.

Helix 3 Released

<<

mad_irish

User avatar

Newbie
Newbie

Posts: 17

Joined: Thu Aug 14, 2008 7:45 am

Post Tue Sep 23, 2008 8:07 am

Helix 3 Released

Helix 3 has been released.  This forensics centric live CD is now Ubuntu based and includes updates to many of the host programs.  From the site:

"Helix has been modified very carefully to NOT touch the host computer in any way and it is forensically sound. Helix wil not auto mount swap space, or auto mount any attached devices. Helix also has a special live side for Incident Response and Forensics."

The new version of Helix can be found at http://www.e-fense.com/helix/
<<

oleDB

User avatar

Recruiters
Recruiters

Posts: 236

Joined: Thu Jul 20, 2006 8:58 am

Location: HOA

Post Tue Sep 23, 2008 8:29 am

Re: Helix 3 Released

sweet, thx for the heads up, downloading asap
<<

RoleReversal

User avatar

Hero Member
Hero Member

Posts: 928

Joined: Fri Jan 04, 2008 8:54 am

Location: UK

Post Tue Sep 23, 2008 12:24 pm

Re: Helix 3 Released

downloading now, cheers
<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Tue Sep 23, 2008 1:24 pm

Re: Helix 3 Released

Thanks for the link.
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Tue Sep 23, 2008 1:25 pm

Re: Helix 3 Released

Love it when people beat me to the punch.

Thanks mad_irish,
Don
CISSP, MCSE, CSTA, Security+ SME
<<

blackazarro

User avatar

Sr. Member
Sr. Member

Posts: 368

Joined: Sun Aug 13, 2006 5:31 pm

Post Tue Sep 23, 2008 10:23 pm

Re: Helix 3 Released

Awesome, its about time. Thanks for the info. I use Helix a lot at my work.
Security+, OSCP, CEH
<<

shednik

Jr. Member
Jr. Member

Posts: 75

Joined: Thu Sep 11, 2008 7:30 am

Post Thu Sep 25, 2008 7:31 am

Re: Helix 3 Released

Nice I'll have to start playing with this one as well  ;D
CCNA, MCP, A+, N+

WIP: Masters of Infosec, CEH, & Mastering C
<<

ctendell

Newbie
Newbie

Posts: 3

Joined: Wed Feb 25, 2009 6:04 pm

Post Wed Feb 25, 2009 6:09 pm

Re: Helix 3 Released

The end of the first chapter and the begining of the next.
As of February 2009 E-fense is no longer offering Helix3 as a free software and requires a membership of $14.95 a month in order to download a copy of Helix3. Because of this a community version is being developed and is scheduled for release in April 2009. Helix3 CE Community forum is available at http://forum.charlestendell.com
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Wed Feb 25, 2009 11:18 pm

Re: Helix 3 Released

I am a little disappointed with the recent release of Helix.  I've been using the CD for quite some time now, and the new version has a couple of annoyances to me:

1.  New build based on Ubuntu.  I have had some issues getting the disc to boot with some systems.  Ubuntu seems to be less forgiving when it comes to hardware.  I carry around version 1.9a and the new version.

2.  There is now an option to Install Helix to Hard Drive.  I realize that this could be cool, but I think its a dumb option on a forensics CD that is supposed to not modify original evidence.  How many people who aren't familiar with evidence handling rules and Helix will attempt to install the software onto a drive they are attempting to analyze? 

3.  The disc mounting and formatting is still confusing to a novice Linux users.  Many forensics investigators do not have Linux ops training.  They are only familiar with the OS from an investigative point of you.  Many of my coworkers are switching to RAPTOR, which makes this task much easier for them.
~~~~~~~~~~~~~~
Ketchup
<<

RoleReversal

User avatar

Hero Member
Hero Member

Posts: 928

Joined: Fri Jan 04, 2008 8:54 am

Location: UK

Post Thu Feb 26, 2009 5:04 am

Re: Helix 3 Released

ctendell wrote:The end of the first chapter and the begining of the next.
As of February 2009 E-fense is no longer offering Helix3 as a free software and requires a membership of $14.95 a month in order to download a copy of Helix3. Because of this a community version is being developed and is scheduled for release in April 2009. Helix3 CE Community forum is available at http://forum.charlestendell.com


That's a bit of a bummer, guess I'll have to make do with the last .iso I downloaded for a while. Better make sure I don't lose this one. Cheers for the heads up.

Ketchup wrote:2.  There is now an option to Install Helix to Hard Drive.   I realize that this could be cool, but I think its a dumb option on a forensics CD that is supposed to not modify original evidence.   How many people who aren't familiar with evidence handling rules and Helix will attempt to install the software onto a drive they are attempting to analyze?  

3.  The disc mounting and formatting is still confusing to a novice Linux users.   Many forensics investigators do not have Linux ops training.   They are only familiar with the OS from an investigative point of you.   Many of my coworkers are switching to RAPTOR, which makes this task much easier for them.


Not sure about the HDD install option from a 'live' perspective but it should make it relatively straightforward to allow the Helix system to double up as a workstation.

Haven't come Raptor before, I'll need to take a look. I'm assuming that this site is the one you refer to?
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Thu Feb 26, 2009 7:39 am

Re: Helix 3 Released

Yep, that's the site for Raptor.  Sorry, I mean to post a link.  It's a pretty decent tool, despite being in BETA.  I am not sure if it will remain free.

I agree with you on the Forensics workstation option.  I just think that should be a separate disc.  The boot disc should be pristine without the option to install, in my opinion.  I have seen too many IT departments attempting to do their own forensics without proper training; and it usually doesn't turn out well.  The HD install can be quite dangerous in the wrong hands.    I do see your point on a workstation option though.
~~~~~~~~~~~~~~
Ketchup
<<

RoleReversal

User avatar

Hero Member
Hero Member

Posts: 928

Joined: Fri Jan 04, 2008 8:54 am

Location: UK

Post Thu Feb 26, 2009 7:57 am

Re: Helix 3 Released

I'll agree with the concern for the install utility getting in the wrong hands. I think separating it to a different disk may be a bit overkill though. Personally I'd handle it (might already be in place I haven't had a chance to play with this myself yet) in the same manor as the Windows side of Helix, basically a big splash screen that states:
'You are about to trash a load of evidence, if you have no idea what we mean step aware from the keyboard'
:D
<<

ctendell

Newbie
Newbie

Posts: 3

Joined: Wed Feb 25, 2009 6:04 pm

Post Thu Feb 26, 2009 11:21 am

Re: Helix 3 Released

Ketchup wrote:I am a little disappointed with the recent release of Helix.   I've been using the CD for quite some time now, and the new version has a couple of annoyances to me:

1.  New build based on Ubuntu.   I have had some issues getting the disc to boot with some systems.   Ubuntu seems to be less forgiving when it comes to hardware.   I carry around version 1.9a and the new version.


What would you suggest for better hardware detection?

These are they types of things I hope to address. I didn't think to remove the install portion that would save some space and avoid the possibility of spoliation.
Last edited by ctendell on Thu Feb 26, 2009 11:26 am, edited 1 time in total.
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Thu Feb 26, 2009 2:37 pm

Re: Helix 3 Released

This may force people into projects like Windows FE. I just posted some info on it here:

http://www.ethicalhacker.net/component/ ... ic,3664.0/

Don
CISSP, MCSE, CSTA, Security+ SME
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Thu Feb 26, 2009 2:55 pm

Re: Helix 3 Released

ctendell wrote:
What would you suggest for better hardware detection?



To be honest with you, I am not sure.  I carry both, 1.9a and 2.0 (Although it says Helix 3 on the new one) with me all the time.  1.9a seems to have less issues with detecting hardware.  The most issues I have had is that the toolbar in X doesn't come up.  In the new version, we have had quite a few of those dreaded Ubuntu errors where it drops you to a shell complaining about a GUID mount point.   

What was the older version based on?  Was it debian or redhat? 

It's not that big of a deal if you have both versions.  You start with the newer Helix boot CD.  If that doesn't boot, you switch to 1.9.
~~~~~~~~~~~~~~
Ketchup
Next

Return to Tools

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software