Hi to all members,
I would like to share a small anti-forensic tool that i wrote in these days: https://github.com/t0t3m/Porcupine

In a nutshell this is a software built with int0x80's great presentations at Derbycon 2012 in mind:

• "Anti-Forensic for the louise"https://www.youtube.com/watch?v=-HK1JHR7LIM
• "Moar Anti-Forensic for the louise"https://www.youtube.com/watch?v=i3nLrJrkYOc

His main goal is to assure a base protection against physical attack vectors like USB pendrives or CD/DVD with forensic/analysis tools.

Please be lenient, it's still a software in beta stage, if not in alpha stage.

Best regards,
_B0l4_

P.S. If it's not the correct place for this sort of thing, i apologize in advance.  
P.P.S. It's developed under BackBox, so it should be fully compatible, pyudev apart.
P.P.P.S At the moment i've only tested USB drives and CD/DVD ROMs

====================================================================================================

Salve a tutti,
vorrei condividere con tutti voi un piccolo tool anti-forensic che ho scritto in questi giorni: https://github.com/t0t3m/Porcupine

In poche parole è un software ispirato dalle ottime presentazioni di int0x80 ai Derbycon 2012:

• "Anti-Forensic for the louise"https://www.youtube.com/watch?v=-HK1JHR7LIM
• "Moar Anti-Forensic for the louise"https://www.youtube.com/watch?v=i3nLrJrkYOc

Il suo principale obiettivo è di assicurare una protezione di base contro vettori di attacco fisici quali USB pendrives o CD/DVD con forensic/analysis tools

Vi prego di essere clementi, è ancora un software in beta stage, se non in alpha stage.

Cordiali saluti,
_B0l4_

P.S. Se non è il posto corretto per postare questo genere di cose, mi scuso in anticipo.  
P.P.S. E' stato sviluppato in BackBox, quindi dovrebbe essere pienamente compatibile, pyudev a parte.
P.P.P.S Al momento mi è stato solo possibile effettuare tests su USB drives e CD/DVD ROMs

Thank you for sharing with us.

Cheers !

Some tips for future releases:

• Add dmesg wipe
• Add $HISTFILE wipe or nullify
• Don't forget about other log files
• Maybe a way to easily insert rootkits to annoy forensic teams

Just some thoughts.

Thanks for the suggestions, i'll implement the first two as soon as possible.  
Also the 3rd point or the list is something that i was thinking yesterday.

About rootkit, i'll have to think about it. At the moment, i have no idea on how to do it.  

Edit: Added:

• Purge dmesg pipe through dmesg -C and deletion of all /var/log/dmesg* files through shred linux command
• Deletion of .bash_history file of the current user through shred linux command