The Coroner’s Toolkit
When a malcontent breaks into, or cracks, your computer, your reactions are likely to be very much the same. What was taken? What was left behind? Is the computer safe to use? How can I keep my computer safer in the future? To find answers, reach for The Coroner’s Toolkit.
Tuesday, March 15th, 2005
When a thief breaks into your home, you’re likely to feel victimized, vulnerable, and confused. You may wonder: What was taken? Will the house ever feel safe again? What can I do to protect myself from another intrusion?
When a malcontent breaks into, or cracks, your computer, your reactions are likely to be very much the same. What was taken? What was left behind? Is the computer safe to use? How can I keep my computer safer in the future?
While the latter question is important, the former three questions weigh more heavily immediately after a break-in. The suits and the geeks want an assessment as soon as possible, especially if the compromised system held critical information or served a critical purpose.
If you (unfortunately) find yourself heading up such an investigation, reach for
The Coroner’s Toolkit (TCT,
http://www.porcupine.org/forensics/tct.html), a collection of programs by Dan Farmer and Wietse Venema (of
Postfix fame) that performs post mortem analysis of
Linux and
Unix systems. TCT may not finger the
perp, but it can resurrect the dead.
