Mash That Key Releases LosBuntu
What it is...
LosBuntu is a Live DVD Linux distribution (distro) that can be used to assist in data forensic investigations. LosBuntu is the result of our desire to have a bootable forensic distro with all of the tools and features that we like, installed by us, controlled by us, and built by us. LosBuntu was built using a clean installation of Linux Ubuntu 14.04 64 bit. Once the foundation was created, many open source forensic tools were installed and tweaks were made to turn the installation into LosBuntu. LosBuntu was then turned into a Live DVD using the tool remastersys.
LosBuntu has been tweaked to never automount media. Although it will boot a computer without mounting its drives, it does not write block them (LosBuntu may write to a pre-existing swap partition). The distro was primarily designed for analyzing images and not booted computers. Validated Linux distributions designed for acquisition have already been released and should be used for that purpose. Remember to always validate your results.
What it is not....
LosBuntu is not better and should not be argued as better or worse than any other distro. LosBuntu is simply another forensic distro. One that was designed the way that we like it, and released to the public in an attempt to give back to the forensic community. LosBuntu will save you the time and trouble of having to install the tools listed below.
One neat usable feature...
Because remastersys was used to turn LosBuntu into a Live DVD, you can re-use remastersys to create your own live DVD distro. This means that you can install LosBuntu to the hard drive, add just about any tool that you wish to add, and then run remastersys to create a new version of LosBuntu with any and all of the tools and tweaks you installed, in essence, creating your very own version of LosBuntu. Change the background, add or remove tools, do anything that you please. LosBuntu was released to you so that you can use it, tweak it, and improve it.
This is the list of packages that we have added to LosBuntu:
7zip, Abiword, Archivemount, Autopsy, Bkhive, Bleachbit, BTRFS-tools, Bulkextractor, Chntpw, Chromium-browser, Clamtk, Dcfldd, Dconf, DFF, Efw-tools, Exfat-fuse, Fileinfo, Filezila, Flashplugin-installer, Foremost, FRED, Furiusisomount, Gddrescue, Gparted, Guymager, Hexedit, Hfsprogs, Hfsutils, Jacksum, John, libbde-alpha-20141023, libevt-alpha-20141229, libewf-20140427, libfuse-dev, libfvde-experimental-20140907, libfwevt-experimental-20141026, liblnk-alpha-20141026,
libpff-experimental-20131028, libsmraw-alpha-20141026, libvhdi-alpha-20141021, libvmdk-alpha-20141021, libvshadow-alpha-20141023, Log2timeline, Nautilus-open-terminal, Pasco,
Python-TK, Rar, Regripper plus plugins, Rifiuti2, Samdump2, Scalpel, SSH, Testdisk, Truecrypt 7.1a,
Vinetto, VLC, Volatility, W3m, Wine, Wireshark, Xmount, Zenmap
UPDATE on 4/26/2015: Packages added
aircrackng, bless, curl, lvm2, macchanger, nautilus-wipe, proxychains, pv, reaver, seahorse tools, sshfs, tor, traceroute, Volatility 2.4, whois, wifite
UPDATE on 8/29/2015: Packages added
recordmydesktop, libevtx, vmfs-tools, open-scsci, boot-up-manager
UPDATE on 11/17/2015: Packages added
hashcat, ntdsextract_1.3, lxde, libesedb, rdesktop
UPDATE on 12/14/2015: Packages added
nbd-client, gdebi-core, veracrypt
UPDATE on 02/01/2016: Packages added
hashid, git, hashcat2.0, newbackground, SMB Access
UPDATE on 05/13/2016: Packages added
mdadm, dmraid, dos2unix, libqcow, libfvde, TorBundle5.5.5
UPDATE on 09/27/2016: Packages added
xor.exe, plaso 1.5, ubuntu-zfs
Download it from this link: LosBuntu
Special thanks go out to my old friends at the lab Mark B, Paul I, Pete M, and John T. for the corny name, ideas, and testing. You guys are the best in the State, keep doing what you do best.
If this tool helped you during your investigation, we would definitely like to hear from you. You can leave a comment or reach me on twitter: @carlos_cajigas
- LosBuntu used to analyze an MS12-020 RDP Crash Dump with Volatility.
Link to - ComputerSecurityStudent
- LosBuntu used to mount and convert a VMDK virtual disk to raw, on-the-fly. YouTubeVideo
- LosBuntu used for physical disk, image acquisitions using guymager. YouTubeVideo
- LosBuntu used to wipe and validate sterilization of physical disks. YouTubeVideo
- LosBuntu used to Activate & Set Windows 7 Admin Password.
Link to - ComputerSecurityStudent