The Sleuth Kit (TSK) is a library and collection of command line tools that
allow you to investigate volume and file system data. The library can be
incorporated into larger digital forensics tools and the command line tools
can be directly used to find evidence.
The media management tools allow you to examine the layout of disks and
other media. The Sleuth Kit supports DOS partitions, BSD partitions (disk
labels), Mac partitions, Sun slices (Volume Table of Contents), and GPT
disks. With these tools, you can identify where partitions are located and
extract them so that they can be analyzed with file system analysis tools.
syslog-ng is an enhanced log daemon, supporting a wide range of input and
output methods: syslog, unstructured text, message queues, databases (SQL
and NoSQL alike) and more.
Key features:
* receive and send RFC3164 and RFC5424 style syslog messages
* work with any kind of unstructured data
* receive and send JSON formatted messages
* classify and structure logs with builtin parsers (csv-parser(),
db-parser(), ...)
* normalize, crunch and process logs as they flow through the system
* hand on messages for further processing using message queues (like
AMQP), files or databases (like PostgreSQL or MongoDB).
The official home page of syslog-ng is:
http://www.balabit.com/network-security/syslog-ng/
The clean utility searches through the filesystem for "temporary files"
left behind by editors and the like which can be deleted safely.
WARNING: This program was written with the express purpose of deleting
(unwanted) files. Please be certain that you understand this program
and that you really want to use such an automatic deletion process
before you begin.
[ On the other hand, I've been using it for over ten years without
doing anything worse than not having a core.1 manpage. The normal
mode is interactive and prompts for confirmation. You are advised to
have backups before using the non-interactive batch mode. ]
-Chuck Swiger <chuck@pkix.net>
dar is a shell command that backs up directory trees and files. It has been
tested under Linux, Windows, Solaris, FreeBSD, NetBSD, MacOS X and several
other systems, it is released under the GNU General Public License (GPL).
Since version 2.0.0 an Application Interface (API) is available, opening the
way for external/independent Graphical User Interfaces (GUIs) like kdar.
This API relies on the libdar library, which is the core part of DAR
programs; as such, the API is released under the GPL. Consequently, to use
the API, your program must be released under the GPL as well.
DSBMD is a media/filesystem type detecting daemon that allows clients to mount
storage devices.
DSBMD watches the mount table for changes, monitors devd events for new storage
devices, polls CD/DVD drives and card readers for media change events, deter-
mines media types, volume names, and filesystem types. Mountable devices,
changes in the mount table as well as device add/remove events and altered
states of mountable devices are presented to clients. Clients can request DSBMD
to mount, unmount, and eject media, or set the CD/DVD reading speed.
fsbackup.pl is a incremental backup creation utility. fsbackup.pl support
backup compression and encryption. Backup can be stored on local file system
and on remote host stored over SSH or FTP. Some addition scripts allow backups
SQL tables from PostgreSQL and MySQL (pgsql_backup.sh and mysql_backup.sh)),
save system configuration files and list of installed packages (sysbackup.sh).
Backuped with fsbackup.pl files can be recovered by script fsrestore.sh,
backuped with sysbackup.sh system packeges can be reinstalled by sysrestore.sh.
GNU GRUB is a multiboot boot loader. It was derived from GRUB, the GRand
Unified Bootloader, which was originally designed and implemented by Erich
Stefan Boleyn.
This port does not install GRUB on the master boot record of your hard drive.
To do this you will need to read the info page that is installed by the port.
This port includes additional patches and fixes making it work properly
with ZFS boot-environments. Users on UFS will probably want to install the
regular sysutils/grub2 port.
nvramtool is a utility for reading/writing coreboot parameters and
displaying information from the coreboot table. It is intended for x86-based
systems (both 32-bit and 64-bit) that use coreboot.
The coreboot table resides in low physical memory, and may be accessed
through the /dev/mem interface. It is created at boot time by coreboot, and
contains various system information such as the type of mainboard in use. It
specifies locations in the CMOS (nonvolatile RAM) where the coreboot
parameters are stored.
For information about coreboot, see http://www.coreboot.org/.
This lets you implement filesystems in perl, through the FUSE
(Filesystem in USErspace) kernel/lib interface.
FUSE expects you to implement callbacks for the various functions.
In the following definitions, "errno" can be 0 (for a success),
-EINVAL, -ENOENT, -EONFIRE, any integer less than 1 really.
You can import standard error constants by saying something like "use
POSIX qw(EDOTDOT ENOANO);".
Every constant you need (file types, open() flags, error values, etc)
can be imported either from POSIX or from Fcntl, often both. See their
respective documentations, for more information.
This set of scripts allows you to imitate Windows feature to automount some
network shares at login time. It is relatively difficult in setup - you should
understand, what you do, know how to install SMB/CIFS support into a kernel,
how to setup /etc/nsmb.conf and .nsmbrc files, etc.
Script are written on Shell. Uses nbtscan and host utilites to locate Windows
boxes when generated .nsmbrc file in semi-automated mode with smb2nsmbrc helper
script. Also uses their own file .mssmbrc to describe any share, mounted with
mountsmb2.