
The grave-robber Data Collection Tool
--------------------------------------

The grave-robber tool is less of a tool itself than a framework for
other tools to reside in.  In the current incarnation it runs a
variety of perl modules, nearly all of them living in the "lib"
subdirectory.

It roughly runs these tools so that data is captured according to the 
Order of Volatility; the OOV roughly says that certain data is more 
volatile or ephemeral than other types (memory vs. disk, for 
instance); generally speaking you want to capture the most volatile 
information before it goes away.  However, since any queries of the 
system risk disturbing other potentially valuable data one must be 
careful.  And while it impossible to automate this perfectly, the 
grave-robber can be a useful way of automating the process.

Before it starts doing much data collection, however, it examines some
of the tools and files that are important to the system that you might
wish to examine manually before waiting the (usually) long time it takes
for the grave-robber to finish its run.  Usually this includes files
located in the /etc directory, but also might include commonly runs
commands, such as those found in /bin, /usr/local/bin, etc.  The 
configuration file look@first is found in the "conf" subdirectory
and controls this.

Often you'll want to run the grave-robber on the entire system, and
by default it does just this.  It is recommended that you run the
grave-robber as root so that it can capture files and process information
that are not available to normal users.  To run it, simply type
"grave-robber" (or "bin/grave-robber", if TCT's "bin" directory is
not in your path.

By default, the grave-robber captures ephemeral information (process
and network state), figures out what it can about the system hardware
configuration (especially, disks and disk partitions), and searches
the file system for critical files (configuration files, logfiles,
other critical files).

However, the grave-robber's file system scan can take several hours.
All that processing is happening with the one and only original
copy of the data.   This goes somewhat against a basic rule of
computer forensics analysis: do as little processing as possible
with the original.

If you have the luxury of being able to dd(1) the disks and of
doing an off-line file system analysis, you will want to run
grave-robber with the -q (quick scan) flag.  This turns off the
file system walk, and allows you to run the full-blown set of tools
at your leisure on another system against a copy of the data (or
at least after the original information has been saved).


Analyzing the data subdirectory
--------------------------------

Captured data is saved in the data subdirectory.  To be precise it
is actually kept in a subdirectory of the data subdirectory, the
name of the subdirectory corresponding to the name of the system and
the time that the grave-robber tool has been run.  The grave-robber
also creates a symbolic link - "data/hostname" - to the actual data 
dir.  In the hostname subdirectory there are several files and 
directories of interest:

        output.*        Each of the sub programs run by TCT creates an
                        output file and an MD5 digital signature.

        strings_log	This is the output of the strings (1) command
			on every directory the filewalker found.  Doing this
			will will often reveal names of deleted files.

        body		This is the mactime database.

        body.S		This contains all SUID files.  They are in the
			normal mactime DB as well, it's simply simpler to 
			see them here.

	error-log	This contains all errors generated by the grave-robber
			program.

	deleted_files	This directory contains all deleted files that were
			still open or running when the grave-robber
			ran.  (Done by a combination of ils & icat).

	pcat		This directory contains all the images of running
			processes that pcat recovered.  Lots of interesting
			things can be found here!  Among other things user
			shells often have their history in memory, some
			programs keep IP #'s or hostnames, etc.; a command
			such as (in SunOS the -s flag pretty prints od
			output in a nice text form, YMMV):

				od -s pid.out.date | less

			can tell you quite a bit about what was going
			on in the past!

	conf_vault	This directory is an archive of all the files that 
			the grave-robber found of interest.  Configuration
			files, critical files & directories, etc.  Mostly
			controlled by the configuration files:

				save_these_files
				coroner.cf
			
			In addition there is an index.html file that points
			(via HTML) to all the files in this subdirectory.

The grave-robber has a few command line options (see the man page), but
mostly it is controlled by either editing the grave-robber file and 
removing or commenting out lines that you do not wish run (e.g. placing 
a pound sign ("#") in the place of the first character of an undesired 
line) or by editing the main configuration file, "coroner.cf".  Most 
of the options in the configuration file do not need to be changed, and 
all are fairly well commented on in the configuration file itself.


The sub-programs
-----------------

Currently the following perl data gathering functions are run.
Descriptions of each are given.

determine_os()		A very simple-minded check to determine what
			sort of system that the program is running in.
			(Some tests only work on some systems).

prepare_config_vault()
close_config_vault()	This creates (and closes) the data subdirectories.
			Typically called near the front of the grave-robber
			and at the end.

do_first_looks()	Examine the tools you use first, so you can look
			at some critical things while the grave-rob is still
			looking around.

suck_lsof()
suck_ps()		Suck in all the process info, from ps & lsof.

suck_proc()		*** Requires one of the above (suck_lsof or suck_ps)
			to be called before being called ***!  This 
			captures the entire memory space of ALL processes.


save_open_files()	*** Requires one of the above (suck_lsof or suck_ps)
			to be called before being called ***!  Saves the 
			executable of currently running programs that have 
			been deleted from the disk.

load_passwd_info()
load_group_info()	This loads in the password/group files for later use.

suck_netinfo()
suck_hostinfo()		These two run a variety of shell commands, like
			rpcinfo, showmount, uname, etc., etc., etc.

process_dir()		This creates the MAC time database that mactime uses.

process_dev_dir()	Grabs the maj/min numbers for the device directory.

process_files_to_save()	Snarfs individual, important files.  The complete
			list of files is kept in "save_these_files".

grab_user_trust_files()
grab_user_time_trust()
grab_window_trust()	These three functions try to collect various 
			data related to trust in some way - rhosts files,
			what runs in cron, at, etc., etc.

