Threat Level: green Handler on Duty: Russ McRee

SANS ISC: Notable Tidbits - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Notable Tidbits
Notable updates for today:
http://liveview.sourceforge.net/

"Live View is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk.
The end result is that one need not create extra "throw away" copies of the disk or image to create the virtual machine."

Live View is capable of booting

    * Full disk raw images
    * Bootable partition raw images
    * Physical Disks (attached via a USB or Firewire bridge)

Containing the following operating systems

    * Windows XP, 2000, 2003, NT, Me, 98
    * Linux (limited support)
[source: liveview site]

http://ssdeep.sourceforge.net/ (Came across while browsing Richard's excellent aggregate site http://www.bloglines.com/public/TaoSecurity)
Uh context triggered piecewise hashes. Makes my head hurt. But you'll like it if you need to compare closely related files (polymorphic malware samples maybe?)
Here's a greaqt interview. http://cyberspeak.libsyn.com/index.php?post_id=115142
This is way beyond me too http://dbacl.sourceforge.net/


Robert

49 Posts

Sign Up for Free or Log In to start participating in the conversation!