libforensic1394

An open source (GNU LGPLv3+) library for performing live memory forensics over the IEEE 1394 (“FireWire”) interface. Currently supported under GNU/Linux and Mac OS X, libforensic1394 improves upon existing libraries by providing a simple and clean interface to the the direct memory access functionality available over FireWire. In addition to a C API Python bindings are also available.

Further information can be found in the associated paper memory forensics over the IEEE 1394 interface.

Contents

News

2010-10-05: 0.2 Released

The first public release of libforensic1394, version 0.2, was tagged earlier today. Source tarballs are available from the downloads section.

2010-08-03: Developer Preview

Available through git libforensic1394 is currently feature complete and undergoing extensive field testing.

Features

Bugs

A list of known bugs and limitations can be found in the BUGS file in the source distribution.

Todo

The following features can be expected in future revisions.

Download

Git

The latest version can always be downloaded from the projects git repository.

Release 0.2

Source code
libforensic1394-0.2.tar.gz (57.8 KiB, sig)
libforensic1394-0.2.zip (69.4 KiB, sig)

Documentation

Complete Doxygen documentation is available.

History

libforensic1394 was written as a modern alternative to pythonraw1394 (a Python wrapper around libraw1394) featuring native support for the new “Juju” stack used by many GNU/Linux distributions.