detection of malicious changes for boot files


chkboot is a set of scripts that will display a notification (console or graphical) when boot files are tempered with.

This tool is indented to be used on encrypted disks. In order to get the operating system to run, parts of the boot process must remains un-encrypted. chkboot checks that those files have not changed between reboots.

Since the scripts and the data they generate are stored on the encrypted part of the disk, any attempts to modify the boot partition between reboots will be detected.

Please note that this tool is not effective against rootkit that hides every boot files modifications or prevents chkboot from functioning properly.

Upload more screenshots

Please help extend the collection of screenshots. Just make a screenshot and upload it here. You don't need to register or anything.

Upload a screenshot

Hint: upload an image here from your clipboard with Ctrl-V


Install this software package

If the package is available for the distribution you are currently using on your computer then install the software by clicking on…

Install chkboot