-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hi,
I'm a german police officer and sick of all the boot-cds around. I want to build a boot-cd / pxe-image for me and other people around based on grml because I like shell and debian / ubuntu.
Currently I'm using a customized HELIX CD * http://e-fense.com/helix/ which is quite ok but "difficult" to customize.
My plans are building ONE grml with the forensic tools I need or (which would be better) include all tools in the official grml-cd.
I need a CD for booting outside our lab and a pxe-version inside our lab.
The pxe-part rocks already.
So here are the things I need to include: * libewf - Free tool to create and write back EnCase-Images * https://www.uitwisselplatform.nl/projects/libewf/ * A.I.R. Cloning HDs for mausschubser ;) * http://air-imager.sourceforge.net/
Additionally it would be cool to add a special hot-plug scipts for hds: if there is a scpecial id-file / volume-name automatically mount the hd as /media/destination-hd for faster hd-cloning.
So, how can I do this and is there someone around who want's to help me?
First of all one question: how can i add a additional dir to the cd for running e.g. libewf if I boot the "normal" grml v0.8 via PXE / NFS?
Or can I place the unzipped ISO-Content in a NFS-Share and do there all the modifications I need?
Further I will create a forensic-page in the grml-wiki and do the doku.
greetings from Heilbronn, Germany,
ralf
* Ralf Moll ralf-info@family-moll.de [20060918 14:15]:
I'm a german police officer and sick of all the boot-cds around. I want to build a boot-cd / pxe-image for me and other people around based on grml because I like shell and debian / ubuntu.
Great. :)
Currently I'm using a customized HELIX CD
which is quite ok but "difficult" to customize.
My plans are building ONE grml with the forensic tools I need or (which would be better) include all tools in the official grml-cd.
Ok.
I need a CD for booting outside our lab and a pxe-version inside our lab.
The pxe-part rocks already.
Great. :)
I hope you already know grml-terminalserver. :) If you don't use grml-terminalserver the grml_netboot_package might be interesting for you, take a look at http://wiki.grml.org/doku.php?id=terminalserver
So here are the things I need to include:
- libewf - Free tool to create and write back EnCase-Images
- https://www.uitwisselplatform.nl/projects/libewf/
I don't see any problems in adding this to main grml (it's available under the BSD license).
I just created a preliminary libewf-20060820_1-1_i386.deb package. I'll improve some minor stuff and the final package should be available within in the next few hours/days via the grml-repository. So the next devel-release (see http://grml.org/beta-tester/ for details) will very probably contain this software already.
- A.I.R. Cloning HDs for mausschubser ;)
- http://air-imager.sourceforge.net/
GPL, that's fine. But it has an absolutely braindread and even broken install script (install-air-1.2.8, 165K) and depends on perl-tk which would need ~10MB of additional space on grml. :(
So the easiest way to run AIR is a short shellscript like http://grml.org/tmp/get-air which does the job. I'll add an shell function named getair (like getskype, getgizmo, get_tw_cli,... we already have) so it's easy to install on demand.
Is there any other software you use for your forensic work and which should become part of grml?
Additionally it would be cool to add a special hot-plug scipts for hds: if there is a scpecial id-file / volume-name automatically mount the hd as /media/destination-hd for faster hd-cloning.
The current develrelease (grml 0.8-1) already provides support for fs-labels, so will you have to run only 'mount /mnt/$LABEL' to mount the partition containing a filesystem named $LABEL. (The release is available for beta-testers, if you are interested in testing just let me know and I'll give you access to the ISO.)
So, how can I do this and is there someone around who want's to help me?
Sure. :)
First of all one question: how can i add a additional dir to the cd for running e.g. libewf if I boot the "normal" grml v0.8 via PXE / NFS? Or can I place the unzipped ISO-Content in a NFS-Share and do there all the modifications I need?
Installing the package on the NFS-server makes it vissible to the NFS-client. :)
If you want to install additional software either install the software manually, use the configuration framework (see http://grml.org/config/ - you can run your own scripts this way) or remaster grml (http://wiki.grml.org/doku.php?id=remastering + http://grml.org/solutions/)
Further I will create a forensic-page in the grml-wiki and do the doku.
I just created http://wiki.grml.org/doku.php?id=forensic so you can drop in your stuff there.
regards, -mika-
* Michael Prokop mika@grml.org [20060919 07:15]:
- Ralf Moll ralf-info@family-moll.de [20060918 14:15]:
So here are the things I need to include:
- libewf - Free tool to create and write back EnCase-Images
- https://www.uitwisselplatform.nl/projects/libewf/
I don't see any problems in adding this to main grml (it's available under the BSD license).
I just created a preliminary libewf-20060820_1-1_i386.deb package. I'll improve some minor stuff and the final package should be available within in the next few hours/days via the grml-repository. So the next devel-release (see http://grml.org/beta-tester/ for details) will very probably contain this software already.
JFYI: The final package is already available:
http://grml.org/repos/libewf_20060820-1-1_i386.deb
regards, -mika-
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hi Michael,
I hope you already know grml-terminalserver. :) If you don't use grml-terminalserver the grml_netboot_package might be interesting for you, take a look at http://wiki.grml.org/doku.php?id=terminalserver
Hmm, if I want to use the terminalserver I've to install a complete grml on my server. With the pxe-netboot-package I can use the grml-cd for our network like being outside having only the grml cd.
I don't want to change my server-os and in additions to that I want the same enviroment for forensic analysis in out net over pxe-boot and outside via cd-boot.
I just created a preliminary libewf-20060820_1-1_i386.deb package. I'll improve some minor stuff and the final package should be available within in the next few hours/days via the grml-repository. So the next devel-release (see http://grml.org/beta-tester/ for details) will very probably contain this software already.
Great. That's one of the most important tools for me.
- A.I.R. Cloning HDs for mausschubser ;)
- http://air-imager.sourceforge.net/
GPL, that's fine. But it has an absolutely braindread and even broken install script (install-air-1.2.8, 165K) and depends on perl-tk which would need ~10MB of additional space on grml. :(
Ok, that's bad. Maybe Adepto is better. I contacted the author and post the result here later.
So the easiest way to run AIR is a short shellscript like http://grml.org/tmp/get-air which does the job. I'll add an shell function named getair (like getskype, getgizmo, get_tw_cli,... we already have) so it's easy to install on demand.
Ok, for forensic analysis the pc are regularly not connected to the internet, so the getair-script doesn't make sense. So I have to do it without A.I.R.
Is there any other software you use for your forensic work and which should become part of grml?
Look at http://wiki.grml.org/doku.php?id=forensic BTW: How can I create an account? ;-) Didn't find the "sign in"....
The current develrelease (grml 0.8-1) already provides support for fs-labels, so will you have to run only 'mount /mnt/$LABEL' to mount the partition containing a filesystem named $LABEL. (The release is available for beta-testers, if you are interested in testing just let me know and I'll give you access to the ISO.)
hmm, that's a good start. so every user should know his harddisk-name and nothing can go wrong.
So, how can I do this and is there someone around who want's to help me?
Sure. :)
Cool :)
First of all one question: how can i add a additional dir to the cd for running e.g. libewf if I boot the "normal" grml v0.8 via PXE / NFS? Or can I place the unzipped ISO-Content in a NFS-Share and do there all the modifications I need?
Installing the package on the NFS-server makes it vissible to the NFS-client. :)
But only for the terminalserver-stuff. The pxe just mounts the grml-file from the cd.
If you want to install additional software either install the software manually, use the configuration framework (see http://grml.org/config/ - you can run your own scripts this way) or remaster grml (http://wiki.grml.org/doku.php?id=remastering + http://grml.org/solutions/)
The author of the helix cd http://e-fense.com/helix/ did create a dir CDROM:/Addon which is not in the knoppix-image, but on the cd-root. The dir is included in the path. So every dummy user can just add his own tools to the CDROM:/Addon dir even via Windoze ISO-Tools and burn his "private" cd with a few new programms. Every easy customizing :)
Further I will create a forensic-page in the grml-wiki and do the doku.
I just created http://wiki.grml.org/doku.php?id=forensic so you can drop in your stuff there.
I alread wrote down some stuff.
Looking forward to a cool project,
ramon
* Ralf Moll ralf-info@family-moll.de wrote:
I hope you already know grml-terminalserver. :) If you don't use grml-terminalserver the grml_netboot_package might be interesting for you, take a look at http://wiki.grml.org/doku.php?id=terminalserver
Hmm, if I want to use the terminalserver I've to install a complete grml on my server. With the pxe-netboot-package I can use the grml-cd for our network like being outside having only the grml cd.
Yes.
I don't want to change my server-os and in additions to that I want the same enviroment for forensic analysis in out net over pxe-boot and outside via cd-boot.
Ok.
I just created a preliminary libewf-20060820_1-1_i386.deb package. I'll improve some minor stuff and the final package should be available within in the next few hours/days via the grml-repository. So the next devel-release (see http://grml.org/beta-tester/ for details) will very probably contain this software already.
Great. That's one of the most important tools for me.
It will be part of the next devel-release and of course of grml 0.9 then. I'll keep you up2date.
- A.I.R. Cloning HDs for mausschubser ;)
- http://air-imager.sourceforge.net/
GPL, that's fine. But it has an absolutely braindread and even broken install script (install-air-1.2.8, 165K) and depends on perl-tk which would need ~10MB of additional space on grml. :(
Ok, that's bad. Maybe Adepto is better. I contacted the author and post the result here later.
Ok, thanks.
So the easiest way to run AIR is a short shellscript like http://grml.org/tmp/get-air which does the job. I'll add an shell function named getair (like getskype, getgizmo, get_tw_cli,... we already have) so it's easy to install on demand.
Ok, for forensic analysis the pc are regularly not connected to the internet, so the getair-script doesn't make sense. So I have to do it without A.I.R.
Ok.
Is there any other software you use for your forensic work and which should become part of grml?
Done that, thanks. :)
BTW: How can I create an account? ;-) Didn't find the "sign in"....
Currently accounts are used only by core developers of grml. If you want to edit a page just do it :) and enter a short description into the field named "Edit summary:" and add your name (if you want) before saving changes.
For example something like:
"added $FOO [ralf moll]"
simplifies it for us to follow all the changes.
BTW: I've removed the wishlist stuff as the specifc pages in the wiki should provide documentation for users and should not contain developers stuff. ;) If you have something for the wishlist either just edit http://wiki.grml.org/doku.php?id=wishlist or use http://grml.org/report/ or feel free to drop me a personal mail.
Ok, back to your wishlist:
* LinEn from EnCase (maybe a licence problem)
=> where can I get that? AFAICS it's just available with the EnCase suite (which is closed source + quite expensive). :(
* AFF-Tools [ http://www.afflib.org/ ]
==> I'll take a look at it!
And Adepto and AIR have been discussed already. :)
The current develrelease (grml 0.8-1) already provides support for fs-labels, so will you have to run only 'mount /mnt/$LABEL' to mount the partition containing a filesystem named $LABEL. (The release is available for beta-testers, if you are interested in testing just let me know and I'll give you access to the ISO.)
hmm, that's a good start. so every user should know his harddisk-name and nothing can go wrong.
Yes. (Small correction: it's filesystem's/partition's name.)
First of all one question: how can i add a additional dir to the cd for running e.g. libewf if I boot the "normal" grml v0.8 via PXE / NFS? Or can I place the unzipped ISO-Content in a NFS-Share and do there all the modifications I need?
Installing the package on the NFS-server makes it vissible to the NFS-client. :)
But only for the terminalserver-stuff. The pxe just mounts the grml-file from the cd.
Ok.
You could write a shellscript which does all the stuff you need if you do not want remaster grml on your own. Just create an additional directory named scripts on the cdrom and place your stuff in /cdrom/scripts/grml.sh. Booting using 'grml scripts' then executes the script on startup. (If you want to do this by default either adjust isolinux.cfg or run 'mkdir bootparams && echo -n " scripts" >>bootparams/bootparams' in the root-directory of the CD, see keyword bootparams at http://grml.org/config/grml-config.html. Labeling a device/partition with GRMLCFG might be interesting for you as well.)
If you want to install additional software either install the software manually, use the configuration framework (see http://grml.org/config/ - you can run your own scripts this way) or remaster grml (http://wiki.grml.org/doku.php?id=remastering + http://grml.org/solutions/)
The author of the helix cd http://e-fense.com/helix/ did create a dir CDROM:/Addon which is not in the knoppix-image, but on the cd-root. The dir is included in the path. So every dummy user can just add his own tools to the CDROM:/Addon dir even via Windoze ISO-Tools and burn his "private" cd with a few new programms. Every easy customizing :)
We have a "debs" bootoption in our config framework (http://grml.org/config/grml-config.html) for installing stuff from /cdrom/debs/. But I must admit that it very probably won't fit your needs, the lines above about /cdrom/scripts/grml.sh should work better for you.
But I like the idea to add an "external" directory to $PATH as you don't have to care about debian packaging and can add software like AIR easily on your own. So I'll add '/cdrom/addons/' to $PATH in our config!
regards, -mika-
Mika is good about user requests. Another way to customize grml is to install it on a portable USB hard drive. The grml2hd script does it. Grml links a Newsforge article about the technique, in the press section. This Western Digital model comes in 40/60/80 gigabytes for around US$100.00 / 78,66 :
http://castle.pricewatch.com/s/search.asp?s=WD+Passport
M
Teilnehmer (3)
-
Mark -
Michael Prokop -
Ralf Moll