https://github.com/kpcyrd/booty

Minimal forensic/exfiltration/evil-maid/rescue live boot system
https://github.com/kpcyrd/booty

evil-maid exfiltration forensics linux live-usb minimal rescue

Last synced: about 1 year ago
JSON representation

Minimal forensic/exfiltration/evil-maid/rescue live boot system

• Host: GitHub
• URL: https://github.com/kpcyrd/booty
• Owner: kpcyrd
• License: gpl-3.0
• Created: 2018-02-13T00:49:32.000Z (over 8 years ago)
• Default Branch: master
• Last Pushed: 2020-02-28T17:50:21.000Z (over 6 years ago)
• Last Synced: 2025-04-14T14:15:02.385Z (about 1 year ago)
• Topics: evil-maid, exfiltration, forensics, linux, live-usb, minimal, rescue
• Language: Shell
• Homepage:
• Size: 89.8 KB
• Stars: 12
• Watchers: 2
• Forks: 3
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-forensics - **5**星 - maid/rescue live boot system (<a id="ecb63dfb62722feb6d43a9506515b4e3"></a>新添加)

README

          
# booty [![Build Status][travis-img]][travis]

[travis-img]:   https://travis-ci.org/kpcyrd/booty.svg?branch=master

[travis]:       https://travis-ci.org/kpcyrd/booty

Minimal forensic/exfiltration/evil-maid/rescue live boot system.

![screenshot](docs/51a9c.png)

## Build

    git submodule init

    ./build.sh -p

    sudo ./build.sh -v

    ls -lah out/

## Rebuild

    # make sure nothing is mounted anymore

    mount | grep `pwd`

    # remove working directory

    sudo rm -rf work/

    # also force package rebuild

    rm -rf repo/

## Customize

The system is supposed to be easily customizable. See `booty.conf` for some

basic flags that can be set/unset. You need to have ssh access enabled and

setup directly at boot? We've got you covered.

It is recommended to fork the repo and commit your changes, so you can easily

merge upstream changes with your personal config.

## Build in docker

    docker build -t booty-builder .

    docker run --privileged --rm -v `pwd`:/booty booty-builder sh -c 'mkdir repo && chown nobody. repo'

    docker run --privileged --rm -v `pwd`:/booty booty-builder sudo -u nobody ./build.sh -p

    docker run --privileged --rm -e 'ARCH_MIRROR=http://ftp.halifax.rwth-aachen.de/archlinux' -v `pwd`:/booty -v /dev:/dev booty-builder ./build.sh -v

## License

GPLv3+