TCT is a collection of programs for a post-mortem analysis of a UNIX system after break-in. It enables you to collect data regarding deleted files, modification times of files and more. . Install this BEFORE you need to use it, so you do not risk destroying essential forensic data before you begin. . Tools contained within this package: grave-robber, lazarus, inode-cat, ils, unrm and pcat.
