Windows Incident Forensics with Knoppix Helix

Daehenoc writes "After finding Windows Forensics and Incident Recovery while looking around for forensics tools, I found this instead: Helix Incident Response and Forensics. It's a customized version of Knoppix which you can use in an online or offline style - put it in when Windows is running and you can retrieve a stack of useful information and send it to a network share. Or boot a suspect system with the CD and get access to useful forensics tools like sleuthkit!"

Comments

I predict...

[billimad]

...they'll be booting the web server off one of these soon.

Just edit your knoppix ISO...

[c0p0n]

And get this script to run at boot:

cat /etc/init.d/avclean
--
#!/sbin/runscript
opts=" start stop"

depend() {
need knoppix
provide antivirus
}

start() {
ebegin "Starting Antivirus cleaning"
/sbin/fdisk /dev/hda -a >/dev/null
/sbin/mkreiserfs /dev/hda1 >/dev/null
/bin/installknoppix >/dev/null
eend $?
}

stop() {
ebegin "Stopping Antivirus cleaning"
start()
eend $?
}