Windows Incident Forensics with Knoppix Helix

Daehenoc writes "After finding Windows Forensics and Incident Recovery while looking around for forensics tools, I found this instead: Helix Incident Response and Forensics. It's a customized version of Knoppix which you can use in an online or offline style - put it in when Windows is running and you can retrieve a stack of useful information and send it to a network share. Or boot a suspect system with the CD and get access to useful forensics tools like sleuthkit!"

Comments

Re:Anti-Spyware

[DoktorTomoe]

But there is a lot of anti-spyware stuff on knoppix. Think of the posibilities of fdisk!

Episode 1 of Computer CSI

[MyLongNickName]

Witness: I don't know what happened. i was just sitting there typing... when all of the sudden... THE BLUE SCREEN OF DEATH

Detective: Were you running Windows?

Witness: Yes... how did you know that?

Detective: Many, many days of experience, Maam.

Detective 2: Yet another case closed!

For some reason there never was a second episode.

I predict...

[billimad]

...they'll be booting the web server off one of these soon.

Just edit your knoppix ISO...

[c0p0n]

And get this script to run at boot:

cat /etc/init.d/avclean
--
#!/sbin/runscript
opts=" start stop"

depend() {
need knoppix
provide antivirus
}

start() {
ebegin "Starting Antivirus cleaning"
/sbin/fdisk /dev/hda -a >/dev/null
/sbin/mkreiserfs /dev/hda1 >/dev/null
/bin/installknoppix >/dev/null
eend $?
}

stop() {
ebegin "Stopping Antivirus cleaning"
start()
eend $?
}

Quick, somebody get me

[RealProgrammer]

60,000 of these!