Skip to content

Perform post-mortem Linux baselining and forensic analysis.

Notifications You must be signed in to change notification settings

Incogn1toBro/dead_dfir

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

64 Commits
 
 
 
 
 
 

Repository files navigation

Dead DFIR

Baseline and perform analysis on dead Linux machine mounted via image file.

Use

Prior to executing the baseline.sh script, ensure you have already mounted the target file system.

sudo ./baseline.sh /mnt/<drive> <time_zone>
  • /mnt/<drive> - Specify the target filesystem location that has been mounted from a dead disk image.
  • <time_zone> - Specify a timezone for command based output (log based output will still be in the timezone of the target machine). By default this is set to the same as the target machine.

About

Perform post-mortem Linux baselining and forensic analysis.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Shell 100.0%