content top

DEFT Linux 7 RC1

Finally we were able to realize a very stable DEFT Linux 7 release, solving all problems responsible for postponing the release date for RC1. We performed several tests on different computer platforms: laptops, servers and desktop PCs. Our main focus was based on Lenovo, DELL, ASUS, Acer, Apple, IBM laptops, IBM and DELL servers as well as Acer, Lenovo and Dell desktop PCs. We tested everything both booting as a live CD and installing the distro on the test machine: compatibility tests suceded with excellent results.
From this year DEFT 7 will also add more support to mobile forensics: we added several tools that allow you to analyze files and databases used in new generation smartphones (Android and iPhone). From the next release there will be a section completely dedicated to Cyber Intelligence.
There has also been a complete review of reporting functionalities, we included KeepNote, an excellent tool that allows the logical organization of collected evidences.
As for the official roadmap, we still have a small delay on releasing DART (Digital Advanced Response Toolkit) which will be available when it will be STABLE probably in the final release of the DEFT 7 distro by the end of this month. In the final Deft 7.0 (including DART) release you will also find a pre-configured vmware virtual appliance, a stand alone version of DART along with the user’s guide (Italian version) ( we plan to publish the english translation in the first half of 2012).

Following you can find the main new features in DEFT Linux 7
– Based on Lubuntu 11.10
– Installable Distro
– Linux kernel 3.0.0-12, USB 3 ready
– Libewf 20100226
– Afflib 3.6.14
– TSK 3.2.3
– Autopsy 2.24
– Digital Forensic Framework 1.2
– PTK Forensic 1.0.5 DEFT edition
– Maltego CE
– KeepNote 0.7.6
– Xplico 0.7.1
– Scalpel 2
– Hunchbackeed Foremost 0.6
– Findwild 1.3
– Bulk Extractor 1.1
– Emule Forensic 1.0
– Guymager 0.6.3-1
– Dhash 2
– Cyclone wizard acquire tool
– SQLite Database Browser 2.0b1
– BitPim 1.0.7
– Bbwhatsapp database converter
– Creepy 0.1.9
– Hydra 7.1
– Log2timeline 0.60
– Wine 1.3.28

This year project volunteer’s collaboration with the project was extraordinary! Beside me (SteveFratepietro), these heroes have actively contributed to the project:

– Massimiliano Dal Cero, DART coauthor and he also wrote some implementations on the Linux side
– Sandro Rossetti, Paolo Dal Checco, Valerio Leomporra and Davide Gabrini: for DART tools selection and beta testing
– Meo Bogliolo: for Hunchbackeed Foremost
– Marco Giorgi: for Cyclone
– Emanuele Gentili and Sandro Rossetti: for the Cyber ​​Intelligence and OSINT part (it will be released in the first quarter of 2012)

A heartfelt GRAZIE (thank you) to all of you.

We are grateful to the people of Cyber ​​Marshall ( for allowing us to insert scripts Dropbox Reader ™ in the final stable release of Deft 7.

The gold release of DEFT 7 will be released January 31, 2012

Please report any bugs here: – bug[at]

Download DEFT Linux 7 RC1 – md5: 082384050a762c4bf617a79223c89d69

Read More

Please wait…!

Hi all,
We have almost finish our job on the new version of DEFT but we do not feel ready to release a public beta yet.
The DEFT Linux side is 90% ready and we are testing the installation on different kind of hardware (Sony Vaio, MacBook Pro / Air, iMac, Lenovo ThinkPad, DELL PCs and servers).
Our new project, an Incident Response manager, DART (Digital Advanced Response ToolKit), is 80% completed . The portability tests were successful: Dart can run on all Microsoft Windows systems and will make easier the execution of Live Forensic and Incident Response activities.

We take this opportunity to wish you all a Merry Christmas! Our Xmas gift will arrive around the second week of January

Read More

DEFT 6.1.1 ready for download

Hello everyone!
For some important needs of international computer forensic experts and our community, we decide to release this micro update that allows you to create the “super timeline” using log2timeline (0.60) utility.

You can download the new release using our mirror.

One other thing… Here is a small preview of one of the great innovations of DEFT 7: Maltego!
Maltego is an open source intelligence and forensics application. It will offer you timous mining and gathering of information as well as the representation of this information in a easy to understand format; With this and other implementations, DEFT is pointing to the needs of enterprise customers, with special attention to the needs of the organization of information and documentation of evidence.

Enjoy DEFT Linux!

Read More

DEFT Linux 7 road map and features

The biggest news in DEFT are two. The first is that the project is also dedicated to incident response issues; the second is that the DEFT will have two core, one dedicated to the server (based on CentOS) and one (based on Lubuntu) for personal computer, Mac and workstations x86, all of them into a live DVD; the choice of double kernel was determined after a thorough series of tests that led to the following conclusion: the desktop environments have different needs from enterprise environments in terms of drivers and performance. The end user decide what to run based on its need, if you must acquire a server, run DEFT SE, but if you needs to perform analysis or acquisition activities of pc or Mac, run DEFT.

DEFT features
– Based on Lubuntu 11.10 and DEFT Extra 3 (Windows side)
– Linux Kernel 3 -usb3 ready
– Guymager 0.5.9
– Dhash 2
– Xplico DEFT edition 0.6.3
– TSK 3.2.2 (or the latest stable version at the date of release)
– Autopsy 2.24 and 3 (beta)
– Digital Forensics Framework 1.1.0
– Libewf
– Afflib 3.6.12 (or the latest stable version at the date of release)
– Scalpel 2.0
– Foremost 1.5.7
– Hunchbacked 4most 0.6
– Log2timeline 0.60
– ClamAV Anti Virus / Malware 0.9.6
– Mount Manager 0.2.6
– TrID 2.10
– Wine 1.3 for the implementation of tools for Windows-based Computer Forensic
– KeepNote 0.7 (reporting tool)
– Emule forensic

DEFT SE features
– Based on CentOS 6
– dd, ddrescue, dd_rescue, dc3dd and dcfldd
– guymager and dhash

– Feature freeze – September 2011
– Tools test – October 2011
– Kernel freeze – October 2011
– Extra DEFT test – November 2011
– Wine tools testing – November 2011
– Beta release – December 23 2011
– DEFT Linux 7 stable – January 27 2012
– Documentation DEFT stable – January 27 2012

Read More

DEFT Linux 6.1 ready for download

DEFT 6.1 is the last planned release of DEFT 6.
From June 2011, We will start working on version 7. It will feature great improvements on both the architectural structure and the included applications.

Release notes:
– Start faster by 15% over the previous version
– Optimization initrd

Fixed problem of large pcap file uploads in Xplico
Revision of all DEFT Extra’s tools to comply with their License.
DEFT 6 can boot from USB (tnks to Valerio Leomporra for the fix)

Download DEFT 6.1!

Read More

DEFT Linux 6 ready for download

I’m happy to announce that DEFT 6 is out!

DEFT 6 is based on Lubuntu with Kernel 2.6.35 (Linux side) and DEFT Extra 3.0 (Windows side) with the best freeware Computer Forensic tools; it is a new concept of Computer Forensic live system, ewflib ready, that use WINE for run Windows Computer Forensics tools under Linux.

This is a list of changes made to the release candidate version:

[new] Update FTK Imager from 2.9 to 3
[new] Update Digital Forensic Framework from 0.8 to 0.9
[new] Added Xmount 0.4.4
[new] Added mount_ewf utility
[bug fix] VWrong Guymager release, now is the 0.5.7
[bug fix] Fixed iso md5 file check
[bug fix] Fixed some grammatical errors

For a full list please refer to this page. For some screenshot please refer to this page

Please submit new bug using launchpad or mailing bug “at”

As announced last month, even today we release the official documentation of the project. For now, it is only in Italian, it will be soon translated into English, Spanish and Chinese. Any other volunteer?
The project documentation is free and open to any useful integration therefore
if you want to help expanding the manual, you can contact me (Stefano Fratepietro) by e-mail: stefano “at”

During the next week, we will release the DEFT virtual appliance and dd image for the USB stick.

IISFA (Italian chapter) appreciates DEFT project as a contribution to the development of the Computer Forensic analysis. The appreciation of IISFA is both scientific and cultural.
This work represent the work of the DEFT team and not of the IISFA association.

A special thanks to all the people that worked with me as volunteers: Salvo Tarantino, Davide Gabrini, Massimiliano Dal Cero, Bartolomeo Bogliolo , Sandro Rossetti and Valerio Leomporra.

Thank you guys!

Read More
content top