In the summer of 2009, I created a forensic boot disc primarily intended for preview examinations of digital media called, appropriately, "Previewer." It was based on Ubuntu 8.10 and included my home-grown tool, Ipod-ID, a bash script that searches iPod devices for evidence of ownership. Basic use of Previewer was taught at a training event for the Central California chapter of the HTCIA in September, 2009, and investigators from four counties were in attendance.
Previewer was modeled after CAINE 1.0, a forensic boot disc targeted at expert forensic examiners. CAINE was feature rich, but required a good foundation in computer forensics to fully utilized. My goal was bring a basic forensic examination ability to non-experts so that criminal cases could be filed before the computer got lost in the computer lab backlog. We debate the merits of that philosophy later.
With that goal in mind, I wrote a handful of nautilus-scripts to assist layman investigators with examination of digital media, primarily computer hard disk drives. The Nautilus file browser was the main examination tool, the the scripts, accessed with a right click in the file pane, providing examination functionality, including the ability to save data as evidence and produce simple reports about the saved data.
A new beginning...
Fast forward to today. Previewer remained stagnant after one revision to correct some minor issues with some of the nautilus-scripts. Since then, the Linux kernel has made advancements in hardware support, and the Ubuntu Linux distribution on which Previewer is based has undergone some major changes. More importantly, mounting schemes in most forensics boot discs, including Previewer and CAINE 1.0, were found to be flawed (in limited, but none-the-less important, ways).
Increased work load and decreased personal free time caused me to turn back the inspiration for Previewer: CAINE. CAINE has an active development team and a very capable project manager, Nanni Bassetti. CAINE was about to update to version 2.0, and the mount issues were corrected. I contacted Nanni and told him about my scripts and the philosophy behind them. He took a look at the scripts and felt they would be a good addition to CAINE.
Therefore, I am happy to announce that CAINE 2.0 was release 9/14/2010. It includes a much-improved set of nautilus-scripts from Previewer as well as all the expert tools expected from previous CAINE releases. Anyone accustomed to Previewer should have no trouble with using CAINE 2.0, and in fact, should find it more effective and useful than Previewer. The main "gotcha" is that the administrator account (root) now has a password (i.e, "caine").
Please contact Nanni (through the CAINE website) with comments or concerns about the main distribution. You can always contact me regarding the nautilus-scripts (here, by email, or through the CAINE webiste).
Good job! :-)
ReplyDeleteGreat job!
ReplyDelete