SPELL=tct VERSION=1.18 SOURCE="${SPELL}-${VERSION}.tar.gz" SOURCE_URL[0]=http://www.porcupine.org/forensics/${SOURCE} SOURCE_HASH=sha512:aea6e599e4e81cc6d320c36e181ee9478899cb85d13d3ea2a2bd90c223b43b919f8c9ee25826b7aada3fe402204a94a87b7142af97d79570e22cef60f8434a26 SOURCE_DIRECTORY="${BUILD_DIRECTORY}/${SPELL}-${VERSION}" WEB_SITE="http://www.porcupine.org/forensics/tct.html" LICENSE[0]=IBMPL DOCS="$DOCS CHANGES Beware quick-start help-recovering-file help-when-broken-into" ENTERED=20090727 SHORT="The coroner's toolkit" cat << EOF TCT is a collection of programs by Dan Farmer and Wietse Venema for a post-mortem analysis of a UNIX system after break-in. The programs are all either oriented towards gathering or analyzing forensic data on a Unix system. There is no single task or ultimate goal that they are directed to, but if there was a theme it'd be an effort towards the reconstruction of the past - determining as much as possible what happened with a static snapshot of a system. Most of the tools are oriented towards data collection rather than analysis - a good use of the toolkit could be for a relative neophyte in Unix forensic security to send the data to someone who does know something and can further analyze the output. Examples of using TCT can be found in the Forensic Discovery book. (Last draft available for free in HTML form on the website) EOF