clamscan can search file systems for malware, but it can't scan possible rootkits on the boot sectors of an external disk. rkhunter also doesn't seem to provide the ability to scan boot sectors of an external drive. Is there Linux software which works like:

rootkitscanproggie /dev/sdb

Where /dev/sdb is a just plugged in thumb drive or hard disk?

Desired features:

  • Command line interface preferred.
  • GPL license
  • Searches partition level, i.e. an evil boot sector, a malware version of GRUB, etc. (Searching file systems is optional, since clamav already does that).

Note: This isn't a sanitizing question -- an external drive can always be wiped using dd and such. This is a forensics question, the goals being detection and identification.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.