clamscan
can search file systems for malware, but it can't scan possible rootkits on the boot sectors of an external disk. rkhunter
also doesn't seem to provide the ability to scan boot sectors of an external drive. Is there Linux software which works like:
rootkitscanproggie /dev/sdb
Where /dev/sdb
is a just plugged in thumb drive or hard disk?
Desired features:
- Command line interface preferred.
- GPL license
- Searches partition level, i.e. an evil boot sector, a malware version of GRUB, etc. (Searching file systems is optional, since
clamav
already does that).
Note: This isn't a sanitizing question -- an external drive can always be wiped using dd
and such. This is a forensics question, the goals being detection and identification.