bulk_extractor : Scans a disk image for regular expressions and other content ( https://github.com/simsong/bulk_extractor )
ftimes : A system baselining and evidence collection tool ( http://ftimes.sourceforge.net/FTimes/ )
hindsight : Internet history forensics for Google Chrome/Chromium ( https://github.com/obsidianforensics/hindsight )
indxparse : INDXParse: Tool suite for inspecting NTFS artifacts ( https://github.com/williballenthin/INDXParse )
libbde : Library and tools to access the BitLocker Drive Encryption (BDE) encrypted volumes ( https://github.com/libyal/libbde )
libbfio : Library for providing a basic file input/output abstraction layer ( https://github.com/libyal/libbfio )
libewf : Implementation of the EWF (SMART and EnCase) image format ( https://github.com/libyal/libewf/ )
log2timeline : Create forensic supertimelines in Perl ( https://github.com/thinrope/log2timeline )
pytsk : Python bindings for Sleuthkit ( https://github.com/py4n6/pytsk/ )
scap-security-guide : Baseline compliance content in SCAP formats ( http://www.open-scap.org/security-policies/scap-security-guide )
Add an ebuild in portage :
The ebuild is now in the portage tree.
You can also use layman : emerge layman then layman -a pkalin
For Paludis use this rsync : rsync://gentoo.zugaina.org/pkalin-portage
If you have a problem : ycarus(-at-)zugaina.org