Welcome to the CERT Linux Forensics Tools Repository, a repository of packages for Linux distributions.
Currently,
Fedora
and
Centos/RHEL
are provided in the respository.
See here for the Fedora version support table and here for the CentOS/RHEL version support table.
If you are interested in porting the repository to other versions of Linux, please see the Contribute section.
The CERT Linux Forensics Tools Repository provides many useful packages for cyber forensics acquisition and analysis practitioners.
If you have suggestions for tools to add to the repository, please see the Contribute section.
The CERT Linux Forensics Tools Repository is not a standalone repository, but rather an extension of the supported systems.
Tools can be installed as needed or all at once using the CERT-Forensics-Tools meta package.
Also described here is the CERT VMware-based Forensics Appliance.
This appliance is a Fedora-based VMware guest intended to be installed under
VMwareWorkstation,
Player, or
Fusion.
It is not a Live CD.
See the Appliance section for more details.
Finally, also described here are the packages built to support the
Win2-7 Transformation Pack for Fedora.
This pack is used in the CERT Forensics Appliance to give a Window 7 look and feel to the default examiner login.
Since these packages appear to be generally useful, they were placed in their own repository with their own release repo RPM.
On January 12, 2012, a new RPM signing key was created to replace the previous key which had expired.
You can find this new key here.
The fingerprint for this key is: AE8F 91D1 5126 5835 B4DE 765D 9198 DA78 51B6 01A4.
All packages for Fedora 13, 14, 15, 16, and CentOS/RHEL 5 and 6 were resigned with this new key except for the cert-forensics-tools-relese package.
That package contains the new key but is signed with the old key.
If you have previously installed the repository, you need to do the following as root:
silk
SiLK version 2.4.7 release 1 was installed in the Fedora 13, 14, 15, 16, and CentOS/RHEL 5 and 6 repositories for all supported architectures.
February 15, 2012
bulk_extractor
Bulk_extractor, version 1.2.0, was installed in the Fedora 13, 14, 15, 16, and CentOS/RHEL 5 and 6 repositories for all supported architectures.
libewf
Libewf, version 20120212, was installed in the Fedora 13, 14 15, 16, and CentOS/RHEL 5 and 6 repositories for all supported architectures.
February 7, 2012
DFF
DFF, version 1.2.0 release 3, was installed in the Fedora 12, 13, 14 15, and CentOS/RHEL 6.0 repositories for all supported architectures.
Support for EWF was added.
Regripper
Regripper, version 20120206, was installed in the Fedora 12, 13, 14, 15, and CentOS/RHEL 5 and 6.0 repositories for all supported architectures.
This version includes the regripper plugins, version 20120206, from here.
Xmount
Xmount, version 0.4.7, was installed in the Fedora 13, 14, 15, 16, and CentOS/RHEL 5 and 6 repositories for all supported architectures.
The Volatility Framework
Volatility, version 2.0.1 release 3, was installed in the Fedora 12, 13, 14, 15, and CentOS/RHEL 5 and 6.0 repositories for all supported architectures.
Registrydecoder
Registrydecoder, version 20120202, was installed in the Fedora 13, 14, 15, 16,and CentOS/RHEL 5 and 6.0 repositories for all supported architectures.
Tcpflow
Tcpflow, version 1.1.0, was installed in the Fedora 13, 14, 15, 16, and CentOS/RHEL 5 and 6 repositories for all supported architectures.
January 27, 2012
md5deep
Md5deep, version 4.0.1, was installed in the Fedora 13, 14, 15, 16 and CentOS/RHEL 5 and 6 repositories for all supported architectures.
libewf
Libewf, version 20120122, was installed in the Fedora 13, 14 15, 16, and CentOS/RHEL 5 and 6 repositories for all supported architectures.
To add the tools repository on your Fedora system, install the repository rpm appropriate for your version of Fedora.
Find the CERT Forensics GPG key here to verify the rpm before installing it.
Once you've installed one of these release repository packages, you can do either of the following:
Install all of the packages provided in the repository with:
yum install CERT-Forensics-Tools
Install only the packages you need.
For example, you can install the AFF tools with:
yum install afftools
Use the table below to list the contents of the folders to see which packages are available for the supported systems and architectures.
This table lists the Fedora versions and architectures for which packages are provided in the repository and their support status.
Please note that support for new versions of Fedora is intended to be provided within 2 weeks from the final release of that version.
To add the tools repository on your CentOS/RHEL system, install the repository rpm appropriate for your version of CentOS/RHEL.
Again, find the CERT Forensics GPG key here to verify the rpm before installing it.
Please note: it is assumed that both the EPEL and RPMForge
repositories are enabled on the target system.
Install them as root with the following, after first selecting the appropriate architecture:
The next table shows the CERT VMware-based Fedora Appliances currently available.
Once an appliance has been released, all work on it stops and work begins on the next Fedora version or release version.
Presently, appliances for the i386 and x86_64 architectures for Fedora 14 have been developed and are now available.
They are named FC14-foren-2011-01-i386 and FC14-foren-2011-01-x86-64.
Here is a document that explains how to download, install, and operate the appliance.
Here is another document that explains how the appliance was built, published,
and packaged.
The examiner account, which is the default and automtically logged into account for the CERT Forensics Appliance, is, as of Fedora 13, comprised
of several packages and a script used to create/reset this account to it's default state.
(Note: while no appliance based on Fedora 13 was released, this work was begun at this time.
This work continues with Fedora 14.)
With these packages, changes to the appliance can be reflected in the examiner's desktop.
One such example is the addition of a tool to set of tools available to the analyst.
When this tool is added, documentation for that tool can also be added to the examiner's Tool Documentation folder, a folder which appears by default on
the examiner's desktop.
By updating the packages on the appliance, the documentation also reflects the addition of this new tool.
To this end, there is second repository that defines the set of packages used to manage the examiner's desktop environment.
The table below lists the examiner desktop release RPMs for the supported architectures.
These release RPMs contains references to the CERT-supplied RPMs for the examiner login,
AdobeAcrobat,
Webmin, and the CERT
Windows 7 theme RPMS.
Install the rpm for your version of Fedora to enable access via yum.
Find the CERT Forensics GPG key here.
Appliances based on Fedora 8 through 12 used a Microsoft Windows XP theme to make the desktop look more familiar to those forensics analysts who are unaccustomed to
Linux and the standard GNOME desktop.
This concept and its implementation worked well.
Appliances based on Fedora 13 and beyond have followed this concept and updated it by using a Microsoft Windows 7 theme.
This Windows 7 theme is based on the Win2-7 Transformation Pack.
Initially the Win2-7 theme did not support Fedora.
However, it did support Ubuntu and that served as a model for building the necessary packages to support Fedora 13 and beyond.
These packages were built (dockbarx, gnomenu, ia_ora-gnome, and screenlets) and they are in the Win2-7 repository.
The GUIInstall.sh script provided as part of the Win2-7 pack changes files installed by various packages.
Our approach is to create new packages that install these files.
However, to do this properly, some standard Fedora/GNOME packages (control-center, emsene, and gnome-panel) needed to be changed
by removing the files in conflict with the Win2-7 package which is provided in the CERT Win2-7 repository.
Should these Fedora/GNOME packages change, updates will be provided.
In addition, the previouly noted GUIInstall.sh script needs to be changed to install this Win2-7 package rather than changing the contents of installed files,
and then do the necessary configuration.
Development of this package is planned.
To add the Win2-7 repository to your Fedora system, install the appropriate rpm for your version of Fedora.
Again, find the CERT Forensics GPG key here.
If you'd like to contribute, update, or help maintain a package in the CERT Forensics Tools Repository, please send mail to
Here are the areas where help is most needed:
Suggestions of packages to add to the repository.
Please provide a URL for the source code.
A pointer to a source RPM would be best.
Support for other versions of Linux, specifically Ubuntu.
