jess LAND
       www.jessland.net
        Sponsored by:       
One eSecurity
www.one-esecurity.com
JISK Knowledgebase >>    About    News    Essentials    Architecture    FWs    IDS/IPS    Honeypots    Malware    Forensics   
  +  JSS Home    Projects    JSS Community    Events    News    Docs    About    Contact .

JISK > Forensics > Software > Live CDs > Helix > Disk Install Forensics Section Map

How to Install Helix to Disk

Content Leader: Jess Garcia - Lead Contributor: Alexis Porros - Last Updated: April 16, 2007


Instructions

The below procedure will allow you to install Helix v1.8 to hard drive. This is very convenient because it allows you to easily have a powerful Forensic Workstation with a minimum effort.

1. Create the swap and root partition for the system with the fdisk or cfdisk tool (I recommend cfdisk for the impacients! :))

  • Swap partition of 128 MB
    (128MB is the minimum required; the rule of thumb is Swap = Physical Memory. We recommend that you fill your Forensic Workstations with as much physical memory as you can afford).
  • Root partition of 2000 MB (later during the installation process, the file system type can be chosen)

2. Format the root and swap partitions.

  • mke2fs /dev/hda2
  • mkswap /dev/hda1

3. Start the installation dialog.

  • IGNORE_CHECK=1 knx2hd

4. Click first on the "Configure installation" option, and then tell the installer where to install the base system, and with what type of file system to format the root partition (or any other partition created before).

5. Then click on the "Start installation" option. It will ask several "easy" questions, then just wait until it copies all the needed files.

6. After that, and due to some misconfiguration issues, the following commands and file modifications must be issued.

  • mkdir /mnt/hda2
  • mount /dev/hda2 /mnt/hda2

7. Edit the file /mnt/hda2/etc/X11/Xsession.d/45xsession, so it contains the following.

  • /usr/bin/startxfce4

8. Add the user name specified during the installation process to the /mnt/hda2/etc/sudoers file.

9. Modify the file /usr/local/autopsy-2.08/conf.pl so that the variable LOCKIR contains the following value.

  • $LOCKDIR = '/home/cyberpadawan/pyflag/evidence';

10. And copy a special folder from the ISO CD image to the real hard disk to avoid errors in the autopsy soft links.

  • mkdir /mnt/hda2/cdrom
  • cp -r /cdrom/Static-Binaries/ /mnt/hda2/cdrom/

11. Then just umount the root partition, reboot, and log in the user name specified during the installation process.

  • umount /mnt/hda2
  • reboot

Copyright © 2000-2008 Jessland - Jess Garcia's Website - All rights reserved.