Choosing a BBC / BCD

• Must not incidentally write to the harddrive

  • Journaling file systems write to disk on recovery
    • No mount on boot (not even read-only)
    • Must not use tmpfs (swap space)

• Inappropriate BBCs / CDs

  • LNX-BBC (automount and tmpfs)
  • LinuxCare Bootable Toolkit (automount)
  • RedHat Rescue CD (automount)

• Appropriate BBCs / CDs

  • PLAC - Portable Linux Auditing CD (BBC)
  • @Stake Forensic Toolkit (BBC)
  • FIRE - Forensic Incident Response Environment
  • Penguin Sleuthkit

Notes: