
[Note - currently we are assuming that you attended our Internet forensics
class and have significant context on what the tools are about and what
functions they perform.  We'll be adding additional documentation and background
for the uninitiated for the final release.  If you have stumbled across
this and were *not* in our class, please don't ask us how things work or
other questions - this is a testing, *not* a general release.]

[Note 2: there's a mailing list (with on-line archive) for sharing
experiences. To subscribe, send a message to majordomo@porcupine.org
with body (not subject): subscribe tct-users. The list will reject
mail from non-members so it is unlikely to catch UCE. To unsubscribe,
send mail with as body (not subject): unsubscribe tct-users.]



The Coroner's Toolkit (TCT) - a Brief Introduction


TCT is a collection of tools - some large, some small, some in perl, some
in C - that are all either oriented towards gathering or analyzing 
data on a Unix system.  There is no single task or ultimate goal that 
they are directed to, but if there was a theme it'd be the reconstruction 
of the past - determining as much as possible what happened in the past 
with a static snapshot of a system.

The most current version of TCT may be found at:

	http://www.fish.com/security/tct.html

	http://www.porcupine.org/security/tct.html


To install TCT read the "INSTALL" file.

A list of the contents of TCT may be found in the "MANIFEST" file.

A copyright notice is in the "COPYRIGHT" file; additional copyrights
might be included in individual source code files (especially look at
the C source code files, which are mostly covered by IBM's open source
license, in the file "LICENSE".)

A general overview of the toolkit may be found in the "README" file
in the "docs" subdirectory.

A quick start for the impatient may be found in the "quickstart" file.

We hope that you enjoy and find our work useful to you!


Dan Farmer & Wietse Venema

