clamscan can search file systems for malware, but it can't scan possible rootkits on the boot sectors of an external disk. rkhunter also doesn't seem to provide the ability to scan boot sectors of an external drive. Is there Linux software which works like:
rootkitscanproggie /dev/sdb
Where /dev/sdb is a just plugged in thumb drive or hard disk?
Desired features:
- Command line interface preferred.
- GPL license
- Searches partition level, i.e. an evil boot sector, a malware version of GRUB, etc. (Searching file systems is optional, since
clamavalready does that).
Note: This isn't a sanitizing question -- an external drive can always be wiped using dd and such. This is a forensics question, the goals being detection and identification.
