Adding applications to CAINE Live USB

View previous topic View next topic Go down

Adding applications to CAINE Live USB

Post  finkga on Mon Jan 18, 2010 6:30 pm

I'm new to CAINE and to Live USB Linux in general. When I made my CAINE Live USB, I enabled a persistent home space so I could collect information. But now I find I'd also like to add new tools to the USB, particularly partimage. (Yes, I realize partimage is not a forensic tool, but I need it for other reasons.) Unfortunately, I can't install it standalone in the home space because it requires libbz2 and stuff to be installed in the normal locations.

So, how can I install partimage persistently in the CAINE Live USB? Can I mount the squashfs partition rw and install there somehow?

Thanks,

Glenn

finkga

Number of posts : 3
Registration date : 2010-01-18

View user profile

Back to top Go down

Re: Adding applications to CAINE Live USB

Post  nannib on Tue Jan 19, 2010 10:10 am


_________________
-------------------------
Nanni Bassetti
Caine Project Manager
http://www.nannibassetti.com
avatar
nannib
Admin

Number of posts : 273
Age : 47
Registration date : 2008-10-28

View user profile http://www.nannibassetti.com/

Back to top Go down

Yes, that's basically what I did, but it isn't persistent

Post  finkga on Tue Jan 19, 2010 10:16 am

I did this, and partimage worked fine. But when I rebooted, partimage was gone. I found out that this was because CAINE uses a squashfs file system that loads the root partition as read-only. There is a complex procedure to use unionfs to add stuff into a separate file to be merged with the main partition, but I haven't managed to do this yet.

finkga

Number of posts : 3
Registration date : 2010-01-18

View user profile

Back to top Go down

Re: Adding applications to CAINE Live USB

Post  nannib on Tue Jan 19, 2010 10:22 am

me too... :-)

But...why don't you use AIR or DD or DC3DD to copy the partitions?
eg.:
dc3dd if=/dev/sda1 of=/media/sdb1/partition_disk.dd progress=on conv=noerror,sync bs=512

or piping it with gzip if you need the compression...or using AFF or LibEWF...there are many tools to backup the partitions...
Let me know...
bye

_________________
-------------------------
Nanni Bassetti
Caine Project Manager
http://www.nannibassetti.com
avatar
nannib
Admin

Number of posts : 273
Age : 47
Registration date : 2008-10-28

View user profile http://www.nannibassetti.com/

Back to top Go down

Re: Adding applications to CAINE Live USB

Post  finkga on Tue Jan 19, 2010 10:29 am

AIR is great for forensic quality backups. But in this case, I needed a _quick_ backup of a 250GB partition. Tools like dd do a disk copy of all the sectors (including the unused ones) and take a _long_ time. You can save space by zeroing out all the unused sectors before you back up, but there's nothing you can do about the time. For my application, rapid backup and quick-and-dirty first-pass forensics were all that were needed. So partimage was the ticket. I just found out that there's no easy way to add packages to live USBs built on the squashfs file system. My answer may come from just replicating CAINE's tool suite on a standard Ubuntu distro instead.

Thanks anyway!

-- Glenn

finkga

Number of posts : 3
Registration date : 2010-01-18

View user profile

Back to top Go down

Re: Adding applications to CAINE Live USB

Post  nannib on Tue Jan 19, 2010 10:49 am

Ok I got you :-)
you can do this:
http://www.caine-live.net/page13/page13.html

Install Caine, apply the procedure above and rebuild the usb stick, using your customized Caine distro...
that's all!
It's easier than customize a virgin Ubuntu :-)
Let me know
bye

_________________
-------------------------
Nanni Bassetti
Caine Project Manager
http://www.nannibassetti.com
avatar
nannib
Admin

Number of posts : 273
Age : 47
Registration date : 2008-10-28

View user profile http://www.nannibassetti.com/

Back to top Go down

Re: Adding applications to CAINE Live USB

Post  Sponsored content


Sponsored content


Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum