From owner-freebsd-stable@FreeBSD.ORG  Sun Aug  3 11:59:37 2003
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 6383E37B401; Sun,  3 Aug 2003 11:59:37 -0700 (PDT)
Received: from rwcrmhc12.comcast.net (rwcrmhc12.comcast.net [216.148.227.85])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id ADEBC43FA3; Sun,  3 Aug 2003 11:59:36 -0700 (PDT)
	(envelope-from rootman22@comcast.net)
Received: from 12-209-185-111.client.attbi.com ([12.209.185.111])
          by comcast.net (rwcrmhc12) with SMTP
          id <2003080318592001400nueaie>; Sun, 3 Aug 2003 18:59:20 +0000
From: Joe Warner <rootman22@comcast.net>
To: Barney Wolff <barney@databus.com>
Date: Sun, 3 Aug 2003 12:59:31 -0600
User-Agent: KMail/1.5.2
References: <200308030920.45437.rootman22@comcast.net>
	<20030803182647.GA29997@pit.databus.com>
In-Reply-To: <20030803182647.GA29997@pit.databus.com>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200308031259.31577.rootman22@comcast.net>
cc: freebsd-security@freebsd.org
cc: freebsd-stable@freebsd.org
Subject: Re: Forensics CD Toolkit for FreeBSD
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Aug 2003 18:59:37 -0000

On Sunday 03 August 2003 12:26 pm, Barney Wolff wrote:
> On Sun, Aug 03, 2003 at 09:20:45AM -0600, Joe Warner wrote:
> > I'd like to build a toolkit CD specifically for conducting
> > forensics on FreeBSD.  I'm not talking about a bootable
> > CD but rather one that I could pop into a CD ROM drive
> > and run trusted commands like ps, netstat, ls, etc., from.
>
> 1.  It would be fairly rare for the bin's from iso-2 (the bootable
> live filesystem) from a release not to work on the corresponding
> -stable.

Ok, I didn't know that, thanks.

>
> 2.  However you should certainly be booting from the cd, for reasons
> already noted.
>
> 3.  make release will enable you to create the equivalent of iso-2
> for your -stable, if you really insist.

I'll take that under consideration but don't think it will be necessary for
what I'm trying to accomplish.

>
> 4.  You should investigate The Coroner's Toolkit, available (free)
> from porcupine.org to really do forensics work.  It comes from
> Dan Farmer & Wiese Venema, who need no endorsement from me.
> I've used it (on Solaris) with very gratifying results.

Yes, I've seen that all over the place from my searches on Google but I
was hesitant about going any further with that because it said it's only
been tested on FreeBSD 2.2.1, 3.4, and 4.4 

Do you think I can run TCT from a CD?

Thanks

Joe