The Coroner’s Toolkit (TCT) is a collection of command-line programs for forensic analysis of Unix and Linux systems. It was developed by Dan Farmer and Wietse Venema and is considered one of the pioneering open-source forensic toolkits.
Key Functions
| Tool | Description |
|---|---|
| grave-robber | Extracts forensic data from a live or mounted system, including file timestamps, permissions, and ownership. |
| mactime | Generates a timeline of file access, modification, and status change events from the system’s file system data. |
| ils | Lists inode information from a raw disk image, showing deleted or unallocated inodes. |
| icat | Extracts the contents of a specific inode from a disk image, useful for recovering deleted files. |
| pcat | Dumps process memory and status information from a live system. |
How to Use TCT
Basic Workflow
- Acquire an image: Create a forensic image of the target disk using
ddor similar tools. - Run grave-robber: Collect system data from the image or live system.
- Analyze with mactime: Generate a timeline of file system events to identify suspicious activity.
- Recover deleted files: Use
ilsto list deleted inodes, thenicatto extract their contents. - Examine process memory: Use
pcaton a live system to capture running processes.
Example Commands
grave-robber -d /path/to/image -o /output/dir– Extracts forensic data from the image.mactime -b /path/to/bodyfile– Creates a timeline from a body file generated by grave-robber.ils -f /path/to/image > inode_list.txt– Lists all inodes from the image.icat -f /path/to/image inode_number > recovered_file– Recovers a file by its inode number.
Important Notes
- TCT is command-line based and requires familiarity with Unix/Linux and forensic concepts.
- It is most effective on Unix file systems like UFS, EXT, and some Linux file systems.
- Development has not been active for many years, but it remains useful for legacy systems and as a foundation for other tools like The Sleuth Kit.
- The Sleuth Kit (TSK) is a more modern, maintained fork of TCT that adds support for NTFS, FAT, and more file systems.