The Coroners Toolkit

• Created by Dan Farmer and Wietse Venema

• Conducts post-mortem analysis of Unix systems and others

  • Grave-robber - capture potentially volatile data
  • Unrm - captures unallocated space on disk
  • Lazarus - reconstructs files and data
  • Mactime - (Modified, Accessed, Changed times) looks for actions within time periods

• OpenSource and updated several times

• Present on most popular BBC collections

• Current version is 1.11

• http://www.porcupine.org/forensics/tct.html

Notes: