Teaching Computer Forensics with Masterkey Linux Forensic System

1

• Teaching Computer Forensics with Masterkey Linux
  Forensic System
• Qin Zhou
• Faculty of Engineering and Computing
• Coventry University

2
Masterkey Linux Forensic System

• Forensically sound
• Bootable
• Installable
• Can be virtual
• Linux OS a collection of computer forensic
  tools
• Root privilege
• Easy to use
• Small, fast and stable
• More

3
Where to Get It?

• http//www.masterkeylinux.com
• http//www.masterkeylinux.net
• Distributed as
• ISO file for CD
• ZIP file for USB

4
(No Transcript)
5
Boot Suspects PC with Masterkey Live CD/USB for
Imaging

• dd/dcfldd
• LinEn
• AIR
• dd_rescue

6
Masterkey is Booting
7
It is Easy to Set up a Masterkey Linux Forensic
Workstation
8
A Masterkey Linux Forensic Workstation Is Loading
Up
9
Masterkey Goes Virtual
10
Media Analysis with Tools included in Masterkey
Linux
11
Forensics Related Tools Included

• Air 1.2.8
• Autopsy 2.08
• ClamAV for Unix 0.91.2
• chkrootkit 0.47
• chntpw 070923
• dcfldd 1.3.4-1
• dd_rescue 1.14
• GParted 0.3.3
• Foremost 1.5

• mac-robber 1.00
• md5deep 1.12
• memdump 1.01
• Rootkit Hunter 1.3.0
• Scalpel 1.60
• The Sleuth Kit 2.09
• Stegdetect 0.6-4
• Wipe 2005-05-09
• Wireshark 0.99.6
• More

12
Demo
13
Questions and Suggestions?