The Coroner's Toolkit (TCT) is a collection of programs by Dan Farmer and Wietse Venema for a post-mortem analysis of a UNIX system after a break-in. TCT enables you to collect date regarding deleted files, modification times of files and more.
Install this BEFORE you need to use it, so you don't risk destroying essential forensic data before you begin.
Tools contained within this package: grave-robber, lazarus, inode-cat (ex icat), ils, unrm and pcat.
|
|
|