# packages

pkgId: 703923efb644297d6502eccf5f569d752c0063c1ee4c2c2df2eddd47593d6891
name: 2hash
arch: src
version: 0.2
epoch: 0
release: 1.fc23
summary: Simultaneously perform an MD5 and SHA1 checksum on files
url: http://trog.qgl.org/20061027/2hash-simultaneous-md5-and-sha1-hashing
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: 2hash-0.2-1.fc23.src.rpm
checksum_type: sha256
description:
  2hash simultaneously performs a md5 and a sha1 checksum on file(s).
  If you want two checksums for additionally integrity checking, you previously
  had to run md5sum and sha1sum serially causing the integrity checks to
  take 100% longer than running a single check alone. 2hash runs both hashes
  in parallel, only having to read the file once. It allows you to
  get both hash values with only about an 8% time increase over md5 alone,
  and only about a 2% time increase over sha1 alone. It runs about 90%
  quicker than using both md5 and sha1 one after the other...


pkgId: b9a024c48e46e67626bed9cc5485645532ccfe8eb8c2af251b739a9f5fd00459
name: DropboxReader
arch: src
version: 1.0
epoch: 0
release: 1.fc23
summary: DropboxReader
url: http://cybermarshal.com/index.php/cyber-marshal-utilities/dropbox-reader
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: DropboxReader-1.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Dropbox Reader is a suite of command-line tools for parsing configuration and cache files associated with the Dropbox cloud storage software.


pkgId: 79336aaf8a2f3bdbc3d0e514880cbe8533260c7bd1585037356584ff7b174148
name: KHracker
arch: src
version: 0.3
epoch: 0
release: 1.fc23
summary: Known Hosts Entry Decrypter
url: http://www.cert.org/forensics/repository
rpm_license: GPL
rpm_group: Development/Libraries/Python
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: KHracker-0.3-1.fc23.src.rpm
checksum_type: sha256
description:
  KHracker is a python-based decryption tool for encrypted known_hosts entries. It will
  attempt to decrypt values stored in SSH known_hosts files, if the encryption option has
  been enabled for that computer. By default, known_hosts entries are not encrypted, but
  there is an option to do so. From a forensics perspective, encrypted known_hosts entries
  can prevent an investigator from seeing other computers a user may have been
  connecting to. Information about the connections made from a system can be integral to
  identifying a complete understanding of the systems involved in a network intrusion or
  incident response case.


pkgId: f899fa6fd8418fb96cc959626754182291f677311018e84cad0b9f17b74acb2e
name: LogAnalysisToolKit
arch: src
version: 1.7
epoch: 0
release: 1.fc23
summary: Log Analysis Tool Kit (latk)
rpm_license: GPLv2
rpm_vendor: Joe McManus
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Joe McManus <josephmc@andrew.cmu.edu>
location_href: LogAnalysisToolKit-1.7-1.fc23.src.rpm
checksum_type: sha256
description:
  The Log Analysis Tool Kit (LATK) is a tool suite for automated log file analysis. It can be used for day-to-day monitoring or in incident response.

  The tool suite consists of a commandline tool located in usr/bin and a web front end located in /var/www/html


pkgId: 2696057c14826a10ff2d0317d1a7997b6a4db078ec42b548b4fe2e88510ffa33
name: Volatility
arch: src
version: 2.5
epoch: 0
release: 3.fc23
summary: Tools for the extraction of digital artifacts from volatile memory (RAM) images
url: https://code.google.com/p/volatility/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: Volatility-2.5-3.fc23.src.rpm
checksum_type: sha256
description:
  The Volatility Framework is a completely open collection of tools,
  implemented in Python under the GNU General Public License, for the
  extraction of digital artifacts from volatile memory (RAM) images. The
  extraction techniques are performed completely independent of the system
  being investigated but offer unprecedented visibilty into the runtime
  state of the system. The framework is intended to introduce people to the
  techniques and complexities associated with extracting digital artifacts
  from volatile memory images and provide a platform for further work into
  this exciting area of research.

  The Volatility Framework demonstrates our committment to and belief
  in the importance of open source digital investigation tools. Volatile
  Systems is committed to the belief that the technical procedures used to
  extract digital evidence should be open to peer analysis and review. We
  also believe this is in the best interest of the digital investigation
  community, as it helps increase the communal knowledge about systems we
  are forced to investigate. Similarly, we do not believe the availability
  of these tools should be restricted and therefore encourage people to
  modify, extend, and make derivative works, as permitted by the GPL.


pkgId: 624ced0a2f7a67c473c8c9966556d10f55395bbd1973d69a4c5e65b845c92894
name: acr
arch: src
version: 1.4
epoch: 0
release: 1.fc23
summary: Reverse Engineering Framework
url: http://www.radare.org
rpm_license: LGPL-3.0
rpm_group: Development/Tools/Debuggers
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: acr-1.4-1.fc23.src.rpm
checksum_type: sha256
description:
  ACR tries to replace autoconf functionality generating a full-compatible 'configure' script (runtime flags).
  But using shell-script instead of m4. This means that ACR is faster, smaller and easy to use.


pkgId: bd332deec717b1d766d13dca7dac5fd70a01cf3ef63c20bbab38420bb391b945
name: aeskeyfind
arch: src
version: 1.0
epoch: 0
release: 4.fc23
summary: aeskeyfind - locate 128-bit and 256-bit AES keys in a captured memory image
url: https://citp.princeton.edu/research/memory/code/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: aeskeyfind-1.0-4.fc23.src.rpm
checksum_type: sha256
description:
  This program illustrates automatic techniques for locating 128-bit and
  256-bit AES keys in a captured memory image.

  The program uses various algorithms and also performs a simple entropy
  test to filter out blocks that are not keys. It counts the number of
  repeated bytes and skips blocks that have too many repeats.

  This method works even if several bits of the key schedule have been
  corrupted due to memory decay.

  This package is useful to several activities, as forensics investigations.


pkgId: 635c55a0539b918026356909c99d044070369584034867c9ca95fe8274981b41
name: afflib
arch: src
version: 3.7.4
epoch: 0
release: 2.fc23
summary: Library to support the Advanced Forensic Format
url: http://www.afflib.org
rpm_license: BSD with advertising
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: afflib-3.7.4-2.fc23.src.rpm
checksum_type: sha256
description:
  AFF® is an open and extensible file format designed to store disk images and
  associated metadata.
  afflib is library for support of the Advanced Forensic Format (AFF).


pkgId: 5f9591070decb9773e0b1c8a88540a28213175fbfeecdc60d75e996c46e9f0c5
name: analysis-pipeline
arch: src
version: 5.3.1
epoch: 0
release: 3.fc23
summary: Stream analysis of SiLK records
url: http://tools.netsa.cert.org/analysis-pipeline/
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: analysis-pipeline-5.3.1-3.fc23.src.rpm
checksum_type: sha256
description:
  The SiLK Analysis Pipeline can be added to the SiLK packing process to
  analyze flow records as they are collected by rwflowpack.


pkgId: 69fcc544d4e2c0e58250be61bd03063fe4d282edc6259b73246a1e4f9255d639
name: analyzeMFT
arch: src
version: 2.0.11
epoch: 0
release: 1.fc23
summary: analyzeMFT
url: https://github.com/dkovar/analyzeMFT
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: analyzeMFT-2.0.11-1.fc23.src.rpm
checksum_type: sha256
description:
  analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem
  and present the results as accurately as possible in multiple formats.


pkgId: b7f931662d8cdbbbce83424a58d291673041ad58e25d5f2b64698b223bef65f1
name: apfs-fuse
arch: src
version: 20180424
epoch: 0
release: 1.fc23
summary: A read-only FUSE driver for the new Apple File System
url: https://github.com/sgan81/apfs-fuse
rpm_license: GPL
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: apfs-fuse-20180424-1.fc23.src.rpm
checksum_type: sha256
description:
  This project is a read-only FUSE driver for the new Apple File System. Since Apple didn't
  yet document the disk format of APFS, this driver should be considered experimental.
  It may not be able to read all files, it may return wrong data, or it may simply crash.
  Use at your own risk. But since it's read-only, at least the data on your apfs drive should be safe.

  Be aware that not all compression methods are supported yet (only the ones I have encountered so far).
  Thus, the driver may return compressed files instead of uncompressed ones.


pkgId: 73b2c4416248314b79a73b0b2979d706391ce13b044572a84b4af5807bde110a
name: artifacts
arch: src
version: 20150409
epoch: 0
release: 1.fc23
summary: artifacts - knowledge base of forensic artifacts
url: https://pypi.python.org/pypi/artifacts/20150409
rpm_license: BSD
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: artifacts-20150409-1.fc23.src.rpm
checksum_type: sha256
description:
  Artifacts is a free, community-sourced, machine-readable knowledge base of forensic artifacts that
  the world can use both as an information source and within other tools.


pkgId: d5910b2817fed94c11acb44d895320d820c6a7db6bde84487ed4f23b7b80578d
name: autopsy
arch: src
version: 2.24
epoch: 0
release: 1.fc23
summary: Autopsy Forensic Browser
url: http://www.sleuthkit.org
rpm_license: GPL
rpm_group: System/Base
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: autopsy-2.24-1.fc23.src.rpm
checksum_type: sha256
description:
  The Autopsy Forensic Browser is a graphical interface to the
  command line digital forensic analysis tools in The Sleuth Kit.
  Together, The Sleuth Kit and Autopsy provide many of the same
  features as commercial digital forensics tools for the analysis
  of Windows(tm) and UNIX file systems (NTFS, FAT, FFS, EXT2FS,
  and EXT3FS).

  The Sleuth Kit and Autopsy are both Open Source and run on UNIX
  platforms. As Autopsy is HTML-based, the investigator can connect
  to the Autopsy server from any platform using an HTML browser.
  Autopsy provides a 'File Manager'-like interface and shows details
  about deleted data and file system structures.


pkgId: f899244af6303cf4f6ea2693911eb20082a87a0717f99a2d54f8efb8f87eea4b
name: autopsy
arch: src
version: 4.9.0
epoch: 0
release: 1.fc23
summary: Autopsy Forensic Browser
url: http://www.sleuthkit.org/sleuthkit/
rpm_license: ASL 2.0
rpm_group: System/Base
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: autopsy-4.9.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Autopsy is a graphical interface to The Sleuth Kit and other open source digital forensics tools.
  Autopsy 3 was a complete rewrite from Autopsy 2 to make it Java-based.
  Autopsy 4 improves on Autopsy 3 by supporting collaboration on a single case by multiple users.

  Although Autopsy is designed to be cross-platform (Windows, Linux, MacOSX), the current version
  is fully functional and fully tested only on Windows. We have run it on XP, Vista, and Windows
  7 with no problems.

  Autopsy 4 is released under the Apache 2.0 license.
  Some libraries Autopsy uses may have different, but similar, open source licenses.


pkgId: 535642f1b2409a0fd9ef86e3df13c79d46b2a9685a5995d068fdb6a9bb068e6c
name: bencode
arch: src
version: 1.0
epoch: 0
release: 1.fc23
summary: The BitTorrent bencode module as light-weight, standalone package.
url: http://bittorrent.com/
rpm_license: BitTorrent Open Source License
rpm_vendor: Thomas Rampelberg <thomas@bittorrent.com>
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: bencode-1.0-1.fc23.src.rpm
checksum_type: sha256
description:
  This package simply re-packages the existing bencoding and bdecoding implemention from the 'official' BitTorrent client as a separate, leight-weight package for re-using them without having the entire BitTorrent software as a dependency.


pkgId: 5aa648f3e60e02a296a7e91e332a8c360d64578f9eae90f415720d8c54af95b7
name: bloom
arch: src
version: 1.4.6
epoch: 0
release: 2.fc23
summary: NPS Bloom filter package (includes frag_find)
url: http://afflib.org/bloom
rpm_license: GPLv2+
rpm_group: Applications/File
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: bloom-1.4.6-2.fc23.src.rpm
checksum_type: sha256
description:
  NPS Bloom filter package (includes frag_find)

  frag_find is a program for finding blocks of one or more MASTER files in a disk IMAGE file. This is useful in cases where a MASTER file has been stolen and you wish to establish that the file has been present on a subject's drive. If most of the MASTER file's sectors are found on the IMAGE drive---and if the sectors are in consecutive sector runs---then the chances are excellent that the file was once there.


pkgId: 91f51e908b92444596bd8412c2853cbf690f9a5d0ea043e22fb1011f88c350f2
name: bokken
arch: src
version: 1.8
epoch: 0
release: 1.fc23
summary: GUI for the Pyew and Radare projects
url: http://www.radare.org
rpm_license: LGPL-3.0
rpm_group: Development/Tools/Debuggers
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: bokken-1.8-1.fc23.src.rpm
checksum_type: sha256
description:
  Bokken is a GUI for the Pyew and Radare projects so it offers almost all
  the same features that Pyew has and and some of the Radare's ones. It's
  intended to be a basic disassembler, mainly, to analyze malware and
  vulnerabilities.

  Currently Bokken is neither an hexadecimal editor nor a full featured
  disassembler YET, so it should not be used for deep code analysis or to
  try to modify files with it.


pkgId: eb445021e5ffb24b821f27d321379a52a30c6e4286cb0f1d71667644ea0549f8
name: bro
arch: src
version: 2.5.3
epoch: 0
release: 1.1.fc23
summary: Bro is a powerful framework for network analysis and security monitoring
url: http://bro.org
rpm_license: BSD-3-Clause
rpm_group: Productivity/Networking/Diagnostic
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: bro-2.5.3-1.1.fc23.src.rpm
checksum_type: sha256
description:
  Bro is a powerful network analysis framework that is much different from the
  typical IDS you may know.  While focusing on network security monitoring, Bro
  provides a comprehensive platform for more general network traffic analysis as
  well. Well grounded in more than 15 years of research, Bro has successfully
  bridged the traditional gap between academia and operations since its
  inception. Today, it is relied upon operationally in particular by many
  scientific environments for securing their cyberinfrastructure. Bro's user
  community includes major universities, research labs, supercomputing centers,
  and open-science communities.


pkgId: 8461576754278544659fd1fb61e3da395ef97a2aa3693074fb068423c4225b8c
name: bulk_extractor
arch: src
version: 1.5.5
epoch: 0
release: 2.fc23
url: http://digitalcorpora.org/downloads/bulk_extractor/
rpm_license: GPL
rpm_group: Applications/File
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: bulk_extractor-1.5.5-2.fc23.src.rpm
checksum_type: sha256
summary:
  bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information

description:
  bulk_extractor is a C++ program that scans a disk image, a file, or a
  directory of files and extracts useful information without parsing the
  file system or file system structures. Useful information currently
  includes email addresses, URLs, credit card numbers, EXIF data
  structures, KML files, AES encryption keys (from RAM), IP packets, and
  other kinds of forensicly important information. Results are stored in
  text files (called feature files)
  that can be easily inspected, parsed, or processed with automated
  tools. The program is multi-threaded and will use all available
  cores. bulk_extractor also created a histograms of features that it finds,
  as features that are more common tend to be more important.


pkgId: 946dc794e1ef6e1a6ac4152fd0cd795cb38988b30ac38c42305e1f2f51c8c977
name: cert-forensics-tools-release
arch: src
version: 23
epoch: 0
release: 11
summary: CERT Forensics Tools Freeword Respository Configuration
url: http://www.cert.org/forensics
rpm_license: BSD
rpm_group: System Environment/Base
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: cert-forensics-tools-release-23-11.src.rpm
checksum_type: sha256
description:
  cert forensics tools freeworld repository contains open source and other
  distributable software for Fedora and CentOS/RHEL.

  This package contains the repository GPG key as well as configuration
  for the Yum, Smart, and APT-RPM package managers.


pkgId: dbbdd390a9895e6268c37623498f688a913b5b475fddb8782c9eee0a7c2b1ac5
name: dc3dd
arch: src
version: 7.2.641
epoch: 0
release: 1.fc23
summary: Enhanced version of dd that includes features useful for forensics
url: http://dc3dd.sourceforge.net/
rpm_license: GPLv2+ and GPLv3+
rpm_group: Applications/Editors
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: dc3dd-7.2.641-1.fc23.src.rpm
checksum_type: sha256
description:
  dc3dd is a patched version of GNU dd to include a number of features useful
  for computer forensics. Many of these features were inspired by dcfldd, but
  were rewritten for dc3dd.

      * Pattern writes. The program can write a single hexadecimal value or a
      text string to the output device for wiping purposes.
      * Piecewise and overall hashing with multiple algorithms and variable
      size windows. Supports MD5, SHA-1, SHA-256, and SHA-512. Hashes can be
      computed before or after conversions are made.
      * Progress meter with automatic input/output file size probing
      * Combined log for hashes and errors
      * Error grouping. Produces one error message for identical sequential
      errors
      * Verify mode. Able to repeat any transformations done to the input
      file and compare it to an output.
      * Ability to split the output into chunks with numerical or alphabetic
      extensions


pkgId: ff98a6c85e828e386756330f16ee1c7312beb552ae6bc40a8bd8df66079c421c
name: dd_rescue
arch: src
version: 1.99
epoch: 0
release: 1.fc23
summary: Fault tolerant "dd" utility for rescuing data from bad media
url: http://www.garloff.de/kurt/linux/ddrescue/
rpm_license: GPL+
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: dd_rescue-1.99-1.fc23.src.rpm
checksum_type: sha256
description:
  ddrescue is a utility similar to the system utility "dd" which copies
  data from a file or block device to another. ddrescue does however
  not abort on errors in the input file. This makes it suitable for
  rescuing data from media with errors, e.g. a disk with bad sectors.

  This package includes dd_rhelp, a wrapper script facilitating data
  recovery.


pkgId: b40049a983d65454751703fbb75bb13afa6712af4b4b3f962a80caa99d90f8d0
name: ddrescue
arch: src
version: 1.20
epoch: 0
release: 1.fc23
summary: Data recovery tool trying hard to rescue data in case of read errors
url: http://www.gnu.org/software/ddrescue/ddrescue.html
rpm_license: GPLv2+
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ddrescue-1.20-1.fc23.src.rpm
checksum_type: sha256
description:
  GNU ddrescue is a data recovery tool. It copies data from one file or block
  device (hard disc, cd-rom, etc) to another, trying hard to rescue data in
  case of read errors. GNU ddrescue does not truncate the output file if not
  asked to. So, every time you run it on the same output file, it tries to
  fill in the gaps.


pkgId: 8fdc17a4659c4f1c90fa89d394364510c7ce2c40616dd8b71aedeba5b536312f
name: ddrescueview
arch: src
version: 0.3
epoch: 0
release: 1.fc23
summary: Graphically examine ddrescue's log files in a user friendly GUI
url: http://sourceforge.net/projects/ddrescueview/
rpm_license: GPL
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ddrescueview-0.3-1.fc23.src.rpm
checksum_type: sha256
description:
  This small tool allows the user to graphically examine ddrescue's log files
  in a user friendly GUI application. The Main window displays a block grid with
  each block's color representing the block types it contains. Many people know
  this type of view from defragmentation programs.  The program is written in
  Object Pascal using the Lazarus IDE. It can be compiled to run on Windows,
  GNU/Linux and probably OS X, too.  The downloads include binaries for the
  respective target platform and the project files (source code).


pkgId: e2fb180e154149b9925d08c9f675bbd25e22898a42a0aef73a39ec1fc27722dd
name: ddrutility
arch: src
version: 2.7
epoch: 0
release: 1.fc23
summary: ddrutility - Utility for use with gnuddrescue to aid with data recovery
url: http://sourceforge.net/projects/ddrutility/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ddrutility-2.7-1.fc23.src.rpm
checksum_type: sha256
description:
  Ddrutility is meant to be a compliment to gnuddrescue. It is a set of
  utilities to help with hard drive data rescue. It currently contains
  the following utilities:

  	ddru_findbad
  	ddru_ntfsbitmap
  	ddru_ntfsfindbad (NEW)

  Please see the Wiki (http://sourceforge.net/p/ddrutility/wiki/Home/) or
  the help files for full documentation (note that the Wiki page does not
  seem to navigate properly, sorry). The readme file contains the latest
  news of updates, and can be viewed as text on the Files page.


pkgId: a07894a0999b643bbf12a7491c6ba1bde48100b8aaf8d73b020d80c21ca295d7
name: dfdatetime
arch: src
version: 20160706
epoch: 0
release: 1.fc23
summary: Digital Forensics Date and Time (dfDateTime).
url: https://github.com/log2timeline/dfdatetime
rpm_license: Apache License, Version 2.0
rpm_vendor: dfDateTime development team <log2timeline-dev@googlegroups.com>
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: log2timeline development team <log2timeline-dev@googlegroups.com>
location_href: dfdatetime-20160706-1.fc23.src.rpm
checksum_type: sha256
description:
  dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.


pkgId: 384fa1044976d2c4b58fc3e001ddfffa88f20bf391c80a69b58b943abb579bf0
name: dff
arch: src
version: 1.3.5.20150908
epoch: 0
release: 2.fc23
summary: dff - open source digital investigation framework
url: http://www.digital-forensic.org/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: dff-1.3.5.20150908-2.fc23.src.rpm
checksum_type: sha256
description:
  The Digital Forensics Framework (DFF) is both a digital investigation
  tool and a development platform. The framework is used by system
  administrators, law enforcement examinors, digital forensics researchers
  and students, and security professionals world-wide. Written in Python
  and C++, it exclusively uses Open Source technologies.
  DFF combines an intuitive user interface with a modular and cross-platform
  architecture.


pkgId: 75c10b510ce2819687ced895add06c604b35144e7ff5650f6496893a3dca21a5
name: dfvfs
arch: src
version: 20160203
epoch: 0
release: 1.fc23
summary: Digital Forensics Virtual File System (dfVFS).
url: https://code.google.com/p/dfvfs
rpm_license: Apache License, Version 2.0
rpm_vendor: "Log2Timeline developer" <log2timeline-dev@googlegroups.com>
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: dfvfs-20160203-1.fc23.src.rpm
checksum_type: sha256
description:
  dfVFS, or Digital Forensics Virtual File System, is a Python module that provides read-only access to file-system objects from various storage media types and file formats.


pkgId: 927d9ea884e2d82b563f48c5c215e8bebaca6965a4b6f4b22b774e9223edb7a2
name: dfwinreg
arch: src
version: 20160116
epoch: 0
release: 1.fc23
summary: Library that provides read-only access to Windows Registry objects
url: https://github.com/log2timeline/dfwinreg
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: dfwinreg-20160116-1.fc23.src.rpm
checksum_type: sha256
description:
  dfWinReg, or Digital Forensics Windows Registry, provides read-only
  access to Windows Registry objects. The goal of dfWinReg is to provide a
  generic interface for accessing Windows Registry objects that resembles
  the Registry key hierarchy as seen on a live Windows system.

  dfWinReg originates from the Plaso project and is also based on ideas
  from the winreg-kb project. It was largely rewritten and made into a
  stand-alone project to provide more flexibility and allow other projects
  to make use of Windows Registry functionality.


pkgId: b14ff2cb62d784e29b1c8bff12d7ff83b492f4be4e31a68830c0a508ff21a4ba
name: disktype
arch: src
version: 9
epoch: 0
release: 15.fc23
summary: Detect the content format of a disk or disk image
url: http://disktype.sourceforge.net/
rpm_license: MIT
rpm_group: Applications/File
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: disktype-9-15.fc23.src.rpm
checksum_type: sha256
description:
  The purpose of disktype is to detect the content format of a disk or disk
  image. It knows about common file systems, partition tables, and boot codes.


pkgId: 118bc7dfa883cf435d17a61f0b33d326118c062e5ee3c95c3e83b7dfccfc3826
name: dislocker
arch: src
version: 0.7.1
epoch: 0
release: 1.fc23
summary: Utility to access BitLocker encrypted volumes
url: https://github.com/Aorimn/dislocker
rpm_license: GPLv2+
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: dislocker-0.7.1-1.fc23.src.rpm
checksum_type: sha256
description:
  Dislocker has been designed to read BitLocker encrypted partitions ("drives")
  under a Linux system. The driver used to only read volumes encrypted under a
  Microsoft Windows 7 system - but is now Microsoft Windows Vista and 8 capable
  and has the write functionality.

  The file name where the BitLocker encrypted partition will be decrypted needs
  to be given. This may take a long time, depending on the size of the encrypted
  partition. But afterward, once the partition is decrypted, the access to the
  NTFS partition will be faster than with FUSE. Another thing to think about is
  the size of the disk (same size as the volume that is tried to be decrypted).
  Nevertheless, once the partition is decrypted, the file can be mounted as any
  NTFS partition and won't have any link to the original BitLocker partition.


pkgId: 1f7924fd71a1e64b3208bf96cc12e15bf786f64da6502ecf215315f3d4b1a972
name: distorm3
arch: src
version: 3.1
epoch: 0
release: 1.fc23
summary: distorm3 - binary stream disassembler library
url: https://code.google.com/p/distorm/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: distorm3-3.1-1.fc23.src.rpm
checksum_type: sha256
description:
  diStorm is a lightweight, easy-to-use and fast decomposer library.  It disassembles instructions in 16, 32 and 64 bit modes.
  Supported instruction sets: FPU, MMX, SSE, SSE2, SSE3, SSSE3, SSE4, 3DNow! (w/ extensions), new x86-64 instruction sets, VMX, AMD's SVM and AVX!


pkgId: 1dfd15cf5becdf5409cf2c063ff797e5b8c4eaf96caf0e89a84c2e60832cadfa
name: efilter-1
arch: src
version: 1.5
epoch: 0
release: 1.fc23
url: https://pypi.python.org/pypi/efilter
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: efilter-1-1.5-1.fc23.src.rpm
checksum_type: sha256
summary:
  EFILTER is a general-purpose destructuring and search language implemented in Python, and suitable for integration with any Python project that requires a search function for some of its data.

description:
  EFILTER is a general purpose query language designed to be embedded in
  Python applications and libraries. It supports SQL-like syntax to filter
  your application's data and provides a convenient way to directly search
  through the objects your applications manages.

  A second use case for EFILTER is to translate queries from one query
  language to another, such as from SQL to OpenIOC and so on. A basic
  SQL-like syntax and a POC lisp implementation are included with the
  language, and others are relatively simple to add.


pkgId: 0e6594fbd9e31c151bb09bb230a1971c70770a6ed88afff2466d05e2f2c2e9bd
name: epub
arch: src
version: 0.5.0
epoch: 0
release: 1.fc23
summary: Extract thumbnails and associated metadata from the Thumbs.db files
url: http://pypi.python.org/pypi/epub/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: epub-0.5.0-1.fc23.src.rpm
checksum_type: sha256
description:
  EPUB is the distribution and interchange format standard for digital
  publications and documents based on Web Standards. EPUB defines a moyen de
  Representing, packaging and encoding structured and Semantically enhanced
  Web content - Including XHTML, CSS, SVG, images, and other resources -
  for distribution in a single-file format.

  EPUB allows publishers to Produce and send a single digital publication
  file through distribution and offers interoperability Between Consumers
  software / hardware for unencrypted reflowable digital books and other
  publications.


pkgId: 0393318325ddce630ca8dff85bdd4207fe73fa5304111272d526e6523334e342
name: fatback
arch: src
version: 1.3
epoch: 0
release: 1.fc23
summary: Undelete files from FAT file systems
url: http://xsanlahci.org/2013/03/24/fatback-forensics-tool/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fatback-1.3-1.fc23.src.rpm
checksum_type: sha256
description:
  Fatback is a forensic tool for undeleting files from Microsoft FAT
  file systems.  Fatback is different from other undelete tools in that
  it does the following:

     * Runs under UNIX environments (only Linux and FreeBSD tested so far)

     * Can undelete files automatically

     * Supports Long File Names

     * Supports FAT12, FAT16, and FAT32

     * Powerful interactive mode

     * Recursively undeletes deleted directories

     * Recovers lost cluster chains

     * Works with single partitions or whole disks

     Fatback was developed by the U.S. Department of Defense Computer
  Forensics Laboratory (<http://www.dcfl.gov>) and is authorized for
  *government and law enforcement use only*.


pkgId: 5c1c6f65e9a228e18df446ea5866e587bdab9c0ac021febca42fd679ba19d522
name: fcrackzip
arch: src
version: 1.0
epoch: 0
release: 1.fc23
summary: fcrackzip - a Free/Fast Zip Password Cracker
url: http://oldhome.schmorp.de/marc/fcrackzip.html
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fcrackzip-1.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Fcrackzip searches each zipfile given for encrypted files and tries to
  guess the password. All files must be encrypted with the same password,
  the more files you provide, the better.


pkgId: ac917fdc077ad485dad68c3eef60a225f92ad1200ae63844e2705d1c1dcc77aa
name: ffmpeg
arch: src
version: 2.8.1
epoch: 0
release: 1.fc23
summary: Digital VCR and streaming server
url: http://ffmpeg.org/
rpm_license: GPLv2+
rpm_vendor: RPM Fusion
rpm_group: Unspecified
rpm_buildhost: arm-cl01.kwizart.net
rpm_packager: http://free.rpmfusion.org/
location_href: ffmpeg-2.8.1-1.fc23.src.rpm
checksum_type: sha256
description:
  FFmpeg is a complete and free Internet live audio and video
  broadcasting solution for Linux/Unix. It also includes a digital
  VCR. It can encode in real time in many formats including MPEG1 audio
  and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.


pkgId: e75cf49f79291a0204840c20c40ff30d93ca51ba8503c1334ff524f7c6007c16
name: fmem-kernel-modules-common
arch: src
version: 1.6
epoch: 0
release: 1.6
summary: This package contains the source code for making FMEM Modules
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-6-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-common-1.6-1.6.src.rpm
checksum_type: sha256
description:
  This package provides a script to install and use the kernel objects.
  These modules are now packaged separately.
  This package is intended to be shared across all OSes and architectures


pkgId: d8551b3436a361e897e53d67303b88ac4117b8d873aa48002e53adf5c3753799
name: fmem-kernel-modules-el9-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.14
description: This package provides kernel objects for CentOS 9 Stream x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-9-stream-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-el9-x86_64-1.6-1.14.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for CentOS 9 Stream x86_64 for FMEM


pkgId: 0b5a6de1c10179c2fe310d91c1fa109f77d4eb0dc55e9cb528fa2249862102de
name: fmem-kernel-modules-fc22-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.36
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-22-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc22-x86_64-1.6-1.36.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 22 x86_64 for FMEM


pkgId: 9bae30c49cded5e248435ca889c78d8befda71788ee0ba5a48208be8e0246a93
name: fmem-kernel-modules-fc23-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.36
description: This package provides kernel objects for Fedora 23 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc23-x86_64-1.6-1.36.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 23 x86_64 for FMEM


pkgId: 9467f98efe59735fe7615e0f02bb6a79f43951b41b6deb2937c16a5077253993
name: fmem-kernel-modules-fc24-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.47
description: This package provides kernel objects for Fedora 23 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-24-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc24-x86_64-1.6-1.47.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 24 x86_64 for FMEM


pkgId: 62b668ba84aa638df6204b26041e9345205b257204df8ec72a71bf1eddcc3f9a
name: fmem-kernel-modules-fc25-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.50
description: This package provides kernel objects for Fedora 23 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-25-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc25-x86_64-1.6-1.50.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 25 x86_64 for FMEM


pkgId: f2147b831222c419d03ba58d1207163e67bf9f3d3ddfb92a237150494aeb344c
name: fmem-kernel-modules-fc26-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.38
description: This package provides kernel objects for Fedora 26 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-26-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc26-x86_64-1.6-1.38.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 26 x86_64 for FMEM


pkgId: 43322fa79c2f0ac4eb80af2b97b330dd54b11b4e381456586082211fbf57d41a
name: fmem-kernel-modules-fc27-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.44
description: This package provides kernel objects for Fedora 23 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-27-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc27-x86_64-1.6-1.44.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 27 x86_64 for FMEM


pkgId: 92cde26acd46c8d9c841c0a6cabd9a22cc43afad7cc2c3f18761a5bc959aecc4
name: fmem-kernel-modules-fc28-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.42
description: This package provides kernel objects for Fedora 28 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-28-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc28-x86_64-1.6-1.42.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 28 x86_64 for FMEM


pkgId: 0e12e96bdb09bc0e4d9e20f19d767afb736b35501e13060af5f2e4414880e3b7
name: fmem-kernel-modules-fc29-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.37
description: This package provides kernel objects for Fedora 29 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-29-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc29-x86_64-1.6-1.37.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 29 x86_64 for FMEM


pkgId: 258995ad090b11f04f9b5e7e33a239ba36daac70b8b74ff67ca4a645c582c925
name: fmem-kernel-modules-fc30-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.39
description: This package provides kernel objects for Fedora 30 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-30-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc30-x86_64-1.6-1.39.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 30 x86_64 for FMEM


pkgId: 098505e741e0a7ba93dfbea1d068abcf85199be4fb5f476446bba90f6914289e
name: fmem-kernel-modules-fc31-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.40
description: This package provides kernel objects for Fedora 31 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-31-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc31-x86_64-1.6-1.40.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 31 x86_64 for FMEM


pkgId: db047bf1edfa2811610636e48b1352ccd77390f14eb0058a2a896f1cc69a1a36
name: fmem-kernel-modules-fc32-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.46
description: This package provides kernel objects for Fedora 32 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-32-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc32-x86_64-1.6-1.46.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 32 x86_64 for FMEM


pkgId: 4871be865e78f187b544a2f32bbf6cbeda9e9b1ebc8ff81c4c998d6f9ae120ae
name: fmem-kernel-modules-fc33-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.46
description: This package provides kernel objects for Fedora 33 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-33-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc33-x86_64-1.6-1.46.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 33 x86_64 for FMEM


pkgId: 8095b7090ba13734c7d31c253978e589855ce3a0632f507493c559c3bc8c1e14
name: fmem-kernel-modules-fc34-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.51
description: This package provides kernel objects for Fedora 34 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-34-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc34-x86_64-1.6-1.51.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 34 x86_64 for FMEM


pkgId: 5c8a0c998945952ee0a42eec8c0c3b6f3a75924e1e3f29fb3b0e65a53221ee8d
name: fmem-kernel-modules-fc35-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.41
description: This package provides kernel objects for Fedora 35 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-35-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc35-x86_64-1.6-1.41.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 35 x86_64 for FMEM


pkgId: e26283f858374702a0fd704128fc655896f80bb9de472ae1e3f2cdac202a8cf8
name: fmem-kernel-modules-fc36-x86_64
arch: src
version: 1.6
epoch: 0
release: 1.17
description: This package provides kernel objects for Fedora 36 x86_64-based systems.
url: http://hysteria.sk/~niekt0/fmem/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-36-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fmem-kernel-modules-fc36-x86_64-1.6-1.17.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 36 x86_64 for FMEM


pkgId: 6a377a5a4e7c38d27cd6a01ca7ce4bafff5a59c250a572a31e3b59906f8b1ce8
name: foremost
arch: src
version: 1.5.7
epoch: 0
release: 13.1.fc23
summary: Recover files by "carving" them from a raw disk
url: http://foremost.sf.net
rpm_license: Public Domain
rpm_group: Applications/File
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: foremost-1.5.7-13.1.fc23.src.rpm
checksum_type: sha256
description:
  Foremost recovers files files based on their headers, footers, and internal
  data structures. This process is commonly referred to as data carving.
  Foremost can work on a raw disk drive or image file generated by dd.  The
  headers and footers can be specified by a configuration file or you can use
  command line switches to specify built-in file types. These built-in types
  look at the data structures of a given file format allowing for a more
  reliable and faster recovery.


pkgId: b6fe298e5485e18e185e8e15bcf13ba9880a9a8740a14d17d373b36a898ae62d
name: frag_find
arch: src
version: 1.0.0
epoch: 0
release: 1.fc23
summary: NPS Bloom Filter Package
url: http://www.afflib.org/
rpm_license: Public Domain (USG Software; no license)
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: frag_find-1.0.0-1.fc23.src.rpm
checksum_type: sha256
description:
  frag_find is the a bloom filter package developed by the Naval Postgraduate School.
  It includes C, C++ and Java implementations, as well as some handy tools.


pkgId: bde5ef946258239f821ea42ac97b43f3d011b6fe5421a13124d2a41384e7ec87
name: fred
arch: src
version: 0.1.1
epoch: 0
release: 1.fc23
summary: Microsoft registry hive editor
url: https://www.pinguin.lu/index.php
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: fred-0.1.1-1.fc23.src.rpm
checksum_type: sha256
description:
  Forensic Registry EDitor (fred) is a cross-platform M$ registry hive
  editor. This project was born out of the need for a reasonably good registry
  hive viewer for Linux to conduct forensic analysis. Therefore it includes
  some functions not found in normal "free" registry editors like a hex viewer
  with data interpreter and a reporting function that can easily be extended
  with custom ECMAScript report templates. The current version contains the
  following reports: NTUSER_RecentDocs, NTUSER_TypedUrls, SAM_UserAccounts,
  SOFTWARE_WindowsVersion, SYSTEM_CurrentNetworkSettings, SYSTEM_SystemTimeInfo
  and SYSTEM_UsbStorageDevices.


pkgId: 40e33eb41da49b0caf316c1e000709989217444dc7fa072923c34c938ea0e90e
name: fuse-exfat
arch: src
version: 1.0.1
epoch: 0
release: 1.fc23
summary: Free exFAT file system implementation
url: http://code.google.com/p/exfat/
rpm_license: GPLv3+
rpm_group: System Environment/Base
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: fuse-exfat-1.0.1-1.fc23.src.rpm
checksum_type: sha256
description:
  This driver is the first free exFAT file system implementation with write
  support. exFAT is a simple file system created by Microsoft. It is intended
  to replace FAT32 removing some of it's limitations. exFAT is a standard FS
  for SDXC memory cards.


pkgId: bd13bfa2abaf555fe42b96c75d7b9c942d2551a2e5ff344614a0db40fa0ea85a
name: future
arch: src
version: 0.16.0
epoch: 0
release: 4.fc23
summary: Easy, clean, reliable Python 2/3 compatibility
url: http://python-future.org/
rpm_license: MIT
rpm_group: Applications/Engineering
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: future-0.16.0-4.fc23.src.rpm
checksum_type: sha256
description:
  future is the missing compatibility layer between Python 2 and
  Python 3. It allows you to use a single, clean Python 3.x-compatible
  codebase to support both Python 2 and Python 3 with minimal overhead.

  It provides ``future`` and ``past`` packages with backports and forward
  ports of features from Python 3 and 2. It also comes with ``futurize`` and
  ``pasteurize``, customized 2to3-based scripts that helps you to convert
  either Py2 or Py3 code easily to support both Python 2 and 3 in a single
  clean Py3-style codebase, module by module.


pkgId: 176754921b41de3733705990bd751d0e305c4b7d481b0a32bb200677a7288dff
name: galleta
arch: src
version: 20040505_1
epoch: 0
release: 1.fc23
summary: Examine the contents of cookie files
url: http://sourceforge.net/projects/odessa/files/Galleta/
rpm_license: GPL
rpm_vendor: lrr@cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: galleta-20040505_1-1.fc23.src.rpm
checksum_type: sha256
description:
  Galleta, the Spanish word meaning "cookie", was developed to examine the
  contents of the cookie files. Galleta will parse the information in a
  Cookie file and output the results in a field delimited manner so that
  it may be imported into your favorite spreadsheet program. Galleta is
  built to work on multiple platforms and will execute on Windows (through
  Cygwin), Mac OS X, Linux, and *BSD platforms.


pkgId: c4d71536d24bc3ca41fad334c5bdeb0727a350db94d4aa142daa932695333ea9
name: ghostpdl
arch: src
version: 9.18
epoch: 0
release: 1.fc23
summary: Artifex Software's implementation of the PCL-5™ and PCL-XL™ family of page description languages
url: https://code.google.com/p/ghostscript/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ghostpdl-9.18-1.fc23.src.rpm
checksum_type: sha256
description:
  GhostPDL is Artifex Software's implementation of the PCL-5™ and PCL-XL™ family of page description languages.


pkgId: 1852bdd3892828f4a87dc1c2a554b43936463ba725fec0bae9ac6e1b436d7c2f
name: grokevt
arch: src
version: 0.5.0
epoch: 0
release: 2.fc23
summary: Read and process Windows Event Files
url: http://projects.sentinelchicken.org/grokevt/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: grokevt-0.5.0-2.fc23.src.rpm
checksum_type: sha256
description:
  GrokEVT is a collection of scripts built for reading Windows NT event
  log files. GrokEVT is released under the GNU GPL, and is implemented
  in Python. GrokEVT is loosely based on the PHP script and documentation
  provided by Jamie French.

  Currently the scripts work together on one or more mounted Windows
  partitions to extract all information needed (registry entries, message
  templates, and log files) to convert the logs to a human-readable format.


pkgId: 402321d800b46468abf09b601c43c92989075c33db63a8db2ff4283ec72949c9
name: guymager
arch: src
version: 0.7.4
epoch: 0
release: 2.fc23
summary: Imager for forensic media acquisition
url: http://guymager.sourceforge.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: guymager-0.7.4-2.fc23.src.rpm
checksum_type: sha256
description:
  guymager is an imager for forensic media acquisition. Its main features are:

      * Easy user interface in different languages
      * Runs under Linux
      * Multi-threaded design, multi-threaded data compression
      * Makes full usage of multi-processor machines
      * Generates flat (dd) and EWF (E01) images


pkgId: f55af93ad791438561bf01311458251336f40e9108a8a0cb7d7429874271e37c
name: hachoir-core
arch: src
version: 1.3.4
epoch: 0
release: 1.fc23
summary: Library for carving binary files
url: https://bitbucket.org/haypo/hachoir/wiki/Home
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: hachoir-core-1.3.4-1.fc23.src.rpm
checksum_type: sha256
description:
  Hachoir is a Python library used to represent of a binary file as a tree of
  Python objects. Each object has a type, a value, an address, etc. The goal is
  to be able to know the meaning of each bit in a file.

  Why using slow Python code instead of fast hardcoded C code? Hachoir has many
  interesting features:

   * Autofix: Hachoir is able to open invalid / truncated files
   * Lazy: Open a file is very fast since no information is read from file,
     data are read and/or computed when the user ask for it
   * Types: Hachoir has many predefined field types (integer, bit, string, etc.)
     and supports string with charset (ISO-8859-1, UTF-8, UTF-16, ...)
   * Addresses and sizes are stored in bit, so flags are stored as classic fields
   * Endian: You have to set endian once, and then number are converted in the
     right endian
   * Editor: Using Hachoir representation of data, you can edit, insert, remove
     data and then save in a new file.


pkgId: 8aebf9de29b233a05d5f8213412b9f8e2731eedf1765f94c79c8380a32446623
name: hachoir-metadata
arch: src
version: 1.3.3
epoch: 0
release: 2.fc23
summary: Extracts metadata from multimedia files
url: https://bitbucket.org/haypo/hachoir/wiki/Home
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: hachoir-metadata-1.3.3-2.fc23.src.rpm
checksum_type: sha256
description:
  hachoir-metadata extracts metadata from multimedia files: music, picture,
  video, but also archives. It supports most common file formats:

   * Archives: bzip2, gzip, zip, tar
   * Audio: MPEG audio ("MP3"), WAV, Sun/NeXT audio, Ogg/Vorbis (OGG), MIDI,
     AIFF, AIFC, Real audio (RA)
   * Image: BMP, CUR, EMF, ICO, GIF, JPEG, PCX, PNG, TGA, TIFF, WMF, XCF
   * Misc: Torrent
   * Program: EXE
   * Video: ASF format (WMV video), AVI, Matroska (MKV), Quicktime (MOV),
     Ogg/Theora, Real media (RM)

  It tries to give as much information as possible. For some file formats,
  it gives more information than libextractor for example, such as the RIFF
  parser, which can extract creation date, software used to generate the file,
  etc. But hachoir-metadata cannot guess informations. The most complex operation
  is just to compute duration of a music using frame size and file size.

  hachoir-metadata has three modes:

   * classic mode: extract metadata, you can use --level=LEVEL to limit quantity
     of information to display (and not to extract)
   * --type: show on one line the file format and most important informations
   * --mime: just display file MIME type

  The command 'hachoir-metadata --mime' works like 'file --mime',
  and 'hachoir-metadata --type' like 'file'. But today file command supports
  more file formats then hachoir-metadata.

  Website: http://bitbucket.org/haypo/hachoir/wiki/hachoir-metadata


pkgId: cf1257a3ca5ec938bee8938072e4cc33d4e325bd11a72b8a69e658458dc2af07
name: hachoir-parser
arch: src
version: 1.3.5
epoch: 0
release: 1.fc23
summary: File format parser fo hachoir suite
url: https://bitbucket.org/haypo/hachoir/wiki/Home
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: hachoir-parser-1.3.5-1.fc23.src.rpm
checksum_type: sha256
description:
  Hachoir framework. Not all parsers are complete, some are very good and other
  are poor: only parser first level of the tree for example.

  A perfect parser have no "raw" field: with a perfect parser you are able to
  know *each* bit meaning. Some good (but not perfect ;-)) parsers:

   * Matroska video
   * Microsoft RIFF (AVI video, WAV audio, CDA file)
   * PNG picture
   * TAR and ZIP archive

  GnomeKeyring parser requires Python Crypto module:
  http://www.amk.ca/python/code/crypto.html

  Website: http://bitbucket.org/haypo/hachoir/wiki/hachoir-parser


pkgId: c04714c056f0c70cb0a02a17e716c5009a330ee7d8b71c8dda3b2dc1fdc45979
name: hachoir-regex
arch: src
version: 1.0.5
epoch: 0
release: 1.fc23
summary: A Python library for regular expression (regex or regexp) manupulation
url: https://bitbucket.org/haypo/hachoir/wiki/Home
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: hachoir-regex-1.0.5-1.fc23.src.rpm
checksum_type: sha256
description:
  hachoir-regex is a Python library for regular expression (regex or regexp)
  manupulation. You can use a|b (or) and a+b (and) operators. Expressions are
  optimized during the construction: merge ranges, simplify repetitions, etc.
  It also contains a class for pattern matching allowing to search multiple
  strings and regex at the same time.

  Website: http://bitbucket.org/haypo/hachoir/wiki/hachoir-regex


pkgId: 4b429939035944c309b790ec143541c58c8f1554143f3806c3f566476d54f907
name: hachoir-subfile
arch: src
version: 0.5.3
epoch: 0
release: 1.fc23
summary: A tool based on hachoir-parser to find subfiles in any binary stream
url: https://bitbucket.org/haypo/hachoir/wiki/Home
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: hachoir-subfile-0.5.3-1.fc23.src.rpm
checksum_type: sha256
description:
  hachoir-subfile is a tool based on hachoir-parser to find subfiles in any binary stream.

  Website: http://bitbucket.org/haypo/hachoir/wiki/hachoir-subfile


pkgId: 6b77e5edd35171d486488ec0d61e790adbc5408b4f0d7c3ef4d0b026011b7fdb
name: hachoir-urwid
arch: src
version: 1.1
epoch: 0
release: 1.fc23
summary: A binary file explorer based on Hachoir library to parse the files
url: https://bitbucket.org/haypo/hachoir/wiki/Home
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: hachoir-urwid-1.1-1.fc23.src.rpm
checksum_type: sha256
description:
  hachoir-urwid is a binary file explorer based on Hachoir library to parse the
  files. Using this tool you can exactly know the meaning of each bit/byte of
  your files. With direction keys, you can navigate in the field tree. The key
  'h' will disable 'human display' and switch to 'raw display'. It's sometime
  useful when you would like to compare hexadecimal data and Hachoir
  reprensentation.

  Website: http://bitbucket.org/haypo/hachoir/wiki/hachoir-urwid


pkgId: c48cad50002f0e2fb18a9e356b55bf0fc2c9257fb6a4fe8d6df17688626bab0c
name: hachoir-wx
arch: src
version: 0.3.1
epoch: 0
release: 1.fc23
summary: A wxWidgets-based program that provides a user-friendly interface to hachoir-parser
url: https://bitbucket.org/haypo/hachoir/wiki/Home
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: hachoir-wx-0.3.1-1.fc23.src.rpm
checksum_type: sha256
description:
  hachoir-wx is a wxWidgets-based program that's meant to provide a
  (more) user-friendly interface to the facilities provided by the
  hachoir binary parser core.

  For latest updates, to ask for a feature (please do!), and
  bleeding(-edge) source code see the website:
  http://bitbucket.org/haypo/hachoir/wiki/hachoir-wx

  Everyone is very welcome to contribute code =)


pkgId: dd743f4b40fdecaec8bb96c2ab001f6489c3b8637d3ac710e210d54d7c3fc53c
name: hashcat
arch: src
version: 3.00
epoch: 0
release: 1.fc23
summary: Advanced password recovery
url: https://hashcat.net/hashcat
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: hashcat-3.00-1.fc23.src.rpm
checksum_type: sha256
description:
  Hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack
  for over 160 highly-optimized hashing algorithms. hashcat currently supports CPU's, GPU's other hardware-accelerators
  on Linux, Windows and OSX, and has facilities to help enable distributed password cracking.


pkgId: 541546bca5209eba6734833590856d7cd031c4346f7029e351241d8b24ec5eb5
name: ip4r
arch: src
version: 2.0.2
epoch: 0
release: 1.fc23
summary: IPv4 and IPv4 range index types for PostgreSQL
url: http://pgfoundry.org/projects/ip4r
rpm_license: BSD
rpm_group: Applications/Databases
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: ip4r-2.0.2-1.fc23.src.rpm
checksum_type: sha256
description:
  ip4 and ip4r are types that contain a single IPv4 address and a range of
  IPv4 addresses respectively. They can be used as a more flexible,
  indexable version of the cidr type.


pkgId: 7bffaa57dc1ae4e18640c040a8627d409e98c81d56a40d8477f7f71136b0b8db
name: ipa
arch: src
version: 0.5.2
epoch: 0
release: 3.fc23
summary: IP Association Library
url: http://tools.netsa.cert.org/ipa
rpm_license: LGPLv2
rpm_vendor: CERT Network Situational Awareness <netsa-help@cert.org>
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: ipa-0.5.2-3.fc23.src.rpm
checksum_type: sha256
description:
  IPA (IP Association) is a library for maintaining associations between IP
  addresses and any number of labels which categorize those addresses.


pkgId: 6413e94aa85d16c946307e5266702918670d014f6a08d3b165baedb2cbdd1f71
name: jafat
arch: src
version: 1.1.6
epoch: 0
release: 2.fc23
summary: JAFAT is an assortment of tools to assist in the forensic investigation of computer systems.
url: http://jafat.sourceforge.net
rpm_license: GPLv2+
rpm_group: Applications/File
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: jafat-1.1.6-2.fc23.src.rpm
checksum_type: sha256
description:
  JAFAT is an assortment of tools to assist in the forensic investigation of computer systems, the included tools are:
  - cookie_cruncher.pl
  - dumpster_dive.pl
  - lnk-parse.pl
  - UserAssist.pl
  - Safari Forensic Tools suite


pkgId: 150c533f6503cc1cf0f69fc4911aa5194577390643311befdc7972a8ff37841a
name: lame
arch: src
version: 3.99.5
epoch: 0
release: 5.fc23
summary: Free MP3 audio compressor
url: http://lame.sourceforge.net/
rpm_license: GPLv2+
rpm_vendor: RPM Fusion
rpm_group: Applications/Multimedia
rpm_buildhost: arm-cl01.kwizart.net
rpm_packager: http://free.rpmfusion.org/
location_href: lame-3.99.5-5.fc23.src.rpm
checksum_type: sha256
description:
  LAME is an open source MP3 encoder whose quality and speed matches
  commercial encoders. LAME handles MPEG1,2 and 2.5 layer III encoding
  with both constant and variable bitrates.


pkgId: 8a4a56fe768b00063466a61d3939c89e80c915190e1b865827000fd71cd93e94
name: libewf
arch: src
version: 20150105
epoch: 0
release: 1.fc23
summary: Library to support the Expert Witness Compression Format (EWF)
url: https://code.google.com/p/libewf/
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: libewf-20150105-1.fc23.src.rpm
checksum_type: sha256
description:
  libewf is a library to support the Expert Witness Compression Format (EWF).
  libewf allows you to read media information of EWF files in the SMART (EWF-S01)
  format and the EnCase (EWF-E01) format. libewf allows to read files created by
  EnCase 1 to 6, linen and FTK Imager.


pkgId: c3b187f96438290d9719be0de06fdf56a8651e29b71f5bb1026bf0ab1205d244
name: libfixbuf
arch: src
version: 1.7.1
epoch: 0
release: 1.fc23
summary: fixbuf IPFIX implementation library
url: http://tools.netsa.cert.org/
rpm_license: LGPL
rpm_vendor: http://tools.netsa.cert.org/
rpm_group: NetSA
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Tony Cebzanov <tonyc@cert.org>
location_href: libfixbuf-1.7.1-1.fc23.src.rpm
checksum_type: sha256
description:
  libfixbuf aims to be a compliant implementation of the IPFIX Protocol
  and message format, from which IPFIX Collecting Processes and
  IPFIX Exporting Processes may be built.


pkgId: deff1057e6d75f9e204adebd8da2e9a5f64f295646a65fa7a81589787044a4e2
name: libiconv
arch: src
version: 1.14
epoch: 0
release: 3.fc23
summary: Character set conversion library
url: http://www.haible.de/bruno/packages-libcharset.html
rpm_license: LGPL v2+
rpm_group: Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: libiconv-1.14-3.fc23.src.rpm
checksum_type: sha256
description:
  This library provides an iconv() implementation, for use on systems
  which don't have one, or whose implementation cannot convert from/to
  Unicode.


pkgId: 199707daea63c565d4bb16aedf98ad6345449e29b386fe583c2a3be891b48253
name: libp0f
arch: src
version: 2.0.8
epoch: 0
release: 1.fc23
summary: Provides library implementation of p0f for use with yaf
url: http://lcamtuf.coredump.cx/p0f.shtml
rpm_license: LGPLv2
rpm_vendor: http://tools.netsa.cert.org/
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Dwight Beaver <dsbeaver@cert.org>
location_href: libp0f-2.0.8-1.fc23.src.rpm
checksum_type: sha256
description:
  Libp0f is a library implementation of p0f version 2.
  This library splits the core p0f functionality from the p0f application
  in order to support 3rd-party linkage.


pkgId: 1335c6b6a95a950390797ff31d1a567ed93d7e331fab9950c89652da0081aeea
name: libpff
arch: src
version: 20131028
epoch: 0
release: 3.fc23
url: http://code.google.com/p/libpff/
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: libpff-20131028-3.fc23.src.rpm
checksum_type: sha256
summary:
  Library to to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files.

description:
  libpff is a library to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files.


pkgId: b5cf47d9aff22ee4f41e89c9a622adfd9d48cf0de262c905500a97f5243fe2b7
name: libpst
arch: src
version: 0.6.63
epoch: 0
release: 1.1.fc23
summary: Utilities to convert Outlook .pst files to other formats
url: http://www.five-ten-sg.com/libpst/
rpm_license: GPLv2+
rpm_group: Applications/Productivity
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: libpst-0.6.63-1.1.fc23.src.rpm
checksum_type: sha256
description:
  The Libpst utilities include readpst which can convert email messages
  to both mbox and MH mailbox formats, pst2ldif which can convert the
  contacts to .ldif format for import into ldap databases, and pst2dii
  which can convert email messages to the DII load file format used by
  Summation.


pkgId: 31e726172afdf1fdad7e3eaf6d14eaa2b9f537b2b5863ea609da634d06ac3b8d
name: libsmraw
arch: src
version: 20160108
epoch: 0
release: 1.fc23
summary: Library to access the storage media (SM) (split) RAW format
url: http://code.google.com/p/libsmraw/
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: libsmraw-20160108-1.fc23.src.rpm
checksum_type: sha256
description:
  libsmraw is library to access the storage media (SM) (split) RAW format
  The library supports both RAW and split RAW.


pkgId: 0d12af546d19edb8148c9a6a54607181056351f4f9ccb9f472ae80ad79c7e875
name: lime-kernel-modules-el9-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 14
description: This package provides kernel objects for CentOS 9 Stream x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-centos-9-stream-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-el9-x86_64-1.9.1-14.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for CentOS 9 Stream x86_64 for LiME


pkgId: bc93061578bf70f7b2572781f7465a6ed4507d75ac1ff5862a8edbe551038d99
name: lime-kernel-modules-fc17-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 2
description: This package provides kernel objects for Fedora 17 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: fedora-17-x86-64
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc17-x86_64-1.1.r17-2.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 17 x86_64 for LiME


pkgId: 10672a1e2c1d72515e9b4ec3c0a7d56627d7af202b3967c20e9a0ac29fd63e7a
name: lime-kernel-modules-fc18-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 2
description: This package provides kernel objects for Fedora 18 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-18-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc18-x86_64-1.1.r17-2.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 18 x86_64 for LiME


pkgId: 99702ec311d1bf8152cc1f9569925fe26a1c4a4c769a1a7e5634649d28f77981
name: lime-kernel-modules-fc21-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 29
description: This package provides kernel objects for Fedora 21 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-21-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc21-x86_64-1.1.r17-29.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 21 x86_64 for LiME


pkgId: 1c38a71cec35bd8b653d904d60647289862bb33ea444947447a49bb7f6210253
name: lime-kernel-modules-fc22-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 36
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-22-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc22-x86_64-1.1.r17-36.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 22 x86_64 for LiME


pkgId: 27df8a96a1f1e124d3c85b32bcd99d2f61a119182ec1a6074e8bcc9372455a7c
name: lime-kernel-modules-fc24-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 47
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-24-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc24-x86_64-1.1.r17-47.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 24 x86_64 for LiME


pkgId: 08086d48ce927ae133b21afca29af66bd574fddc8d70963fddb227cfed71b8de
name: lime-kernel-modules-fc25-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 50
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-25-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc25-x86_64-1.1.r17-50.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 25 x86_64 for LiME


pkgId: 8f20223df1c0b938c3709939faee3ea192cbb8ada6ce8da1c00fd998042fcc15
name: lime-kernel-modules-fc26-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 38
description: This package provides kernel objects for Fedora 26 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-26-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc26-x86_64-1.1.r17-38.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 26 x86_64 for LiME


pkgId: bc7811d7cf96587afe3c2c5eafbee818817d46cf0da2c793b28451860bc5dc55
name: lime-kernel-modules-fc27-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 44
description: This package provides kernel objects for Fedora 22 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-27-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc27-x86_64-1.1.r17-44.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 27 x86_64 for LiME


pkgId: 805dfe72548c73368af720bcb1e683c75761f5b9d8df5dc3604a1cabbe9e221a
name: lime-kernel-modules-fc28-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 42
description: This package provides kernel objects for Fedora 28 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-28-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc28-x86_64-1.1.r17-42.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 28 x86_64 for LiME


pkgId: 4a65b4b5ec03a3ecc9972d4789bfd29d73550b517eb575f040281f9aae520f11
name: lime-kernel-modules-fc29-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 37
description: This package provides kernel objects for Fedora 29 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-29-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc29-x86_64-1.1.r17-37.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 29 x86_64 for LiME


pkgId: 2eed86b461fbce19096d16669f866c63544f93541e1fc13bf890a0531ec95ce1
name: lime-kernel-modules-fc30-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 39
description: This package provides kernel objects for Fedora 30 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-30-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc30-x86_64-1.1.r17-39.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 30 x86_64 for LiME


pkgId: ef159759f28269e103a5c8fffe3224f8696ae9061ea8ef12f3f6c91b7df3d117
name: lime-kernel-modules-fc31-x86_64
arch: src
version: 1.1.r17
epoch: 0
release: 40
description: This package provides kernel objects for Fedora 31 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-31-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc31-x86_64-1.1.r17-40.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 31 x86_64 for LiME


pkgId: c6c8e9842de7672fbb8c21aaec8531afba015c8d163989277d86cdc7dff517be
name: lime-kernel-modules-fc32-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 46
description: This package provides kernel objects for Fedora 32 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-32-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc32-x86_64-1.9.1-46.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 32 x86_64 for LiME


pkgId: ed22e1087c0dbf75253068119156ddfb9289a22bb73f0aae873e6fb588963eaa
name: lime-kernel-modules-fc33-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 46
description: This package provides kernel objects for Fedora 33 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-33-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc33-x86_64-1.9.1-46.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 33 x86_64 for LiME


pkgId: e9b495e7111481bb71d5f3a1b98d62eb3a2db70a6db6e695075570803d7f7a7f
name: lime-kernel-modules-fc34-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 51
description: This package provides kernel objects for Fedora 34 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-34-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc34-x86_64-1.9.1-51.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 34 x86_64 for LiME


pkgId: a44dccad7cfb0fd273a4424db7637eccde11ce685cc23c6906198d03b2cc7bba
name: lime-kernel-modules-fc35-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 41
description: This package provides kernel objects for Fedora 35 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-35-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc35-x86_64-1.9.1-41.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 35 x86_64 for LiME


pkgId: 8bf52131af2c0f2e63f6a39287c6fb0b33f7ad79c52cb20d889078a12951da75
name: lime-kernel-modules-fc36-x86_64
arch: src
version: 1.9.1
epoch: 0
release: 17
description: This package provides kernel objects for Fedora 36 x86_64-based systems.
url: https://code.google.com/p/lime-forensics/
rpm_license: GP5
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-36-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: lime-kernel-modules-fc36-x86_64-1.9.1-17.src.rpm
checksum_type: sha256
summary:
  This package contains all of the kernel objects for all of the kernels for Fedora 36  x86_64 for LiME


pkgId: ba0660a7993b0476d9d0dc5169fd03289c9f4fc3c7e9306030d6a90f1cd07766
name: log2timeline
arch: src
version: 0.65
epoch: 0
release: 1.fc23
summary: A framework for timeline creation and analysis
url: http://log2timeline.net
rpm_license: GPLv2
rpm_group: Applications/Engineering
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: log2timeline-0.65-1.fc23.src.rpm
checksum_type: sha256
description:
  A framework to for timeline creation and analysis.

  Log2timeline provides a framework to automatically extract timeline
  information out of various log files and artifacts found on various
  operating systems.  The framework then outputs the timeline information
  in the chosen output format that can then be viewed using already
  existing timeline analysis tools, or other tools to inspect the timeline.


pkgId: 9d5d11ae9314e0b9a0f91185d498a6e4f40fbe3687f1bc5b7ad3a6699a5880ff
name: md5deep
arch: src
version: 4.4
epoch: 0
release: 1.fc23
summary: Programs to compute MD5, SHA-1, or SHA-256 message digests on files
url: http://md5deep.sourceforge.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: md5deep-4.4-1.fc23.src.rpm
checksum_type: sha256
description:
  md5deep is a cross-platform set of programs to compute MD5, SHA-1, or SHA-256
  message digests on an arbitrary number of files. The programs run on Windows,
  Linux, *BSD, OS X, Solaris, and should run on most other platforms. md5deep
  is similar to the md5sum program found in the GNU Coreutils package, but
  has the following additional features:
      * Recursive operation - md5deep is able to recursive examine an entire directory tree. That is, compute the MD5
        for every file in a directory and for every file in every subdirectory.
      * Time estimation - md5deep can produce a time estimate when it's processing very large files.
      * Comparison mode - md5deep can accept a list of known hashes and compare them to a set of input files. The program can
        display either those input files that match the list of known hashes or those that do not match. Hashes sets can be drawn
        from the National Software Reference Library, iLook Investigator, Hashkeeper, or md5sum. Users are welcome to add functionality
        to read other formats too!
      * File type mode - md5deep can process only files of a certain type, such as regular files, block devices, etc.


pkgId: db64412446ce2da693cedcbdab465034f86523f8db6d916d6f8e6a99bd8bb79c
name: mdbtools
arch: src
version: 0.7
epoch: 0
release: 43.13.fc23
summary: A Suite of Libraries and Programs to Access Microsoft Access Databases
url: https://github.com/brianb/mdbtools
rpm_license: GPL-2.0+
rpm_group: Productivity/Databases/Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: mdbtools-0.7-43.13.fc23.src.rpm
checksum_type: sha256
description:
  Mdbtools contains:
  mdb-dump -- simple hex dump utility for looking at mdb files
  mdb-schema -- prints DDL for the specified table
  mdb-export -- export table to CSV format
  mdb-tables -- a simple dump of table names to be used with shell scripts
  mdb-header -- generates a C header to be used in exporting mdb data to a C prog
  mdb-parsecvs -- generates a C program given a CSV file made with mdb-export
  mdb-sql -- demo SQL engine program
  mdb-ver -- print version of database


pkgId: d4918900c58e6fbb38b290f6fa636cbe559bd1e2ff6a5bff83c653658a12916f
name: missidentify
arch: src
version: 1.0
epoch: 0
release: 1.fc23
summary: Find Win32 applications
url: http://missidentify.sourceforge.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: missidentify-1.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Miss Identify is a program to find Win32 applications. In its default
  mode it displays the filename of any executable that does not have
  an executable extension (i.e. exe, dll, com, sys, cpl, hxs, hxi, olb,
  rll, or tlb). The program can also be run to display all executables
  encountered, regardless of the extension. This is handy when looking
  for all of the executables on a drive. Other options allow the user to
  record the strings found in an executable and to work recursively. See
  the manual page for more information.
  Sample output

  Searching for mislabeled executables

  C:\> missidentify *
  C:\missidentify-1.0\sample.jpg

  Searching for all executables

  C:\> missidentify -a *
  C:\missidentify-1.0\sample.jpg
  C:\missidentify-1.0\missidentify.exe

  Searching for all executables in an unusual place

  C:\> missidentify -ar c:\windows\system32
  ...
  C:\WINDOWS\System32\ntdll.dll
  C:\WINDOWS\System32\ntoskrnl.exe
  C:\WINDOWS\System32\NEVER-GONNA-CATCH-ME.EXE
  C:\WINDOWS\System32\ntver.dll


pkgId: 5b20eaf12d1cd38f4036acf3d441dcf4805343eb53d0052f408e81b7183e5c2d
name: nDPI
arch: src
version: 1.7.1
epoch: 0
release: 1.fc23
summary: Open source deep packet inspection
url: http://www.ntop.org/products/ndpi/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: nDPI-1.7.1-1.fc23.src.rpm
checksum_type: sha256
description:
  nDPI is a ntop-maintained superset of the popular OpenDPI
  library. Released under the GPL license, its goal is to extend the
  original library by adding new protocols that are otherwise available
  only on the paid version of OpenDPI. In addition to Unix platforms,
  we also support Windows, in order to provide you a cross-platform DPI
  experience. Furthermore, we have modified nDPI do be more suitable for
  traffic monitoring applications, by disabling specific features that
  slow down the DPI engine while being them un-necessary for network
  traffic monitoring.

  nDPI is used by both ntop and nProbe for adding application-layer
  detection of protocols, regardless of the port being used. This means
  that it is possible to both detect known protocols on non-standard
  ports (e.g. detect http non ports other than 80), and also the opposite
  (e.g. detect Skype traffic on port 80). This is because nowadays the
  concept of port=application no longer holds.


pkgId: 3def7dcd2c43608d5c53f3391da55be30e0a8ad892682fe5377d16ab61c31b82
name: netsa-python
arch: src
version: 1.4.3
epoch: 0
release: 1.fc23
summary: Python routines and frameworks helpful when developing analyses using the SiLK toolkit
url: http://tools.netsa.cert.org/netsa-python
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: netsa-python-1.4.3-1.fc23.src.rpm
checksum_type: sha256
description:
  The netsa-python library is a grab-bag of Python routines and frameworks
  that the NetSA team at CERT has found helpful when developing analyses using the SiLK
  toolkit. Of particular note are the netsa.script NetSA Scripting
  Framework, which provides a standard framework for writing scripts that
  process flow data, and the netsa.util.shell command line processing
  system, which provides tools for managing extremely complicated
  collections of shell processes that should fail or succeed together
  (extremely useful when working with named pipes).

  netsa-python is compatible with Python versions 2.4 and greater.

  Here are the tools installed:

  	netsa.script — The NetSA Scripting Framework
  	netsa.sql — SQL Database Access
  	netsa.util.shell — Robust Shell Pipelines

  	Data Manipulation
  		netsa.data.countries — Country and Region Codes
  		netsa.data.format — Formatting Data for Output
  		netsa.data.nice — “Nice” Numbers for Chart Bounds
  		netsa.data.times — Time and Date Manipulation

  	Miscellaneous Facilities
  		netsa.files — File and Path Manipulation
  		netsa.files.datefiles — Date-based filenames
  		netsa.json — JSON Wrapper Module
  		netsa.tools.service — Tools for building services
  		netsa.util.clitest — Utility for testing CLI tools
  		netsa.util.compat — Python version compatibility code


pkgId: 953d9353d463a6327084abfc61d389ee3357e2915102ad9dad5c9689c2743eb5
name: netsa-rayon
arch: src
version: 1.4.3
epoch: 0
release: 1.fc23
summary: Rayon visualization toolkit
url: http://tools.netsa.cert.org/rayon/index.html
rpm_license: GPL
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: netsa-rayon-1.4.3-1.fc23.src.rpm
checksum_type: sha256
description:
  Rayon is a Python library and set of tools for generating basic
  two-dimensional statistical visualizations. Rayon can be used to
  automate reporting; provide data visualization in command-line, GUI or
  web applications; or do ad-hoc exploratory data analysis.


pkgId: 93451c636e9138d98a4a39f7039e1d87c8b5843fe5fc8e8e25ab624611b96e29
name: null-package
arch: src
version: 1.0
epoch: 0
release: 4.fc23
summary: null-package - used for testing automatic updates
url: http://www.cert.org
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: null-package-1.0-4.fc23.src.rpm
checksum_type: sha256
description:
  This is a null package that has nothing in it.
  It is used to test the automatic package update packages on various OS and Arch combinations


pkgId: b10819d576aa3f7dc6e593824035db6fb2c593c2fe2eca11ab76f021b156a832
name: packetexaminer
arch: src
version: 0.9
epoch: 0
release: 1.fc23
summary: PacketExaminer - Analyze PCAP files
url: https://github.com/joemcmanus/packetexaminer
rpm_license: GPL3
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: packetexaminer-0.9-1.fc23.src.rpm
checksum_type: sha256
description:
  This is a harness to perform PCAP analysis that a security engineer may do during an incident response
  or when looking at network security. I - Joe McManus - found myself using a collection of tools and techniques
  again and again and thought it would be helpful to create a program that would do this for me. This hopefully
  automates some routine functions you would do manually.


pkgId: 237d22d5b4fadea5cca39c53b189fde5b0b87ae906837d028a6e2a41c343295b
name: partclone
arch: src
version: 0.2.80
epoch: 0
release: 1.fc23
summary: File System Clone Utilities
url: http://partclone.sf.net
rpm_license: GPLv2
rpm_group: System/Configuration/Other
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: partclone-0.2.80-1.fc23.src.rpm
checksum_type: sha256
description:
  Partclone provides utilities to back up and restore used-blocks of a partition
  and it is designed for higher compatibility of the file system by using
  existing library, e.g. e2fslibs is used to read and write the ext2 partition.

  Authors:
  --------
      Thomas Tsai <Thomas _at_ nchc org tw>
      Jazz Wang <jazz _at_ nchc org tw>
      http://partclone.sourceforge.net
      http://partclone.nchc.org.tw


pkgId: ec0914af10652cd47c3d8e41169833d4aaa53f31badf9976ed0d1dfac92588dc
name: pasco
arch: src
version: 1.0
epoch: 0
release: 1.fc23
summary: Reconstruct IE internet activity
url: http://sourceforge.net/projects/odessa/files/Pasco/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: pasco-1.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Pasco will parse the information in an index.dat file and output the
  results in a field delimited manner so that it may be imported into
  your favorite spreadsheet program. Pasco is built to work on multiple
  platforms and will execute on Windows (through Cygwin), Mac OS X, Linux,
  and *BSD platforms.


pkgId: 42e7ef276d7d15e7f30415a85ca3ceb055f954223777ddc052fa4c70c641ce7d
name: perl-File-Mork
arch: src
version: 0.3
epoch: 0
release: 1.fc23
summary: Module to read Mozilla URL history files
url: http://search.cpan.org/dist/File-Mork/
rpm_license: CHECK(GPL+ or Artistic)
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: perl-File-Mork-0.3-1.fc23.src.rpm
checksum_type: sha256
description:
  This is a module that can read the Mozilla URL history file -- normally
  $HOME/.mozilla/default/*.slt/history.dat -- and extract the id, url, name,
  hostname, first visted dat, last visited date and visit count.


pkgId: 67093a0b742d56f06f7f92fc58a5571375fe0f7436828726d4b5cf4f1877d8ea
name: perl-Mac-PropertyList
arch: src
version: 1.33
epoch: 0
release: 1.fc23
summary: Work with Mac plists at a low level
url: http://search.cpan.org/dist/Mac-PropertyList/
rpm_license: GPL+ or Artistic
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: perl-Mac-PropertyList-1.33-1.fc23.src.rpm
checksum_type: sha256
description:
  This module is a low-level interface to the Mac OS X Property List (plist)
  format. You probably shouldn't use this in applications--build interfaces
  on top of this so you don't have to put all the heinous multi-level object
  stuff where people have to look at it.


pkgId: ee0eb043b75c8abd338b14c0ef47203c5078375b710705f7d7b581c1e3b11f90
name: perl-Parse-Win32Registry
arch: src
version: 0.51
epoch: 0
release: 1.fc23
summary: Parse Windows Registry Files
url: http://search.cpan.org/dist/Parse-Win32Registry/
rpm_license: CHECK(GPL+ or Artistic)
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: perl-Parse-Win32Registry-0.51-1.fc23.src.rpm
checksum_type: sha256
description:
  Parse::Win32Registry is a module for parsing Windows Registry files,
  allowing you to read the keys and values of a registry file without going
  through the Windows API.


pkgId: 754f224bc96da9bef9a0f4c8c86a13a72020c1599081ebe86b5d8b2ca40cfe4f
name: plaso
arch: src
version: 1.5.1
epoch: 0
release: 1.fc23
url: http://plaso.kiddaland.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: plaso-1.5.1-1.fc23.src.rpm
checksum_type: sha256
summary:
  plaso - a  Python based back-end engine used by tools such as log2timeline for automatic creation of a super timelines

description:
  Plaso (plaso langar að safna öllu) is the Python based back-end engine
  used by tools such as log2timeline for automatic creation of a super
  timelines. The goal of log2timeline (and thus plaso) is to provide a
  single tool that can parse various log files and forensic artifacts from
  computers and related systems, such as network equipment to produce a
  single correlated timeline. This timeline can then be easily analysed by
  forensic investigators/analysts, speeding up investigations by correlating
  the vast amount of information found on an average computer system.

  Auxiliary goal of plaso is to provide forensic analysts and tool makers
  powerful libraries that they can use to access, find, read and parse
  various files within disk images to create their own tools, or to adjust
  log2timeline to their own workflow, instead of relying on the workflow
  provided by log2timeline.py.


pkgId: 5915f97eb87466383a8808505225089ef3f7376ad626f8c10b2bae26931ad88e
name: prism
arch: src
version: 1.2
epoch: 0
release: 3.fc23
summary: Visualize flow data as a time-series broken down into several configurable bins
url: http://tools.netsa.cert.org/prism/
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: prism-1.2-3.fc23.src.rpm
checksum_type: sha256
description:
  The Prism trend script is a tool for quickly visualizing flow data as a time-series broken
  down into several configurable bins by SiLK's rwfilter tool. The script can be used directly,
  or might be used as a component in other more specialized scripts.

  In addition to providing immediate visualizations, the Prism trend script can store these
  breakdowns in a relational database (currently supporting PostgreSQL or sqlite) for later
  quick lookup.

  Prism 1.1 requires netsa-python 1.3, Rayon 1.3.0, and SiLK 2.0.0 or better.

  For assistance with the Prism script, please contact netse-help@cert.org


pkgId: f5e217479c63755a468da330d79e5317fca57366ec7dea2d06f91724f375ab02
name: pstotext
arch: src
version: 1.9
epoch: 0
release: 2.1.fc23
summary: PostScript to text converter
url: http://www.research.compaq.com/SRC/virtualpaper/pstotext.html
rpm_license: Digital's paranoid but open-source license
rpm_group: Applications/Text
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: pstotext-1.9-2.1.fc23.src.rpm
checksum_type: sha256
description:
  This utility reads in postscript files and outputs an ASCII rendering.
  While the rendering is not always accurate, it is often sufficient.


pkgId: 94287fcf2dbca557e789af5313f6b5db431c5c00ded97440ae2b45a4d810cf5b
name: ptk
arch: src
version: 1.0.5
epoch: 0
release: 5.fc23
summary: An alternative advanced interface for the suite TSK (The SleuthKit)
url: http://www.dfresponse.com/computer-forensic-software.html
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ptk-1.0.5-5.fc23.src.rpm
checksum_type: sha256
description:
  PTK is an alternative advanced interface for the suite TSK (The
  SleuthKit). PTK was developed from scratch and besides providing the
  functions already present in Autopsy Forensic Browser it implements
  numerous new features essential during forensic activity. PTK is not just
  a new graphic and highly professional interface based on Ajax technology
  but offers a great deal of features like analysis, search and management
  of complex cases of digital investigation.

  The core component of the software is made up of an efficient Indexing
  Engine performing different preliminary analysis operations during
  importing of every evidence. PTK allows the management of different cases
  and different levels of multi-users. It is possible to allow more than
  one investigators to work at the same case at the same time. All the
  reports generated by an investigator are saved in a reserved section of
  the Database. PTK is a Web Based application and builds its indexing
  archive inside a Database MySQL, using thus the construction LAMP
  (Linux-Apache-MySql-PHP).


pkgId: b59d414f27ec33192366caaa3183eb4e0f6803c785859e8f21a1ec8b4201cba2
name: pyew
arch: src
version: 2.0
epoch: 0
release: 1.fc23
summary: Python tool for malware analysis
url: https://code.google.com/p/pyew/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: pyew-2.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Pyew is a (command line) python tool to analyse malware. It does have support
  for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits), PE and ELF
  file formats (it performs code analysis and let you write scripts using an
  API to perform many types of analysis), follows direct call/jmp instructions
  in the interactive command line, displays function names and string data
  references; supports OLE2 format, PDF format and more. It also supports
  plugins to add more features to the tool.


pkgId: 17d94f1499731688d32591f78d52a2a8b04fa0a781cf97b653e7e7dcc4842e0e
name: pyfixbuf
arch: src
version: 0.2.1
epoch: 0
release: 1.fc23
summary: Python API for libfixbuf
url: https://tools.netsa.cert.org/pyfixbuf/doc/index.html
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: pyfixbuf-0.2.1-1.fc23.src.rpm
checksum_type: sha256
description:
  pyfixbuf is a Python API for libfixbuf, an implementation of the IPFIX
  protocol used for building collecting and exporting processes. pyfixbuf
  can be used to write applications, often called mediators, that collect and
  export IPFIX. Mediators are useful in modifying, filtering, or adding to the
  contents of a message before forwarding to another IPFIX collection point,
  or converting IPFIX to another format (text, database, JSON, etc.).


pkgId: 8132bfe0a90bb887b80237001e918b95efd45cb959049435251838411772d1fa
name: python-M2Crypto
arch: src
version: 0.26.0
epoch: 0
release: 0
summary: M2Crypto: A Python crypto and SSL toolkit
url: https://gitlab.com/m2crypto/m2crypto
rpm_license: BSD
rpm_group: Development/Languages/Python
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-M2Crypto-0.26.0-0.src.rpm
checksum_type: sha256
description:
  M2Crypto is the most complete Python wrapper for OpenSSL featuring RSA, DSA,
  DH, EC, HMACs, message digests, symmetric ciphers (including AES); SSL
  functionality to implement clients and servers; HTTPS extensions to Python's
  httplib, urllib, and xmlrpclib; unforgeable HMAC'ing AuthCookies for web
  session management; FTP/TLS client and server; S/MIME; ZServerSSL: A HTTPS
  server for Zope and ZSmime: An S/MIME messenger for Zope. M2Crypto can also be
  used to provide SSL for Twisted. Smartcards supported through the Engine
  interface.


pkgId: 32d300c70160c2ea00a3ee0e0d62cb1b346394fe93856c9e0fd83581d2879931
name: python-apsw
arch: src
version: 3.19.3
epoch: 0
release: 1.fc23
summary: Another Python SQLite Wrapper
url: https://github.com/rogerbinns/apsw
rpm_license: zlib/libpng License
rpm_group: Development/Libraries/Python
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-apsw-3.19.3-1.fc23.src.rpm
checksum_type: sha256
description:
  APSW is a Python wrapper for the SQLite embedded relational database
  engine. In contrast to other wrappers such as pysqlite it focuses on
  being a minimal layer over SQLite attempting just to translate the
  complete SQLite API into Python.


pkgId: 8bff65af2d77610058615053ea1c90fb235c83fc250e4719a3f5e4727a8e469a
name: python-biplist
arch: src
version: 1.0.3
epoch: 0
release: 1.fc23
summary: python-%{modname} - Python package for reading/writing binary plists
url: https://pypi.org/project/biplist/
rpm_license: BSD
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: python-biplist-1.0.3-1.fc23.src.rpm
checksum_type: sha256
description:
  biplist is a binary plist parser/generator for Python.
  Binary Property List (plist) files provide a faster and smaller serialization format for property lists on OS X.
  This is a library for generating binary plists which can be read by OS X, iOS, or other clients.
  This module requires Python 2.6 or higher or Python 3.4 or higher.


pkgId: 48b5e03f88114c4278b9652b0a2c79e135cbd5b5934d973e63a13eb0ff9eea53
name: python-certifi
arch: src
version: 2016.9.26
epoch: 0
release: 2.fc23
summary: Python package for providing Mozilla's CA Bundle
url: http://certifi.io/en/latest/
rpm_license: MPLv2.0
rpm_group: Unspecified
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-certifi-2016.9.26-2.fc23.src.rpm
checksum_type: sha256
description:
  Certifi is a carefully curated collection of Root Certificates for validating
  the trustworthiness of SSL certificates while verifying the identity of TLS
  hosts. It has been extracted from the Requests project.

  Please note that this Fedora package does not actually include a certificate
  collection at all. It reads the system shared certificate trust collection
  instead. For more details on this system, see the ca-certificates package.


pkgId: e686060ded5444b022f9da774eb97dc08325bd2dc13ff781482647979b569f7f
name: python-construct
arch: src
version: 2.5.2
epoch: 0
release: 1.fc23
summary: A powerful declarative parser/builder for binary data
url: http://construct.readthedocs.org
rpm_license: MIT
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-construct-2.5.2-1.fc23.src.rpm
checksum_type: sha256
description:
  Construct is a powerful declarative parser (and builder) for binary
  data.

  Instead of writing imperative code to parse a piece of data, you
  declaratively define a data structure that describes your data. As
  this data structure is not code, you can use it in one direction to
  parse data into Pythonic objects, and in the other direction, convert
  (build) objects into binary data.


pkgId: a30ca94791b04953c435be95bad6ce050b048ef1a5cd20d8913630562407dbc8
name: python-dpapick
arch: src
version: 0.3
epoch: 0
release: 0
summary: DPAPI decryption toolkit
url: http://www.dpapick.com
rpm_license: GPL-3.0
rpm_group: Development/Languages/Python
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-dpapick-0.3-0.src.rpm
checksum_type: sha256
description:
  OVERVIEW

  DPAPIck is a python toolkit to provide a platform-independant implementation
  of Microsoft's cryptography subsytem called DPAPI (Data Protection API).

  It can be used either as a library or as a standalone tool.

  It is also the first open-source tool that allows decryption of DPAPI
  structures in an offline way and, moreover, from another plateform than
  Windows.

  It is provided with some application probes that includes the built-in logic
  to retreive the corresponding secrets that are protected.

  To have more information or to contact us, go to our website:
  http://www.dpapick.com


  REQUIREMENTS

  This application has been developped and tested on python 2.7.

  M2Crypto is required to provide all the requireds algorithms. To obtain it,
  see: http://chandlerproject.org/bin/view/Projects/MeTooCrypto

  Probes and other tool may require other modules to be able to retreive
  information such as:
    * python-sqlite3 for Google Chrome password database
    * CFPropertyList for Apple Safari keychain.plist
        see https://github.com/bencochran/CFPropertyList
    * python-registry for low-level manipulation of hives
        see https://github.com/williballenthin/python-registry
    * pyASN1 for the RSA key pair manipulation
        see http://pyasn1.sourceforge.net/

  We also recommend the use of MoonSols Windows Memory Toolkit to convert
  hibernation file to usable memory dumps and be able to extract credentials
  from it.
  For more information about Moonsols products, see <http://www.moonsols.com>


  AUTHOR

  DPAPIck is written by Jean-Michel Picod (jean-michel.picod@cassidian.com)
  with the help from Ivan Fontarensky (ivan.fontarensky@cassidian.com)
  who work for the Cyber Security Center of Cassidian, an EADS company,
  and Elie Bursztein (dpapi@elie.im)


  LICENSE

  This program is free software: you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation version 3 of the License.

  This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License
  along with this program.  If not, see <http://www.gnu.org/licenses/>.


pkgId: 872ba09b79f5dffaa050434aa5e6e926e68d1777753c067c76c7f1c87e94e8b4
name: python-elasticsearch
arch: src
version: 6.3.1
epoch: 0
release: 1.fc23
summary: python-elasticsearch - Python package for ElasticSearch
url: URL
rpm_license: BSD
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: python-elasticsearch-6.3.1-1.fc23.src.rpm
checksum_type: sha256
description:
  Official low-level client for Elasticsearch. Its goal is to provide common ground for all
  Elasticsearch-related code in Python; because of this it tries to be opinion-free and very
  extendable.

  For a more high level client library with more limited scope, have a look at elasticsearch-dsl -
  a more pythonic library sitting on top of elasticsearch-py.

  It provides a more convenient and idiomatic way to write and manipulate queries. It stays close
  to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the whole
  range of the DSL from Python either directly using defined classes or a queryset-like expressions.

  It also provides an optional persistence layer for working with documents as Python objects in
  an ORM-like fashion: defining mappings, retrieving and saving documents, wrapping the document
  data in user-defined classes.


pkgId: 19f5cebf503395392a36a24f4493d55090bf1c5468584338d253597901396e53
name: python-elasticsearch5
arch: src
version: 5.5.1
epoch: 0
release: 1.fc23
summary: python-%{modname} - Python package for low-level client for Elasticsearch.
url: URL
rpm_license: BSD
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: python-elasticsearch5-5.5.1-1.fc23.src.rpm
checksum_type: sha256
description:
  Official low-level client for Elasticsearch. Its goal is to provide common ground for all
  Elasticsearch-related code in Python; because of this it tries to be opinion-free and very
  extendable.

  For a more high level client library with more limited scope, have a look at elasticsearch-dsl -
  a more pythonic library sitting on top of elasticsearch-py.

  It provides a more convenient and idiomatic way to write and manipulate queries. It stays close
  to the Elasticsearch JSON DSL, mirroring its terminology and structure while exposing the whole
  range of the DSL from Python either directly using defined classes or a queryset-like expressions.
  It also provides an optional persistence layer for working with documents as Python objects in
  an ORM-like fashion: defining mappings, retrieving and saving documents, wrapping the document
  data in user-defined classes.

  The library is compatible with Elasticsearch 5.x. For Elasticsearch 2.x please use elasticsearch2
  and for future releases use elasticsearcch.


pkgId: 30c8f72d2a22253e6d10e797da43977c29420dcfdd14005c226f4996aeada011
name: python-haystack
arch: src
version: 0.36
epoch: 0
release: 0
summary: Search C Structures in a process' memory
url: http://packages.python.org/haystack/
rpm_license: GPL
rpm_group: Development/Languages/Python
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-haystack-0.36-0.src.rpm
checksum_type: sha256
description:
  [![Build Status](https://travis-ci.org/trolldbois/python-haystack.svg?branch=master)](https://travis-ci.org/trolldbois/python-haystack)
  [![Coverage Status](https://coveralls.io/repos/trolldbois/python-haystack/badge.svg?branch=master&service=github)](https://coveralls.io/github/trolldbois/python-haystack?branch=master)
  [![Code Health](https://landscape.io/github/trolldbois/python-haystack/master/landscape.svg?style=flat)](https://landscape.io/github/trolldbois/python-haystack/master)
  [![pypi](https://img.shields.io/pypi/dm/haystack.svg)](https://pypi.python.org/pypi/haystack)

  Quick Start:
  ============
  [Quick usage guide](docs/Haystack basic usage.ipynb) in the docs/ folder.
  [Haystack-reverse CLI](docs/Haystack reverse CLI.ipynb) in the docs/ folder.

  Introduction:
  =============

  python-haystack is an heap analysis framework, focused on searching and reversing of
  C structure in allcoated memory.

  The first function/API is the SEARCH function.
   - It gives the ability to search for known record types in a process memory dump or live process's memory.

  The second function/API is the REVERSE function.
   - It aims at helping an analyst in reverse engineering the memory records types present in a process heap.
  It focuses on reconstruction, classification of classic C structures from memory.
  It attempts to recreate types definition.

  Scripts & Entry Points:
  =======================

  A few entry points exists to handle the format your memory dump.

  Memory dump folder produced by `haystack-live-dump`
  ---------------------------------------------------
   - `haystack-find-heap` allows to show details on Windows HEAP.
   - `haystack-search` search CLI
   - `haystack-show` show CLI for specific record type at a specific address
   - `haystack-reverse` reverse CLI - reverse all allocation chunks
   - `haystack-reverse-show` show the reversed record at a specific address
   - `haystack-reverse-hex` show a specific record hex bytes at a specific address
   - `haystack-reverse-parents` show the records pointing to the allocated record at a specific address

  Memory dump file produced by a Minidump tool
  ---------------------------------------------------
   - `haystack-find-heap` allows to show details on Windows HEAP.
   - `haystack-minidump-search` search CLI
   - `haystack-minidump-show` show a specific record type at a specific address
   - `haystack-minidump-reverse` reverse CLI - reverse all allocation chunks
   - `haystack-minidump-reverse-show` show the reversed record at a specific address
   - `haystack-minidump-reverse-hex` show a specific record hex bytes at a specific address
   - `haystack-minidump-reverse-parents` show the records pointing to the allocated record at a specific address

  For live processes
  ------------------
   - `haystack-live-dump` capture a process memory dump to a folder (haystack format)
   - `haystack-live-search` search CLI in live process memory
   - `haystack-live-show` show a specific record type at a specific addres in a live process memory

  For a Rekall memory dump
  ---------------------------
   - `haystack-rekall-search` search CLI for a specific process in a rekall dump
   - `haystack-rekall-show` show a specific record type at a specific address
   - `haystack-rekall-dump` dump a specific process to a haystack process dump

  For a Volatility memory dump
  ---------------------------
   - `haystack-volatility-search`  search CLI for a specific process in a volatility dump
   - `haystack-volatility-show` show a specific record type at a specific address
   - `haystack-volatility-dump` dump a specific process to a haystack process dump

  How to get a memory dump:
  =========================

  On Windows, the most straightforward is to get a Minidump. The Microsoft Sysinternals
  suite of tools provide either a CLI (procdump.exe) or a GUI (Process explorer).
  Using one of these (with full memory dump option) you will produce a file
  that can be used with the `haystack-minidump-xxx` list of entry points.

  While technically you could use many third party tool, haystack actually
  need memory mapping information to work with.
  So there is a dumping tool included `haystack-live-dump`:

      

  You can easily reproduce the format of the dump, its a folder/archive
  containing each memory map in a separate file :

  - memory content in a file named after it's start/end addresses ( 0x000700000-0x000800000 )
  - 'mappings' file containing memory mappings metadata.  ( mappings )

  Or you can code a `haystack.abc.IMemoryMapping` implementation for your favorite format.

  Otherwise, if you already have a system memory dump from Volatility or Rekall,
  you can use the `haystack-rekall-xxx` or `haystack-volatility-xxx` families of
  entry points to extract a specific process memory into a file.

  Verifying Windows Heap attributes:
  ==================================

  The entry point `haystack-find-heap` allows to show details on Windows HEAP.
  It should support:

  - Windows XP 32 bits
  - Windows XP 64 bits
  - Windows 7 32 bits
  - Windows 7 64 bits

  and show details of the Look Aside List (LAL) and Low Fragmentation Heap (LFH) frontend.

  You might be surprised to see that sometimes, a single process can mix the two types of HEAP (32 & 64).

  Search for known structures:
  ============================

  To search for a specific record, you will first need to define that record type.
  A [quick usage guide](docs/Haystack basic usage.ipynb) is available to go
  over the basic steps to go from a C Header file to a Python ctypes definition.
  Or you can do it yourself, with traditional Python ctypes records.

  The search api is available through the `haystack-xxx-search` family of scripts but
  also in an API so that you can embed that search in your own code.

  In short, the haystack search will iterate over every offset of the program's
  memory to try and find 'valid' offset for that specific record type.

  The validity of the record is determined by type constraints such as:
  - pointer field should have valid address space values
  - user-defined type constraints (see 'Constraints file' section below)
  - etc..

  Constraints file:
  -----------------

  The following constraints are supported:
   - IgnoreMember: The value of this field will be ignored. Useful to Ignore pointer fields.
   - NotNull: The value of this field must not be 0.
   - RangeValue(x,y): the field must have a value between x and y.
   - PerfectMatch('hello world'): the field (a string) must match 'hello world'
   - [1,2,3]: A list of values that the fields should have
   - [1, RangeValue(12,16), 42]: The field value should be 1, 12-16 or 42.


  Example:

      [struct_name]
      myfield: [1,0xff]
      ptr_field: NotNull

  You can take a look a `haystack/structures/win32/winxpheap32.constraints`, where
  the constraints of a Windows XP HEAP x32 are defined.

  Obviously, the more constraints, the better the results will be.

  Dynamic constraints definition:
  -------------------------------
  You can also create more complex constraints using python code by implementing
  a `haystack.abc.interface.IRecordTypeDynamicConstraintsValidator` class and feeding it to
  the `ModuleConstraints.set_dynamic_constraints`

  Command line example:
  ---------------------

  **sslsnoop repository needs an update to be compatible with releases > v0.30 - pending**

  For example, this will dump the session_state structures + pointed
  children structures as an python object that we can play with.
  Lets assume we have an ssh client or server as pid *4042*:

      $ sudo haystack-live-search --pickled 4042 sslsnoop.ctypes_openssh.session_state search > instance.pickled
      $ sudo haystack-live-search --pickled 4042 sslsnoop.ctypes_openssh.session_state refresh 0xb8b70d18 > instance.pickled
      $ sudo haystack-live-search --pickled <pid> <your ctypes Structure> search


  Graphic example :
  -----------------

  **This is not working right now**

  There is also an attempt at a Graphical GUI ( Qt4 )
  Dump the process, then you can open it in the GUI::

      $ haystack-gui # ( and Ctrl-O , click click)
      $ haystack-gui --dumpname dumps/myssh.dump

  You can the search a structure from the heap of that memory mapping.

  You have to import your extensions before that to have them listed in
  the search dialog.


  python API example:
  -------------------

  See the [quick usage guide](docs/Haystack basic usage.ipynb)


  How to define your own structures:
  ----------------------------------

  The most easy way is to use ctypeslib to generate ctypes records from
  C Headers.

  Or define your python ctypes record by hand.


  Heap analysis / forensics:
  ==========================

  Quick info:
   - The `haystack-xxx-reverse` family of entry points parse the heap for
   allocator structures, pointers values, small integers and text (ascii/utf).
   Given all the previous information, it can extract instances and helps you
   in classifying and defining structures types.

  IPython notebook usage guide:
   - [Haystack-reverse CLI](docs/Haystack reverse CLI.ipynb) in the docs/ folder.

  Command line example:
  --------------------
  The first step is to launch the analysis process with the `haystack-xxx-reverse` entry point.
  This will create several files in the `cache/` folder in the memory dump folder:

      $ haystack-reverse haystack/test/src/test-ctypes6.64.dump
      $ ls -l haystack/test/src/test-ctypes6.64.dump/cache
      $ ls -l haystack/test/src/test-ctypes6.64.dump/cache/structs

  This will create a few files. The most interesting one being the `<yourdumpfolder>/cache/xxxxx.headers_values.py` that
  gives you an ctypes listing of all found structures, with guesstimates
  on fields types.

  A `<yourdumpfolder>/cache/graph.gexf` file is also produced to help you visualize
  instances links. It gets messy for any kind of serious application.

  - `*.headers_values.py` contains the list of heuristicly reversed record types.
  - `*.strings` contains the list of heuristicly typed strings field in reversed record.

  Other Entry points for reversing:
  --------------------------------

   - `haystack-reverse-show` show a specific record at a specific address
   - `haystack-reverse-hex` show a specific record hex bytes at a specific address
   - `haystack-reverse-parents` show the records pointing to the allocated record at a specific address
   - `haystack-minidump-reverse-show` show a specific record at a specific address
   - `haystack-minidump-reverse-hex` show a specific record hex bytes at a specific address
   - `haystack-minidump-reverse-parents` show the records pointing to the allocated record at a specific address


  Extension examples :
  ====================
  @ see sslsnoop in the Pypi repo. openssl and nss structures are generated.

  @ see ctypes-kernel on my github. Linux kernel structure are generated from a build kernel tree. (VMM is abitch)



  not so FAQ :
  ============

  What does it do ?:
  ------------------
  The basic functionality is to search in a process' memory for a
  specific C Record.

  The extended reverse engineering functionality aims at reversing
  structures from memory/heap analysis.

  How do it knows that the structures is valid ? :
  ------------------------------------------------
  You add some constraints on the record fields expected values.
  Pointers are always constrained to valid memory space.

  Where does the idea comes from ? :
  -----------------------------------
  http://www.hsc.fr/ressources/breves/passe-partout.html.fr originally.
  since I started in March 2011, I have uncovered several other related
  previous work.

  Most of them are in the docs/ folder.

  Other related work are mona.py from Immunity, some other Mandiant stuff...

  In a nutshell, this is probably not an original idea. But yet, I could
  not find a operational standalone lib for live memory extraction for my sslsnoop PoC, so....


  What are the dependencies ? :
  ----------------------------

  - python-ptrace on linux
  - winappdbg on win32 ( not sure if working, feedback welcome)
  - python-numpy
  - python-networkx
  - python-levenshtein
  - several others...

  Others
  ------
  http://ntinfo.biz/ xntsv32


pkgId: 5fb31d69de9fc4addbdf9022ff005971dc67f976d33679663a655f7f5aba4cad
name: python-idna
arch: src
version: 2.5
epoch: 0
release: 1.fc23
summary: Internationalized Domain Names in Applications (IDNA)
url: https://github.com/kjd/idna
rpm_license: BSD and Python and Unicode
rpm_group: Unspecified
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-idna-2.5-1.fc23.src.rpm
checksum_type: sha256
description:
  A library to support the Internationalised Domain Names in Applications (IDNA)
  protocol as specified in RFC 5891 <http://tools.ietf.org/html/rfc5891>.  This
  version of the protocol is often referred to as "IDNA2008" and can produce
  different results from the earlier standard from 2003.

  The library is also intended to act as a suitable drop-in replacement for the
  "encodings.idna" module that comes with the Python standard library but
  currently only supports the older 2003 specification.


pkgId: 85dbfc4ac48d1443a3f716998e1475674187de5a9f7a33fcfc0f492704dc56fe
name: python-ioc_writer
arch: src
version: 0.3.3
epoch: 0
release: 0
summary: API providing a limited CRUD for manipulating OpenIOC formatted Indicators of Compromise
url: http://www.github.com/mandiant/ioc_writer/
rpm_license: Apache
rpm_group: Development/Languages/Python
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-ioc_writer-0.3.3-0.src.rpm
checksum_type: sha256
description:
  ioc\_writer
  ===========

  The source code in this package is made available under the terms of the
  Apache License , Version 2.0. See the "LICENSE " file for more
  information.

  Status
  ------

  -  |Build Status|
  -  |Coverage Status|

  Author
  ------

  William Gibb william.gibb at fireeye dot com

  Purpose
  -------

  Provide a python library that allows for basic creation and editing of
  OpenIOC objects. It supports a basic CRUD (Create, Read, Update, Delete)
  for various items:

  +-----------------------+----------+--------+----------+----------+
  | item                  | Create   | Read   | Update   | Delete   |
  +=======================+==========+========+==========+==========+
  | IOC name              | Yes      | No     | Yes      | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | IOC description       | Yes      | No     | Yes      | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | created date          | Yes      | No     | Yes      | N/A      |
  +-----------------------+----------+--------+----------+----------+
  | last modified date    | Yes      | No     | Yes      | N/A      |
  +-----------------------+----------+--------+----------+----------+
  | published date        | Yes      | No     | Yes      | N/A      |
  +-----------------------+----------+--------+----------+----------+
  | link metadata         | Yes      | No     | Yes      | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | IndicatorItem nodes   | Yes      | No     | NotYet   | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | Indicator nodes       | Yes      | No     | NotYet   | Yes      |
  +-----------------------+----------+--------+----------+----------+
  | Parameters            | Yes      | No     | Yes      | Yes      |
  +-----------------------+----------+--------+----------+----------+

  Items do not have built in Read operations, since all items can be
  accesed with built in ElementTree syntax or the use of XPATH to select
  portions of the IOC.

  No decision has been made about whether or not to support changing of
  existing Indicator/IndicatorItem nodes.

  See the Docs located at https://pythonhosted.org/ioc\_writer/ and the
  examples directory for examples of working with the library. The user
  code should avoid having to call functionality in ioc\_writer.ioc\_et.

  Requirements
  ------------

  The python "lxml" library must be installed. This can be obtained from
  https://pypi.python.org/pypi/lxml

  Installation
  ------------

  See the file named "INSTALL" for instructions on installing this library
  locally.

  Examples
  --------

  Example code lives in the examples folder of the repository.

  1. examples/11\_to\_10\_downgrade Script to downgrade OpenIOC 1.1 to
     OpenIOC 1.1.
  2. examples/openioc\_to\_yara Scripts that support encapsulating YARA
     signatures in OpenIOC 1.1 format.
  3. examples/simple\_ioc\_writer Script that consumes a csv of data to
     build an IOC. this csv contains the content, context, et cetera. An
     example CSV is provided.

  Bug reports / questions / feedback / feature requests
  =====================================================

  william.gibb at fireeye dot com

  .. |Build Status| image:: https://travis-ci.org/mandiant/ioc_writer.svg?branch=master
     :target: https://travis-ci.org/mandiant/ioc_writer
  .. |Coverage Status| image:: https://coveralls.io/repos/github/mandiant/ioc_writer/badge.svg?branch=master
     :target: https://coveralls.io/github/mandiant/ioc_writer?branch=master


pkgId: 8d54389d885098a8b77b3670b50c04167141ea39583ad2690d544a1cc4526468
name: python-pefile
arch: src
version: 2017.5.26
epoch: 0
release: 2.fc23
summary: Python module for working with Portable Executable files
url: https://github.com/erocarrera/pefile
rpm_license: MIT
rpm_group: Unspecified
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-pefile-2017.5.26-2.fc23.src.rpm
checksum_type: sha256
description:
  pefile is a multi-platform Python module to read and work with Portable
  Executable (aka PE) files. Most of the information in the PE Header is
  accessible, as well as all the sections, section's information and data.
  pefile requires some basic understanding of the layout of a PE file. Armed
  with it it's possible to explore nearly every single feature of the file.
  Some of the tasks that pefile makes possible are:
  * Modifying and writing back to the PE image
  * Header Inspection
  * Sections analysis
  * Retrieving data
  * Warnings for suspicious and malformed values
  * Packer detection with PEiD’s signatures
  * PEiD signature generation


pkgId: 22cc092011d3e98f71167d21cb7ae195b4f3b135fc9b190cb5e86c6847aa8713
name: python-psutil
arch: src
version: 5.4.3
epoch: 0
release: 4.fc23
summary: A process and system utilities module for Python
url: https://github.com/giampaolo/psutil
rpm_license: BSD
rpm_group: Unspecified
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-psutil-5.4.3-4.fc23.src.rpm
checksum_type: sha256
description:
  psutil is a module providing an interface for retrieving information on all
  running processes and system utilization (CPU, memory, disks, network, users) in
  a portable way by using Python, implementing many functionalities offered by
  command line tools such as: ps, top, df, kill, free, lsof, free, netstat,
  ifconfig, nice, ionice, iostat, iotop, uptime, pidof, tty, who, taskset, pmap.


pkgId: c7adf3be09be324d8c7451d656d7d6ebb01e47fe9a52302542f00aae4cda255f
name: python-rarfile
arch: src
version: 2.6
epoch: 0
release: 1.fc23
summary: python-rarfile - RAR archive reader for Python
url: https://pypi.python.org/pypi/rarfile
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: python-rarfile-2.6-1.fc23.src.rpm
checksum_type: sha256
description:
  This is Python module for RAR_ archive reading.  The interface
  is made as zipfile_ like as possible.  Licensed under ISC_
  license.

  .. _RAR: http://en.wikipedia.org/wiki/RAR
  .. _zipfile: http://docs.python.org/library/zipfile.html
  .. _ISC: http://en.wikipedia.org/wiki/ISC_license

  Features:

  - Supports both RAR 2.x and 3.x archives.
  - Supports multi volume archives.
  - Supports Unicode filenames.
  - Supports password-protected archives.
  - Supports archive comments.
  - Archive parsing and non-compressed files are handled in pure Python code.
  - For compressed files runs ``unrar`` utility.
  - Works with both Python 2.x and 3.x.

  Links:

  - News: http://rarfile.berlios.de/NEWS.html
  - FAQ: http://rarfile.berlios.de/FAQ.html
  - API documentation: http://rarfile.berlios.de/doc/
  - Downloads, GIT: http://developer.berlios.de/projects/rarfile


pkgId: bf9388fcda2e755af8b16f8f6635962fdd31c6c60429d957701a08669d6638ec
name: python-registry
arch: src
version: 1.1.0
epoch: 0
release: 2.fc23
summary: Read access to Windows Registry Files
url: http://www.williballenthin.com/registry/
rpm_license: Apache 2.0
rpm_group: Development/Libraries/Python
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-registry-1.1.0-2.fc23.src.rpm
checksum_type: sha256
description:
  python-registry was originally written by Willi Ballenthin, a forensicator at Mandiant who wanted to access the contents of the
  Windows Registry from his Linux laptop. python-registry currently provides read-only access to Windows Registry files,
  such as NTUSER.DAT, userdiff, and SAM. The interface is two-fold: a high-level interface suitable for most tasks, and a low level
  set of parsing objects and methods which may be used for advanced study of the Windows Registry. python-registry is written in pure
  Python, making it portable across all major platforms.


pkgId: a175200b876bcbc4d1ae4baccef229063219fdc8917ea0f8e18cfb3f8c1abf60
name: python-ssdeep
arch: src
version: 3.2
epoch: 0
release: 1.fc23
summary: Python wrapper for the ssdeep library
url: http://github.com/DinoTools/python-ssdeep
rpm_license: LGPLv3+
rpm_group: Unspecified
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: python-ssdeep-3.2-1.fc23.src.rpm
checksum_type: sha256
description:
  ssdeep Python Wrapper This is a straightforward Python wrapper for ssdeep by
  Jesse Kornblum_, which is a library for computing context triggered piecewise
  hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have
  homologies. Such inputs have sequences of identical bytes in the same order,
  although bytes in between these sequences may be different in both content and
  length. :target:


pkgId: 44f63bc0be4cc05d23616d7370cd53284512fc222ed098ff9dd98a8a2032f9f3
name: qtmltfs
arch: src
version: 2.2.2
epoch: 0
release: 2.fc23
summary: Quantum Linear Tape File System
rpm_license: GNU Lesser GPL Version 2.1
rpm_vendor: Quantum
rpm_group: Util
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: qtmltfs-2.2.2-2.fc23.src.rpm
checksum_type: sha256
description:
  Quantum Linear Tape File System (QTM LTFS) enables standard file operations on LTO-5 and LTO-6 tape media


pkgId: 577a0d75d00f344fe05188694ab0552f0ce8f44627f0c7d0202b14f8f0223bb8
name: radare-extras
arch: src
version: 2.0.10.4
epoch: 0
release: 1.fc23
summary: Reverse Engineering Framework
url: http://www.radare.org
rpm_license: LGPL-3.0
rpm_group: Development/Tools/Debuggers
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: radare-extras-2.0.10.4-1.fc23.src.rpm
checksum_type: sha256
description:
  This repository contains extra plugins for radare2.

  The reasons why those plugins are distributed in a separate
  repository are the following:

  * Depends on external libraries (yara, ewf)
  * Marginal/specific use (ctf-specific asm/anal vm f.ex)
  * r2 must be self-contained (no optional/external deps)
  * Simplify packagers work, and makes it more flexible
  * Duplicates functionality from r2 (no need to have
    multiple disassemblers for the same arch in core)

  The compiled plugins will be installed at

  	/usr/lib/radare2-extras/$(VERSION)

  Some of the plugins/code doesnt compiles, it will be reviewed
  and cleaned up, merged into core, updated or removed.

  In addition, this repository will be useful to new contributors,
  comers who want to write his own r2 plugins for example.

  The aim of this repository is to make the master radare2
  repository to be as concise as possible, and reduce the
  amount of unnecessary plugins to shrink the install size and
  keep it usable for 99% of users.


pkgId: 53b7a4fcd9150214f151305c83e6dcd85eed5875ca8daba5adceac596a4ad74a
name: radare2
arch: src
version: 2.2.0
epoch: 0
release: 1.fc23
summary: The radare2 reverse engineering framework
url: http://radare.org/
rpm_license: LGPLv3
rpm_group: Applications/Engineering
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: radare2-2.2.0-1.fc23.src.rpm
checksum_type: sha256
description:
  The radare2 is a reverse-engineering framework that is multi-architecture,
  multi-platform, and highly scriptable.  radare2 provides a hexadecimal
  editor, wrapped I/O, file system support, debugger support, diffing
  between two functions or binaries, and code analysis at opcode,
  basic block, and function levels.


pkgId: 52f140da2a45e7b78e1fae22673a5a6495b648e9a894a08223829e956514ad1e
name: registrydecoder
arch: src
version: 20120816
epoch: 0
release: 1.fc23
url: https://code.google.com/p/registrydecoder/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: registrydecoder-20120816-1.fc23.src.rpm
checksum_type: sha256
summary:
  registrydecoder - automates acquisition, analysis, and reporting of Microsoft Windows registry contents.

description:
  This version of the Registry Decoder performs offline analysis (on an
  investigator’s lab machine) of acquired registry files. This project
  can be found here. The current version of this tool can process raw disk
  images, partition images, individual registry files, and the database
  of hives acquired by the online component. When given a disk image,
  the Sleuthkit libraries are used to parse the image and read each
  registry hive.  This includes the ability to acquire historical files
  from System Restore Points as well as the RegBack folder of Vista and
  7 images. Individual registry hives are processed using libraries from
  the RegLookup project.

  After being provided with all registry-oriented evidence for a particular
  case, which can be any combination of registry files, disk images, and
  acquired databases, Registry Decoder performs a one-time pre-processing
  of the evidence. During this process, it creates a number of databases and
  metadata files that contain all information needed to analyze the files.

  The analysis section of the offline component contains a number of
  powerful features. The first feature is Search, which allows for powerful
  searching across registry hives. The searching abilities include:

  	* Filtering by hive keys, name, and data
  	* Filtering by the last write time of keys
  	* Searching individual terms or with a newline delimited search term file
  	* Exact or wildcard based search
  	* Viewing of search results
  	* Automated reporting of search contents to HTML, PDF, or XLS


pkgId: 58855ba417b1ef4f74386e290ee75ede77e62daaade9db65e901774596938d33
name: reglookup
arch: src
version: 1.0.1
epoch: 0
release: 2.fc23
summary: Windows NT registry reader/lookup tool
url: https://code.google.com/p/reglookup/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: reglookup-1.0.1-2.fc23.src.rpm
checksum_type: sha256
description:
  RegLookup project is an small command line utility for reading and
  querying Windows NT/2K/XP registries.

  Currently the program allows one to read an entire registry and output
  it in a (mostly) standardized, quoted format. It also provides features
  for filtering of results based on registry path and data type.


pkgId: 741967e48c868d2e3b7fe87bc3c57b6ecea818d111a92ac1e36dc60e9d430bd1
name: regripper
arch: src
version: 28000000
epoch: 0
release: 5.fc23
summary: A Windows Registry data extraction and correlation tool
url: http://www.regripper.net/RegRipper/RegRipper/rr_20080909.zip
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: regripper-28000000-5.fc23.src.rpm
checksum_type: sha256
description:
  RegRipper is a Windows Registry data extraction and correlation
  tool. RegRipper uses plugins (similar to Nessus) to access specific
  Registry hive files in order to access and extract specific keys, values,
  and data, and does so by bypassing the Win32API.


pkgId: 743617f270170c649838ecb1e763a8d18896fc6c45bdb41e46b2e64c777549bd
name: rifiuti
arch: src
version: 20040505_1
epoch: 0
release: 1.fc23
summary: Examine the contents of INFO2 in the Windows Recycle bin
url: http://www.mcafee.com/us/downloads/free-tools/rifiuti.aspx
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers
location_href: rifiuti-20040505_1-1.fc23.src.rpm
checksum_type: sha256
description:
  Rifiuti, the Italian word meaning "trash", was developed to examine
  the contents of the INFO2 file in the Recycle Bin. Rifiuti will parse
  the information in an INFO2 file and output the results in a field
  delimited manner so that it may be imported into your favorite spreadsheet
  program. Rifiuti is built to work on multiple platforms and will execute
  on Windows (through Cygwin), Mac OS X, Linux, and *BSD platforms.


pkgId: f0937bdd79994bca8c6912e0447b617c9e9f583d3aa67a66396a5fc0c4cc6cd9
name: scapy
arch: src
version: 2.4.0
epoch: 0
release: 4.fc23
summary: Interactive packet manipulation tool and network scanner
url: http://www.secdev.org/projects/scapy/
rpm_license: GPLv2
rpm_group: Applications/Internet
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: scapy-2.4.0-4.fc23.src.rpm
checksum_type: sha256
description:
  Scapy is a powerful interactive packet manipulation program built on top
  of the Python interpreter. It can be used to forge or decode packets of
  a wide number of protocols, send them over the wire, capture them, match
  requests and replies, and much more.


pkgId: e91ab73d3fd22bdea0351d72e39aac328a55619d25d6af12e61e7c9322fb34ed
name: scrounge-ntfs
arch: src
version: 0.9
epoch: 0
release: 1.fc23
summary: Data recovery program for NTFS file systems
url: http://memberwebs.com/stef/software/scrounge/
rpm_license: BSD
rpm_group: File tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: scrounge-ntfs-0.9-1.fc23.src.rpm
checksum_type: sha256
description:
  scrounge-ntfs is a utility that can rescue data from corrupted NTFS partitions. It
  writes the files retrieved to another working file system. Certain
  information about the partition needs to be known in advance.


pkgId: 6f64dfd84674fdfc4d3c0084695416aa9c867c585d6c82580ff3158de30862ba
name: sfdumper
arch: src
version: 2.2
epoch: 0
release: 1.fc23
summary: A Selective File Dumper program built on top of the Sleuthkit
url: http://sfdumper.sourceforge.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: sfdumper-2.2-1.fc23.src.rpm
checksum_type: sha256
description:
  SFDumper is a Selective File Dumper program built on top of the Sleuthkit.
  There is a windowed interface named sfdumper-gui.


pkgId: 928ca15bc9e5cf60174bc072f25a611513f3561827342288cab48175b52438a7
name: shellbags
arch: src
version: 0.5.5
epoch: 0
release: 1.fc23
summary: Cross-platform shellbag parser
url: http://www.williballenthin.com/forensics/shellbags/index.html
rpm_license: Apache 2.0
rpm_group: Development/Libraries/Python
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: shellbags-0.5.5-1.fc23.src.rpm
checksum_type: sha256
description:
  Microsoft Windows uses a set of Registry keys known as "shellbags"
  to maintain the size, view, icon, and position of a folder when using
  Explorer. These keys are useful to a forensic investigator. Shellbags
  persist information for directories even after the directory is removed,
  which means that they can be used to enumerate past mounted volumes,
  deleted files, and user actions. Yuandong Zhu, Pavel Gladyshev, and Joshua
  James provided a nice overview of the investigative value of shellbags in
  "Using shellbag information to reconstruct user activities" [pdf]; however,
  they do not describe how to programmatically access the data. Allan S Hay
  went into greater detail in his December, 2004 document "MiTeC Registry
  Analyser" [pdf], although he also leaves out a thorough analysis of the
  format. TZWorks provides an effective closed-source shellbag parser sbag,
  but does not explain its algorithm. Yogesh Khatri first described the basic
  structure of Windows Shell Items in his blog post for 42 LLC entitled Shell BAG
  Format Analysis. Joachim Metz went on to described the binary format of the
  Windows Shell Item structures with great detail in Windows Shell Item format
  specification [pdf]. This page documents an approach to parsing shellbags in
  detail, as well as introduces an open-source, cross-platform shellbag parser.


pkgId: f7ec4b7839409c4d5f75936fda871d834e93b236111263eca14a2c15861caa81
name: silk
arch: src
version: 3.11.0.1
epoch: 0
release: 1.fc23
summary: SiLK: A network flow collection and analysis package
url: http://tools.netsa.cert.org/silk/
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness <netsa-help@cert.org>
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: silk-3.11.0.1-1.fc23.src.rpm
checksum_type: sha256
description:
  SiLK, the System for Internet-Level Knowledge, is a collection of
  traffic analysis tools developed by the CERT Network Situational
  Awareness Team (CERT NetSA) to facilitate security analysis of large
  networks. The SiLK tool suite supports the efficient collection,
  storage and analysis of network flow data, enabling network security
  analysts to rapidly query large historical traffic data sets. SiLK is
  ideally suited for analyzing traffic on the backbone or border of a
  large, distributed enterprise or mid-sized ISP.

  SiLK consists of two sets of tools: a packing system and analysis
  suite. The packing system receives network flow information from
  Netflow v5 or any IPFIX-based flowmeter and converts them into a more
  space efficient format, recording the packed records into
  service-specific, binary flat files. The analysis suite consists of
  tools which can read these flat files and then perform various query
  operations, ranging from per-record filtering to statistical analysis
  of groups of records. The analysis tools interoperate using pipes,
  allowing a user to develop a relatively sophisticated query from a
  simple beginning.


pkgId: 6958ff2870c1e8a198506f65d9e1a770147e4610c67d91510305d7b599bc6621
name: silk-ipa
arch: src
version: 1.0
epoch: 0
release: 1.fc23
summary: silk-ipa - SiLK with the IPA Suite and PostgreSQL
url: http://www.cert.org/forensics/repository
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: silk-ipa-1.0-1.fc23.src.rpm
checksum_type: sha256
description:
  This package contains a script named EnableSilkWithIPA that
  enables the forensics-sip (Silk with Ipa and Postgresql)
  repostory, installs needed packages, and then provides a
  URL to configure these tools


pkgId: e1ca4013f1f65a6833bf041254915dd98b5b9f78e0d43bc2d4406c9a66536526
name: silk-ipset
arch: src
version: 3.11.0
epoch: 0
release: 1.fc23
summary: SiLK IPset: Library and tools for manipulating sets of IP Addresses
url: http://tools.netsa.cert.org/silk/
rpm_license: GPLv2
rpm_vendor: CERT Network Situational Awareness <netsa-help@cert.org>
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: silk-ipset-3.11.0-1.fc23.src.rpm
checksum_type: sha256
description:
  The SiLK IPset packages contain a library and a set of command line
  tools to build and manipulate IPset files, which are binary files
  containing a set of IP addresses.

  The SiLK IPset packages are derived from the SiLK traffic analysis
  tools developed by the CERT Network Situational Awareness Team (CERT
  NetSA).  Since the SiLK IPset packages contain a small subset of the
  tools in the SiLK package, there is no need to install the SiLK IPset
  packages when the SiLK packages are installed.


pkgId: 38e758ff8f883ec4639f34b281b02780f3bd7d102a75b22dedbab382c27220fc
name: sleuthkit
arch: src
version: 4.2.0
epoch: 0
release: 2.fc23
summary: The Sleuth Kit (TSK)
url: http://www.sleuthkit.org
rpm_license: CPL and IBM and GPLv2+
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: sleuthkit-4.2.0-2.fc23.src.rpm
checksum_type: sha256
description:
  The Sleuth Kit (TSK) is a collection of UNIX-based command line tools that
  allow you to investigate a computer. The current focus of the tools is the
  file and volume systems and TSK supports FAT, Ext2/3, NTFS, UFS,
  and ISO 9660 file systems


pkgId: da33e5dbce6aaa8f3ad3784834943379a075fe45ee3b9fef1058100baf23bd73
name: snarf
arch: src
version: 0.3.0
epoch: 0
release: 2.fc23
summary: snarf - Structured Network Alert Reporting Framework
url: http://tools.netsa.cert.org/snarf
rpm_license: LGPLv2
rpm_vendor: CERT Network Situational Awareness <netsa-help@cert.org>
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: snarf-0.3.0-2.fc23.src.rpm
checksum_type: sha256
description:
  snarf is a distributed alert reporting system. Applications can use snarf's C
  and Python APIs to construct and send network alert messages, which can then be
  routed to multiple destinations in a configurable manner.


pkgId: 5b339541135744a1b8e8110ea4448c5eeddd16c18fbf347ca354194d62af684c
name: snort
arch: src
version: 2.9.11
epoch: 1
release: 1.fc23
summary: An open source Network Intrusion Detection System (NIDS)
url: http://www.snort.org/
rpm_license: GPL
rpm_vendor: Snort.org
rpm_group: Applications/Internet
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Official Snort.org RPMs
location_href: snort-2.9.11-1.fc23.src.rpm
checksum_type: sha256
description:
  Snort is an open source network intrusion detection system, capable of
  performing real-time traffic analysis and packet logging on IP networks.
  It can perform protocol analysis, content searching/matching and can be
  used to detect a variety of attacks and probes, such as buffer overflows,
  stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
  and much more.

  Snort has three primary uses. It can be used as a straight packet sniffer
  like tcpdump(1), a packet logger (useful for network traffic debugging,
  etc), or as a full blown network intrusion detection system.

  You MUST edit /etc/snort/snort.conf to configure snort before it will work!

  Please see the documentation in /usr/share/doc/snort-2.9.11 for more
  information on snort features and configuration.


pkgId: d453a9da22d2a3dbe6d7648ce464e24eea2adfc31cb05f93bd73ae25aedbf033
name: snort
arch: src
version: 2.9.11.1
epoch: 1
release: 1.fc23
summary: An open source Network Intrusion Detection System (NIDS)
url: http://www.snort.org/
rpm_license: GPL
rpm_vendor: Snort.org
rpm_group: Applications/Internet
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Official Snort.org RPMs
location_href: snort-2.9.11.1-1.fc23.src.rpm
checksum_type: sha256
description:
  Snort is an open source network intrusion detection system, capable of
  performing real-time traffic analysis and packet logging on IP networks.
  It can perform protocol analysis, content searching/matching and can be
  used to detect a variety of attacks and probes, such as buffer overflows,
  stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
  and much more.

  Snort has three primary uses. It can be used as a straight packet sniffer
  like tcpdump(1), a packet logger (useful for network traffic debugging,
  etc), or as a full blown network intrusion detection system.

  You MUST edit /etc/snort/snort.conf to configure snort before it will work!

  Please see the documentation in /usr/share/doc/snort-2.9.11.1 for more
  information on snort features and configuration.


pkgId: 7618cd8f221603591cecec48ffa5f48ac13a5781ebdcb8cd550aded47575df5b
name: snort
arch: src
version: 2.9.12
epoch: 1
release: 1.fc23
summary: An open source Network Intrusion Detection System (NIDS)
url: http://www.snort.org/
rpm_license: GPL
rpm_vendor: Snort.org
rpm_group: Applications/Internet
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Official Snort.org RPMs
location_href: snort-2.9.12-1.fc23.src.rpm
checksum_type: sha256
description:
  Snort is an open source network intrusion detection system, capable of
  performing real-time traffic analysis and packet logging on IP networks.
  It can perform protocol analysis, content searching/matching and can be
  used to detect a variety of attacks and probes, such as buffer overflows,
  stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
  and much more.

  Snort has three primary uses. It can be used as a straight packet sniffer
  like tcpdump(1), a packet logger (useful for network traffic debugging,
  etc), or as a full blown network intrusion detection system.

  You MUST edit /etc/snort/snort.conf to configure snort before it will work!

  Please see the documentation in /usr/share/doc/snort-2.9.12 for more
  information on snort features and configuration.


pkgId: d68354d4cde928c829ada1394a4cfbfad283ff77a17f0efdb28177216c2d3e83
name: snort
arch: src
version: 2.9.8.0
epoch: 1
release: 1.fc23
summary: An open source Network Intrusion Detection System (NIDS)
url: http://www.snort.org/
rpm_license: GPL
rpm_vendor: Snort.org
rpm_group: Applications/Internet
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Official Snort.org RPMs
location_href: snort-2.9.8.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Snort is an open source network intrusion detection system, capable of
  performing real-time traffic analysis and packet logging on IP networks.
  It can perform protocol analysis, content searching/matching and can be
  used to detect a variety of attacks and probes, such as buffer overflows,
  stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
  and much more.

  Snort has three primary uses. It can be used as a straight packet sniffer
  like tcpdump(1), a packet logger (useful for network traffic debugging,
  etc), or as a full blown network intrusion detection system.

  You MUST edit /etc/snort/snort.conf to configure snort before it will work!

  Please see the documentation in /usr/share/doc/snort-2.9.8.0 for more
  information on snort features and configuration.


pkgId: a87f87bc6efb1eb8900bcc162157497cee9c6951f9ef5d0c610c2c0d402fbb76
name: snort
arch: src
version: 2.9.8.3
epoch: 1
release: 1.fc23
summary: An open source Network Intrusion Detection System (NIDS)
url: http://www.snort.org/
rpm_license: GPL
rpm_vendor: Snort.org
rpm_group: Applications/Internet
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Official Snort.org RPMs
location_href: snort-2.9.8.3-1.fc23.src.rpm
checksum_type: sha256
description:
  Snort is an open source network intrusion detection system, capable of
  performing real-time traffic analysis and packet logging on IP networks.
  It can perform protocol analysis, content searching/matching and can be
  used to detect a variety of attacks and probes, such as buffer overflows,
  stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
  and much more.

  Snort has three primary uses. It can be used as a straight packet sniffer
  like tcpdump(1), a packet logger (useful for network traffic debugging,
  etc), or as a full blown network intrusion detection system.

  You MUST edit /etc/snort/snort.conf to configure snort before it will work!

  Please see the documentation in /usr/share/doc/snort-2.9.8.3 for more
  information on snort features and configuration.


pkgId: fec2e1a6c3edeb7167e5d81a87f3e735da49c27fa801349c3bd1675bda854728
name: snort
arch: src
version: 2.9.9.0
epoch: 1
release: 1.fc23
summary: An open source Network Intrusion Detection System (NIDS)
url: http://www.snort.org/
rpm_license: GPL
rpm_vendor: Snort.org
rpm_group: Applications/Internet
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Official Snort.org RPMs
location_href: snort-2.9.9.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Snort is an open source network intrusion detection system, capable of
  performing real-time traffic analysis and packet logging on IP networks.
  It can perform protocol analysis, content searching/matching and can be
  used to detect a variety of attacks and probes, such as buffer overflows,
  stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts,
  and much more.

  Snort has three primary uses. It can be used as a straight packet sniffer
  like tcpdump(1), a packet logger (useful for network traffic debugging,
  etc), or as a full blown network intrusion detection system.

  You MUST edit /etc/snort/snort.conf to configure snort before it will work!

  Please see the documentation in /usr/share/doc/snort-2.9.9.0 for more
  information on snort features and configuration.


pkgId: 4079a252f1b0e958c6abc2cdb5cddb5bf6cf392c03cd82591027c6697bb64073
name: socat
arch: src
version: 1.7.3.0
epoch: 0
release: 1.fc23
summary: Relay for bidirectional data transfer between 2 channels
url: http://www.dest-unreach.org/socat/
rpm_license: GPL
rpm_vendor: CERT Linux Forensics Tools Repository (LFTR) http://www.cert.org/forensics/repository
rpm_group: Applications/Internet
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers <lrr@cert.org>
location_href: socat-1.7.3.0-1.fc23.src.rpm
checksum_type: sha256
description:
  socat is a relay for bidirectional data transfer between two independent data
  channels. Each of these data channels may be a file, pipe, device (serial line
  etc. or a pseudo terminal), a socket (UNIX, IP4, IP6 - raw, UDP, TCP), an
  SSL socket, proxy CONNECT connection, a file descriptor (stdin etc.), the GNU
  line editor, a program, or a combination of two of these.


pkgId: 2e7d03731c8308cdb39dd85c3824221fd933dd97ad0f098412198c41ee9d0e17
name: ssdeep
arch: src
version: 2.13
epoch: 0
release: 1.fc23
summary: Computes a checksum based on context triggered piecewise hashes
url: http://ssdeep.sourceforge.net/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: ssdeep-2.13-1.fc23.src.rpm
checksum_type: sha256
description:
  Computes a checksum based on context triggered piecewise hashes for
  each input file. If requested, the program matches those checksums
  against a file of known checksums and reports any possible matches.
  Output is written to standard out and errors to standard error.
  Input from standard input is not supported.


pkgId: f6cae57cc82a788c81e0da200f8261748a5b5ecbe795ee2fca64feb183df4755
name: stegdetect
arch: src
version: 0.6
epoch: 0
release: 2.fc23
summary: Detect and extract steganography messages inside JPEG
url: http://www.outguess.org/detection.php
rpm_license: BSD
rpm_group: File tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: stegdetect-0.6-2.fc23.src.rpm
checksum_type: sha256
description:
  Stegdetect is an automated tool for detecting steganographic content in
  images. It is capable of detecting several different steganographic
  methods to embed hidden information in JPEG images. Currently, the
  detectable schemes are jsteg, jphide, invisible secrets, outguess 01.3b,
  F5, appendX, and camouflage. Using linear discriminant analysis, it also
  supports detection of new stego systems. Stegbreak is used to launch
  dictionary attacks against JSteg-Shell, JPHide, and OutGuess 0.13b.


pkgId: 9b79fa6fc75c14b8dcadfdf2696114d0fdbede24a12287a886b399fba9db19cf
name: super_mediator
arch: src
version: 1.2.1
epoch: 0
release: 1.fc23
summary: IPFIX Super Mediator for use with the YAF and SiLK tools
url: http://tools.netsa.cert.org/super_mediator/index.html
rpm_license: GPL
rpm_group: NetSA
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Emily Sarneso <ecoff@cert.org>
location_href: super_mediator-1.2.1-1.fc23.src.rpm
checksum_type: sha256
description:
  super_mediator is an IPFIX mediator for use with the YAF and SiLK tools.
  It collects and filters YAF output data to various IPFIX collecting processes
  and/or csv files. super_mediator can be configured to perform de-duplication
  of DNS resource records, SSL certificates, or HTTP header fields as exported
  by YAF.


pkgId: 919b1b16c3ac74b6344fb3fad3756ffe5677aff6ca5d261f1b6b396a2c1ecb34
name: testdisk
arch: src
version: 6.14
epoch: 0
release: 3.3.fc23
summary: Tool to check and undelete partition, PhotoRec recovers lost files
url: http://www.cgsecurity.org/wiki/TestDisk
rpm_license: GPLv2+
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: ttestdisk-6.14-3.3.fc23.src.rpm
checksum_type: sha256
description:
  Tool to check and undelete partition. Works with FAT12, FAT16, FAT32,
  NTFS, ext2, ext3, ext4, btrfs, BeFS, CramFS, HFS, JFS, Linux Raid, Linux
  Swap, LVM, LVM2, NSS, ReiserFS, UFS, XFS
  PhotoRec is a signature based file recovery utility. It handles more than
  200 file formats including JPG, MSOffice, OpenOffice documents.


pkgId: 30f54a2684c5cf048da7d6b8862d98a7ca2db6197038007867bb9b9c05840f88
name: undbx
arch: src
version: 0.21
epoch: 0
release: 1.fc23
summary: undbx - Tool to extract, recover and undelete e-mail messages from Outlook Express .dbx files
url: https://code.google.com/p/undbx/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: undbx-0.21-1.fc23.src.rpm
checksum_type: sha256
description:
  Tool to extract, recover and undelete e-mail messages from Outlook Express
  .dbx files. On first run all messages are extracted as individual .eml
  files. Subsequent runs only update the output directory with new messages,
  and delete old .eml files that correspond to deleted messages in the .dbx
  file. Corrupted .dbx files (including files larger than 2GB) can be opened in
  recovery mode, in order to recover messages and partially undelete deleted
  messages. The success of recovery depends on the type and level of .dbx
  file corruption.


pkgId: e422d2088486cd9e6656121378012e224a41f6b08c7d4c8b7fc0a32022d7b318
name: unrar
arch: src
version: 4.2.4
epoch: 0
release: 3.fc23
summary: Utility for extracting, testing and viewing RAR archives
url: http://www.rarlab.com/rar_add.htm
rpm_license: Freeware with further limitations
rpm_group: Applications/Archiving
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: unrar-4.2.4-3.fc23.src.rpm
checksum_type: sha256
description:
  The unrar utility is a freeware program for extracting, testing and
  viewing the contents of archives created with the RAR archiver version
  1.50 and above.


pkgId: df16a8c40600c3503f2c8ca5588f0a6e88b1abf7b21181ce7145d5276479277a
name: untex
arch: src
version: 1.3
epoch: 0
release: 3.1.fc23
summary: Command to strip LaTeX commands from input
url: ftp://ftp.thp.uni-duisburg.de/pub/source/
rpm_license: GPL
rpm_group: Applications/Publishing
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: untex-1.3-3.1.fc23.src.rpm
checksum_type: sha256
description:
  Like detex untex removes some LaTeX commands from the files listed in the
  arguments (or standard input) and prints the output to standard output.
  Has some alternative options, and the source code too, of course.


pkgId: 41cfec22ec0f4ffff783c2fc5f7499f11b6596add4acccc8f103c62905476462
name: valabind
arch: src
version: 0.10.0
epoch: 0
release: 1.fc23
summary: Transform vala or vapi files into swig, C++, NodeJS-ffi, or GIR
url: https://github.com/radare/valabind
rpm_license: GPLv3+
rpm_group: Applications/Engineering
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: valabind-0.10.0-1.fc23.src.rpm
checksum_type: sha256
description:
  Valabind is a tool to parse vala[1] or vapi files to transform them
  into swig[2] interface files, C++, NodeJS-ffi or GIR.  With swig, you
  can create language bindings for any API written in vala or C with a
  vapi interface.  It can also generate bindings for C++.


pkgId: b2257e2ef9d0f58fa3e9656a20f03dd26e6674bb3e8d945324f5fd03a9a4f50a
name: videosnarf
arch: src
version: 0.63
epoch: 0
release: 1.fc23
summary: Output detected media sessions
url: http://ucsniff.sourceforge.net/videosnarf.html
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: videosnarf-0.63-1.fc23.src.rpm
checksum_type: sha256
description:
  VideoSnarf is a new security assessment tool that takes an offline
  pcap as input, and outputs any detected media streams (RTP sessions),
  including common audio codecs as well as H264 Video support. Why did we
  write VideoSnarf? To give security assessment professionals options to
  decode media traffic other than forcing them to use UCSniff. We know that
  some people, for whatever reason, might not be using UCSniff to capture
  and decode VoIP/Video traffic. For example, some people might want to
  use Ettercap and their favorite Sniffer (tshark/Wireshark) to capture
  the traffic, or they might have a monitor SPAN Session and are running
  a dedicated sniffer and want to re-construct the traffic just using a
  pcap trace file. VideoSnarf was inspired by the rtpbreak tool. To our
  knowledge, it is the first tool to detect RTP sessions that are encoded
  with the H.264 Video Codec, and output raw H264 files. VideoSnarf
  also supports the following common audio codecs: G711ulaw, G711alaw,
  G722, G729, G723, and G726. These are the most common audio codecs
  found in enterprise networks where you are going to be doing security
  assessments.


pkgId: 571c9dd2f8e2f7bae0a97c458c6946a27dee553aeaab98fa4a7b0347beb2c1ee
name: vmfs-tools
arch: src
version: 0.2.5
epoch: 0
release: 2.fc23
summary: Tools to access VMFS filesystems
url: http://glandium.org/projects/vmfs-tools/
rpm_license: GPL-2.0+
rpm_group: System/Filesystems
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: vmfs-tools-0.2.5-2.fc23.src.rpm
checksum_type: sha256
description:
  Originally loosely based on the vmfs code from fluidOps, this set of tools has
  since evolved to handle more features from VMFS, such as extents, and allows to
  access VMFS through the standard Linux VFS with the help of the FUSE framework.

  While it is still work in progress and is not destined for production use yet,
  it can be of some help for some people.


pkgId: e301d161cff85cb67da1bbd0d1374b1ccd23fc2034f2f69549d31eab21442f52
name: winevt-kb
arch: src
version: 20170527
epoch: 0
release: 1.fc23
summary: winevt-kb - Windows Event Log Knowledge Base
url: https://github.com/libyal/winevt-kb/wiki
rpm_license: ASL 2.0
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: winevt-kb-20170527-1.fc23.src.rpm
checksum_type: sha256
description:
  winevt-kb is a project to build a Windows Event Log knowledge base.

  winevtrc is a Python module part of winevt-kb to allow reuse of Windows Event Log resources.


pkgId: 63dffb18ef6dfd2f2894d503037f71752e3a5b507400d29c02980732620a4aa1
name: winreg-kb
arch: src
version: 20170525
epoch: 0
release: 1.fc23
summary: winreg-kb - A project to build a Windows Registry Knowledge Base
url: https://github.com/libyal/winreg-kb/wiki
rpm_license: ASL 2.0
rpm_vendor: cert.org
rpm_group: Applications
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: winreg-kb-20170525-1.fc23.src.rpm
checksum_type: sha256
description:
  winreg-kb is a project to build a Windows Registry Knowledge Base.

  winregrc is a Python module part of winreg-kb to allow reuse of Windows
  Registry Resources.


pkgId: 95e0ed5f8d70641c331ece7516b9ae5c7394b178094640b1edf37e1b43011f43
name: x264
arch: src
version: 0.148
epoch: 0
release: 1.20151020gita0cd7d3.fc23
summary: H264/AVC video streams encoder
url: http://developers.videolan.org/x264.html
rpm_license: GPLv2+
rpm_vendor: RPM Fusion
rpm_group: System Environment/Libraries
rpm_buildhost: arm-cl01.kwizart.net
rpm_packager: http://free.rpmfusion.org/
location_href: x264-0.148-1.20151020gita0cd7d3.fc23.src.rpm
checksum_type: sha256
description:
  x264 is a free library for encoding H264/AVC video streams, written from
  scratch.

  This package contains the frontend.


pkgId: a34fd7d6d1c3de9be42dc878071e31b0793747d3c5068bc77d23ccae7cfd7a0a
name: x265
arch: src
version: 1.8
epoch: 0
release: 1.fc23
summary: H.265/HEVC encoder
url: http://x265.org/
rpm_license: GPLv2+ and BSD
rpm_vendor: RPM Fusion
rpm_group: Unspecified
rpm_buildhost: arm-cl01.kwizart.net
rpm_packager: http://free.rpmfusion.org/
location_href: x265-1.8-1.fc23.src.rpm
checksum_type: sha256
description:
  The primary objective of x265 is to become the best H.265/HEVC encoder
  available anywhere, offering the highest compression efficiency and the
  highest performance on a wide variety of hardware platforms.

  This package contains the command line encoder.


pkgId: 9131993cc55b2f14b85622e75f69ca8a7125f127a8f98570938bd617764a7b1d
name: xlsxwriter
arch: src
version: 0.8.4
epoch: 0
release: 1.fc23
summary: Python module for writing files in the Excel 2007+ XLSX file format
url: https://pypi.python.org/pypi/XlsxWriter
rpm_license: LGPL
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: xlsxwriter-0.8.4-1.fc23.src.rpm
checksum_type: sha256
description:
  XlsxWriter is a Python module for writing files in the Excel 2007+ XLSX file format.

  XlsxWriter can be used to write text, numbers, formulas and hyperlinks
  to multiple worksheets and it supports features such as formatting and
  many more, including:

  	100% compatible Excel XLSX files.
  	Full formatting.
  	Merged cells.
  	Defined names.
  	Charts.
  	Autofilters.
  	Data validation and drop down lists.
  	Conditional formatting.
  	Worksheet PNG/JPEG images.
  	Rich multi-format strings.
  	Cell comments.
  	Integration with Pandas.
  	Textboxes.
  	Memory optimization mode for writing large files.

  It supports Python 2.5, 2.6, 2.7, 3.1, 3.2, 3.3, 3.4, 3.5, Jython and PyPy and uses standard libraries only.


pkgId: 84fd43359f961e47c370fad1f62ff8cb9179fe8b09e2b3be529efffd135fd34a
name: xmount
arch: src
version: 0.7.3
epoch: 0
release: 1.fc23
summary: Tool to crossmount between multiple input and output harddisk images
url: https://www.pinguin.lu/
rpm_license: GPL
rpm_group: Applications/System
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: xmount-0.7.3-1.fc23.src.rpm
checksum_type: sha256
description:
  xmount allows you to convert on-the-fly between multiple input and output
  harddisk image types. xmount creates a virtual file system using FUSE
  (Filesystem in Userspace) that contains a virtual representation of the input
  harddisk image. The virtual representation can be in raw DD, VirtualBox's
  virtual disk file format, Microsoft's Virtual Hard Disk Image format or in
  VMware's VMDK format. Input harddisk images can be raw DD or EWF (Expert
  Witness Compression Format) files. In addition, xmount also supports virtual
  write access to the output files that is redirected to a cache file. This
  makes it for example possible to boot acquired harddisk images using QEMU,
  KVM, VirtualBox, VMware or alike.


pkgId: 622144f0416d59086d2224d57de44640e245bcc5cb2347ddd75938122484fff0
name: xmount
arch: src
version: 0.7.6
epoch: 0
release: 3.fc23
summary: A on-the-fly convert for multiple hard disk image types
url: https://www.pinguin.lu/index.php
rpm_license: GPLv3+
rpm_group: Unspecified
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: xmount-0.7.6-3.fc23.src.rpm
checksum_type: sha256
description:
  xmount allows you to convert on-the-fly between multiple input
  and output hard disk image types. xmount creates a virtual file
  system using FUSE (Filesystem in Userspace) that contains a virtual
  representation of the input image. The virtual representation can
  be in raw DD, VirtualBox's virtual disk file format or in VmWare's
  VMDK file format. Input images can be raw DD, EWF (Expert Witness
  Compression Format) or AFF (Advanced Forensic Format) files. In
  addition, xmount also supports virtual write access to the output
  files that is redirected to a cache file. This makes it possible
  to boot acquired hard disk images using QEMU, KVM, VirtualBox,
  VmWare, or alike.


pkgId: 91be5bc2baa13320a364095c68fd6b646380ed803f98fa0922a391b0f723566e
name: xplico
arch: src
version: 1.1.1
epoch: 0
release: 1.fc23
summary: Internet traffic decoder and network forensic analysis tool
url: http://www.xplico.org/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: xplico-1.1.1-1.fc23.src.rpm
checksum_type: sha256
description:
  The goal of Xplico is extract from an internet traffic capture the
  applications data contained.  For example, from a pcap file Xplico
  extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents,
  each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network
  protocol analyzer. Xplico is an open source Network Forensic Analysis Tool
  (NFAT).


pkgId: 4f0ef875d7575d0e00afbe713aa3ad0e130f086200fe0c678e79f812ae41d587
name: yaf
arch: src
version: 2.10.0
epoch: 0
release: 1.fc23
summary: Yet Another Flow sensor
url: http://tools.netsa.cert.org/yaf/
rpm_license: GPL
rpm_vendor: http://tools.netsa.cert.org/
rpm_group: NetSA
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Tony Cebzanov <tonyc@cert.org>
location_href: yaf-2.10.0-1.fc23.src.rpm
checksum_type: sha256
description:
  YAF is Yet Another Flow sensor. It processes packet data from pcap(3) dumpfiles
  as generated by tcpdump(1) or via live capture from an interface using pcap(3)
  or an Endace DAG card into bidirectional flows, then exports those flows to
  IPFIX Collecting Processes or in an IPFIX-based file format. YAF's output can
  be used with the NetSA Aggregated Flow (NAF) toolchain.


pkgId: 3471c0ea2a74c7ad2fbb7ef2a373345867a43684cedea656f4fb4cec4d7038e0
name: yara
arch: src
version: 3.4.0
epoch: 0
release: 2.fc23
summary: yara - find files matching patterns and rules written in a special-purpose language
url: http://plusvic.github.io/yara/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: yara-3.4.0-2.fc23.src.rpm
checksum_type: sha256
description:
  Yara scans the given FILE or the process indentified by PID looking if
  it matches the patterns and rules provided in a special purpose-lan‐
  guage. The rules are read from RULEFILEs or standard input.


pkgId: 74fd837b47123116c859a20c4ce3ef1731b02eb18ca997507b664ee6eee52b03
name: yara
arch: src
version: 3.5.0
epoch: 0
release: 5.1.fc23
summary: Pattern matching Swiss knife for malware researchers
url: http://VirusTotal.github.io/yara/
rpm_license: ASL 2.0
rpm_group: Development/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: yara-3.5.0-5.1.fc23.src.rpm
checksum_type: sha256
description:
  YARA is a tool aimed at (but not limited to) helping malware researchers to
  identify and classify malware samples. With YARA you can create descriptions
  of malware families (or whatever you want to describe) based on textual or
  binary patterns. Each description, a.k.a rule, consists of a set of strings
  and a Boolean expression which determine its logic.


pkgId: 681129e63d82437147155b9de1da3ec6d0b33ffe853b10c4c894372a083d2f22
name: yara-python
arch: src
version: 3.4.0
epoch: 0
release: 2.fc23
summary: yara-python - Python extension that gives access to YARA from Python scripts
url: http://plusvic.github.io/yara/
rpm_license: GPL
rpm_vendor: cert.org
rpm_group: Applications/Forensics Tools
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
rpm_packager: Lawrence R. Rogers (lrr@cert.org)
location_href: yara-python-3.4.0-2.fc23.src.rpm
checksum_type: sha256
description:
  YARA for Python - This is a Python extension that gives access to YARA's powerful features from Python scripts.


pkgId: 0751b73d02827c9011f2151496c571d4f984f836e9a9b012656998f988eb1737
name: zeromq
arch: src
version: 2.2.0
epoch: 0
release: 4.fc23
summary: Software library for fast, message-based applications
url: http://www.zeromq.org
rpm_license: LGPLv3+
rpm_group: System Environment/Libraries
rpm_buildhost: lftr-fedora-23-x86-64.cs2.cert.org
location_href: zeromq-2.2.0-4.fc23.src.rpm
checksum_type: sha256
description:
  The 0MQ lightweight messaging kernel is a library which extends the
  standard socket interfaces with features traditionally provided by
  specialized messaging middle-ware products. 0MQ sockets provide an
  abstraction of asynchronous message queues, multiple messaging
  patterns, message filtering (subscriptions), seamless access to
  multiple transport protocols and more.

  This package contains the ZeroMQ shared library.


