libforensic1394

About libforensic1394

  libforensic1394 is  a library  for performing memory  forensics over
  the  IEEE 1394  (“FireWire”) interface.   Unlike  existing libraries
  libforensic1394 supports  the new  ‘Juju’ stack introduced  in Linux
  2.6.22 as  well as  recent versions  of Mac OS  X through  IOKit. In
  addition  to  a  C  API  Python bindings  (using  ctypes)  are  also
  provided.

  Further information on libforensic1394 can be found at:

    https://freddie.witherden.org/tools/libforensic1394/

  Contact information can be found in the `AUTHORS` file.

Runtime Requirements

  GNU/Linux

    A recent version of Linux  running a 2.6.22 kernel (or later) with
    the ‘Juju’ stack compiled either  into the kernel or as a loadable
    module. Presence of  the new stack can be  determined by analysing
    the output of:

      $ ls /dev | grep fw

    If  the new  stack  is loaded  and  the system  has  at least  one
    FireWire   port  then   `fw0`  should   be   printed.   Additional
    ports/devices will take the form  fw<n>.  If no devices are listed
    then it is likely that the new stack is not loaded.

    Instructions for loading  the new stack can be  found on the Linux
    IEEE 1394 FireWire wiki:

      https://ieee1394.wiki.kernel.org/index.php/Juju_Migration

    In  addition  the  page  also  contains  instructions  for  making
    FireWire  devices  accessible to  regular  (non-root) users.   For
    libforensic1394 to work correctly access to all nodes is required.

    In the  relatively common case where  both the old  and new stacks
    are compiled  as loadable modules the  new stack can  be loaded as
    follows:

      $ sudo modprobe -r ohci1394 sbp2 eth1394 dv1394 raw1394 video1394
      $ sudo modprobe firewire-ohci

    The  first command  removes the  old stack  (if loaded)  while the
    second loads the new stack.

  Mac OS X

    Mac OS X 10.5 (“Leopard”)  or newer running on a FireWire equipped
    Macintosh.

  Windows & BSD

    There is currently no support for using libforensic1394 on Windows
    or BSD operating  systems.  It is likely that  support for FreeBSD
    will be added in the near future.  A platform layer for Windows is
    less likely  on account of  there being no standard  userspace API
    for accessing FireWire devices.

Building libforensic1394

  In order to build libforensic1394  a recent version of CMake (2.8 or
  later)  is required.  After  extracting the  archive libforensic1394
  can be built by issuing the following commands:

    $ mkdir build
    $ cd build
    $ cmake -G"Unix Makefiles" ../
    $ make

  (Alternatively it  is also possible  to use CMake to  generate build
  files  for   other  development  environments  such   as  XCode  and
  Eclipse/CDT.   Please consult  the CMake  documentation  for further
  information.)

  Installing directly

    Once built libforensic1394 can be installed by executing:

      $ sudo make install

    Users on  operating systems  which use `su`  as opposed  to `sudo`
    should issue the above command as root.  On some GNU/Linux systems
    it may be necessary to execute `ldconfig` afterwards to regenerate
    the shared library cache.

  Installing through a package manager

    An alternative to installing  libforensic1394 directly is to use a
    binary package produced  by CPack, which is a  component of CMake.
    Supported package  formats include .tae.gz, .deb  and .rpm.  Using
    one of these packages in combination with a package manager is the
    recommended way to install libforensic1394.

    Building a package  is as simple issuing:

      $ make package

    After building the project.  This will produce the binary packages
    relevant to the system (.tar.gz  on all systems, .deb if `dpkg` is
    available and  .rpm if `rpmbuild` is  available).  The appropriate
    package can then be installed using the systems package manager.

Python Bindings

  Python language  bindings are provided in the  python/ directory and
  are  compatible with  all versions  of Python  since  2.5 (including
  Python 3).   The bindings themselves are written  entirely in Python
  and interface with libforensic1394 using the ctypes package.

  The bindings can be installed,  either locally or system wide, using
  the `setup.py` file  in the python/ directory.  As  the setup script
  is  merely   a  frontend  to  the   Python  Distributions  Utilities
  (`distutils`) module  it is  worth consulting its  documentation for
  further information.

Known Bugs & Limitations

  A list of known bugs & limitations can be found in the BUGS file.

Special Thanks

  I am  greatly indebted to Stefan  Richter for the  assistance he has
  provided to me (and others!) on the Linux 1394 user list.