Linux Forensics Tools Repository: Package Summary for Packages on June 17, 2013:

  • aff{lib,lib-devel,tools}-3.7.1-2.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Afflib is the library and tools to manipulate files using the Advanced Forensic Format. Please note: as of AFFLIB 3.6, all tool names start with the string aff which marks a change from AFFLIB version 3.5. This version now uses the correct version of libewf-devel.
  • testdisk-6.13-3.{fc15,fc16,fc17,fc18,el5,el6}.{i686,x86_64}.rpm - Testdisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). This package also contains photorec which is a file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted. This version now uses the correct version of libewf-devel.
  • libbde{,-devel,-python,-tools}-20130422-1.fc18.{i686,x86_64}.rpm - Libbde is a library and tools to access the BitLocker Drive Encryption (BDE) format. The BDE format is used by Windows, as of Vista, to encrypt data on a storage media volume.

    The supported BDE formats are:
    • BitLocker Windows Vista
    • BitLocker Windows 7
    • BitLocker Windows 8 (Consumer Preview)
    • BitLocker To Go

    The supported protection methods are:
    • clear key
    • password
    • recovery password
    • start-up key
    • FKEV and/or TWEAK key data

    The additional features are:
    • support for partial encrypted volumes
    • zeros out the BDE metadata, matches behavior seen on Windows

  • libfvde{,-devel,-tools}-20130422-1.fc18.{i686,x86_64}.rpm - Libfvde is a lbrary and tools to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes. The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.

    The supported FileVault2 implementations are:
    • Mac OS X Lion
    • Mac OS X Mountain Lion

    The supported encryption volume types are:
    • removable media volume (initial support as of 20121113 version)
    • system volume

    The supported protection methods are:
    • password
    • recovery password
    • VMK key data (as of 20121114 version)

    The development in progress work areas are:
    • extend CoreStorage volume support
    • partial encrypted volumes

  • libvhdi{,-devel,-python,-tools}-20130512-1.fc18.{i686,x86_64}.rpm - Libvhdi is a library and tools to access the Virtual Hard Disk (VHD) image format. Note that this project has an experimental status.

    The supported formats for reading are:
    • VHD version 1

    The supported image types are:
    • Fixed-size hard disk image
    • Dynamic-size (or sparse) hard disk image

    The image types currently not supported are:
    • Differential (or differencing) hard disk image

    The areas for work in progress are:
    • Differential image support
    • Dokan library support