Our friends at anti-forensics.ru have given us seven very small disk images that are designed to demonstrate failings of particular open source Linux distributions.
You can view all of the images at http://digitalcorpora.org/corp/images/aor/. The images you will find there includes:
- 2009-aor-test_caine15.iso
- 2009-aor-test_deft5.iso
- 2009-aor-test_grml200910.iso
- 2009-aor-test_othernew.iso
- 2009-aor-test_otherold.iso
- 2009-aor-test_raptor20091026.iso
- 2009-aor-test_spada4.iso
These images should be directly copied to a hard drive or a partition. Forensic Linux distributions would use them as root file systems and execute proof-of-concept code during the boot.
Details of why these images are useful can be found on the author’s website, at: Linux_for_computer_forensic_investigators_2.pdf