Linux IR Tools

Description The Linux Incident Response Scripts are designed to obtain information from an event or, incident with repeatable results quickly and efficiently. A single purchase grants you the ability to have the software updated each and every time a new version is released, and or, bug fixes become available. While also updating the scripts any support applications we develop (C, C++, ASM) will also become available free of charge!

Currently the scripts pull the following information (more information not listed):

File System Information
- Downloads, Desktop, Videos, Photo hash fingerprints
- Files / Folders created in the last 30 days.
- Files with improper permissions (web root, etc.)
- Users in user path
Network Information
- IP Address information
- Public IP Address
- Network routes
- Hosts file, ssh file
- list of connected WiFi Networks, Preferred WiFi Networks and currently connected network
- WiFi Networks within range of incident
- Connected, Foreign IP addresses, PIDs and Ports
- Remote users logged in
- Host file
- ssh and other network files

Software Information
- Running applications
- Running services
- Loaded kernel modules.
- Installed applications (dpkg / apt, etc.)
- process owners / location of running application
Disk Information
- Physical hard disks
- Virtual Hard Disks
- USB Hard disk / devices plugged in
- Disk information
USB Information
- Connected USB devices and classes
- Identification of devices (HID devices, rubber ducky, etc.)

Bluetooth Information
- Connected bluetooth devices - Bluetooth devices previously seen - Bluetooth devices first time seen - Devices currently within range.

Diagnostic Information
- Gathers apple diagnostic information
- Gathers system logs



And much much more...