Forensic Server Project

As promised, I'm going to blog more often on the Forensic Server Project, or FSP. I'd like to kick that off with a brief description, and then follow that up with a request to the readers, particularly those who use the FSP.

The FSP is a client-server based approach to information collection during incident response. I'm specifying "information collection", b/c I've explicitly separated the collection and analysis phases. The FSP, and the client component First Responder Utility (FRU), work together to perform collection. In a nutshell, the admin/first responder downloads the utilities (both are standalone .EXEs, with their Perl source code included), and places the FSP server component on a system of her choosing. She then configures the fruc.ini file (per the documentation) and copies fruc.ini, p2x584.dll, and fruc.exe (along with all of the necessary supporting tools) to a CD or USB thumb drive. The fruc.ini also allows the admin/first responder to specify Registry keys and values to query.

When responding to an incident, the first responder place the media containing the FRU in the system, and launches the FRU with the necessary command line switches (if applicable). The FRU will automatically connect to the FSP server, and place all information it collects on that system. The server component of the FSP handles storage and checksumming of the data that its sent, as well as logging of all activity.

Again, this is simply the data collection phase...analysis is another thing all together. I provided some useful Perl scripts with my book for performing data correlation, and I would like to expand the analysis suite. However, nothing prevents the user from doing the same...using any programming language(s) (ie, Perl, VBScript, Python, Ruby, etc.), and any other utilities (mySql, Excel, etc), you can perform data reduction, analysis, and presentation.

Now, my request to the readers...actually, this is a couple of requests:

1. Are you using the FRU/FSP? If so, what are your comments? What's good or bad about it, how could it be improved, etc.?

2. If you are using the FRU, what does your fruc.ini file look like? Got a link to it someplace where you'd care to share? If you don't feel like sharing it in this forum, is there another forum that you'd be more comfortable with?

3. What kind of analysis are you doing? Do you have any analysis tools? What specific things are you looking for, or at?

One final thought...Robert states in his blog that the WOLF tool is not available publicly. I can definitely understand the reasons why. If you're interested in a tool like that, that will write it's data to a drive (mapped, USB-connected, etc.), let me know. I've been toying with the idea of writing a version of the FRU that does that.

Thanks!