From owner-freebsd-stable@FreeBSD.ORG  Sun Aug  3 20:09:35 2003
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B0ACB37B401
	for <freebsd-stable@freebsd.org>;
	Sun,  3 Aug 2003 20:09:35 -0700 (PDT)
Received: from rwcrmhc11.comcast.net (rwcrmhc11.comcast.net [204.127.198.35])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 3300443F93
	for <freebsd-stable@freebsd.org>;
	Sun,  3 Aug 2003 20:09:35 -0700 (PDT)
	(envelope-from rootman22@comcast.net)
Received: from 12-209-185-111.client.attbi.com ([12.209.185.111])
          by comcast.net (rwcrmhc11) with SMTP
          id <2003080403093401300g4gjke>; Mon, 4 Aug 2003 03:09:34 +0000
From: Joe Warner <rootman22@comcast.net>
To: Barney Wolff <barney@databus.com>
Date: Sun, 3 Aug 2003 21:09:26 -0600
User-Agent: KMail/1.5.2
References: <200308030920.45437.rootman22@comcast.net>
	<200308031259.31577.rootman22@comcast.net>
	<20030803223352.GA32105@pit.databus.com>
In-Reply-To: <20030803223352.GA32105@pit.databus.com>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200308032109.26264.rootman22@comcast.net>
cc: freebsd-stable@freebsd.org
Subject: Re: Forensics CD Toolkit for FreeBSD
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 04 Aug 2003 03:09:36 -0000

On Sunday 03 August 2003 04:33 pm, Barney Wolff wrote:
> On Sun, Aug 03, 2003 at 12:59:31PM -0600, Joe Warner wrote:
> > > 4.  You should investigate The Coroner's Toolkit, available (free)
> > > from porcupine.org to really do forensics work.  It comes from
> > > Dan Farmer & Wiese Venema, who need no endorsement from me.
> > > I've used it (on Solaris) with very gratifying results.
> >
> > Yes, I've seen that all over the place from my searches on Google but I
> > was hesitant about going any further with that because it said it's only
> > been tested on FreeBSD 2.2.1, 3.4, and 4.4
>
> It should run on any 4- FreeBSD version.  The parts of it that need to
> understand file system formats will likely not be happy with 5.x's UFS2,
> but that's not an issue for 4.x.
>
> > Do you think I can run TCT from a CD?
>
> Sure.

Ok great, that's what I needed.

Thanks for your help and quick responses!

Joe