Pacote: chkboot (1.3-8.2)

detection of malicious changes for boot files

chkboot is a set of scripts that will display a notification (console or graphical) when boot files are tempered with.

This tool is indented to be used on encrypted disks. In order to get the operating system to run, parts of the boot process must remains un-encrypted. chkboot checks that those files have not changed between reboots.

Since the scripts and the data they generate are stored on the encrypted part of the disk, any attempts to modify the boot partition between reboots will be detected.

Please note that this tool is not effective against rootkit that hides every boot files modifications or prevents chkboot from functioning properly.

This page is also available in the following languages: