See http://www.porcupine.org/forensics/ for more information.
The Coroner's Toolkit was presented during Dan&Wietse's free computer forensics class in August 1999. Copies of class handouts can be found at http://www.porcupine.org/forensics/.
The latest version (gzip'd and tar'd) of the TCT software may be gotten here, including PGP signature.
Dan is maintaining a little buglist.
TCT requires, at minimum:
Unix - currently Solaris, SunOS, FreeBSD, Linux (Redhat, currently), OpenBSD, BSD/OS
Perl, version 5.004 or greater
We've created a mailing list to discuss the toolkit and methods used to forensically analyze Unix systems. To subscribe send a one-line email message saying "subscribe tct-users" to:
majordomo@porcupine.org
Please send any comments, problems, critique, or additional thoughts or code to:
tct@fish.com
Dan Farmer & Wietse Venema