note that you must install the JDK for Ghidra to work.
In testing, The Java Development Kit (JDK) version 11.0.2 was used and worked successfully.
Ghidra expects a program named java to be available in the directories named in the PATH variable.
- CERT-Forensics-Tools-1.0-83.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-83.el7.x86_64.rpm -
The changes since the last release (1.0-82) are the following:
- The dcp package is installed except for CentOS/RHEL 6.
- The femto package is installed.
- The ghidra package is installed except for CentOS/RHEL 6.
- examiner-tooldocumentation-1.18-10.el7.noarch.rpm - The following packages were updated to added to the documetation suite found on the desktop:
- dcp
- ghidra
- femto_index
- femto_search
- appcompatcache.py
- application_identifiers.py
- mru.py
- msie_zone_info.py
- process_tree.py
- profiles.py
- programscache.py
- sam.py
- services.py
- shellfolders.py
- srum_extensions.py
- sysinfo.py
- task_cache.py
- type_libraries.py
- userassist.py
Once this package has been updated, run the following command:
sudo manage-examiner-login -S -v
to install these changes in the examiner's desktop.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- 5.0.4-200 for FC29
- 5.0.3-200 for FC29
- 4.20.16-200 for FC29
- 4.20.15-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- 5.0.4-200 for FC29
- 5.0.3-200 for FC29
- 4.20.16-200 for FC29
- 4.20.15-200 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.20.17-100 for FC28
- 4.20.16-100 for FC28
- 4.20.15-100 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.20.17-100 for FC28
- 4.20.16-100 for FC28
- 4.20.15-100 for FC28
- fmem-kernel-modules-el7-x86_64-1.6-1.49.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-49.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 15, 2019:
The following changes have been made:
- python{2,3}‑dfvfs-20190301-1.{fc24,fc25,fc26,fc27,fc28,fc29}.noarch.rpm and python2‑dfvfs‑20190301‑1.el7.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation of the various storage media types,
volume systems and file systems.
- python{2,3}‑dfwinreg‑20190311‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and python2‑dfwinreg‑20190329‑2.el7.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- pfring-7.4.0-2456.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2456.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.8.0-1507.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 8, 2019:
The following changes have been made:
- pfring-7.4.0-2446.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2446.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.8.0-1499.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- libregf{,‑devel,‑python2,‑python3,‑tools}-20190303-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libregf{,‑devel,‑python2,‑tools}-20190303-1.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑python3,‑tools}-20190303-1.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- apfs-fuse-20190304-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm and apfs-fuse-20181116-1.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental.
It may not be able to read all files, it may return wrong data, or it may simply crash.
Use at your own risk.
But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far).
Thus, the driver may return compressed files instead of uncompressed ones.
Although most of the time it should just report an error.
- autopsy-4.10.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and autopsy-4.10.0-1.el7.x86_64.rpm -
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer.
You can even use it to recover photos from your camera's memory card.
In addition, the Java™ Platform, Standard Edition Development Kit (JDK™) from Oracle also needs to be installed before running autopsy.
That package can be found here.
Testing has been verified to work with JDK 11.0.2.
- ddrescue-1.24-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
See here for the changes since the last version (1.23) released to this repository.
- libodraw{,‑devel,‑tools}-20190118-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and libodraw{,‑devel,‑tools}-20190118-1.el7.x86_64.rpm -
Libodraw is a library to access to optical disc (split) RAW image files (bin/cue, iso/cue).
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 1, 2019:
The following changes have been made:
- python{2,3}-xlsxwriter-1.1.5-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.1.4).
- pfring-7.4.0-2433.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2433.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.6.0-1492.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- python{2,3}‑artifacts‑20190227‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm, artifacts‑data‑20190227‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm,
python2‑artifacts‑20190227‑1.el7.x86_64.rpm, and artifacts‑data‑20190227‑1.el7.x86_64.rpm -
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.20.12-200 for FC29
- 4.20.11-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.20.12-200 for FC29
- 4.20.11-200 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.51.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-51.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
February 21, 2019:
The following changes have been made:
- pfring-7.4.0-2417.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2417.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.6.0-1489.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.20.10-200 for FC29
- 4.20.8-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.20.10-200 for FC29
- 4.20.8-200 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
February 15, 2019:
The bulk of the changes noted here consist of new revisions of existing packages that have been rebuilt to eliminate errors that arose when the Python 2 and Python 3 versions of packages were installed on the same machine.
Earlier packages were built incorrectly.
The following changes have been made:
- python{2,3}-xlsxwriter-1.1.4-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm and python2-xlsxwriter-1.1.4-1.el6.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.1.2).
Note: the packages installed are named python2-xlsxwriter and python3-xlsxwriter for Fedora 24 through 29 and CentOS/RHEL 7 but there is no Python 3 version for CentOS/RHEL 6.
- libfsapfs{,‑devel,‑python2,‑python3,‑tools}-20190210-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2,‑tools}-20190210-2.el6.{i686,x86_64}.rpm and libfsapfs{,‑devel,‑python2,‑python3,‑tools}-20190210-2.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
Note that this project currently only focuses on the analysis of the format.
- plaso-20190131-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and plaso-20190131-2.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This revision changed some of the dependencies for the Python Virtual Environment-based version for Fedora 24 and 25 and CentOS/RHEL 7.
For Fedora 24 and 25 and CentOS/RHEL 7, this package contains a program named update-plaso, the purpose of which is to update the packages that plaso depends upon.
Note that this updates the dependent packages but not plaso.
The recommendation is to run update-plaso routinely to keep the plaso dependencies updated.
For Fedora 24 and 25, the recommended way to install this update is the following:
sudo rpm -ev plaso --nodeps; sudo rm -rf /usr/local/lib/PythonVirtualEnvironments/plaso; sudo dnf -y install plaso
and for CentOS/RHEL 7, the following:
sudo rpm -ev plaso --nodeps; sudo rm -rf /usr/local/lib/PythonVirtualEnvironments/plaso; sudo yum -y install plaso
- pfring-7.4.0-2414.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2414.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.6.0-1488.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- libbde{,‑devel,‑python2,‑python3,‑tools}‑20190102‑3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libbde{,‑devel,‑python2,‑tools}‑20190102‑3.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python2,‑python3,‑tools}‑20190102‑3.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libesedb{,‑devel,‑python2,‑python3,‑tools}-20181229-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libesedb{,‑devel,‑python2,‑tools}-20181229-3.el6.{i686,x86_64}.rpm, and libesedb{,‑devel,‑python2,‑python3,‑tools}-20181229-3.el7}.x86_64.rpm -
Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libevt{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libevt{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and libevt{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libevtx{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and libevtx{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libfshfs{,‑devel,‑python2,‑python3,‑tools}-20181101-3.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.{i686,x86_64}.rpm, libfshfs{,‑devel,‑python,‑tools}-20181101-3.el6.{i686,x86_64}.rpm, and libfshfs{,‑devel,‑python2,‑python3,‑tools}-20181101-3.el7.x86_64.rpm -
Libfshfs is a lbrary and tools to access the Hierarchical File System (HFS).
Note that this project currently only focuses on the analysis of the format.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system and renames the python version to python2.
- libfsntfs{,‑devel,‑python2,‑python3,‑tools}-20190104-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2,‑tools}-20190104-3.el6.{i686,x86_64}.rpm, and libfsntfs{,‑devel,‑python2,‑python3,‑tools}-20190104-3.el7.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libfwsi{,‑devel,‑python2,‑python3}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python2}-20181227-2.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python2,‑python3}-20181227-2.el7.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libmsiecf{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc26,fc27,fc29}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, and libmsiecf{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libolecf{,‑devel,‑python2,‑python3,‑tools}-20181231-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python2,‑tools}-20181231-3.el6.{i686,x86_64}.rpm, and libolecf{,‑devel,‑python2,‑python3,‑tools}-20181231-3.el7.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libpff{,‑devel,‑python2,‑python3,‑tools}-20180714-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libpff{,‑devel,‑python,‑tools}-20180714-3.{i686,x86_64}.rpm, and libpff{,‑devel,‑python2,‑python3,‑tools}-20180714-3.el7.x86_64.rpm -
Libpff is a library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.
PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libqcow{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libregf{,‑devel,‑python2,‑python3,‑tools}-20181231-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libregf{,‑devel,‑python2,‑tools}-20181231-3.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑python3,‑tools}-20181231-3.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libsmdev{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑tools}-20181227-3.el6}.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libsmraw{,‑devel,‑python2,‑python3,‑tool2}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm and libsmraw{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libvshadow{,‑devel,‑python2,‑python3,‑tools}-20190127-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python2,‑tools}-20190127-3.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python2,‑python3,‑tools}-20190127-3.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libvhdi{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and libvhdi{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- libvmdk{,‑devel,‑python2,‑python3,‑tools}-20181227-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python2,‑tools}-20181227-3.el6.{i686,x86_64}.rpm, and libvmdk{,‑devel,‑python2,‑python3,‑tools}-20181227-3.el7.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
This release fixes a problem where the python2 and python3 versions were to be installed on the same system.
- python{2,3}-dfvfs-20190128-4.{fc24,fc25,fc26,fc27,fc28,fc29}.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation of the various storage media types,
volume systems and file systems.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
February 8, 2019:
The following changes have been made:
- python{2,3}‑biplist-1.0.3-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and python2‑biplist-1.0.3-2.el7.x86_64.rpm -
Biplist is a library for reading/writing binary plists.
Binary Property List (plist) files provide a faster and smaller serialization format for property lists on OS X.
This is a library for generating binary plists which can be read by OS X, iOS, or other clients.
- elasticsearch5-5.5.5-2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and elasticsearch5-5.5.5-2.el7.x86_64.rpm -
ElasticSearch5 is a low-level client for
Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python;
because of this it tries to be opinion-free and very extendable. For a more high level client library with more limited scope, have a
look at elasticsearch-dsl - a more pythonic library sitting on top of elasticsearch-py. It provides a more convenient and idiomatic way
to write and manipulate queries. It stays close to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the
whole range of the DSL from Python either directly using defined classes or a queryset-like expressions. It also provides an optional
persistence layer for working with documents as Python objects in an ORM-like fashion: defining mappings, retrieving and saving documents,
wrapping the document data in user-defined classes.
- python{2,3}-elasticsearch-6.3.1-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, python2-elasticsearch-6.3.1-2.el6.{i686,x86_64}.rpm, and python2-elasticsearch-6.3.1-2.el7.x86_64.rpm -
ElasticSearch is the official low-level client for
Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python;
because of this it tries to be opinion-free and very extendable. For a more high level client library with more limited scope, have a
look at elasticsearch-dsl - a more pythonic library sitting on top of elasticsearch-py. It provides a more convenient and idiomatic way
to write and manipulate queries. It stays close to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the
whole range of the DSL from Python either directly using defined classes or a queryset-like expressions. It also provides an optional
persistence layer for working with documents as Python objects in an ORM-like fashion: defining mappings, retrieving and saving documents,
wrapping the document data in user-defined classes.
- plaso-20190131-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and plaso-20190131-1.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline.py (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This version was changed to use the new package names for the packages noted above.
For Fedora 24 and 25 and CentOS/RHEL 7, this package contains a program named update-plaso, the purpose of which is to update the packages that plaso depends upon.
Note that this updates the dependent packages but not plaso.
The recommendation is to run update-plaso routinely to keep the plaso dependencies updated.
For Fedora 24 and 25, the recommended way to install this update is the following:
sudo rpm -ev plaso --nodeps; sudo rm -rf /usr/local/lib/PythonVirtualEnvironments/plaso; sudo dnf -y install plaso
and for CentOS/RHEL 7, the following:
sudo rpm -ev plaso --nodeps; sudo rm -rf /usr/local/lib/PythonVirtualEnvironments/plaso; sudo yum -y install plaso
- pfring-7.4.0-2398.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2398.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- libfsapfs{,‑devel,‑python2,‑python3,‑tools}-20190206-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2,‑tools}-20190206-1.el6.{i686,x86_64}.rpm and libfsapfs{,‑devel,‑python2,‑python3,‑tools}-20190206-1.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
Note that this project currently only focuses on the analysis of the format.
- crunch-3.6-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i386,x86_64}.rpm and crunch-3.6-1.el7.x86_64.rpm -
Crunch is a wordlist generator where you can specify a standard character set or a character set you specify. crunch can generate all possible combinations and permutations.
Here are its features:
- generates wordlists in both combination and permutation ways
- can breakup output by number of lines or file size
- now has resume support
- pattern now supports number and symbols
- pattern now supports upper and lower case characters separately
- adds a status report when generating multiple files
- new -l option for literal support of @, $, and ^
- new -d option to limit duplicate characters; see man page for details
- now has unicode support
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.48.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-48.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
February 1, 2019:
The bulk of the changes noted here consist of new revisions of existing packages that have been rebuilt to rename packages to include
the appropriate Python version, currently either Python 2 or Python 3.
For example, the package libfsntfs-python has been rebuilt and the package named libfsntfs-python2.
Further the Python 2 version of these packages also provides the previous package name, libfsntfs-python in this case, for backward compatibility.
In other cases, some packages previously built for Python 2 only have been rebuilt for both Python 2 and Python 3 and the packages appropriately renamed.
Again, the Python 2 versions of these packages also provide the previous simple package name for backward combability.
As an example, the package previous known as dtfabric now consists of two packages named python2-dtfabric and python3-dtfabric,
with the package python2-dtfabric also providing dtfabric again for backward compatibility.
The following changes have been made:
- sleuthkit{,‑devel,‑libs}-4.6.5-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and sleuthkit{,‑devel,‑libs}-4.6.5-1.el7.x86_64.rpm -
The Sleuth Kit (TSK) is a library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.6.3) released to this repository.
- pytsk3-20190121-2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and pytsk3-20190122-1.el7.x86_64.rpm -
Pytsk is Python bindings for The Sleuth Kit.
Note: the packages installed are named python2-pytsk3 and python3-pytsk3 for Fedora 24 through 29 and CentOS/RHEL 7 but there is no Python 3 version for CentOS/RHEL 6.
- python{2,3}-dtfabric-20190120-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and python2-dtfabric-20190120-2.el7.x86_64.rpm -
Dtfabric is a project to manage data types and structures, as used in the libyal projects.
- libfsapfs{,‑devel,‑python2,‑python3,‑tools}-20181215-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python2,‑tools}-20181205-2.el6.{i686,x86_64}.rpm and libfsapfs{,‑devel,‑python2,‑python3,‑tools}-20181205-2.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
Note that this project currently only focuses on the analysis of the format.
- libbde{,‑devel,‑python2,‑python3,‑tools}-20190102-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libbde{,‑devel,‑python2,‑tools}-20190102-2.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python2,‑python3,‑tools}-20190102-2.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
- libesedb{,‑devel,‑python2,‑python3,‑tools}-20181229-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libesedb{,‑devel,‑python2,‑tools}-20181229-2.el6.{i686,x86_64}.rpm, and libesedb{,‑devel,‑python2,‑python3,‑tools}-20181229-2.el7}.x86_64.rpm -
Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
- libevt{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, and libevt{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm ,libevt{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
- libevtx{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, and libevtx{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, libevtx{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
- libfsntfs{,‑devel,‑python2,‑python3,‑tools}-20190104-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python2,‑tools}-20190104-2.el6.{i686,x86_64}.rpm, and libfsntfs{,‑devel,‑python2,‑python3,‑tools}-20190104-2.el7.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
- libfwnt{,‑devel,‑python2,‑python3}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python2}-20181227-2.el6.x86_64.rpm, and libfwnt{,‑devel,‑python2,‑python3}-20181227-2.el7.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
- liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, and liblnk{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
- libmsiecf{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc26,fc27,fc29}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, and libmsiecf{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
- libolecf{,‑devel,‑python2,‑python3,‑tools}-20181231-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python2,‑tools}-20181231-2.el6.{i686,x86_64}.rpm, and libolecf{,‑devel,‑python2,‑python3,‑tools}-20181231-2.el7.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
- libqcow{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
- libregf{,‑devel,‑python2,‑python3,‑tools}-20181231-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libregf{,‑devel,‑python2,‑tools}-20181231-2.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python2,‑python3,‑tools}-20181231-2.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- libscca{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libscca{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, and libscca{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
- libsigscan{,‑devel,‑python2,‑python3,‑tools}-20190103-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python2,‑tools}-20190103-2.el6.{i686,x86_64}.rpm, and libsigscan{,‑devel,‑python2,‑python3,‑tools}-20190103-2.el7.x86_64.rpm -
Libsigscan is a library and tools used to binary signature scanning.
- libsmdev{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python2,‑tools}-20181227-2.el6}.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
- libsmraw{,‑devel,‑python2,‑python3,‑tool2}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm and libsmraw{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
- libvhdi{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, and libvhdi{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
- libvshadow{,‑devel,‑python2,‑python3,‑tools}-20190127-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python2,‑tools}-20190127-2.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python2,‑python3,‑tools}-20190127-2.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
- libvslvm{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, and libvslvm{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
- libvmdk{,‑devel,‑python2,‑python3,‑tools}-20181227-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python2,‑tools}-20181227-2.el6.{i686,x86_64}.rpm, and libvmdk{,‑devel,‑python2,‑python3,‑tools}-20181227-2.el7.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
- libfvde{,‑devel,‑python2,‑python3,‑tools}-20190104-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfvde{,‑devel,‑python2,‑tools}-20190104-2.el6.{i686,x86_64}.rpm, and libfvde{,‑devel,‑python2,‑python3,‑tools}-20190104-2.el7.6_64.rpm -
Libfvde is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
- python{2,3}‑dfdatetime-20190116-2.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm - dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- python{2,3}‑dfwinreg‑20190122‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and python2‑dfwinreg‑20190122‑2.el7.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- libexe{,‑devel,‑python2,‑python3,‑tools}-20181128-2.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libexe{,‑devel,‑python2,‑tools}-20181128-2.el6.{i686,x86_64}.rpm, and libexe{,‑devel,‑python2,‑python3,‑tools}-20181128-2.el7.x86_64.rpm -
Libexe is a library and tools to access the executable (EXE) format.
- libwrc{,‑devel,‑python2,‑python3,‑tools}-20181203-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libwrc{,‑devel,‑python2,‑tools}-20181203-2.el6.{i686,x86_64}.rpm, and libwrc{,‑devel,‑python2,‑python3,‑tools}-20181203-2.el7.x86_64.rpm -
Libwrc is a library and tools to access the Windows Resource Compiler (WRC) format.
- libewf{,‑devel,‑tools,‑python2,‑python3,‑tools}-20160718-20140806.1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libewf{,‑devel,‑tools,‑python2,‑tools}-20160718-20140806.1.el6.{i686,x86_64}.rpm, and libewf{,‑devel,‑tools,‑python2,‑python3,‑tools}-20160718-20140806.1.el7.x86_64.rpm -
Libewf supports Expert Witness Compression Format (EWF) formatted files.
It supports both the SMART (EWF-S01) and EnCase (EWF-E01) format.
Libewf allows you to read and write EWF files. Recent versions also support the LEV (EWF-L01) format.
This package is built from the libewf source code dated 20140806 but to make it the latest version, the version number was changed to the build date (20160718)
and the release number changed to include the source code release date (20140806).
- python{2,3}-construct-2.5.2-2.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm and python2-construct-2.5.2-2.el6.noarch.rpm -
Python-construct is a powerful declarative parser (and builder) for binary data.
Note: the packages installed are named python2-construct and python3-construct for Fedora 24 through 29 and CentOS/RHEL 7 but there is no Python 3 version for CentOS/RHEL 6.
- python{2,3}‑artifacts‑20190113‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm, artifacts‑data‑20190113‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm,
python2‑artifacts‑20190113‑2.el7.x86_64.rpm, and artifacts‑data‑20190113‑2.el7.x86_64.rpm -
- python{2,3}‑bencode-2.0.0-2.{fc24,fc25,fc26,fc27,fc28,fc29}.noarch.rpm -
Bencode re-packages the existing bencoding
and bdecoding implemention from the ‘official’ BitTorrent client as a separate, light-weight package for re-using them without having the entire BitTorrent software as a dependency.
- python{2,3}-xlsxwriter-1.1.2-2.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm and python2-xlsxwriter-1.1.2-2.el6.noarch.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.0.8).
Note: the packages installed are named python2-xlsxwriter and python3-xlsxwriter for Fedora 24 through 29 and CentOS/RHEL 7 but there is no Python 3 version for CentOS/RHEL 6.
- efilter-1.5-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.noarch.rpm - Efilter
is a general purpose query language designed to be embedded in Python applications and libraries.
It supports SQL-like syntax to filter your application's data and provides a convenient way to directly search through the objects your applications manages.
A second use case for EFILTER is to translate queries from one query language to another, such as from SQL to OpenIOC and so on.
A basic SQL-like syntax and a POC lisp implementation are included with the language, and others are relatively simple to add.
Note: the packages installed are named python2-efilter and python3-efilter for Fedora 24 through 29 but there is no Python 3 version for CentOS/RHEL 6 and 7.
- python{2,3}‑dfvfs-20190128-1.{fc24,fc25,fc26,fc27,fc28,fc29}.noarch.rpm and python2‑dfvfs‑20190128‑1.el7.noarch.rpm -
dfVFS, the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several back-ends that provide the actual implementation of the various storage media types,
volume systems and file systems.
- winreg-kb-20181223-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and winreg-kb-20181223-1.el7.x86_64.rpm -
Winreg-kb-kb winreg-kb is a project to build a Windows Registry Knowledge Base.
winregrc is a Python module part of winreg-kb to allow reuse of Windows Registry Resources.
See these scripts that make use of package.
Note that winreg-kb is not available for CentOS/RHEL 6 because of the old version of Python 2.
- winevt-kb-20181223-2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and winevt-kb-20181223-1.el7.x86_64.rpm -
Winevt-kb is a project to build a Windows Event Log knowledge base.
winevtrc is the Python module part of winevt-kb to allow reuse of Windows Event Log resources.
See this resource for an explanation of the scripts included with this package - export.py, extract.py, query.py - and how to use them.
- pyparsing{,‑doc}-2.3.1-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6}.noarch.rpm, python3-pyparsing-2.3.1-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.noarch.rpm, pyparsing{,‑doc}-2.3.1-1.el7.noarch.rpm, python3-pyparsing-2.3.1-1.el7.noarch.rpm -
Pyparsing is a module that provides an alternative approach to creating and executing simple grammars, vs. the traditional lex/yacc approach, or the use of regular expressions.
The pyparsing module provides a library of classes that client code uses to construct the grammar directly in Python code.
Pyparsing is provided by RedHat for Fedora 21.
Pyparsing version 2.3.3 is needed by plaso.
- plaso-20181219-5.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and plaso-20181219-5.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
This version was changed to use the new package names for the packages noted above.
For Fedora 24 and 25, the recommended way to install this update is the following:
sudo rpm -ev plaso --nodeps; sudo dnf -y install plaso
and for CentOS/RHEL 7, the following:
sudo rpm -ev plaso --nodeps; sudo yum -y install plaso
- pfring-7.4.0-2394.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2394.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.6.0-1485.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.20.5-200 for FC29
- 4.20.4-200 for FC29
- 4.20.3-200 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.20.5-200 for FC29
- 4.20.4-200 for FC29
- 4.20.3-200 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.20.5-100 for FC28
- 4.20.4-100 for FC28
- 4.19.16-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.20.5-100 for FC28
- 4.20.4-100 for FC28
- 4.19.16-200 for FC28
|
|
January 18, 2019:
The following changes have been made:
- cutter-1.7.3-1.{fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and cutter-1.7.3-1.el7.x86_64.rpm - Cutter is a Qt and C++
GUI for radare2 reverse engineering framework.
Its goal is making an advanced, customizable, and FOSS (free and open-source software) reverse-engineering platform while keeping the user experience at mind.
Cutter is created by reverse engineers for reverse engineers.
This version of cutter is based on the code dated 2019-01-15 which was built to embed radare2 version 2.6.0 in it.
- distorm3-3.4.1-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i386,x86_64}.rpm and distorm3-3.4.1-1.el7.x86_64.rpm -
Distorm3 is a lightweight, easy-to-use and fast decomposer library.
It disassembles instructions in 16, 32 and 64 bit modes.
Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX.
Distorm3 is used by The Volatility Framework.
- libbde{,‑devel,‑python,‑python3,‑tools}-20190102-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libbde{,‑devel,‑python,‑tools}-20190102-1.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python,‑python3,‑tools}-20190102-1.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
- libbfio,{-devel}-20190112-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i386,x86_64}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access.
- libfplist{,‑devel}-20190101-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm - Libfplist is a library for plist formats.
Note: this is a library only - there are no tools provided by these packages.
- libfsext{,‑devel,‑python,‑python3,‑tools}-20190115-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsext{,‑devel,‑python,‑python3,‑tools}-20190115-1.el7.x86_64.rpm, and libfsext{,‑devel,‑python,‑tools}-20190115-1.el6.{i686,x86_64}.rpm -
Libfsext is a lbrary and tools to access the Extended File System (EXT).
Note that this project currently only focuses on the analysis of the format.
- libfwevt{,‑devel}-20190102-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm - Libfwevt
is a library for Windows XML Event Log (EVTX) data types.
Note: this is a library only - there are no tools provided by these packages.
- libsigscan{,‑devel,‑python,‑python3,‑tools}-20190103-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python,‑tools}-20190103-1.el6.{i686,x86_64}.rpm, and libsigscan{,‑devel,‑python,‑python3,‑tools}-20190103-1.el7.x86_64.rpm, -
Libsigscan is a library and tools used to binary signature scanning.
- python-certifi-2018.11.29-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm - Certifi is a
carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
This package was supports plaso.
- Volatility-2.6-6.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i386,x86_64}.rpm and Volatility-2.6-6.el7.x86_64.rpm -
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.6 that has been patched to November 19, 2018.
You can read about this version here
- python‑dfdatetime-20190116-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- pfring-7.4.0-2377.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2377.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.6.0-1476.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.15-300 for FC29
- 4.19.14-300 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.15-300 for FC29
- 4.19.14-300 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.15-200 for FC28
- 4.19.14-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.15-200 for FC28
- 4.19.14-300 for FC28
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.50.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-50.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
January 14, 2019:
The following changes have been made:
- pfring-7.4.0-2374.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2374.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- artifacts‑20190113‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm and artifacts‑20190113‑1.el7.x86_64.rpm -
Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
Please note that with this release, it is no longer necessary to revert to version 20181213 of artifacts on Fedora 24, 25, or CentOS/RHEL 7 to fix a problem when using plaso.
To install this version of artifacts on Fedora 24, 25, or CentOS/RHEL 7, run the command update-plaso.
- libvshadow{,‑devel,‑python,‑python3,‑tools}-20190112-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python,‑tools}-20190112-1.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python,‑python3,‑tools}-20190112-1.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
To install this version of libvshadow on Fedora 24, 25, or CentOS/RHEL 7, run the command update-plaso.
|
|
January 11, 2019:
The following changes have been made:
- libfsntfs{,‑devel,‑python,‑python3,‑tools}-20190104-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python,‑tools}-20190104-1.el6.{i686,x86_64}.rpm, and libfsntfs{,‑devel,‑python,‑python3,‑tools}-20190104-1.el7.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
- libfvde{,‑devel,‑python,‑python3,‑tools}-20190104-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfvde{,‑devel,‑python,‑tools}-20190104-1.el6.{i686,x86_64}.rpm, and libfvde{,‑devel,‑python,‑python3,‑tools}-20190104-1.el7.6_64.rpm -
Libfvde is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
- plaso-20181219-3.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and plaso-20181219-3.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
Here are the recent changes:
- Release 2
- For Fedora 24 and 25 and CentOS/RHEL 7, this release contains a new program named update-plaso, the purpose of which is to update the packages installed via pip for the Python Virtual Environment built for plaso.
The recommendation is to run update-plaso routinely to keep plaso updated.
- No changes were made for the Fedora 26, 27, 28, and 29 revisions of plaso.
- Release 3
- For CentOS/RHEL 7, the version of Python 2 installed by default is 2.7.5 which is fairly old.
This version causes problems in plaso.
To solve these problems, the version of Python 2 - 2.7.13 - that is distributed as part of the RedHat Software Collections Library (SCL) is used for plaso.
This resulted in a re-engineering of the installation and the installed scripts to use the scl program.
This version contains those re-engineered versions.
Use this version of plaso, run the following command
sudo yum -y install centos-release-scl-rh
- No changes were made for the Fedora 24, 25, 26, 27, 28, and 29 revisions of plaso.
Please note that the pip package artifacts, version 20190111, causes plaso to generate errors and exit prematurely.
To solve this problem after installing or updating plaso on Fedora 24 or 25 or CentOS/RHEL 7, do the following:
sudo scl enable python27 -- /bin/sh -c "source /usr/local/lib/PythonVirtualEnvironments/plaso/bin/activate;
pip uninstall artifacts; pip install artifacts==20181213"
- pfring-7.4.0-2370.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2370.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.6.0-1459.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
|
|
January 4, 2019:
The following changes have been made:
- pfring-7.4.0-2360.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
Here is the announcement of PF_Ring 7.4.
- pfring-dkms-7.4.0-2360.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- ndpi-2.6.0-1458.{el6,el7}.x86_64.rpm - ndpi is an open source LGPLv3 library for deep-packet inspection.
Based on OpenDPI it includes ntop extensions.
- libbde{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libbde{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm , and libbde{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
- libesedb{,‑devel,‑python,‑python3,‑tools}-20181229-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libesedb{,‑devel,‑python,‑tools}-20181229-1.el6.{i686,x86_64}.rpm, and libesedb{,‑devel,‑python,‑python3,‑tools}-20181229-1.el7}.x86_64.rpm -
Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
- libevt{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libevt{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libevt{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
- libevtx{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libevtx{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
- libfwnt{,‑devel,‑python,‑python3}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python}-20181227-1.el6.x86_64.rpm, and libfwnt{,‑devel,‑python,‑python3}-20181227-1.el7.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
- libfwsi{,‑devel,‑python,‑python3}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python}-20181227-1.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python,‑python3}-20181227-1.el7.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
- liblnk{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and liblnk{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
- libmsiecf{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc26,fc27,fc29}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libmsiecf{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
- libqcow{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
- libscca{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libscca{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libscca{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
- libsmdev{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python,‑tools}-20181227-1.el6}.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
- libsmraw{,‑devel,‑python,‑python3,‑tool2}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libsmraw{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm, -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
- libvhdi{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libvhdi{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
- libvmdk{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libvmdk{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
- libvslvm{,‑devel,‑python,‑python3,‑tools}-20181227-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python,‑tools}-20181227-1.el6.{i686,x86_64}.rpm, and libvslvm{,‑devel,‑python,‑python3,‑tools}-20181227-1.el7.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
- libolecf{,‑devel,‑python,‑python3,‑tools}-20181231-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python,‑tools}-20181231-1.el6.{i686,x86_64}.rpm, and libolecf{,‑devel,‑python,‑python3,‑tools}-20181231-1.el7.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
- libregf{,‑devel,‑python,‑python3,‑tools}-20181231-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libregf{,‑devel,‑python,‑tools}-20181231-1.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python,‑python3,‑tools}-20181231-1.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- python{2,3}-urllib3-1.24.1-2.fc26.{i686,x86_64}.rpm - Python-urllib3 is a powerful, sanity-friendly HttP client for Python.
Much of the Python ecosystem already uses urllib3.
urllib3 brings many critical features that are missing from the Python standard libraries:
- Thread safety.
- Connection pooling.
- Client-side SSL/TLS verification.
- File uploads with multipart encoding.
- Helpers for retrying requests and dealing with HttP redirects.
- Support for gzip and deflate encoding.
- Proxy support for HttP and SOCKS.
- 100% test coverage.
This package was built to support plaso.
- python{2,3}-requests-2.20.0-1.fc26.{i686,x86_64}.rpm -
Python-requests is an Apache2 Licensed HttP library, written in Python, for human beings.
Python’s standard urllib2 module provides most of the HttP capabilities you need, but the API is thoroughly broken. It was built for a different time — and a different web.
It requires an enormous amount of work (even method overrides) to perform the simplest of tasks.
This package was built to support plaso.
- plaso-20181219-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and plaso-20181219-1.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
Please note that for Fedora 24 and 25 and CentOS/RHEL 7, of all of the ancillary packages needed by plaso use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
- rekall-forensics-1.7.1-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.{i686,x86_64}.rpm - Rekall is an advanced forensic and incident response framework.
While it began life purely as a memory forensic framework, it has now evolved into a complete platform.
Rekall implements the most advanced analysis techniques in the field, while still being developed in the open, with a free and open source license. Many of the innovations implemented within Rekall have been published in
peer reviewed papers.
Please note that the installation of all of these ancillary packages neede by rekall use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
Please also note that to install this package, you will first need to remove rekall-1.7.2 which was previously installed in the forensics-test repository.
To do this, do the following:
sudo dnf erase rekall; sudo dnf install rekall-forensics
The program to run is now named rekall.py due to conflicts with another package named rekall.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.13-300 for FC29
- 4.19.12-301 for FC29
- 4.19.10-300 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.13-300 for FC29
- 4.19.12-301 for FC29
- 4.19.10-300 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.13-200 for FC28
- 4.19.12-200 for FC28
- 4.19.10-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.13-200 for FC28
- 4.19.12-200 for FC28
- 4.19.10-200 for FC28
|
|
December 18, 2018:
The following changes have been made:
- artifacts‑20181213‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm and artifacts‑20181213‑1.el7.x86_64.rpm -
Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
- libfsapfs{,‑devel,‑python,‑python3,‑tools}-20181215-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python,‑tools}-20181205-1.el6.{i686,x86_64}.rpm, and libfsapfs{,‑devel,‑python,‑python3,‑tools}-20181205-1.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
Note that this project currently only focuses on the analysis of the format.
- libfwnt{,‑devel,‑python,‑python3}-20181215-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python,‑python3}-20181215-1.el7.x86_64.rpm, and libfwnt{,‑devel,‑python,‑python3}-20181215-1.el7.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
- libfwsi{,‑devel,‑python,‑python3}-20181215-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python}-20181215-1.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python,‑python3}-20181215-1.el7.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
- libmsiecf{,‑devel,‑python,‑python3,‑tools}-20181215-1.{fc24,fc25,fc26,fc26,fc27,fc29}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python,‑tools}-20181215-1.el6.{i686,x86_64}.rpm, and libmsiecf{,‑devel,‑python,‑python3,‑tools}-20181215-1.el7.x86_64.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
- libsigscan{,‑devel,‑python,‑python3,‑tools}-20181215-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python,‑tools}-20181215-1.el6.{i686,x86_64}.rpm, and libsigscan{,‑devel,‑python,‑python3,‑tools}-20181215-1.el7.x86_64.rpm, -
Libsigscan is a library and tools used to binary signature scanning.
- libsmdev{,‑devel,‑python,‑python3,‑tools}-20181215-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python,‑tools}-20181215-1.el6}.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python,‑python3,‑tools}-20181215-1.el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
- libsmraw{,‑devel,‑python,‑python3,‑tools}-20181215-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python,‑tools}-20181215-1.el6.{i686,x86_64}.rpm, and libsmraw{,‑devel,‑python,‑python3,‑tools}-20181215-1.el7.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
- libwrc{,‑devel,‑python,‑python3,‑tools}-20181203-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libwrc{,‑devel,‑python,‑python3,‑tools}-20181203-1.el7.x86_64.rpm, and libwrc{,‑devel,‑python,‑tools}-20181203-1.el6.{i686,x86_64}.rpm -
Libwrc is a library and tools to access the Windows Resource Compiler (WRC) format.
- libevtx{,‑devel,‑python,‑python3,‑tools}-20181016-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python,‑tools}-20181016-1.el6.{i686,x86_64}.rpm, and libevtx{,‑devel,‑python,‑python3,‑tools}-20181016-1.el7.x86_64.rpm -
Libevtx contains libraries and tools to access the Windows XML Event Log (EVTX) format files.
- libvslvm{,‑devel,‑python,‑python3,‑tools}-20181216-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python,‑tools}-20181216-1.el6.{i686,x86_64}.rpm, and libvslvm{,‑devel,‑python,‑python3,‑tools}-20181216-1.el7.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
- dfvfs-20181215-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
This release is testing APFS support in plaso.
- libevt{,‑devel,‑python,‑python3,‑tools}-20181216-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libevt{,‑devel,‑python,‑tools}-20181216-1.el6.{i686,x86_64}.rpm, and libevt{,‑devel,‑python,‑python3,‑tools}-20181216-1.el7.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
- libqcow{,‑devel,‑python,‑python3,‑tools}-20181216-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python,‑tools}-20181216-1.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python,‑python3,‑tools}-20181216-1.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
- libvshadow{,‑devel,‑python,‑python3,‑tools}-20181216-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python,‑tools}-20181216-1.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python,‑python3,‑tools}-20181216-1.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
This version uses the external version of libbfio to support
DFF, the Digital Forensics Framework.
- silk-ipset-{devel,lib,tools}-3.18.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and silk-ipset{-devel,‑lib,‑tools}-3.18.0-1.el7.x86_64.rpm -
The SiLK IPset distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.18.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.0‑2.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.18.0‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- analysis-pipeline-5.9-3.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.9-3.el7.x86_64.rpm -
The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes.
This package was rebuilt to use silk 3.18.0.
- prism-1.2-5.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm - The prism
trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool.
The script can be used directly, or might be used as a component in other more specialized scripts.
In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup.
This package was rebuilt to use silk 3.18.0.
- super_mediator-1.6.0-5.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator-1.6.0-5.el7.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
This package was rebuilt to use silk 3.18.0.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.9-300 for FC29
- 4.19.8-300 for FC29
- 4.19.7-300 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.9-300 for FC29
- 4.19.8-300 for FC29
- 4.19.7-300 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.8-200 for FC28
- 4.19.7-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.8-200 for FC28
- 4.19.7-200 for FC28
|
|
December 7, 2018:
The following changes have been made:
- libregf{,‑devel,‑python,‑python3,‑tools}-20181129-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libregf{,‑devel,‑python,‑tools}-20181129-1.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python,‑python3,‑tools}-20181129-1.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- dfvfs-20181202-1.{fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
This release is testing APFS support in plaso.
- libfsapfs{,‑devel,‑python,‑python3,‑tools}-20181205-1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python,‑tools}-20181205-1.el6.{i686,x86_64}.rpm, and libfsapfs{,‑devel,‑python,‑python3,‑tools}-20181205-1.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
Note that this project currently only focuses on the analysis of the format.
- libfixbuf{,‑devel}-2.2.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- pyfixbuf-0.6.0-1.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm - Pyfixbuf
is a Python API for libfixbuf, an implementation of the
IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this and all releases.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.17.2-5.{fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
This version was rebuilt for libfixbuf-2.2.0.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.17.2‑6.{fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.17.2‑6.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
This version was rebuilt for libfixbuf-2.1.0.
- libschemaTools{,‑devel}-1.3-3.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and libschemaTools{,‑devel}-1.3-3.el7.x86_64.rpm -
libschemaTools is a library that provides a standard representation of data records.
It is built on fixbuf, using IPFIX information elements.
It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source.
SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records.
See here for the list of changes for this release.
This package was rebuilt to use libfixbuf 2.2.0.
- analysis-pipeline-5.9-2.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.9-2.el7.x86_64.rpm -
The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes.
This package was rebuilt to use libfixbuf 2.2.0.
- super_mediator-1.6.0-4.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator-1.6.0-4.el7.x86_64.rpm -
Super_mediator is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
This package was rebuilt to use libfixbuf 2.2.0.
- yaf{,‑devel}-2.10.0-3.{fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and yaf{,‑devel}-2.10.0-3.el7.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
Note that for CentOS 6 and 7 for the x86_64 architecture, yaf has been built to use PF_Ring.
This package was rebuilt to use libfixbuf 2.2.0.
- lime-kernel-modules-1.1.r17-15.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 29 x86_64 and i386 architectures was added.
- fmem-kernel-modules-1.6-1.15.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 29 x86_64 and i386 architectures was added.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.6-300 for FC29
- 4.19.5-300 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.6-300 for FC29
- 4.19.5-300 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.6-200 for FC28
- 4.19.5-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.6-200 for FC28
- 4.19.5-200 for FC28
- fmem-kernel-modules-el7-x86_64-1.6-1.47.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-957.1.3 for EL7
- 3.10.0-957 for EL7
- lime-kernel-modules-el7-x86_64-1.1.r17-47.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-957.1.3 for EL7
- 3.10.0-957 for EL7
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.49.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-49.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 29, 2018:
The following changes have been made:
- pfring-7.2.0-2285.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2285.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- libbde{,‑devel,‑python,‑python3,‑tools}-20181124-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libbde{,‑devel,‑python,‑tools}-20181124-1.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python,‑python3,‑tools}-20181124-1.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
- libfsapfs{,‑devel,‑python,‑python3,‑tools}-20181125-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python,‑tools}-20181125-1.el6.{i686,x86_64}.rpm, and libfsapfs{,‑devel,‑python,‑python3,‑tools}-20181125-1.el7.x86_64.rpm -
libfsapfs is a library to access the Apple File System (APFS).
Note that this project currently only focuses on the analysis of the format.
- libqcow{,‑devel,‑python,‑python3,‑tools}-20181124-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python,‑tools}-20181124-1.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python,‑python3,‑tools}-20181124-1.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
- libvhdi{,‑devel,‑python,‑python3,‑tools}-20181125-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python,‑tools}-20181125-1.el6.{i686,x86_64}.rpm, and libvhdi{,‑devel,‑python,‑python3,‑tools}-20181125-1.el7.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
- libvmdk{,‑devel,‑python,‑python3,‑tools}-20181124-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python,‑tools}-20181124-1.el6.{i686,x86_64}.rpm, and libvmdk{,‑devel,‑python,‑python3,‑tools}-20181124-1.el7.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
- libregf{,‑devel,‑python,‑python3,‑tools}-20181127-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libregf{,‑devel,‑python,‑tools}-20181127-1.el6.{i686,x86_64}.rpm, and libregf{,‑devel,‑python,‑python3,‑tools}-20181127-1.el7.x86_64.rpm -
Libregf contains libraries and tools to access the Windows NT Registry File files.
- dfvfs-20181128-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
This release is testing APFS support in plaso.
- super_mediator-1.6.0-3.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and super_mediator-1.6.0-3.el7.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
This release - 3 - was built to properly support SiLK IPSet support, allowing the IN_LIST and NOT_IN_LIST operators in filters.
Thanks to Braden Licastro of the IT department at the Software Engineering Institute for requesting SiLK IPSet support and for testing the updated packages on RHEL 6.
- libscca{,‑devel,‑python,‑python3,‑tools}-20181128-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libscca{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm, and libscca{,‑devel,‑python,‑python3,‑tools}-20181128-1.el7.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
- dtfabric-20181128-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and dtfabric-20181128-1.el7.x86_64.rpm -
Dtfabric
is a project to manage data types and structures, as used in the libyal projects.
- libexe{,‑devel,‑python,‑python3,‑tools}-20181128-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libexe{,‑devel,‑python,‑tools}-20181128-1.el6.{i686,x86_64}.rpm, and libexe{,‑devel,‑python,‑python3,‑tools}-20181128-1.el7.x86_64.rpm -
Libexe is a library and tools to access the executable (EXE) format.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.4-300 for FC29
- 4.19.3-300 for FC29
- 4.19.2-301 for FC29
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.4-300 for FC29
- 4.19.3-300 for FC29
- 4.19.2-301 for FC29
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.19.4-200 for FC28
- 4.19.3-200 for FC28
- 4.19.2-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.19.4-200 for FC28
- 4.19.3-200 for FC28
- 4.19.2-200 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.43.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-43.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 20, 2018:
The following changes have been made:
- pfring-7.2.0-2239.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2239.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- libqcow{,‑devel,‑python,‑python3,‑tools}-20181117-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python,‑tools}-20181117-1.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python,‑python3,‑tools}-20181117-1.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
- libvhdi{,‑devel,‑python,‑python3,‑tools}-20181118-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python,‑tools}-20181118-1.el6.{i686,x86_64}.rpm, and libvhdi{,‑devel,‑python,‑python3,‑tools}-20181118-1.el7.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format.
- libbde{,‑devel,‑python,‑python3,‑tools}-20181117-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libbde{,‑devel,‑python,‑tools}-20181117-1.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python,‑python3,‑tools}-20181117-1.el7.x86_64.rpm -
Libbde
is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
- libvmdk{,‑devel,‑python,‑python3,‑tools}-20181118-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python,‑tools}-20181118-1.el6.{i686,x86_64}.rpm, and libvmdk{,‑devel,‑python,‑python3,‑tools}-20181118-1.el7.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
- Volatility-2.6-5.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i386,x86_64}.rpm and Volatility-2.6-5.el7.x86_64.rpm -
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.6 that has been patched to November 19, 2018.
You can read about this version here
Since the Volatility-community-plugins contain the mimikatz plugin, that plugin is no longer packaged with Volatility.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 16, 2018:
The following changes have been made:
- pfring-7.2.0-2232.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2232.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- libfsapfs{,‑devel,‑python,‑python3,‑tools}-20181110-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libfsapfs{,‑devel,‑python,‑tools}-20181110-1.el6.{i686,x86_64}.rpm, and libfsapfs{,‑devel,‑python,‑python3,‑tools}-20181110-1.el7.x86_64.rpm, -
libfsapfs
is a library to access the Apple File System (APFS).
Note that this project currently only focuses on the analysis of the format.
- CERT-Forensics-Tools-1.0-82.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-82.el7.x86_64.rpm -
The changes since the last release (1.0-81) are the following:
- rekall-1.7.2-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el7}.{i686,x86_64}.rpm - Rekall is an advanced forensic and incident response framework.
While it began life purely as a memory forensic framework, it has now evolved into a complete platform.
Rekall implements the most advanced analysis techniques in the field, while still being developed in the open, with a free and open source license. Many of the innovations implemented within Rekall have been published in
peer reviewed papers.
Note that this package has been installed in the forensics-test repository for now.
To install rekall on your system, you first need to enable this repository by running this command for Fedora:
sudo dnf config‑manager ‑‑set‑enabled forensics‑test
or this command for CentOS/RHEL:
sudo yum‑config‑manager ‑‑enable forensics‑test
Please report any problems with rekall to
Please note that the installation of all of these ancillary packages neede by rekall use the pip program in a Python
Virtual Environment.
Insure that pip works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
- autopsy-4.9.1-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and autopsy-4.9.1-1.el7.x86_64.rpm -
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer.
You can even use it to recover photos from your camera's memory card.
Note that autopsy has been promoted from the forensics-test repository.
In addition, the Java™ Platform, Standard Edition Development Kit (JDK™) from Oracle also needs to be installed before running autopsy.
That package can be found here.
Testing has been verified to work with JDK 8, update 191.
- coreutilsshim-1.0-1.fc29.noarch.rpm - CoreutilsShim is a package that resolves dependencies from changes to the coreutils package for Fedora 29.
- sleuthkit{,‑devel,‑libs}-4.6.4-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.6.3) released to this repository.
- apfs-fuse-20181116-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i386,x86_64}.rpm and apfs-fuse-20181116-1.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental.
It may not be able to read all files, it may return wrong data, or it may simply crash.
Use at your own risk.
But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far).
Thus, the driver may return compressed files instead of uncompressed ones.
Although most of the time it should just report an error.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.42.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-42.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 12, 2018:
The following changes have been made:
- pfring-7.2.0-2229.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2229.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- packetexaminer-0.9-4.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el7}.{i686,x86_64}.rpm - PacketExaminer is a harness to perform PCAP analysis.
In this release, the packages needed to support the --graph, --url, --netmap, and --timeseries command line options are now installed by default.
Furthermore, the previously required scapy and prettytable packages have been similarly replaced.
Please note that the installation of all of these ancillary packages uses the pip3 program.
Insure that pip3 works correctly in your environment by connfiguring the /etc/pip.conf file according to the configuration guide found
here.
|
|
November 9, 2018:
The following changes have been made:
- pfring-7.2.0-2226.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2226.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- xmount-0.7.6-3.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.{i686,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types.
- cutter-1.7.2-2.{fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and cutter-1.7.2-2.el7.x86_64.rpm - Cutter is a Qt and C++
GUI for radare2 reverse engineering framework.
Its goal is making an advanced, customizable, and FOSS (free and open-source software) reverse-engineering platform while keeping the user experience at mind.
Cutter is created by reverse engineers for reverse engineers.
This version of cutter is based on the code dated 2018-11-08 which was built to embed radare2 version 2.6.0 in it.
- CERT-Forensics-Tools-1.0-81.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-81.el7.x86_64.rpm -
The changes since the last release (1.0-78) are the following:
- Umit replaces nmap-frontend for Fedora systems.
- wireshark-gnome is not installed on Fedora 29-based systems because this package is not provided by RedHat.
- Cutter replaces bokken for Fedora 26 through 29 systems and for CentOS/RHEL 7 systems.
In addition, python-radare2 has also been obsoleted on Fedora 26 through 29 systems and for CentOS/RHEL 7 systems since it is no longer needed and
incompatible with the latest version of radare2 on Fedora systems.
- The PacketExaminer package is installed.
- python{2,3}-scapy-2.4.0-4.{fc23,fc24,fc25,el7}.noarch.rpm - Scapy is a powerful interactive packet manipulation program.
It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more.
It can easily handle most classical tasks like scanning, tracerouting, probing, unit tests, attacks or network discovery (it can replace hping, 85% of nmap, arpspoof, arp-sk, arping,
tcpdump, tethereal, p0f, etc.).
It also performs very well at a lot of other specific tasks that most other tools can’t handle, like sending invalid frames, injecting your own 802.11 frames,
combining technics (VLAN hopping+ARP cache poisoning, VOIP decoding on WEP encrypted channel, …), etc.
- python{,3}-prettytable-0.7.2-3.el7.noarch.rpm - Python-PrettyTable is a simple Python library designed to make it quick
and easy to represent tabular data in visually appealing ASCII tables.
It was inspired by the ASCII tables used in the PostgreSQL shell psql.
PrettyTable allows for selection of which columns are to be printed, independent alignment of columns (left or right justified or centred) and printing of “sub-tables” by specifying a row range.
- packetexaminer-0.9-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el7}.{i686,x86_64}.rpm - PacketExaminer is a harness to perform PCAP analysis that
a security engineer may do during an incident response or when looking at network security.
The author found that they were frequently using a collection of tools and techniques again and again and thought it would be helpful to create a program that would do this.
This hopefully automates some routine functions that one would do manually.
- examiner-tooldocumentation-1.18-8.el7.noarch.rpm - The following packages were updated to added to the documetation suite found on the desktop:
and the following packages were removed:
Once this package has been updated, run the following command:
sudo manage-examiner-login -S -v
to install these changes in the examiner's desktop.
- fmem-kernel-modules-fc29-{i386,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc29-{i386,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 5, 2018:
The following changes have been made:
- pfring-7.2.0-2215.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2215.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- libmdmp{,‑devel,‑tools}-20181031-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - Libmdmp
is a library to access the Windows Minidump (MDMP) format.
Note that this project currently only focuses on the analysis of the format.
- libhibr{,‑devel,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - libhibr
is a lbrary and tools to access the Windows Hibernation File (hiberfil.sys) format.
Note that this project currently only focuses on the analysis of the format.
- libfshfs{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.{i686,x86_64}.rpm and libfshfs{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm - Libfshfs
is a lbrary and tools to access the Hierarchical File System (HFS).
Note that this project currently only focuses on the analysis of the format.
- libmodi{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libmodi{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm, and libmodi{,‑devel,‑python,‑python3,‑tools}-20181101-1.el7.x86_64.rpm -
Libmodi is a lbrary and tools to access the Mac OS disk image formats.
- libfsext{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libfsext{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm - Libfsext
is a lbrary and tools to access the Extended File System (EXT).
Note that this project currently only focuses on the analysis of the format.
- libnk2{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.{i686,x86_64}.rpm and libnk2{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm - Libnk2
is a lbrary and tools to access Microsoft Outlook Nickfile (NK2) format files.
- libphdi{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libphdi{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm, and libphdi{,‑devel,‑python,‑python3,‑tools}-20181101-1.el7.x86_64.rpm -
Libphdi is a library to access the Parallels Hard Disk image format.
- libexe{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libexe{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm, and libexe{,‑devel,‑python,‑python3,‑tools}-20181101-1.el7.x86_64.rpm -
Libexe is a library and tools to access the executable (EXE) format.
- libwtcdb{,‑devel,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm libwtcdb{,‑devel,‑tools}-20181101-1.el6.{i686,x86_64}.rpm -
Libwtcdb is a library and tools to access the Windows (Vista/7) Explorer thumbnail cache database format (thumbcache.db).
- libagdb{,‑devel,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - Libagdb
is a library to access the SuperFetch database format.
- libcreg{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.{i686,x86_64}.rpm and libcreg{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm - Libcreg
is a library and tools to access the Windows 9x/Me Registry File (CREG) format.
- libscca{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm, libscca{,‑devel,‑python,‑tools}-20181101-1.el6.x86_64.rpm, libscca{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.{i686,x86_64}.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
See here for the list of changes.
- libfsntfs{,‑devel,‑python,‑python3,‑tools}-20181101-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python,‑tools}-20181101-1.el6.{i686,x86_64}.rpm, and libfsntfs{,‑devel,‑python,‑python3,‑tools}-20181101-1.el7.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
- Fedora 29 - The repository now supports Fedora 29
for the x86_64 and i386 CPU architectures.
Here is the list of tools provided for Fedora 29:
- radare2{,‑devel,‑common}-2.9.0-1.el7.x86_64.rpm - Radare
is a framework for doing reverse engineering.
- python-radare2-2.9.0-1.el7.x86_64.rpm - Python-Radare
are bindings that allow Radare to be used from Python.
These updates were made to keep pace with the Radare2 package installed in CentOS/RHEL 7.
- dtfabric-20181103-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29}.{i686,x86_64}.rpm and dtfabric-20181103-1.el7.x86_64.rpm -
Dtfabric
is a project to manage data types and structures, as used in the libyal projects.
- python‑dfdatetime-20181025-1.{fc23,fc24,fc25,fc26,fc27,fc28,fc29,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- splunk-7.2.0-8c86330ac18-linux-2.6-x86_64.rpm and splunk-7.2.0-8c86330ac18.i386.rpm - This version of
Splunk was added to the Splunk repository for Fedora through 29 and Fedora 6 and 7 for the i386 and x86_64 architectures.
Follow these instructions after upgrading
to this version.
Make sure that you following these instruction after upgrading but before rebooting.
If you do not following these instructions your system may hang when it reboots.
- splunkshim-1.0-1.fc29.noarch.rpm - SplunkShim is a package that resolves dependencies from changes to the coreutils package for Fedora 29.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.41.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-41.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 26, 2018:
The following changes have been made:
- pfring-7.2.0-2205.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2205.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- apfs-fuse-20181022-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i386,x86_64}.rpm and apfs-fuse-20181008-1.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental.
It may not be able to read all files, it may return wrong data, or it may simply crash.
Use at your own risk.
But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far).
Thus, the driver may return compressed files instead of uncompressed ones.
Although most of the time it should just report an error.
- xlsxwriter-1.1.2-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and xlsxwriter-1.1.2-1.el7.x86_64.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.0.8).
- autopsy-4.9.0-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and autopsy-4.9.0-1.el7.x86_64.rpm -
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
It is used by law enforcement, military, and corporate examiners to investigate what happened on a computer.
You can even use it to recover photos from your camera's memory card.
Note that this package has been installed in the forensics-test repository for now.
To install autopsy on your system, you first need to enable this repository by running this command for Fedora: sudo dnf config‑manager ‑‑set‑enabled forensics‑test
or this command for CentOS/RHEL: sudo yum‑config‑manager ‑‑enable forensics‑test.
In addition, the Java™ Platform, Standard Edition Development Kit (JDK™) from Oracle also needs to be installed before running autopsy.
That package can be found here.
Testing has been verified to work with JDK 8, update 191.
If you encounter problems with this version of autopsy, please send an email to:
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.40.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-40.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 19, 2018:
The following changes have been made:
- snort-2.9.12-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and snort-2.9.12-1.el7.x86_64.rpm-
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
This release includes support for PF_Ring for CentOS/RHEL 6 and 7 for the x86_64 architecture.
- snort-sample-rules-2.9.12-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.noarch.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HttP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- snort-openappid-2.9.12-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.12-1.el7.x86_64.rpm -
This is the snort package built with the following additions:
To install snort-openappid on your system, you must first remove snort.
Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi
sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
This release includes support for PF_Ring for CentOS/RHEL 6 and 7 for the x86_64 architecture.
- Volatility-2.6-4.{fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i386,x86_64}.rpm and Volatility-2.6-4.el7.x86_64.rpm -
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.6 that has been patched to October 15, 2018.
You can read about this version here
Since the Volatility-community-plugins contain the mimikatz plugin, that plugin is no longer packaged with Volatility.
- sleuthkit{,‑devel,‑libs}-4.6.3-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.6.2) released to this repository.
- regripper-plugins-20181017-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.noarch.rpm - Regripper-plugins
are the plugins packaged separately from the regripper application.
This package is taken from the plugins directory at the Github source code site as of 2018-10-17.
- python-certifi-2018.10.15-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.noarch.rpm - Certifi is a
carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
This package was supports plaso.
- pfring-7.2.0-2190.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2190.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.18.14-200 for FC28
- 4.18.13-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.18.14-200 for FC28
- 4.18.13-200 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.39.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-39.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 11, 2018:
The following changes have been made:
- apfs-fuse-20181008-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i386,x86_64}.rpm and apfs-fuse-20181008-2.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental.
It may not be able to read all files, it may return wrong data, or it may simply crash.
Use at your own risk.
But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far).
Thus, the driver may return compressed files instead of uncompressed ones.
Although most of the time it should just report an error.
- exfat-utils-1.3.0-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
See here for the list of changes since the last released version (1.2.8).
- pfring-7.2.0-2174.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2174.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- cutter-1.7.2-1.{fc26,fc27,fc28,el7}.x86_64.rpm - Cutter is a Qt and C++
GUI for radare2 reverse engineering framework.
Its goal is making an advanced, customizable, and FOSS (free and open-source software) reverse-engineering platform while keeping the user experience at mind.
Cutter is created by reverse engineers for reverse engineers.
- libbfio,{-devel}-20180910-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i386,x86_64}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access.
See here for the list of changes.
- libqcow{,‑devel,‑python,‑python3,‑tools}-20180831-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python,‑tools}-20180831-1.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python,‑python3,‑tools}-20180831-1.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
See here for the list of changes.
- CERT-Forensics-Tools-1.0-78.{fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-78.el7.x86_64.rpm -
This package was updated to add the cutter package for
Fedora 26 through 28 for the x86_64 architecture and CentOS/RHEL 7 for the x86_64 architecture.
- examiner-tooldocumentation-1.18-7.el7.noarch.rpm - This package was updated to add the following programs to the documetation suite found on the desktop:
Once this package has been updated, run sudo manage-examiner-login -S -v to install these changes in the examiner's desktop.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.18.12-200 for FC28
- 4.18.11-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.18.12-200 for FC28
- 4.18.11-200 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.38.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-38.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.48.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-48.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 5, 2018:
The following changes have been made:
- sleuthkit{,‑devel,‑libs}-4.6.2-2.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.6.0) released to this repository.
- pfring-7.2.0-2167.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2167.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.37.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.18.10-100 for FC27
- 4.18.9-100 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-37.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.18.10-100 for FC27
- 4.18.9-100 for FC27
- fmem-kernel-modules-el7-x86_64-1.6-1.46.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-46.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 2, 2018:
The following changes have been made:
- plaso-20180930-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and plaso-20180930-1.el7.x86_64.rpm -
Plaso is the Python-based back-end engine used by tools such as log2timeline
for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 23, 24, 25, 26, 27, and 28 for the i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
- python-radare2-2.9.0-1.{fc27,fc28}.{i686,x86_64}.rpm - Python-Radare
are bindings that allow Radare to be used from Python.
These updates were made to keep pace with the Radare2 package installed in Fedora 27 and 28.
|
|
September 28, 2018:
The following changes have been made:
- pfring-7.2.0-2163.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2163.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 21, 2018:
The following changes have been made:
- pfring-7.2.0-2154.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2154.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.18.8-200 for FC28
- 4.18.7-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.18.8-200 for FC28
- 4.18.7-200 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 15, 2018:
The following changes have been made:
- yara-python-3.8.1-1.x86_64.el7.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in CentOS/RHEL 7.
|
|
September 14, 2018:
The following changes have been made:
- pfring-7.2.0-2150.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2150.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 7, 2018:
The following changes have been made:
- pfring-7.2.0-2133.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2133.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- dfvfs-20180831-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- pyfixbuf-0.5.0-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - Pyfixbuf
is a Python API for libfixbuf, an implementation of the
IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this
and all releases.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 30, 2018:
The following changes have been made:
- artifacts‑20180827‑1.{fc24,fc25,fc26,fc27,fc28,fc29}.{i386,x86_64}.rpm and artifacts‑20180827‑1.el7.x86_64.rpm -
Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
- xlsxwriter-1.0.8-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and xlsxwriter-1.0.8-1.el7.x86_64.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.0.5).
- python-certifi-2018.8.24-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.noarch.rpm - Certifi is a
carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
This package was built to support plaso.
- dfvfs-20180827-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- pfring-7.2.0-2128.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2128.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.17.18-200 for FC28
- 4.17.17-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.17.18-200 for FC28
- 4.17.17-200 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 24, 2018:
The following changes have been made:
- pfring-7.2.0-2113.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2113.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- python-elasticsearch5-5.5.5-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.{i686,x86_64}.rpm - ElasticSearch5 is a low-level client for
Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python;
because of this it tries to be opinion-free and very extendable. For a more high level client library with more limited scope, have a
look at elasticsearch-dsl - a more pythonic library sitting on top of elasticsearch-py. It provides a more convenient and idiomatic way
to write and manipulate queries. It stays close to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the
whole range of the DSL from Python either directly using defined classes or a queryset-like expressions. It also provides an optional
persistence layer for working with documents as Python objects in an ORM-like fashion: defining mappings, retrieving and saving documents,
wrapping the document data in user-defined classes.
- python-elasticsearch-6.3.1-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and python-elasticsearch-6.3.1-1.el7.x86_64.rpm -
ElasticSearch is the official low-level client for
Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python;
because of this it tries to be opinion-free and very extendable. For a more high level client library with more limited scope, have a
look at elasticsearch-dsl - a more pythonic library sitting on top of elasticsearch-py. It provides a more convenient and idiomatic way
to write and manipulate queries. It stays close to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the
whole range of the DSL from Python either directly using defined classes or a queryset-like expressions. It also provides an optional
persistence layer for working with documents as Python objects in an ORM-like fashion: defining mappings, retrieving and saving documents,
wrapping the document data in user-defined classes.
- python-setuptools_scm-1.15.7-2.el7.x86_64.rpm - Python-Setuptools_scm
is a package that handles managing your python package versions in scm metadata.
It also handles file finders for the suppertes scms.
This package was required to build LZ4 for CentOS/RHEL 7.
- python-lz4-0.10.0-1.{fc25,fc24,fc23}.{i386,x86_64}.rpm and python-lz4-0.10.0-1.el7.x86_64.rpm - LZ4
contains the python bindings for the lz4 compression library.
This package was built for CentOS/RHEL 7 to support Plaso
- plaso-20180818-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and plaso-20180818-1.el7.x86_64.rpm -
Plaso is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 23, 24, 25, 26, 27, and 28 for the i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
|
|
August 17, 2018:
The following changes have been made:
- pfring-7.2.0-2096.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2096.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.45.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-45.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.47.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-47.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 10, 2018:
The following changes have been made:
- libbde{,‑devel,‑python,‑python3,‑tools}-20180806-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libbde{,‑devel,‑python,‑tools}-20180806-1.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python,‑python3,‑tools}-20180806-1.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
- dtfabric-20180808-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and dtfabric-20180808-1.el7.x86_64.rpm -
Dtfabric
is a project to manage data types and structures, as used in the libyal projects.
- python{2,3}-pefile-2018.8.8-1.{fc23,fc24,fc25,fc26,fc27,fc28,el7}.noarch.rpm -
PEFile is a Portable Executable reader module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.17.11-200 for FC28
- 4.17.12-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.17.11-200 for FC28
- 4.17.12-200 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.17.12-100 for FC27
- 4.17.11-100 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.17.12-100 for FC27
- 4.17.11-100 for FC27
|
|
August 3, 2018:
The following changes have been made:
- pfring-7.2.0-2083.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2083.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- apfs-fuse-20180731-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i386,x86_64}.rpm and apfs-fuse-20180731-2.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental.
It may not be able to read all files, it may return wrong data, or it may simply crash.
Use at your own risk.
But since it's read-only, at least the data on your apfs drive should be safe.
Be aware that not all compression methods are supported yet (only the ones the author has encountered so far).
Thus, the driver may return compressed files instead of uncompressed ones.
Although most of the time it should just report an error.
- libpff{,‑devel,‑python,‑python3,‑tools}-20180714-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libpff{,‑devel,‑python,‑python3,‑tools}-20180714-1.el7.x86_64.rpm, and libpff{,‑devel,‑python,‑tools}-20180714-1.{i686,x86_64}.rpm - Libpff
is a library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format.
PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files. Static and dynamic versions of the libraries are provided.
Libpff is used by DFF,the Digital Forensics Framework.
- libvsmbr{,‑devel,‑python,‑python3,‑tools}-20180731-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libvsmbr{,‑devel,‑python,‑python3,‑tools}-20180731-1.el7.x86_64.rpm, and libvsmbr{,‑devel,‑python,‑tools}-20180731-1.el6.{i686,x86_64}.rpm - Libvsmbr
is a library and tools to access the Master Boot Record (MBR) volume system.
- plaso-20180703-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and plaso-20180703-1.el7.x86_64.rpm -
Plaso is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 23, 24, 25, 26, 27, and 28 for the i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.17.9-200 for FC28
- 4.17.7-200 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.17.9-200 for FC28
- 4.17.7-200 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.17.9-100 for FC27
- 4.17.7-100 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.17.9-100 for FC27
- 4.17.7-100 for FC27
|
|
|
July 20, 2018:
The following changes have been made:
|
|
June 29, 2018:
The following changes have been made:
- pfring-7.2.0-2043.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2043.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- The following where installed because they were missing.
This prevented dff and CERT-Forensics-Tools from being installed on Fedora 23.
- x264-libs-0.148-1.20151020gita0cd7d3.fc23.x86_64.rpm
- x265-libs-1.8-1.fc23.x86_64.rpm
- xvidcore-1.3.4-2.fc23.x86_64.rpm
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.17.2-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.17.2‑2.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.17.2‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- artifacts‑20180628‑1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i386,x86_64}.rpm and artifacts‑20180628‑1.el7.x86_64.rpm -
Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
- libfwsi{,‑devel,‑python,‑python3}-20180623-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python}-20180623-1.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python,‑python3}-20180623-1.el7.x86_64.rpm -
Libfwsi is a library to access the
Windows Shell Item format.
- liblnk{,‑devel,‑python,‑python3,‑tools}-20180626-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python,‑tools}-20180826-1.el6.{i686,x86_64}.rpm, and liblnk{,‑devel,‑python,‑python3,‑tools}-20180626-1.el7.x86_64.rpm -
Liblnk contains libraries and tools to access the Windows Shortcut File (LNK) format file.
See here for the list of changes.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.16.16-200 for FC27
- 4.17.2-100 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.16.16-200 for FC27
- 4.17.2-100 for FC27
|
|
June 22, 2018:
The following changes have been made:
- Volatility-2.6-3.{fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i386,x86_64}.rpm and Volatility-2.6-3.el7.x86_64.rpm-
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.6 that has been patched to June 15, 2018.
You can read about this version here
Since the Volatility-community-plugins contain the mimikatz plugin, that plugin is no longer packaged with Volatility.
- pfring-7.2.0-2026.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2026.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.43.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-43.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 15, 2018:
The following changes have been made:
- pfring-7.2.0-2003.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.2.0-2003.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- pyfixbuf-0.3.0-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - Pyfixbuf
is a Python API for libfixbuf, an implementation of the
IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this
and all releases.
This package was rebuilt to use libfixbuf 2.0.0.
- python-dfdatetime-20180606-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- dtfabric-20180604-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and dtfabric-20180604-1.el7.x86_64.rpm -
Dtfabric
is a project to manage data types and structures, as used in the libyal projects.
- ssdeep-2.14.1-1.{fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - Ssdeep is a program for computing context triggered
piecewise hashes (CTPH), also called fuzzy hashes. See here for the list of changes.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.16.15-300 for FC28
- 4.16.14-300 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.16.15-300 for FC28
- 4.16.14-300 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 8, 2018:
The following changes have been made:
- apfs-fuse-20180604-2.{fc23,fc24,fc25,fc26,fc27,fc28}.{i386,x86_64}.rpm and apfs-fuse-20180604-2.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
In this version the assembly language code was removed and replaced by zlib and lzfse.
- libluksde{,‑devel,‑python2,‑python3,‑tools}-20180514-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm, libluksde{,‑devel,‑python2,‑python3,‑tools}-20180514-1.el7.x86_64.rpm, and libluksde{,‑devel,‑python,‑tools}-20180514-1.el6.{i686,x86_64}.rpm -
Libluksde is a library and tools used to access LUKS Disk Encryption encrypted volumes.
See here for the list of changes.
- radare2{,‑devel}-2.7.0-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and radare2{,‑devel}‑2.7.0‑1.el7.x86_64.rpm - Radare
is a framework for doing reverse engineering.
- python-radare2-2.6.0-1.{fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and python‑radare2‑2.6.0‑1.el7.x86_64.rpm -
Python-Radare are bindings that allow Radare to be used from Python.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 1, 2018:
The following changes have been made:
- pfring-7.0.0-1976.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1976.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.16.12-200 for FC27
- 4.16.11-200 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.16.12-200 for FC27
- 4.16.11-200 for FC27
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.37.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-37.noarch.rpm - Support for the following kernels were added for
LiME:
- libfixbuf{,‑devel}-2.0.0-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
- libschemaTools{,‑devel}-1.3-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and libschemaTools{,‑devel}-1.3-1.el7.x86_64.rpm -
libschemaTools is a library that provides a standard representation of data records.
It is built on fixbuf, using IPFIX information elements.
It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source.
SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records.
See here for the list of changes for this release.
This package was rebuilt to use libfixbuf 2.0.0.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.17.1-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.17.1‑2.{fc22,fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.17.1‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- silk-ipset-{devel,lib,tools}-3.17.0-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
- prism-1.2-4.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.{i686,x86_64}.rpm - The prism
trend script is a tool for quickly visualizing flow data as a time-series broken down into several configurable bins by SiLK's rwfilter tool.
The script can be used directly, or might be used as a component in other more specialized scripts.
In addition to providing immediate visualizations, the Prism trend script can store these breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later quick lookup.
This is a new release keeping up with the latest SiLK 3 tools.
- super_mediator-1.6.0-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and super_mediator-1.6.0-1.el7.x86_64.rpm -
Super_mediator is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the list of changes for this release.
- yaf{,‑devel}-2.10.0-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and yaf{,‑devel}-2.10.0-1.el7.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
Note that for CentOS 6 and 7 for the x86_64 architecture, yaf has been built to use PF_Ring.
- analysis-pipeline-5.8-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.8-1.el7.x86_64.rpm -
The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
This package was rebuilt to use silk 3.17.1 and libfixbuf 2.0.0.
|
|
May 27, 2018:
The following changes have been made:
- pfring-7.0.0-1970.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1970.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- dtfabric-20180522-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and dtfabric-20180522-1.el7.x86_64.rpm -
Dtfabric
is a project to manage data types and structures, as used in the libyal projects.
- xlsxwriter-1.0.5-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6}.{i686,x86_64}.rpm and xlsxwriter-1.0.5-1.el7.x86_64.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.0.4).
- python‑biplist-1.0.3-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and python‑biplist-1.0.3-1.el7.x86_64.rpm -
Biplist is a library for reading/writing binary plists.
Binary Property List (plist) files provide a faster and smaller serialization format for property lists on OS X.
This is a library for generating binary plists which can be read by OS X, iOS, or other clients.
- python-elasticsearch5-5.5.1-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el7}.{i686,x86_64}.rpm - ElasticSearch5 is a low-level client for
Elasticsearch. Its goal is to provide common ground for all Elasticsearch-related code in Python;
because of this it tries to be opinion-free and very extendable. For a more high level client library with more limited scope, have a
look at elasticsearch-dsl - a more pythonic library sitting on top of elasticsearch-py. It provides a more convenient and idiomatic way
to write and manipulate queries. It stays close to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the
whole range of the DSL from Python either directly using defined classes or a queryset-like expressions. It also provides an optional
persistence layer for working with documents as Python objects in an ORM-like fashion: defining mappings, retrieving and saving documents,
wrapping the document data in user-defined classes.
- python{2,3}-psutil-5.4.3-4.{fc23,fc24,fc25}.{i686,x86_64}.rpm, python2-psutil-5.4.3-4.fc22.{i686,x86_64}.rpm, and python2-psutil-5.4.3-4.el7}.x86_64.rpm -
Python-psutil is a cross-platform library for retrieving information onrunning processes and system utilization (CPU, memory, disks, network)in Python.
This package was built to support plaso.
- plaso-20180524-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and plaso-20180524-1.el7.x86_64.rpm -
Plaso is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 22, 23, 24, 25, 26, 27, and 28 for the i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.16.11-300 for FC28
- 4.16.10-300 for FC28
- 4.16.9-300 for FC28
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.16.11-300 for FC28
- 4.16.10-300 for FC28
- 4.16.9-300 for FC28
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.42.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-42.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.45.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-45.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
May 18, 2018:
The following changes have been made:
- pfring-7.0.0-1949.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1949.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- python-dfdatetime-20180510-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- dfvfs-20180510-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- artifacts‑20180505‑1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28}.{i386,x86_64}.rpm and artifacts‑20180505‑1.el7.x86_64.rpm -
Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
- dfwinreg-20180329-1.{fc22,fc23,fc24,fc25,fc26,fc27,fc28}.{i686,x86_64}.rpm and dfwinreg-20180329-1.{el6,el7}.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- icu-57.1-9.1.fc27.{i686,x86_64}.rpm, libicu{,‑devel}-57.1-9.1.fc27.{i686,x86_64}.rpm, and libicu-doc-57.1-9.1.fc27.noarch.rpm - ICU
is a mature, widely used set of C/C++ and Java libraries providing Unicode and Globalization support for software applications.
ICU is widely portable and gives applications the same results on all platforms and between C/C++ and Java software.
Note that there is a bug in the Fedora-provided version for Fedora 27 that is explained and patched here.
This patch has been applied in version 9.1 of this package.
ICU is needed for the QTMLTFS package.
- qtmltfs-2.2.2-2.{fc28,fc27,fc23,fc22,el6,el7}.{i686,x86_64}.rpm - QTMLTFS
(Quantum Linear Tape File System) enables standard file operations on LTO-5 and LTO-6 tape media.
Note that this packages is not available for Fedora 24 through 26 due to problems with ICU package.
- fmem-kernel-modules-fc28-{i386,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc28-{i386,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.41.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-862.2.3 for EL7
- 3.10.0-862 for EL7
- lime-kernel-modules-el7-x86_64-1.1.r17-41.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-862.2.3 for EL7
- 3.10.0-862 for EL7
|
|
May 11, 2018:
The following changes have been made:
- pfring-7.0.0-1926.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1926.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- libnk2{,‑devel,‑python,‑python3,‑tools}-20180503-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.{i686,x86_64}.rpm and libnk2{,‑devel,‑python,‑tools}-20180503-1.el6.{i686,x86_64}.rpm - Libnk2
is a lbrary and tools to access Microsoft Outlook Nickfile (NK2) format files.
- libscca{,‑devel,‑python,‑python3,‑tools}-20180509-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm, libscca{,‑devel,‑python,‑tools}-20180509-1.el6.x86_64.rpm, and libscca{,‑devel,‑python,‑python3,‑tools}-20180509-1.el7.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
See here for the list of changes.
- Fedora 28 - The repository now supports Fedora 28
for the x86_64 and i386 CPU architectures.
Here is the list of tools provided for Fedora 28:
- lime-kernel-modules-1.1.r17-14.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 28 x86_64 and i386 architectures was added.
- fmem-kernel-modules-1.6-1.14.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 28 x86_64 and i386 architectures was added.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.16.7-200 for FC27
- 4.16.6-202 for FC27
- 4.16.5-200 for FC27
- 4.16.4-200 for FC27
- 4.16.3-200 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.16.7-200 for FC27
- 4.16.6-202 for FC27
- 4.16.5-200 for FC27
- 4.16.4-200 for FC27
- 4.16.3-200 for FC27
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.44.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-44.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
April 27, 2018:
The following changes have been made:
- pfring-7.0.0-1887.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1887.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- apfs-fuse-20180424-1.{fc24,fc25,fc26,fc27}.{i386,x86_64}.rpm and apfs-fuse-20180424-1.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
See here for a list of the changes since the last version (20180303).
- aimage-3.2.5-3.{el6,el7}.{i386,x86_64}.rpm - Aimage (the advanced imager) is an imaging tool which is part of AFF, the Advanced Forensic Format.
Aimage can create files in raw, AFF, AFD, or AFM formats.
AFF and AFD formats can be compressed or uncompressed.
Aimage can optionally compress and calculate MD5 or SHA-1 hash residues while the data is being copied.
It has intelligent error recovery, similar to what is in ddrescue.
- CERT-Forensics-Tools-1.0-76.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-76.el7.x86_64.rpm -
This package was updated to add the apfs-fuse package to the systems where it is supported.
This releasae also installs aimage, libluksde, and libluksde-tools for CentOS/RHEL 7, and aimage for CentOS/RHEL 6.
- examiner-tooldocumentation-1.18-6.el7.noarch.rpm - This package was updated to add the following programs to the documetation suite found on the desktop:
- aimage
- apfs-dump-quick
- apfs-dump
- apfs-fuse
- luksdeinfo
- luksdemount
- lzfse
- partclone.f2fs
- psteal.py
- usnjls
Once this package has been updated, run sudo manage-examiner-login -S -v to install these changes in the examiner's desktop.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
April 20, 2018:
The following changes have been made:
- libfwsi{,‑devel,‑python,‑python3}-20180408-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python}-20180408-1.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python,‑python3}-20180408-1.el7.x86_64.rpm -
Libfwsi is a library to access the Windows Shell Item format.
Here are the changes:
- Improved Python bindings
- Fixed issues in m4/libclocale.m4
- Made changes to setup.py for sdist
- Applied updates
- Worked on tests
- Made changes to URI and URI sub shell items
- xlsxwriter-1.0.4-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and xlsxwriter-1.0.4-1.el7.x86_64.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
See here for a list of the changes since the last version (1.0.2).
- pfring-7.0.0-1846.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1846.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.15.16-300 for FC27
- 4.15.15-300 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.15.16-300 for FC27
- 4.15.15-300 for FC27
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.15.16-200 for FC26
- 4.15.15-200 for FC26
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.15.16-200 for FC26
- 4.15.15-200 for FC26
|
|
April 10, 2018:
The following changes have been made:
- pfring-7.0.0-1833.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1833.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
April 6, 2018:
The following changes have been made:
- cert-forensics-tools-release-{6,7,22,23,24,25,26,27}-13.noarch.rpm - cert-forensics-tools-release is the package
that connects a Fedora- and CentOS/RHEL-based computer system to the CERT Linux Forensics Tools Repository (LiFTeR).
This package has been changed to include a new Forensics team key which is also available here.
- pfring-7.0.0-1826.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1826.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.15.14-300 for FC27
- 4.15.13-300 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.15.14-300 for FC27
- 4.15.13-300 for FC27
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
April 2, 2018:
The following changes have been made:
- yara-python-3.7.1-1.x86_64.el6.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in CentOS/RHEL 6.
|
|
March 30, 2018:
The following changes have been made:
- dtfabric-20180325-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and dtfabric-20180325-1.el7.x86_64.rpm -
Dtfabric
is a project to manage data types and structures, as used in the libyal projects.
- dfvfs-20180326-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- pfring-7.0.0-1816.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1816.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- sleuthkit{,‑devel,‑libs}-4.6.0-3.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.5.0) released to this repository.
In this release, the file /usr/share/java/sleuthkit-4.6.0.jar was moved from sleuthkit-devel to sleuthkit.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 26, 2018:
The following changes have been made:
- bro{,‑core,ctl}-2.5.3-1.2.el7.x86_64.rpm and libbroccoli{,‑devel}-2.5.3-1.2.el7.x86_64.rpm - Bro
was recomplied for CentOS/RHEL 7 to use PF_Ring.
See the instructions here that explains this capability.
Note that since PF_Ring does not support Fedora, Bro for those systems were not recompiled.
|
|
March 23, 2018:
The following changes have been made:
- libevt{,‑devel,‑python,‑python3,‑tools}-20180317-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm, libevt{,‑devel,‑python,‑tools}-20180317-1.el6.{i686,x86_64}.rpm, and libevt{,‑devel,‑python,‑python3,‑tools}-20180317-1.el7.x86_64.rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- snort-2.9.11.1-2.{el6,el7}.x86_64.rpm - Snort is an open
source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
This release was recomplied to use PF_Ring.
- snort-openappid-2.9.11.1-2.{el6,el7}.x86_64.rpm - This is the snort package
built with the following additions:
To install snort-openappid on your system, you must first remove snort.
Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi
sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
This release was recomplied to use PF_Ring.
- python-dfdatetime-20180318-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- bro{,‑core,ctl}-2.5.3-1.1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.{i686,x86_64}.rpm and libbroccoli{,‑devel}-2.5.3-1.1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.{i686,x86_64}.rpm - Bro
is a powerful network analysis framework that is much different from the typical IDS you may know.
While focusing on network security monitoring, Bro provides a comprehensive platform for more general network traffic analysis as well.
Well grounded in more than 15 years of research, Bro has successfully bridged the traditional gap between academia and operations since its inception.
Today, it is relied upon operationally in particular by many scientific environments for securing their cyberinfrastructure.
Bro's user community includes major universities, research labs, supercomputing centers, and open-science communities.
- pfring-7.0.0-1804.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1804.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- guymager-0.8.8-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and guymager-0.8.8-1.el7.x86_64.rpm -
Guymager is a forensic imaging package.
See here for the list of changes.
- ddrescue-1.23-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
See here for the changes since the last version (1.22) released to this repository.
- analyzeMFT-2.0.19.1-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - AnalyzeMFT is a tool that fully parses
the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.
See here for the changes since the previously installed version 2.0.19.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.15.10-300 for FC27
- 4.15.9-300 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.15.10-300 for FC27
- 4.15.9-300 for FC27
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.15.10-200 for FC26
- 4.15.9-200 for FC26
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.15.10-200 for FC26
- 4.15.9-200 for FC26
|
|
March 16, 2018:
The following changes have been made:
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.16.1-1.{fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.16.1‑2.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.16.1‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
This package was rebuilt to use libfixbuf 1.8.0.
- analysis-pipeline-5.7-2.{fc20,fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.7-2.el7.86_64.rpm -
The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
This package was rebuilt to use silk 3.16.1.
- silk-ipset-{devel,lib,tools}-3.16.1-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.15.8-300 for FC27
- 4.15.7-300 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.15.8-300 for FC27
- 4.15.6-300 for FC27
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.43.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-43.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
March 9, 2018:
The following changes have been made:
- apfs-fuse-20180303-1.{fc24,fc25,fc26,fc27}.x86_64.rpm and apfs-fuse-20180303-1.el7.x86_64.rpm -
APFS-Fuse is a read-only FUSE driver for the new Apple File System.
This is from the README:
Since Apple didn't yet document the disk format of APFS, this driver should be considered experimental.
It may not be able to read all files, it may return wrong data, or it may simply crash.
Use at your own risk.
But since it's read-only, at least the data on your apfs drive should be safe.
- dislocker{,‑libs}-0.7.1-1.{el6,el7}.{i686,x86_64}.rpm and fuse-dislocker-0.7.1-1.{el6,el7}.{i686,x86_64}.rpm -
Dislocker reads BitLocker encrypted partitions under a Linux system.
The driver has the capability to read/write on:
- Windows Vista, 7, 8, 8.1 and 10 encrypted partitions - that's AES-CBC, AES-XTS, 128 or 256 bits, with or without the Elephant diffuser, encrypted partitions;
- BitLocker-To-Go encrypted partitions - that's USB/FAT32 partitions.
The core driver is composed of a library, with multiple binaries (see the NOTES section below) using this library.
Two binaries are of interest when wanting to decrypt a BitLocker encrypted partition:
- dislocker-fuse: binary using FUSE to dynamically decrypt the BitLocker-ed partition.
You have to give it a mount point where, once keys are decrypted, a file named dislocker-file appears.
This file is a virtual NTFS partition, so you can mount it as any NTFS partition and then read from or write to it.
Note that writing to the NTFS virtual file will change the underlying BitLocker partition's content.
- dislocker-file: binary decrypting a BitLocker encrypted partition into a flat file.
This file has to be given through command line and, once dislocker-file is finished, will be an NTFS partition.
It won't have any link to the original BitLocker partition.
Therefore, if you write to this file, the BitLocker volume won't change, only the NTFS file will.
Note that this may take a long time to create that file, depending on the size of the encrypted partition.
But afterward, once the partition is decrypted, the access to the NTFS partition will be faster.
Another thing to think about is the size on your disk this binary needs: the same size as the volume you're trying to decrypt.
Nevertheless, once the partition is decrypted, you can mount your file as any NTFS partition.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.40.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-40.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-7.0.0-1797.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1797.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
March 1, 2018:
The following changes have been made:
- pfring-7.0.0-1788.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1788.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- sleuthkit{,‑devel,‑libs}-4.6.0-2.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.5.0) released to this repository.
- pytsk3-20180228-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.{i686,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
- yara-python-3.7.1-1.x86_64.el7.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in CentOS/RHEL 7.
|
|
February 21, 2018:
The following changes have been made:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
February 16, 2018:
The following changes have been made:
- exfat-utils-1.2.8-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
See here for the list of changes since the last released version (1.2.7).
- ddrescueview-0.4.a3-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm - Ddrescueview is a small tool that allows
the user to graphically examine ddrescue's log files in a user friendly GUI application.
The Main window displays a block grid with each block's color representing the block types it contains.
Many people know this type of view from defragmentation programs.
The program is written in Object Pascal using the Lazarus IDE.
- libfplist{,‑devel}-20180125-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - Libfplist
is a library for plist formats.
Note: this is a library only - there are no tools provided by these packages.
- libfwevt{,‑devel}-20180124-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - Libfwevt
is a library for Windows XML Event Log (EVTX) data types.
Note: this is a library only - there are no tools provided by these packages.
- radare2{,‑devel}-2.3.0-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and radare2{,‑devel}‑2.3.0‑1.el7.x86_64.rpm - Radare
is a framework for doing reverse engineering.
- acr-1.4-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - ACR
tries to replace autoconf functionality generating a full-compatible 'configure' script (runtime flags).
But using shell-script instead of m4. This means that ACR is faster, smaller and easy to use.
- python-radare2-2.3.0-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and python‑radare2‑2.3.0‑1.el7.x86_64.rpm- Python-Radare
are bindings that allow Radare to be used from Python.
- pfring-7.0.0-1764.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1764.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
February 9, 2018:
The following changes have been made:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
February 2, 2018:
The following changes have been made:
- pfring-7.0.0-1736.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1736.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.42.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-42.noarch.rpm - Support for the following kernels were added for
LiME:
- python-certifi-2018.1.18-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.noarch.rpm - Certifi is a
carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
This package was built to support plaso.
- libsmraw{,‑devel,‑python,‑python3,‑tools}-20180123-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python,‑tools}-20180123-1.el6.{i686,x86_64}.rpm, and libsmraw{,‑devel,‑python,‑python3,‑tools}-20180123-1.el7.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
Libsmraw contains supports for multiple (split) RAW naming schemes.
- libwrc{,‑devel,‑python,‑python3,‑tools}-20180124-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm, libwrc{,‑devel,‑python,‑tools}-20180124-1.el6.{i686,x86_64}.rpm, and libwrc{,‑devel,‑python,‑python3,‑tools}-20180124-1.el7.x86_64.rpm - Libwrc
is a library and tools to access the Windows Resource Compiler (WRC) format.
- plaso-20180127-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and plaso-20180127-1.el7.x86_64.rpm -
Plaso is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 21, 22, 23, 24, 25, 26, and 27 for the i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
|
|
January 26, 2018:
The following changes have been made:
- pfring-7.0.0-1727.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1727.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.14.14-300 for FC27
- 4.14.13-300 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.14.14-300 for FC27
- 4.14.13-300 for FC27
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.14.14-200 for FC26
- 4.14.13-200 for FC26
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.14.14-200 for FC26
- 4.14.13-200 for FC26
- fmem-kernel-modules-el7-x86_64-1.6-1.39.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-39.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
January 19, 2018:
The following changes have been made:
- pfring-7.0.0-1707.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1707.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- artifacts‑20180115‑1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i386,x86_64}.rpm and artifacts‑20180115‑1.el7.x86_64.rpm -
Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
- libguytools-2.0.5-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and libguytools-2.0.5-1.el7.x86_64.rpm -
Libguytools is a package of subroutines and header files needed to
build and operate guymager.
The changes are:
- Moved to Qt5
- Adapted to Debian 8 (Jessie)
- guymager-0.8.7-2.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and guymager-0.8.7-2.el7.x86_64.rpm -
Guymager is a forensic imaging package.
This release was rebuilt for libguytools-2.0.5 .
- libfwnt{,‑devel,‑python,‑python3}-20180117-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python}-20180117-1.el6.x86_64.rpm, and libfwnt{,‑devel,‑python,‑python3}-20180117-1.el7.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
See here for the list of changes.
|
|
January 12, 2018:
The following changes have been made:
- libsmdev{,‑devel,‑python,‑python3,‑tools}-20171112-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python,‑tools}-20171112-1.el6.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python,‑python3,‑tools}-20171112-1.el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
See here for the list of changes.
- libfvde{,‑devel,‑python,‑python3,‑tools}-20180108-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm, libfvde{,‑devel,‑python,‑tools}-20180108-1.el6.{i686,x86_64}.rpm, and libfvde{,‑devel,‑python,‑python3,‑tools}-20180108-1.el7.x86_64.rpm -
Libfvde is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
- python-dfdatetime-20180110-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- libfplist{,‑devel}-20180108-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - Libfplist
is a library for plist formats.
Note: this is a library only - there are no tools provided by these packages.
- pfring-7.0.0-1684.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1684.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
January 5, 2018:
The following changes have been made:
- pfring-7.0.0-1677.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1677.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- python-dfdatetime-20171228-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- dfvfs-20171230-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- sleuthkit{,‑devel,‑libs}-4.5.0-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.4.2) released to this repository.
- pytsk3-20171108-2.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
- plaso-20171231-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and plaso-20171231-1.el7.x86_64.rpm -
Plaso is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 21, 22, 23, 24, 25, 26, and 27 for the i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
- analysis-pipeline-5.7-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.7-1.el7.x86_64.rpm -
The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes for this release.
- dd_rescue-1.99.8-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
See here for the changes since the last version (1.99.5) released to this repository.
- libodraw{,‑devel,‑tools}-20171105-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.{i686,x86_64}.rpm and libodraw{,‑devel,‑tools}-20171105-1.el6.{i686,x86_64}.rpm - Libodraw
is a library to access to optical disc (split) RAW image files (bin/cue, iso/cue).
- nDPI{,‑devel}-2.3-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
- radare2{,‑devel}-2.2.0-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and radare2{,‑devel}‑2.2.0‑1.el7.x86_64.rpm - Radare
is a framework for doing reverse engineering.
- valabind-0.10.0-4.el7.x86_64.rpm - Valabind is a tool to parse vala
or vapi files to transform them into swig interface files, C++,
NodeJS-ffi, or GIR.
With swig, you can create language bindings for any API written in vala or C with a vapi interface.
It can also generate bindings for C++.
This release was built for CentOS/RHEL 7 to build Python-Radare2 .
- python-radare2-2.1.0-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and python‑radare2‑2.2.0‑1.el7.x86_64.rpm- Python-Radare
are bindings that allow Radare to be used from Python.
- xplico-1.2.1-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
See here for the changes since the last version (1.2.0) released to this repository.
- yaf{,‑devel}-2.9.3-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and yaf{,‑devel}-2.9.3-1.el7.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
- Volatility-2.6-2.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i386,x86_64}.rpm and Volatility-2.6-2.el7.x86_64.rpm -
The Volatility Framework is a completely
open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
This version of Volatility is the official version of Volatility 2.6 that has been patched to January 2, 2018.
You can read about this version here
Since the Volatility-community-plugins contain the mimikatz plugin, that plugin is no longer packaged with Volatility.
- python{2,3}-ssdeep-3.2-1.{fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and python2-ssdeep-3.2-1.{el6,el7}.{i686,x86_64}.rpm - Python-SSDeep
is a Python wrapper for ssdeep by Jesse Kornblum, which is a library for computing context triggered piecewise hashes (CTPH).
Also called fuzzy hashes, CTPH can match inputs that have homologies.
Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length.
- Volatility-community-plugins-20180102-2.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm - The Volatility Community Plugins
is a collection of Volatility plugins written and maintained by authors in the forensics community.
Many of these are the result of the last 3 years of Volatility plugin contests, but some were just written for fun.
Either way, it's an entire arsenal of plugins that you can easily extend into your existing Volatility installation.
These plugins are installed in /usr/share/volatility/plugins/community/ and to use them you need to specify this location on the command line thusly:
volatility --plugins=/usr/share/volatility/plugins/community ...
Note: The following plugins were removed the el6: BartoszInglot, ESET_Browserhooks, LoicJaquemet, ThomasChopitea, TranVienHa, and YingLi.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.38.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-38.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.41.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-41.noarch.rpm - Support for the following kernels were added for
LiME:
- snort-2.9.11.1-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and snort-2.9.11.1-1.el7.x86_64.rpm -
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.11.1-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HttP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- snort-openappid-2.9.11.1-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.13-1.el7.x86_64.rpm -
This is the snort package built with the following additions:
To install snort-openappid on your system, you must first remove snort.
Here is an example:
if rpm -q --quiet snort; then sudo rpm -ev snort --nodeps; fi
sudo dnf install snort-openappid # On CentOS/RHEL, use yum instead of dnf
|
|
December 29, 2017:
The following changes have been made:
- pfring-7.0.0-1664.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1664.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.14.7-300 for FC27
- 4.14.8-300 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.14.7-300 for FC27
- 4.14.8-300 for FC27
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.22.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-22.noarch.rpm - Support for the following kernels were added for
LiME:
- dfvfs-20171228-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
|
|
December 21, 2017:
The following changes have been made:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.20.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-20.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.21.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-21.noarch.rpm - Support for the following kernels were added for
LiME:
- dfvfs-20171216-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- python{2,3}‑bencode-2.0.0-1.{fc22,fc23,fc24,fc25,fc26,fc27}.noarch.rpm -
Bencode re-packages the existing bencoding
and bdecoding implemention from the ‘official’ BitTorrent client as a separate, light-weight package for re-using them without having the entire BitTorrent software as a dependency.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- xlsxwriter-1.0.2-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and xlsxwriter-1.0.2-1.el7.x86_64.rpm -
XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.
XlsxWriter can be used to write text, numbers, formulas and hyperlinks to multiple worksheets and it supports features such as formatting and many more.
- pfring-7.0.0-1659.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1659.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
December 15, 2017:
The following changes have been made:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.19.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-19.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-7.0.0-1616.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1616.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
December 13, 2017:
The following changes have been made:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-7.0.0-1600.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1600.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- python-dfdatetime-20171129-1.{fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- yara-python-3.7.0-1.x86_64.el7.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in CentOS/RHEL 7.
|
|
December 8, 2017:
The following changes have been made:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.18.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-18.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.17.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-17.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.49.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-49.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.37.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-37.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-7.0.0-1592.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1592.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- dfvfs-20171203-1.{fc22,fc23,fc24,fc25,fc26,fc27,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
|
|
December 1, 2017:
The following changes have been made:
- pfring-7.0.0-1569.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1569.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.16.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-16.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.48.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-48.noarch.rpm - Support for the following kernels were added for
LiME:
- Fedora 21 - Updates to Fedora 21 for both
the i686 and x86_64 CPU architectures has ceased.
- ADIA - This item is the VMware and VirtualBox-based appliances built with CentOS 7 for the x86_64 architecture.
See here for more details.
The release consists of the following:
|
|
November 23, 2017:
The following changes have been made:
- Fedora 27 - The repository now supports Fedora 27
for the x86_64 and i386 CPU architectures.
Here is the list of tools provided for Fedora 27:
- lime-kernel-modules-1.1.r17-12.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 27 x86_64 and i386 architectures was added.
- fmem-kernel-modules-1.6-1.12.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 27 x86_64 and i386 architectures was added.
- snort-2.9.11-1.{fc21,fc22,fc23,fc24,fc25,fc26,fc27,el6}.{i686,x86_64}.rpm and snort-2.9.11.1-1.el7.x86_64.rpm -
Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks.
It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,
stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.
See here for the changes in this version.
- snort-sample-rules-2.9.11-1.{fc21,fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm - These rules are sample rules only and are intended to allow
snort to start successfully.
These rules only flag HttP traffic destined for port 80.
Please see the snort rules page to acquire a current set of snort rules.
- snort-openappid-2.9.11-1.{fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and snort-openappid-2.9.11-1.el7.x86_64.rpm -
This is the snort package built with the following additions:
Note: This version of snort is not yet avaiable for Fedora 26 or 27.
- snarf{,‑devel,‑python}-0.3.0-3.{fc21,fc22,fc23,fc24,fc25,fc26,fc27,el7}.{i686,x86_64}.rpm - Snarf is a distributed alert reporting system.
Applications can use snarf's C and Python APIs to construct and send network alert messages,
which can then be routed to multiple destinations in a configurable manner.
See here for the list of changes for this release.
This version uses zeromq3.
Note: due to the changing package requirements of snarf, there is no support for CentOS/RHEL 6.
- pfring-7.0.0-1560.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1560.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- python-dfdatetime-20170719-1.{fc21,fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- python-construct-2.5.2-1.{fc21,fc22,fc23,fc24,fc25,fc26,fc27,el6,el7}.noarch.rpm -
Python-construct is a powerful declarative parser (and builder) for binary data.
- dfvfs-20171022-1.{fc21,fc22,fc23,fc24,fc25,fc26,fc27,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- plaso-20171118-1.{fc21,fc22,fc23,fc24,fc25,fc26,fc27}.{i686,x86_64}.rpm and plaso-20171118-1.el7.x86_64.rpm -
Plaso is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 21, 22, 23, 24, 25, 26, and 27 for the i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
- fmem-kernel-modules-fc27-{i386,x86_64}-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.13.9-300 for FC27
- 4.13.13-300 for FC27
- lime-kernel-modules-fc27-{i386,x86_64}-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.13.9-300 for FC27
- 4.13.13-300 for FC27
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.15.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-15.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.47.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-47.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 17, 2017:
The following changes have been made:
- pfring-7.0.0-1557.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1557.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.46.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-46.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.14.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-14.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.40.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-40.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
November 10, 2017:
The following changes have been made:
- fmem-kernel-modules-fc26-{i386,x86_64}-1.6-1.13.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i386,x86_64}-1.1.r17-13.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-x86_64-1.6-1.12.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-x86_64-1.1.r17-12.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.45.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-45.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.44.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.13.8-100 for FC25
- 4.13.10-100 for FC25
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-44.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.13.8-100 for FC25
- 4.13.10-100 for FC25
- pfring-7.0.0-1535.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1535.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- libfwsi{,‑devel,‑python,‑python3}-20171103-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm libfwsi{,‑devel,‑python}-20171103-1.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python,‑python3}-20171103-1.el7.x86_64.rpm -
Libfwsi is a library to access the
Windows Shell Item format.
See here for the list of changes.
- liblnk{,‑devel,‑python,‑python3,‑tools}-20171101-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python,‑tools}-20171101-1.el6.{i686,x86_64}.rpm, abnd liblnk{,‑devel,‑python,‑python3,‑tools}-20171101-1.el7.x86_64.rpm -
Liblnk contains libraries and tools to access the
Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libsmdev{,‑devel,‑python,‑python3,‑tools}-20171105-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python,‑tools}-20171105-1.el6}.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python,‑python3,‑tools}-20171105-1.el7.x86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
See here for the list of changes.
- libsmraw{,‑devel,‑python,‑python3,‑tools}-20171105-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python,‑tools}-20171105-1.el6.{i686,x86_64}.rpm, and libsmraw{,‑devel,‑python,‑python3,‑tools}-20171105-1.el7.86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
Libsmraw contains supports for multiple (split) RAW naming schemes.
- artifacts‑20171107‑1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i386,x86_64}.rpm and artifacts‑20171107‑1.el7.x86_64.rpm -
Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
This package was built to support plaso.
- python-certifi-2016.9.26-2.{fc21,fc22,fc23,fc24,fc25,el7}.noarch.rpm - Certifi is a
carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.
This package was built to support plaso.
- python{2,3}-future-0.16.0-4.{fc21,fc22,fc23}.noarch.rpm - Future is
the missing compatibility layer between Python 2 and Python 3. It allows you to use a single, clean Python 3.x-compatible codebase to support both Python 2 and Python 3 with minimal overhead.
This package was built to support plaso.
- python{2,3}-idna-2.5-1.{fc21,fc22,fc23,el7}.noarch.rpm - IDNA provides
support for the Internationalised Domain Names in Applications (IDNA) protocol as specified in RFC 5891. This is the latest version of the protocol and is sometimes referred to as “IDNA 2008”.
This package was built to support plaso.
- python{2,3}-pefile-2017.5.26-2.{fc21,fc22,fc23,fc24}.noarch.rpm and python-pefile-2017.5.26-2.el7.noarch.rpm -
PEFile is a Portable Executable reader module.
This package was built to support plaso.
- plaso-20170930-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm and plaso-201709301-1.el7.x86_64.rpm -
Plaso is the Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines.
The goal of log2timeline (and thus plaso) is to provide a single tool that can parse various log files and forensic artifacts from computers
and related systems, such as network equipment to produce a single correlated timeline.
This timeline can then be easily analysed by forensic investigators/analysts, speeding up investigations by correlating the vast amount of information found on an average computer system.
See the release announcement here.
At this time, this repository, in combination of all supporting repositories, provides all of the necessary packages for Fedora versions 21, 22, 23, 24, 25, and 26 for i686 and x86_64
architectures and CentOS/RHEL version 7 for the x86_64 architecture for this version of plaso.
- libfixbuf{,‑devel}-1.8.0-1.{fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm - Libfixbuf
is a compliant implementation of the IPFIX Protocol, as defined in the "Specification of the IPFIX Protocol for the Export of IP Flow Information" (RFC 5101).
See here for the list of changes.
Libsmraw contains supports for multiple (split) RAW naming schemes.
- yaf{,‑devel}-2.9.2-1.{fc21,fc22,fc23,fc24,fc25,fc26,el6}.{i686,x86_64}.rpm and yaf{,‑devel}-2.9.2-1.el7.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
- analysis-pipeline-5.6-4.{fc21,fc22,fc23,fc24,fc25,fc26,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.6-4.el7.x86_64.rpm -
The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes for this release.
This package was rebuilt to use libfixbuf 1.8.0.
- libschemaTools{,‑devel}-1.2.1-2.{fc21,fc22,fc23,fc24,fc25,fc26,el6}.{i686,x86_64}.rpm and libschemaTools{,‑devel}-1.2.1-2.el7.x86_64.rpm -
libschemaTools is a library that provides a standard representation of data records.
It is built on fixbuf, using IPFIX information elements.
It describes data using schemas. Schemas are wrapped in "dataInfo" structures that provide ways to get the next record from the data source.
SchemaTools removes the need for the processing application to know the details of how to retrive data, and to know the structure of the records.
See here for the list of changes for this release.
This package was rebuilt to use libfixbuf 1.8.0.
- pyfixbuf-0.2.1-2.{fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm - Pyfixbuf
is a Python API for libfixbuf, an implementation of the
IPFIX protocol used for building, collecting, and exporting processes.
Pyfixbuf can be used to write applications, often called mediators, that collect and export IPFIX.
Mediators are useful in modifying, filtering, or adding to the contents of a message before forwarding to another
IPFIX collection point, or converting IPFIX to another format (text, database, JSON, etc.).
See this page for a list of problems fixed in this
and all releases.
This package was rebuilt to use libfixbuf 1.8.0.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.16.0-3.{fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
This package was rebuilt to use libfixbuf 1.8.0.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.16.0‑4.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.16.0‑4.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
This package was rebuilt to use libfixbuf 1.8.0.
- super_mediator-1.5.3-2.{fc21,fc22,fc23,fc24,fc25,fc26,el6}.{i686,x86_64}.rpm and super_mediator-1.5.3-2.el7.x86_64.rpm -
Super_mediator is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the list of changes for this release.
This package was rebuilt to use libfixbuf 1.8.0.
|
|
October 27, 2017:
The following changes have been made:
- yaf{,‑devel,‑common}-2.9.0-1.{fc21,fc22,fc23,fc24,fc25,fc26,el6}.{i686,x86_64}.rpm and yaf{,‑devel,‑common}-2.9.0-1.el7.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
Yaf is used as a sensor to capture flow information on a network and export that information in IPFIX format.
It reads packet data from pcap(3) dumpfiles as generated by tcpdump(1), from live capture from an interface using
pcap(3), an Endace DAG capture device,
or a Napatech adapter, aggregates these packets into flows, and exports flow records via IPFIX
over SCTP, TCP or
UDP, Spread, or into serialized IPFIX message streams (IPFIX files) on the local file system.
See here for the changes since the last released version (2.8.4).
- fmem-kernel-modules-el7-x86_64-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
- super_mediator-1.5.3-1.{fc21,fc22,fc23,fc24,fc25,fc26,el6}.{i686,x86_64}.rpm and super_mediator-1.5.3-1.el7.x86_64.rpm -
Super_mediator
is an IPFIX mediator for use with the YAF
and SiLK tools.
It collects and filters YAF output data to various IPFIX collecting processes and/or csv files.
Super_mediator can be configured to perform de-duplication of DNS resource records as exported by YAF.
See here for the list of changes for this release.
- pfring-7.0.0-1513.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1513.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
October 22, 2017:
The following changes have been made:
- pfring-7.0.0-1506.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-7.0.0-1506.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- yaf{,‑devel}-2.8.4-3.{el6,el7}.x86_64.rpm -
Yaf is Yet Another Flowmeter and yaf is a suite of tools to do flow metering.
This package has been rebuilt for a new version of pf_ring.
To install PF_Ring on your CentOS/RHEL system, please follow the directions found here.
|
|
October 20, 2017:
The following changes have been made:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.39.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-39.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-6.6.0-1459.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1459.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.43.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-43.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i686,x86_64}-1.6-1.11.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i686,x86_64}-1.1.r17-11.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
October 6, 2017:
The following changes have been made:
- libbde{,‑devel,‑python,‑python3,‑tools}-20170902-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libbde{,‑devel,‑python,‑tools}-20170902-1.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python,‑python3,‑tools}-20170902-1.el7.x86_64.rpm -
Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
- libolecf{,‑devel,‑python,‑python3,‑tools}-20170825-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python,‑tools}-20170825-1.el6.{i686,x86_64}.rpm, and libolecf{,‑devel,‑python,‑python3,‑tools}-20170825-1.el7.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
- libvshadow{,‑devel,‑python,‑python3,‑tools}-20170902-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python,‑tools}-20170902-1.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python,‑python3,‑tools}-20170902-1.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
This version uses the external version of libbfio to support
DFF, the Digital Forensics Framework.
- pyparsing{,‑doc}-2.2.0-1.{el6,el7}.noarch.rpm and python3-pyparsing-2.2.0-1.el7.noarch.rpm - Pyparsing is a module that provides an alternative approach to creating and executing simple grammars,
vs. the traditional lex/yacc approach, or the use of regular expressions.
The pyparsing module provides a library of classes that client code uses to construct the grammar directly in Python code.
Pyparsing is provided by RedHat for Fedora 21.
Pyparsing is needed by plaso.
- sleuthkit{,‑devel,‑libs}-4.4.2-1.{fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.4.1) released to this repository.
- libfvde{,‑devel,‑python,‑python3,‑tools}-20170930-1.{fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libfvde{,‑devel,‑python,‑tools}-20170930-1.el6.{i686,x86_64}.rpm, and libfvde{,‑devel,‑python,‑python3,‑tools}-20170930-1.el7.x86_64.rpm -
Libfvde
is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.
The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.42.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-42.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc26-{i686,x86_64}-1.6-1.10.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i686,x86_64}-1.1.r17-10.noarch.rpm - Support for the following kernels were added for
LiME:
- guymager-0.8.7-1.{fc21,fc22,fc23,fc24,fc25,fc26,el6}.{i686,x86_64}.rpm and guymager-0.8.7-1.el7.x86_64.rpm -
Guymager is a forensic imaging package.
See here for the list of changes.
|
|
September 29, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.41.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-41.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-6.6.0-1435.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1435.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- xplico-1.2.0-3.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el7}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
This version adds the missing documetation file /usr/share/doc/xplico-1.2.0/README.md .
- fmem-kernel-modules-fc26-{i686,x86_64}-1.6-1.9.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i686,x86_64}-1.1.r17-9.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.38.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-38.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 22, 2017:
The following changes have been made:
- fmem-kernel-modules-fc26-{i686,x86_64}-1.6-1.8.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.12.13-300 for FC26
- 4.12.12-300 for FC26
- lime-kernel-modules-fc26-{i686,x86_64}-1.1.r17-8.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.12.13-300 for FC26
- 4.12.12-300 for FC26
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.37.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-37.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 15, 2017:
The following changes have been made:
- fmem-kernel-modules-el7-x86_64-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-693.2.2 for EL7
- 3.10.0-693.2.1 for EL7
- 3.10.0-693.1.1 for EL7
- 3.10.0-693 for EL7
- lime-kernel-modules-el7-x86_64-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-693.2.2 for EL7
- 3.10.0-693.2.1 for EL7
- 3.10.0-693.1.1 for EL7
- 3.10.0-693 for EL7
- fmem-kernel-modules-fc26-{i686,x86_64}-1.6-1.7.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i686,x86_64}-1.1.r17-7.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.40.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-40.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
September 8, 2017:
The following changes have been made:
- snarf{,‑devel,‑python}-0.2.4-2.el6.{i686,x86_64}.rpm - Snarf is a distributed alert reporting system.
Applications can use snarf's C and Python APIs to construct and send network alert messages,
which can then be routed to multiple destinations in a configurable manner.
This version was rebuilt for CentOS/RHEL 6 to solve a dependency problem.
- fmem-kernel-modules-fc26-{i686,x86_64}-1.6-1.6.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i686,x86_64}-1.1.r17-6.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.39.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-39.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-6.6.0-1401.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1401.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
September 1, 2017:
The following changes have been made:
- pfring-6.6.0-1396.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1396.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
August 25, 2017:
The following changes have been made:
- fmem-kernel-modules-fc26-{i686,x86_64}-1.6-1.5.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i686,x86_64}-1.1.r17-5.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.38.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-38.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 18, 2017:
The following changes have been made:
- fmem-kernel-modules-fc26-{i686,x86_64}-1.6-1.4.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-{i686,x86_64}-1.1.r17-4.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
August 11, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.37.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-37.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.47.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-47.noarch.rpm - Support for the following kernels were added for
LiME:
- yara-python-3.6.3-1.{i386,x86_64}.{el6,el7}.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in CentOS/RHEL 6 and 7.
- artifacts‑20170727.‑1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26}.{i386,x86_64}.rpm and artifacts‑8209;20170727‑1.el7.x86_64.rpm -
Artifacts is a free,
community-sourced, machine-readable knowledge base of forensic artifacts that the world can use both as an information source and within other tools.
This package was built to support plaso.
- binplist-0.1.5-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm - Binplist is a binary property list (plist) parser module written in python.
- python-dfdatetime-20170719-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.noarch.rpm -
dfDateTime,
or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.
- dfvfs-20170723-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- libfsntfs{,‑devel,‑python,‑python3,‑tools}-20170315-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm, libfsntfs{,‑devel,‑python,‑tools}-20170315-1.el6.{i686,x86_64}.rpm, and libfsntfs{,‑devel,‑python,‑python3,‑tools}-20170315-1.el7.x86_64.rpm -
Libfsntfs contains library and tools to access the New Technology File System (NTFS).
See here for the list of changes.
- libfwnt{,‑devel,‑python,‑python3}-20170115-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libfwnt{,‑devel,‑python}-20170115-1.el6.x86_64.rpm, libfwnt{,‑devel,‑python,‑python3}-20170115-1.el7.x86_64.rpm -
LibFWNT, is a library for Windows NT data types.
See here for the list of changes.
This package is needed by dfvfs and plaso.
- libpst{,‑devel,‑devel-doc,‑doc,‑libs,‑python}-0.6.71-1.1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm - The libpst
utilities convert Outlook .pst files to other formats.
See here for the list of changes.
- libscca{,‑devel,‑python,‑python3,‑tools}-20170205-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm, libscca{,‑devel,‑python,‑tools}-20170205-1.el6.x86_64.rpm, and libscca{,‑devel,‑python,‑python3,‑tools}-20170205-1.el7.x86_64.rpm -
Libscca is a library to access the Windows Prefetch File (SCCA) format.
See here for the list of changes.
- libsmraw{,‑devel,‑python,‑python3,‑tools}-20170803-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libsmraw{,‑devel,‑python,‑tools}-20170803-1.el6.{i686,x86_64}.rpm, and libsmraw{,‑devel,‑python,‑python3,‑tools}-20170803-1.el7.x86_64.rpm -
Libsmraw is a library and tools used to read and write (split) RAW storage media bitstream copies.
Libsmraw contains supports for multiple (split) RAW naming schemes.
- libvshadow{,‑devel,‑python,‑python3,‑tools}-20170715-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm, libvshadow{,‑devel,‑python,‑tools}-20170715-1.el6.{i686,x86_64}.rpm, and libvshadow{,‑devel,‑python,‑python3,‑tools}-20170715-1.el7.x86_64.rpm -
Libvshadow is a library and tools used to support the Volume Service Snapshot (VSS) format.
The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.
This version uses the external version of libbfio to support
DFF, the Digital Forensics Framework.
- libwrc{,‑devel,‑python,‑python3,‑tools}-20170304-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el7}.{i686,x86_64}.rpm and libwrc{,‑devel,‑python,‑tools}-20170304-1.el6.{i686,x86_64}.rpm - Libwrc
is a library and tools to access the Windows Resource Compiler (WRC) format.
- epub-0.5.2-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i386,x86_64}.rpm - Epub is the distribution and interchange format
standard for digital publications and documents based on Web Standards. Epub defines a method for representing, packaging, and encoding structured and semantically enhanced
web content - including XHTML, CSS, SVG, images, and other resources - for distribution in a single-file format.
Epub allows publishers to produce and send a single digital publication file through distribution and offers interoperability between consumers
software / hardware for unencrypted reflowable digital books and other publications.
Epub is a helper application for recoll.
- ghostpdl-9.21-1.{fc20,fc21,fc22,fc23.f24,fc25,fc26,el6}.{i686,x86_64}.rpm and ghostpdl-9.21-1.el7.x86_64.rpm -
Ghostpdl is Artifex Software's implementation of the PCL-5™ and PCL-XL™ family of page description languages.
Ghostpdl is used by Xplico.
- nDPI{,‑devel}-2.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
- xplico-1.2.0-3.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el7}.{i686,x86_64}.rpm - xplico is an Internet traffic decoder.
This version was recompiled for nDPI-2.0 and add python3.6 list of valid Python executables.
- perl-File-Mork-0.4-1.{fc20,fc21,fc22,fc23.f24,fc25,fc26,el6,el7}.noarch.rpm - perl-File-Mork
is a module to read Mozilla URL history files.
- perl-Mac-PropertyList-1.412-1{fc20,fc21,fc22,fc23.f24,fc25,fc26,el7}.noarch.rpm - perl-Mac-PropertyList
is a low-level interface to the Mac OS X Property List (plist) format.
See here for the list of changes
- perl-Alien-wxWidgets-0.67-6.el7.x86_64.rpm - perl-Alien-wxWudgets
can be used to detect and get configuration settings from an installed wxWidgets.
- perl-Wx-0.9928-3.el7.x86_64.rpm - perl-Wx
is a wrapper for the wxWidgets (formerly known as wxWindows) GUI toolkit.
This module comes with extensive documentation in HTML format; you can download it from http://wxperl.sourceforge.net.
- perl-Parse-Win32Registry-1.0-1.{fc20,fc21,fc22,fc23.f24,fc25,fc26,el6,el7}.noarch.rpm - perl-Parse-Win32Registry
is a module for parsing Windows Registry files, allowing you to read the keys and values of a registry file without going through the Windows API.
It provides an object-oriented interface to the keys and values in a registry file.
Registry files are structured as trees of keys, with each key containing further subkeys or values.
The module is intended to be cross-platform, and run on those platforms where Perl will run.
It supports both Windows NT registry files (Windows NT, 2000, XP, 2003, Vista, 7) and Windows 95 registry files (Windows 95, 98, Millennium Edition).
It is intended to be used to parse offline registry files.
If a registry file is currently in use, you will not be able to open it.
However, you can save part or all of a currently loaded registry file using the Windows reg command if you have the appropriate administrative access.
- pfring-6.6.0-1377.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1377.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- python-apsw-3.19.3-1.{fc20,fc21,fc22,fc23.f24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm - Python-apsw
is a Python wrapper for the SQLite embedded relational database engine.
In contrast to other wrappers such as pysqlite
it focuses on being a minimal layer over SQLite attempting just to translate the complete SQLite API into Python.
The documentation has a section on the differences between APSW and pysqlite.
See here for a list of the changes.
- python-haystack-0.42-1.{fc20,fc21,fc22,fc23.f24,fc25,fc26,el6,el7.}noarch.rpm - Python-Haystack
is an heap analysis framework, focused on searching and reversing of C structure in allcoated memory.
- python-rarfile-3.0-1.{fc20,fc21,fc22,fc213,fc24,fc25,fc26,el6,el7}.{i686,x86_64}.rpm - Python-rarfile is a
Python module for RAR archive reading.
See here for the list of changes since the last release version (2.6);
- regripper-plugins-20170809-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26,el6,el7}.noarch.rpm - Regripper-plugins
are the plugins packaged separately from the regripper application.
This package is taken from the plugins directory at the Github source code site as of 2017-08-09.
- radare{,‑devel}-2.1.6.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm and radare{,‑devel}‑2.1.6.0‑1.el7.x86_64.rpm - Radare
is a framework for doing reverse engineering.
- python-radare-2.1.6.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,fc26}.{i686,x86_64}.rpm and python‑radare‑2.1.6.0‑1.el7.x86_64.rpm- Python-Radare
are bindings that allow Radare to be used from Python.
- rifiuti2-0.6.1-1.{fc20,fc21,fc22,fc213,fc24,fc25,fc26,el6}.{i686,x86_64}.rpm and rifiuti2-0.6.1-1.el7.x86_64.rpm -
rifiuti2 is a rewrite of rifiuti, a tool for analyzing Windows Recycle Bin INFO2 file.
|
|
July 27, 2017:
The following changes have been made:
- Fedora 26 - The repository now supports Fedora 26
for the i386 CPU architecture.
Support for the x86_64 architecture was previously announced.
Here is the list of tools provided for Fedora 26:
- lime-kernel-modules-1.1.r17-11.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 26 i386 architecture was added.
- fmem-kernel-modules-1.6-1.11.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 26 i386 architecture was added.
|
|
July 26, 2017:
The following changes have been made:
- fmem-kernel-modules-fc26-x86_64-1.6-1.3.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-x86_64-1.1.r17-3.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.36.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-36.noarch.rpm - Support for the following kernels were added for
LiME:
- yara-python-3.6.3-1.{fc24,fc25}.x86_64.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in Fedora 24 and 25.
- pfring-6.6.0-1372.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1372.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
|
|
July 21, 2017:
The following changes have been made:
- Fedora 26 - The repository now supports Fedora 26
for the x86_64 CPU architecture only.
Here is the list of tools provided for Fedora 26:
- lime-kernel-modules-1.1.r17-10.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for LiME.
Support for Fedora 26 x86_64 architecture was added.
- fmem-kernel-modules-1.6-1.10.noarch.rpm - This is a meta-package that requires all of the supporting kernel objects for Fmem.
Support for Fedora 26 x86_64 architecture was added.
- fmem-kernel-modules-fc26-x86_64-1.6-1.2.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc26-x86_64-1.1.r17-2.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.46.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-46.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-6.6.0-1353.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1353.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- CERT-Forensics-Tools-1.0-75.fc26.{i686,x86_64}.rpm -
This package was updated not install tools that are only OpenSSL 1.0 compliant,
namely aimage, bloom, bulk_extractor, bulk_extractor-stoplist, and frag_find.
|
|
July 14, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.44.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-44.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.35.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-35.noarch.rpm - Support for the following kernels were added for
LiME:
- libfsext{,‑devel,‑python,‑python3,‑tools}-20170624-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libfsext{,‑devel,‑python,‑tools}-20170624-1.el6.{i686,x86_64}.rpm - Libfsext
is a lbrary and tools to access the Extended File System (EXT).
Note that this project currently only focuses on the analysis of the format.
- libfshfs{,‑devel,‑python,‑python3,‑tools}-20170626-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libfshfs{,‑devel,‑python,‑tools}-20170626-1.el6.{i686,x86_64}.rpm - Libfshfs
is a lbrary and tools to access the Hierarchical File System (HFS).
Note that this project currently only focuses on the analysis of the format.
- libhibr{,‑devel,‑tools}-20170530-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libhibr{,‑devel,‑tools}-20170530-1.el6.{i686,x86_64}.rpm - libhibr
is a lbrary and tools to access the Windows Hibernation File (hiberfil.sys) format.
Note that this project currently only focuses on the analysis of the format.
- libmdmp{,‑devel,‑tools}-20170522-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libmdmp{,‑devel,‑tools}-20170522-1.el6.{i686,x86_64}.rpm - Libmdmp
is a library to access the Windows Minidump (MDMP) format.
Note that this project currently only focuses on the analysis of the format.
- libmodi{,‑devel,‑python,‑python3,‑tools}-20170527-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm, libmodi{,‑devel,‑python,‑tools}-20170527-1.el6.{i686,x86_64}.rpm, and libmodi{,‑devel,‑python,‑python3,‑tools}-20170527-1.el7.x86_64.rpm -
Libmodi is a lbrary and tools to access the Mac OS disk image formats.
- libnk2{,‑devel,‑python,‑python3,‑tools}-20170527-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libnk2{,‑devel,‑python,‑tools}-20170527-1.el6.{i686,x86_64}.rpm - Libnk2
is a lbrary and tools to access Microsoft Outlook Nickfile (NK2) format files.
- libodraw{,‑devel,‑tools}-20170217-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libodraw{,‑devel,‑tools}-20170217-1.el6.{i686,x86_64}.rpm - Libodraw
is a library to access to optical disc (split) RAW image files (bin/cue, iso/cue).
- libphdi{,‑devel,‑python,‑python3,‑tools}-20170529-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libphdi{,‑devel,‑python,‑tools}-20170529-1.el6.{i686,x86_64}.rpm, and libphdi{,‑devel,‑python,‑python3,‑tools}-20170529-1.el7.x86_64.rpm -
Libphdi is a library to access the Parallels Hard Disk image format.
- libexe{,‑devel,‑python,‑python3,‑tools}-20170123-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libexe{,‑devel,‑python,‑tools}-20170123-1.el6.{i686,x86_64}.rpm, and libexe{,‑devel,‑python,‑python3,‑tools}-20170123-1.el7.x86_64.rpm -
Libexe is a library and tools to access the executable (EXE) format.
- libwtcdb{,‑devel,‑tools}-20170201-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm libwtcdb{,‑devel,‑tools}-20170201-1.el6.{i686,x86_64}.rpm - Libwtcdb
is a library and tools to access the Windows (Vista/7) Explorer thumbnail cache database format (thumbcache.db).
- libfplist{,‑devel}-20170112-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Libfplist
is a library for plist formats.
Note: this is a library only - there are no tools provided by these packages.
- libfwevt{,‑devel}-20170114-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Libfwevt
is a library for Windows XML Event Log (EVTX) data types.
Note: this is a library only - there are no tools provided by these packages.
- libagdb{,‑devel,‑tools}-20170201-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Libagdb
is a library to access the SuperFetch database format.
- libcreg{,‑devel,‑python,‑python3,‑tools}-20170119-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libcreg{,‑devel,‑python,‑tools}-20170119-1.el6.{i686,x86_64}.rpm - Libcreg
is a library and tools to access the Windows 9x/Me Registry File (CREG) format.
- libvsmbr{,‑devel,‑tools}-20170525-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Libvsmbr
is a library and tools to access the Master Boot Record (MBR) volume system.
- libwrc{,‑devel,‑python,‑python3,‑tools}-20160419-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i686,x86_64}.rpm and libwrc{,‑devel,‑python,‑tools}-20160419-1.el6.{i686,x86_64}.rpm - Libwrc
is a library and tools to access the Windows Resource Compiler (WRC) format.
- winevt-kb-20170527-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and winevt-kb-20170527-1.el7.x86_64.rpm -
Winevt-kb is a project to build a Windows Event Log knowledge base.
winevtrc is the Python module part of winevt-kb to allow reuse of Windows Event Log resources.
See this resource for an explanation of the scripts included with this package - export.py, extract.py, query.py - and how to use them.
Note that winevt-kb is not available for CentOS/RHEL 6 because of the old version of Python 2.
- dtfabric-20170630-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and dtfabric-20170630-1.el7.x86_64.rpm -
Dtfabric
is a project to manage data types and structures, as used in the libyal projects.
- winreg-kb-20170525-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and winreg-kb-20170525-1.el7.x86_64.rpm -
Winreg-kb-kb winreg-kb is a project to build a Windows Registry Knowledge Base.
winregrc is a Python module part of winreg-kb to allow reuse of Windows Registry Resources.
See these scripts that make use of package.
Note that winreg-kb is not available for CentOS/RHEL 6 because of the old version of Python 2.
- dfwinreg-20170706-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and dfwinreg-20170706-1.{el6,el7}.x86_64.rpm -
DFWinreg, or Digital Forensics Windows Registry, provides read-only access to Windows Registry objects.
The goal of dfWinReg is to provide a generic interface for accessing Windows Registry objects that resembles the Registry key hierarchy as seen on a live Windows system.
- CERT-Forensics-Tools-1.0-74.{fc20,fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-74.el7.x86_64.rpm -
This package was updated as follows:
- libagdb-tools
- libcreg-tools
- libexe-tools
- libfsext-tools
- libfshfs-tools
- libhibr-tools
- libmdmp-tools
- libmodi-tools
- libnk2-tools
- libodraw-tools
- libphdi-tools
- libvsmbr-tools
- libwrc-tools
- libwtcdb-tools
- winevt-kb (not for CentOS/RHEL 6)
- winreg-kb (not for CentOS/RHEL 6)
- pfring-6.6.0-1334.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1334.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- yara-python-3.6.2-1.{fc24,fc25}.x86_64.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in Fedora 24 and 25.
|
|
June 30, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.43.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-43.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.16.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.16.0‑2.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.16.0‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- silk-ipset-{devel,lib,tools}-3.16.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
- analysis-pipeline-5.6-3.{fc20,fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.6-3.el7.86_64.rpm -
The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes for this release.
This package was rebuilt to use silk 3.16.0.
|
|
June 26, 2017:
The following changes have been made:
- partclone-0.3.6-2.el7.x86_64.rpm and partclone-0.3.6-2.el6.{i386,x86_64}.rpm- Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), exfat, xfs, vmfs3 and vmfs5.
See the /usr/share/doc/partclone/ChangeLog for the list of changes in this release.
This version was rebuilt because of an update to ntfs-3g in EL6 and EL7.
- testdisk-7.0-4.1.el6.{i686,x86_64}.rpm and qphotorec-7.0-4.1.el6.{i386,x86_64}.rpm - Testdisk is powerful free
data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused
by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a
file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo
Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file
system has been severely damaged or reformatted.
These releases were built to use the latest version of libewf that is installed in this repository.
|
|
June 23, 2017:
The following changes have been made:
- fmem-kernel-modules-el7-x86_64-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.34.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-34.noarch.rpm - Support for the following kernels were added for
LiME:
|
|
June 20, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.11.5-200 for FC25
- 4.11.4-200 for FC25
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.11.5-200 for FC25
- 4.11.4-200 for FC25
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.42.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.11.5-100 for FC24
- 4.11.4-100 for FC24
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-42.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.11.5-100 for FC24
- 4.11.4-100 for FC24
- yara-python-3.6.0-1.{fc24,fc25}.x86_64.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of an update to yara in Fedora 24 and 25.
- partclone-0.3.6-2.{fc24,fc25}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), exfat, xfs, vmfs3 and vmfs5.
See the /usr/share/doc/partclone/ChangeLog for the list of changes in this release.
This version was rebuilt because of an update to ntfs-3g in Fedora 24 and 25.
|
|
June 19, 2017:
The following changes have been made:
- yara-python-3.6.0-1.el7.x86_64.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
This version was rebuilt because of the update to yara in EPEL for CentOS/RHEL 7.
|
|
June 14, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.29.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-29.noarch.rpm - Support for the following kernels were added for
LiME:
- partclone-0.3.6-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), exfat, xfs, vmfs3 and vmfs5.
See the /usr/share/doc/partclone/ChangeLog for the list of changes in this release.
- exfat-utils-1.2.7-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The EXfat-utils are a set of utilities
for creating, checking, dumping and labeling exFAT file systems.
See here for the list of changes since the last released version (1.2.3).
- xmount-0.7.5-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Xmount
is a tool that allows you to convert on-the-fly between multiple input and output harddisk image types. The changes in this version are the following:
Here are the changes for this version:
- New for version 0.7.5
- Improved and fixed the way fsname is built.
- Added a patch fixing a bug in libxmount_input_aewf (supplied by Guy Voncken)
- New for version 0.7.4
- Re-enabled full OSx support
- libxmount_input_aewf input library is now able to decompress EWF chunks in parallel, which will increase read speed
- sleuthkit{,‑devel,‑libs}-4.4.1-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.4.0) released to this repository.
|
|
June 2, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.28.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-28.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.27.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-27.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.41.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-41.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.33.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-33.noarch.rpm - Support for the following kernels were added for
LiME:
- lime-kernel-modules-common-1.1.r17-4.noarch.rpm - LiME is a
Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android.
This package contains only the source code for making the LiME kernel modules, the CaptureMemoryWithLime script and the corresponding manual page.
This package also obsoletes tie lime-kernel-objects package which contained the source code and all of the kernel objects.
This repackaging increases the number of packages but decreases their size.
This revision fixes a problem that resulted from the release of the
4.11 kernel for Linux.
Note: this RPM is hard-linked between all of the supported architectures, Fedora 20-25 and CentOS 6 and 7
If you use rsync, make certain that you use the -H option to preserve those hard links.
|
|
May 26, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.26.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-26.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.40.noarch.rpm - Support for the following kernels were added for
Fmem:
- 4.10.15-100 for FC24
- 4.10.16-100 for FC24
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-40.noarch.rpm - Support for the following kernels were added for
LiME:
- 4.10.15-100 for FC24
- 4.10.16-100 for FC24
- fmem-kernel-modules-el7-x86_64-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el7-x86_64-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- jansson{,‑devel}-2.9-1.el7.x86_64.rpm and jansson-devel-doc-2.9-1.el7.noarch.rpm - Jansson
is a C library for encoding, decoding and manipulating JSON data. It features:
- Simple and intuitive API and data model
- Comprehensive documentation
- No dependencies on other libraries
- Full Unicode support (UTF-8)
- Extensive test suite
This tool was built to be used by yara-python.
- yara{,‑doc,‑devel}-3.5.0-7.1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Yara scans the given FILE or
the process indentified by PID looking if it matches the patterns and rules provided in a special purpose language. The rules are read from RULEFILEs or standard input.
Note that the -devel and -doc packages split out the files needed for development and documentation respectively.
- yara-python-3.5.0-7.1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Yara-python
is a Python extension that gives access to Yara's powerful features from Python scripts.
- dislocker{,‑libs}-0.7.1-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm and fuse-dislocker-0.7.1-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm -
Dislocker reads BitLocker encrypted partitions under a Linux system.
The driver has the capability to read/write on:
- Windows Vista, 7, 8, 8.1 and 10 encrypted partitions - that's AES-CBC, AES-XTS, 128 or 256 bits, with or without the Elephant diffuser, encrypted partitions;
- BitLocker-To-Go encrypted partitions - that's USB/FAT32 partitions.
The core driver is composed of a library, with multiple binaries (see the NOTES section below) using this library.
Two binaries are of interest when wanting to decrypt a BitLocker encrypted partition:
- dislocker-fuse: binary using FUSE to dynamically decrypt the BitLocker-ed partition.
You have to give it a mount point where, once keys are decrypted, a file named dislocker-file appears.
This file is a virtual NTFS partition, so you can mount it as any NTFS partition and then read from or write to it.
Note that writing to the NTFS virtual file will change the underlying BitLocker partition's content.
- dislocker-file: binary decrypting a BitLocker encrypted partition into a flat file.
This file has to be given through command line and, once dislocker-file is finished, will be an NTFS partition.
It won't have any link to the original BitLocker partition.
Therefore, if you write to this file, the BitLocker volume won't change, only the NTFS file will.
Note that this may take a long time to create that file, depending on the size of the encrypted partition.
But afterward, once the partition is decrypted, the access to the NTFS partition will be faster.
Another thing to think about is the size on your disk this binary needs: the same size as the volume you're trying to decrypt.
Nevertheless, once the partition is decrypted, you can mount your file as any NTFS partition.
- CERT-Forensics-Tools-1.0-73.{fc20,fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-73.el7.x86_64.rpm -
This package was updated as follows:
- The dislocker suite was added for all supported systems.
|
|
May 19, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.25.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-25.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.39.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-39.noarch.rpm - Support for the following kernels were added for
LiME:
- pfring-6.6.0-1231.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package contains header files and libraries, among other files, to support the PF_Ring network socket.
- pfring-dkms-6.6.0-1231.{el6,el7}.x86_64.rpm - PF_Ring is a new type of network socket that dramatically
improves the packet capture speed.
This package conains the code and supporting files needed to create the PF_Ring kernel module.
- aeskeyfind-1.0-3.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Aeskeyfind
illustrates automatic techniques for locating 128-bit and 256-bit AES keys in a captured memory image.
The program uses various algorithms and also performs a simple entropy test to filter out blocks that are not keys.
It counts the number of repeated bytes and skips blocks that have too many repeats.
This method works even if several bits of the key schedule have been corrupted due to memory decay.
This package is useful to several activities, as forensics investigations.
- CERT-Forensics-Tools-1.0-72.{fc20,fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-72.el7.x86_64.rpm -
This package was updated as follows:
- The package aeskeyfind was added for all supported systems.
|
|
May 8, 2017:
The following changes have been made:
- nDPI{,‑devel}-1.8-3.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
This version eliminates a dependency for CentOS/RHEL 6 for the x86_64 architecture.
The other revisions for all other systems and architectures are to maintain revision compatibility.
|
|
April 28, 2017:
The following changes have been made:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.24.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-24.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc25-{i686,x86_64}-1.6-1.23.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc25-{i686,x86_64}-1.1.r17-23.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.38.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-38.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-fc24-{i686,x86_64}-1.6-1.37.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-fc24-{i686,x86_64}-1.1.r17-37.noarch.rpm - Support for the following kernels were added for
LiME:
- fmem-kernel-modules-el7-x86_64-1.6-1.30.noarch.rpm - Support for the following kernels were added for
Fmem:
- 3.10.0-514.16.1 for EL&
- 3.10.0-514.10.2 for EL7
- lime-kernel-modules-el7-x86_64-1.1.r17-30.noarch.rpm - Support for the following kernels were added for
LiME:
- 3.10.0-514.16.1 for EL&
- 3.10.0-514.10.2 for EL7
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.32.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-32.noarch.rpm - Support for the following kernels were added for
LiME:
- libvslvm{,‑devel,‑python,‑python3,‑tools}-20160110-2.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libvslvm{,‑devel,‑python,‑tools}-20160110-2.el6.{i686,x86_64}.rpm, and libvslvm{,‑devel,‑python,‑python3,‑tools}-20160110-2.el7.x86_64.rpm -
Libvslvm is a library and tools to access the Linux Logical Volume Manager (LVM) volume system format.
This release added the missing FUSE dependencies.
- CERT-Forensics-Tools-1.0-71.{fc20,fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and CERT-Forensics-Tools-1.0-71.el7.x86_64.rpm -
This package was updated as follows:
- The package libvslvm-tools was added for all supported systems.
|
|
April 13, 2017:
The following changes have been made:
- fmem-kernel-modules-el6-{i686,x86_64}-1.6-1.31.noarch.rpm - Support for the following kernels were added for
Fmem:
- lime-kernel-modules-el6-{i686,x86_64}-1.1.r17-31.noarch.rpm - Support for the following kernels were added for
LiME:
- Volatility-community-plugins-20170405-2.fc25.noarch.rpm - The Volatility Community Plugins for Fedora 25 had
an incorrect dependency which has been fixed.
|
|
April 7, 2017:
The following changes have been made:
- sleuthkit{,‑devel,‑libs}-4.4.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The Sleuth Kit (TSK) is a
library and collection of command line tools that allow you to investigate volume and file system data.
See here for the changes since the last version (4.3.0) released to this repository.
- pytsk3-20170324-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.{i386,x86_64}.rpm - Pytsk
is Python bindings for The Sleuth Kit.
- ddrescue-1.22-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Ddrescue
is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.
See here for the changes since the last version (1.21) released to this repository.
- ddrutility-2.8-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Ddrutility is meant to be a compliment to
gnuddrescue.
It is a set of utilities to help with hard drive data rescue. It currently contains the following utilities:
- ddru_findbad
- ddru_ntfsbitmap
- ddru_ntfsfindbad
- ddru_diskutility
- ddru_diskutility
See here for the list of changes in this release.
- dd_rescue-1.99.5-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Dd_rescue
is a utility similar to the system utility dd which copies data from a file or block device to another. dd_rescue. does however
not abort on errors in the input file. This makes it suitable for rescuing data from media with errors, e.g. a disk with bad sectors.
See here for the changes since the last version (1.99) released to this repository.
- dc3dd-7.2.646-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i386,x86_64}.rpm - dc3dd is a patched version of GNU dd that
includes several features useful for computer forensics.
- guymager-0.8.4-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and guymager-0.8.4-1.el7.x86_64.rpm -
Guymager is a forensic imaging package.
See here for the list of changes.
- dfvfs-20170324-1.{fc20,fc21,fc22,fc23,fc24,fc25,el7}.noarch.rpm - dfVFS,
the Digital Forensics Virtual File System, provides read-only access to file-system objects from various storage media types and file formats.
The goal of dfVFS is to provide a generic interface for accessing file-system objects, for which it uses several
back-ends that provide the actual implementation of the various storage media types, volume systems and file systems.
- libbde{,‑devel,‑python,‑python3,‑tools}-20170204-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libbde{,‑devel,‑python,‑tools}-20170204-1.el6.{i686,x86_64}.rpm, and libbde{,‑devel,‑python,‑python3,‑tools}-20170204-1.el7.x86_64.rpm -
Libbde
is a library and tools to access the BitLocker Drive Encryption (BDE) format.
The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.
See here for the list of changes.
- libbfio,{-devel}-20170123-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i386,x86_64}.rpm - Libbfio is a
library that provides basic file input/output abstraction. Libbfio is used in multiple other libraries like libewf, libmsiecf, libnk2, libolecf and libpff.
It is used to chain I/O to support file-in-file access.
See here for the list of changes.
- libesedb{,‑devel,‑python,‑python3,‑tools}-20170121-1.{fc20,fc21,fc22,fc23,fc24}.{i686,x86_64}.rpm, libesedb{,‑devel,‑python,‑tools}-20170121-1.el6.{i686,x86_64}.rpm, and libesedb{,‑devel,‑python,‑python3,‑tools}-20170121-1.el7.x86_64.rpm -
Libesedb contains a library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
ESEDB is used in may different applications like Windows Search, Windows Mail, Exchange, Active Directory, etc.
See here for the list of changes.
- libevt{,‑devel,‑python,‑python3,‑tools}-20170120-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libevt{,‑devel,‑python,‑tools}-20170120-1.el6.{i686,x86_64}.rpm, and libevt{,‑devel,‑python,‑python3,‑tools}-20170120-1.el7.x86_64rpm -
Libevt contains libraries and tools to access the Windows Event Log (EVT) format files.
See here for the list of changes.
- libevtx{,‑devel,‑python,‑python3,‑tools}-20170122-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libevtx{,‑devel,‑python,‑tools}-20170120-1.el6.{i686,x86_64}.rpm, and libevt{,‑devel,‑python,‑python3,‑tools}-20170120-1.el7.x86_64.rpm -
Libevtx contains libraries and tools
to access the Windows XML Event Log (EVTX) format files.
See here for the list of changes.
- libfwsi{,‑devel,‑python,‑python3}-20160110-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libfwsi{,‑devel,‑python}-20160110-1.el6.{i686,x86_64}.rpm, and libfwsi{,‑devel,‑python,‑python3}-20160110-1.el7.x86_64.rpm -
Libfwsi is a library to access the
Windows Shell Item format.
See here for the list of changes.
- libiconv{,‑devel,‑static,‑utils}-1.15-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Libiconv
provides an iconv() implementation, for use on systems which don't have one, or whose implementation cannot convert from/to Unicode.
Due to conflicts with other packages, notably glibc, the libiconv packages are installed in /usr/libiconv.
This release makes the library files also available at /usr/liboconv/lib for the x86_64 architecture which makes the package easier to use when building
packages that use libiconv.
- liblnk{,‑devel,‑python,‑python3,‑tools}-20170111-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, liblnk{,‑devel,‑python,‑tools}-20170111-1.el6.{i686,x86_64}.rpm, liblnk{,‑devel,‑python,‑python3,‑tools}-20170111-1.el7.x86_64.rpm -
Liblnk contains libraries and tools to access the
Windows Shortcut File (LNK) format file.
See here for the list of changes.
- libmsiecf{,‑devel,‑python,‑python3,‑tools}-20170116-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libmsiecf{,‑devel,‑python,‑tools}-20170116-1.el6.{i686,x86_64}.rpm, and libmsiecf{,‑devel,‑python,‑python3,‑tools}-20170116-1.el7.x86_64}.rpm -
Libmsiecf contains libraries and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files.
See here for the list of changes.
- libolecf{,‑devel,‑python,‑python3,‑tools}-20170129-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libolecf{,‑devel,‑python,‑tools}-20170129-1.el6.{i686,x86_64}.rpm, and libolecf{,‑devel,‑python,‑python3,‑tools}-20170129-1.el7.x86_64.rpm -
Libolecf contains libraries and tools to access the OLE 2 Compound File (OLECF) format filed.
See here for the list of changes.
- libqcow{,‑devel,‑python,‑python3,‑tools}-20170222-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libqcow{,‑devel,‑python,‑tools}-20170222-1.el6.{i686,x86_64}.rpm, and libqcow{,‑devel,‑python,‑python3,‑tools}-20170222-1.el7.x86_64.rpm -
Libqcow is a library and tools used to access the QEMU Copy-On-Write (QCOW) image format.
See here for the list of changes.
- libsigscan{,‑devel,‑python,‑python3,‑tools}-20170124-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libsigscan{,‑devel,‑python,‑tools}-20170124-1.el6.{i686,x86_64}.rpm, and libsigscan{,‑devel,‑python,‑python3,‑tools}-20170124-1.el7.x86_64.rpm -
Libsigscan is a library and tools used to binary signature scanning.
See here for the list of changes.
- libsmdev{,‑devel,‑python,‑python3,‑tools}-20170225-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libsmdev{,‑devel,‑python,‑tools}-20170225-1.el6}.{i686,x86_64}.rpm, and libsmdev{,‑devel,‑python,‑python3,‑tools}-20170225-1.el7.86_64.rpm -
Libsmdev is a library and tools used to access storage media devices.
See here for the list of changes.
- libvhdi{,‑devel,‑python,‑python3,‑tools}-20170223-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libvhdi{,‑devel,‑python,‑tools}-20170223-1.el6.{i686,x86_64}.rpm, and libvhdi{,‑devel,‑python,‑python3,‑tools}-20170223-1.el7.x86_64.rpm -
Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.
See here for the list of supported disk formats.
- libvmdk{,‑devel,‑python,‑python3,‑tools}-20170226-1.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm, libvmdk{,‑devel,‑python,‑tools}-20170226-1.el6.{i686,x86_64}.rpm, and libvmdk{,‑devel,‑python,‑python3,‑tools}-20170226-1.el7.x86_64.rpm -
Libvmdk is a library and tools used to access the VMware Virtual Disk (VMDK) image format.
See here the list of changes.
- nDPI{,‑devel}-1.8-2.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - nDPI is a ntop-maintained superset of
the popular OpenDPI library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available
only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience.
Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while
being them un-necessary for network traffic monitoring.
nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that
it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic
on port 80). This is because nowadays the concept of port=application no longer holds.
See here for the list of supported protocols.
This version brings the code base used to build this package up to 2017-03-28.
- partclone-0.2.90-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Partclone is a program similar to the
well-known backup utility "Partition Image" a.k.a partimage.
Partclone provides utilities to save and restore used blocks on a partition and is designed for higher compatibility of the file system
by using existing libraries, e.g. e2fslibs is used to read and write the ext2 partition.
The supported file systems are: ext2, ext3, ext4, hfs+, btrfs, ntfs, fat(12/16/32), and exfat.
See here for the list of changes in this release.
- silk-{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}-3.15.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm -
SiLK is the System for Internet-Level Knowledge, a collection of
traffic analysis tools developed by the CERT Network Situational Awareness Team (CERT NetSA) to facilitate security analysis of large networks.
See here for a list of changes in this version.
- silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.15.0‑2.{fc20,fc21,fc22,fc23,fc24,fc25}.{i686,x86_64}.rpm and
silk‑{analysis,common,devel,flowcap,rwflowappend,rwflowpack,rwpollexec,rwreceiver,rwsender}‑3.15.0‑2.{el6,el7}.x86_64.rpm -
This release of the SiLK tools can be found in an optional repository that is now part of
cert-forensics-tools-release named forensics‑sip, the definition of which can be found in /etc/yum.repos.d/cert-forensics-tools.repo.
This repository is diabled by default and can be enabled by running the script named /usr/bin/EnableSilkWithIPA as root.
- silk-ipset-{devel,lib,tools}-3.15.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - The SiLK IPset
distribution is derived from the SiLK tool suite developed by the CERT Network Situational Awareness Team (CERT NetSA).
The SiLK IPset distribution contains a library and a set of command line tools to build and manipulate IPset files, which are binary files containing a set of IP addresses.
SiLK IPset can be used by those wishing to use IPsets but who do not need the entire SiLK tool suite.
Since the SiLK IPset distribution contains a small subset of the tools in the SiLK distribution, there is no need to install SiLK IPset when SiLK is already installed.
See here for the list of changes in this release.
- analysis-pipeline-5.6-2.{fc20,fc21,fc22,fc23,fc24,fc25,el6}.{i686,x86_64}.rpm and analysis-pipeline-5.6-2.el7.x86_64.rpm -
The analysis-pipeline processes SiLK Flow records, and its goals are to automate common tasks, to get closer to "real-time" reporting of events,
and to feed interesting data to a security information and event manager (SIEM).
See here for the list of changes for this release.
This package was rebuilt to use silk 3.15.0.
- capstone{,‑devel,‑python,‑python3}-3.0.4-4.{fc20,fc21}.{i686,x86_64}.rpm and capstone-java-3.0.4-4.noarch.rpm - Capstone is a
lightweight multi-platform, multi-architecture disassembly framework.
See here for the list of changes and future features.
- capstone{,‑devel,‑python,‑python3}-3.0.4-4.el7.x86_64.rpm - Capstone is a
lightweight multi-platform, multi-architecture disassembly framework.
See here for the list of changes and future features.
- capstone{,‑devel,‑python,}-3.0.4-4.el6.{i386,x86_64}.rpm - Capstone is a
lightweight multi-platform, multi-architecture disassembly framework.
See here for the list of changes and future features.
- pyew-2.3.0.0-1.{fc20,fc21,fc22,fc23,fc24,fc25,el6,el7}.{i686,x86_64}.rpm - Pyew is a (command line) python tool to analyse malware.
It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits)
|
|
|