CAINE 2.0 proposed Nautilus Scripts

[slo.sleuth]

Denis,

I'm proposing to help with CAINE 2.0 by writing Nautilus scripts to help with previewing mounted partitions. I have already written a few that I put on a project similar to CAINE, but I can't keep up with development of the whole distro.

The idea is that an investigator can mount the partition and examine allocated files, using nautilus scripts to launch appropriate viewers. I have some of my scripts at http://code.google.com/p/linuxsleuthing/ for you to look at and I can work on many more, including a more automated catch-all viewer.

The original idea was that non-experts could use CAINE to examine a computer for evidence and collect files for a basic report BEFORE the computer reaches the lab. That way, if the the evidence seized is sufficient to file a case, the prosecution is not delayed because of lab backlogs. Also, only cases requiring more technical examinations need go to the computer lab initially.

From a forensic examiner perspective, the scripts can render index.dat, places.sqlite, Windows Registry, ICQ chat log files, etc. into text files for copy/paste actions in final reports, etc.

Let me know what you think (I know that not all the scripts are the most efficient or coded well, but I offer these as an example before I begin improvements). We can discuss this more if you have an interest.

John

[nannib]

It could be interesting...let me know when the script will be available and I'll try it! :-)
Thanks for your help
Nanni Bassetti