The Sleuth Kit

I was asked to create an image of a system a couple of weeks ago but 
told not to investigate it.  I used dcfldd over netcat on a crossover 
cable to image the system.  I created MD5's of the source and image, 
and both matched.

I did a physical image, not logical.

Today, I have been asked to investigate the image.  However, the 
partition table appears bad.

I am getting warnings from fdisk saying Partition 1 has different 
logical/physical endings.  Then Partition 2 has different beginnings 
and endings.  I can't figure out how to get the logical images 
extracted, and we no longer have access to the source system.

Can anyone provide any help?
--

On Mon, 27 Mar 2006 10:14:23 -0500
Carlton Foster <c.a.foster@...> wrote:

> I was asked to create an image of a system a couple of weeks ago but 
> told not to investigate it.  I used dcfldd over netcat on a crossover 
> cable to image the system.  I created MD5's of the source and image, 
> and both matched.
> 
> I did a physical image, not logical.
> 
> Today, I have been asked to investigate the image.  However, the 
> partition table appears bad.
> 
> I am getting warnings from fdisk saying Partition 1 has different 
> logical/physical endings.  Then Partition 2 has different beginnings 
> and endings.  I can't figure out how to get the logical images 
> extracted, and we no longer have access to the source system.
> 
> Can anyone provide any help?
> -- 

Try out this one: http://www.cgsecurity.org/wiki/TestDisk

From the summary:

"If you have missing partitions or a completely empty Partition Table,
TestDisk can search for partitions and create a new Table or even a new
MBR if necessary."

regards

Where can I find the INSTALL document referred to in README in =
sleuthkit-win32-2.06r2.

=20

The README in the windows zip file is from the Unix version.  The =20
README-win32.txt is the Windows-specific one.

There is no INSTALL file in the Windows version since it simply =20
contains the executables.  There is nothing to install.

brian



On Dec 6, 2006, at 2:51 AM, Lars H=E5kansson wrote:

> Where can I find the INSTALL document referred to in README in =20
> sleuthkit-win32-2.06r2.
>
>
>
> ----------------------------------------------------------------------=20=

> ---
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to =20
> share your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?=20
> page=3Djoin.php&p=3Dsourceforge&CID=3DDEVDEV____________________________=
____=20
> _______________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Hi,
.
I want to remove HPA area under Kernel-2.6.18.
I am using SATA 250GB includes HPA, 11GB.
I used HDPARM7.3 to get some information.
But there's nothing information related to my SATA
250GB.
There is a device size, 239GB, but that is not
included HPA area.
Could you please tell me which program or commands to
use in order to remove HPA area under Linux ?
.......................
[root@... hdparm-7.3]# ./hdparm -I /dev/sda
/dev/sda:
ATA device, with non-removable media
        Model Number:       SAMSUNG SP2504C
        Serial Number:      S0H9J1QP400136
        Firmware Revision:  VT100-50
Standards:
        Used: ATA/ATAPI-7 T13 1532D revision 4a
        Supported: 7 6 5 4
Configuration:
        Logical         max     current
        cylinders       16383   16383
        heads           16      16
        sectors/track   63      63
        --
        CHS current addressable sectors:   16514064
        LBA    user addressable sectors:  268435455
        LBA48  user addressable sectors:  467348955
        device size with M = 1024*1024:      228197
MBytes
        device size with M = 1000*1000:      239282
MBytes (239 GB)
Capabilities:
        LBA, IORDY(can be disabled)
        Queue depth: 32
        Standby timer values: spec'd by Standard, no
device specific minimum
        R/W multiple sector transfer: Max = 16 
Current = 16
        Recommended acoustic management value: 254,
current value: 128
        DMA: mdma0 mdma1 mdma2 udma0 udma1 udma2 udma3
udma4 *udma5 udma6 udma7
             Cycle time: min=120ns recommended=120ns
        PIO: pio0 pio1 pio2 pio3 pio4
             Cycle time: no flow control=120ns  IORDY
flow control=120ns
Commands/features:
        Enabled Supported:
           *    SMART feature set
                Security Mode feature set
           *    Power Management feature set
           *    Write cache
           *    Look-ahead
           *    Host Protected Area feature set
           *    WRITE_BUFFER command
           *    READ_BUFFER command
           *    NOP cmd
           *    DOWNLOAD_MICROCODE
           *    SET_MAX security extension
           *    Automatic Acoustic Management feature
set
           *    48-bit Address feature set
           *    Device Configuration Overlay feature
set
           *    Mandatory FLUSH_CACHE
           *    FLUSH_CACHE_EXT
           *    SMART error logging
           *    SMART self-test
           *    General Purpose Logging feature set
           *    Segmented DOWNLOAD_MICROCODE
           *    SATA-I signaling speed (1.5Gb/s)
           *    SATA-II signaling speed (3.0Gb/s)
           *    Native Command Queueing (NCQ)
           *    Host-initiated interface power
management
           *    Phy event counters
                DMA Setup Auto-Activate optimization
                Device-initiated interface power
management
           *    Software settings preservation
           *    SMART Command Transport (SCT) feature
set
           *    SCT Long Sector Access (AC1)
           *    SCT LBA Segment Access (AC2)
           *    SCT Error Recovery Control (AC3)
           *    SCT Features Control (AC4)
           *    SCT Data Tables (AC5)
Security:
        Master password revision code = 65534
                supported
        not     enabled
        not     locked
                frozen
        not     expired: security count
                supported: enhanced erase
        88min for SECURITY ERASE UNIT. 88min for
ENHANCED SECURITY ERASE UNIT.
Checksum: correct
[root@... hdparm-7.3]#
.
Friendly,
Nobel


      ________________________________________________________ 
180도 달라진 야후! 메일 - 신세대 메일? 이제 새로운 야후! 메일에서 만나보세요.
http://kr.content.mail.yahoo.com/cgland

Hi All, 

I've been working on a faster way to map unallocated blocks extracted
with blkls to disk blocks in the partition.  The TSK tool blkcalc can do
this, but it is quite slow as the man page denotes.  I figured with some
simple math and a little metadata, I could do it faster manually.

Here's what I did:

1) extracted unallocated ascii and unicode strings with blkls with
something like: 
$ blkls partition.dd | (tee >/dev/null >(strings -td) >(strings -td
-el))> partition.strings

2) grepped partition strings for "search term" and found it at byte
offset #####.  Decided I needed to look at original block.

3) created a list of unallocated blocks with:
$ blkls -l partition.dd > unalloc.block.list

4) determined the block offset of my "search term" by dividing the byte
offset by the file system block size determined through fsstat.
$ echo $((#####/4096)))
##

5) determined the block address of unallocated block in the partition by
reading line ## of unallocated.block.list (the tail command removes the
three lines of header from the blkls -l output)
$ tail -n +4 unallocated.block.list | cat -n | grep -m1 ^##
#####|f

where "#####" is the block id of the unallocated block in the partition
(almost, see below). With exception to making the strings file and the
block list, this process takes only a minute or so to complete on a
250gb partition with 137gb of unallocated space.  And, it can be
scripted, of course.

That said, what I have found is that the block address retrieved from
step 5 is short by 1 block.  Easy to compensate for, but I could use
some help understanding why.  Anybody have an explanation?

Thanks,
John
______________________________
 
John Lehr
 
Evidence Technician
San Luis Obispo Police Department
______________________________

Hi all,i'm arguing  to this install, let's say problem as a point of about the future.
Brian i will give an interpretation about the sense to your point, sleuthkit, as a forencisc tool
need to be completed as a de facto tool.
Whats
means?, it means that when someone as a counterpart he could point that
this tool, is not under the standard , blah blah blah.
My opinion
is, all that is a Dogma, there are not perfect tools where we can
analyze tests, where imagination errors and skills and fortune, as
being proben to be more effective than something else.
So i will apologize to all of you sayng, a bit of balance is not deprecable
ciao
Thank you very much about your astonish work
will be there in the future any implementation of zfs filesystem? 

On Jul 27, 2010, at 1:06 PM, Simson Garfinkel wrote:

> The current version of SleuthKit doesn't work with the current version of libewf.

<a name="roclfrptfc" title="" href="http://wordpress.chalegroup.org/wp-content/plugins/extended-comment-options/fjsh.htm">http://wordpress.chalegroup.org/wp-content/plugins/extended-comment-options/fjsh.htm</a>?rmjm=rmjm

Sorry to bother you... I tried everything to resolve issue, but am getting nowhere.
I'm running Ubuntu inside VMPlayer 4.0 and have installed Sleuthkit (3.1.3-1) and Autopsy (2.24-1)
I cannot get autopsy to execute. I get a failure to connect to localhost:9999/autopsy. I've read many Internet postings relative to this problem, but nothing seems to work. From Ubuntu terminal I can ping localhost and/or 127.0.0.1. I know I'm probably doing something dumb. Any help you can provide would be greatly appreciated. Thanks, Jerry Miller
 
Gerald C. Miller
IST Assistant Professor
Cisco Regional Academy Director
Germanna Community College
Security+
(540) 891-3038

Gerald,

> I cannot get autopsy to execute. I get a failure to connect to localhost:9999/autopsy. 

Which browser are you using?
Do you get any error messages/warning at all?
Are there any corresponding entries in autopsy.log?
Is a local firewall blocking access to port 9999?

Cheers,

	Stefan.

-- 
Stefan Kelm                   <skelm@...>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstrasse 100             Tel: +49-721-96201-1
D-76133 Karlsruhe             Fax: +49-721-96201-99

Hey Gerald,

Is autopsy running? (Run: ps -ef | grep autopsy)

Is it a browser problem or something in autopsy? ('telnet localhost 
9999' then type 'GET / HTTP/1.0' and hit enter a few times. What happens?)

Good luck,

MJ


On 12/06/2011 09:43 AM, Gerald Miller wrote:
> Sorry to bother you... I tried everything to resolve issue, but am
> getting nowhere.
> I’m running Ubuntu inside VMPlayer 4.0 and have installed Sleuthkit
> (3.1.3-1) and Autopsy (2.24-1)
> I cannot get autopsy to execute. I get a failure to connect to
> localhost:9999/autopsy. I've read many Internet postings relative to
> this problem, but nothing seems to work. From Ubuntu terminal I can ping
> localhost and/or 127.0.0.1. I know I’m probably doing something dumb.
> Any help you can provide would be greatly appreciated. Thanks, Jerry Miller

Are you actually executing the autopsy script ? What messages does it display when it starts ? 
Which machine is running the browser ? 

On 6 Dec 2011, at 14:43, Gerald Miller wrote:

> Sorry to bother you... I tried everything to resolve issue, but am getting nowhere.
> I’m running Ubuntu inside VMPlayer 4.0 and have installed Sleuthkit (3.1.3-1) and Autopsy (2.24-1)
> I cannot get autopsy to execute. I get a failure to connect to localhost:9999/autopsy. I've read many Internet postings relative to this problem, but nothing seems to work. From Ubuntu terminal I can ping localhost and/or 127.0.0.1. I know I’m probably doing something dumb. Any help you can provide would be greatly appreciated. Thanks, Jerry Miller
>  
> Gerald C. Miller
> IST Assistant Professor
> Cisco Regional Academy Director
> Germanna Community College
> Security+
> (540) 891-3038
> ------------------------------------------------------------------------------
> Cloud Services Checklist: Pricing and Packaging Optimization
> This white paper is intended to serve as a reference, checklist and point of 
> discussion for anyone considering optimizing the pricing and packaging model 
> of a cloud services business. Read Now!
> http://www.accelacomm.com/jaw/sfnl/114/51491232/_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Everyone... thanks for quick reply.
 
I'm running FireFox with no FW.
 
I get this error message when I try to execute autopsy.
 
" Can't open log: autopsy.log at /usr/share/autopsy/lib/Print.pm line 383"
 
When I go into the perl script at line 383 this is what I see:
 
" Open AUTOLOG,">>$::LOCKDIR|$lname" " outside quotes are mine
 
As you can see I teach IST, mostly Cisco. We are trying to setup some forensics classes using open source software. We are a small community college and can't afford the commercial software. I'm not a programmer so I'm lost. Again, thanks for your reply. I'll keep trying. Jerry
 
Gerald C. Miller
IST Assistant Professor
Cisco Regional Academy Director
Germanna Community College
Security+
(540) 891-3038

OK - so the user running autopsy doesn't have write permission for the directory you set as the evidence locker, hence autopsy isn't starting.


On 6 Dec 2011, at 17:50, Gerald Miller wrote:

> Everyone... thanks for quick reply.
>  
> I'm running FireFox with no FW.
>  
> I get this error message when I try to execute autopsy.
>  
> " Can't open log: autopsy.log at /usr/share/autopsy/lib/Print.pm line 383"
>  
> When I go into the perl script at line 383 this is what I see:
>  
> " Open AUTOLOG,">>$::LOCKDIR|$lname" " outside quotes are mine
>  
> As you can see I teach IST, mostly Cisco. We are trying to setup some forensics classes using open source software. We are a small community college and can't afford the commercial software. I'm not a programmer so I'm lost. Again, thanks for your reply. I'll keep trying. Jerry
>  
> Gerald C. Miller
> IST Assistant Professor
> Cisco Regional Academy Director
> Germanna Community College
> Security+
> (540) 891-3038
> ------------------------------------------------------------------------------
> Cloud Services Checklist: Pricing and Packaging Optimization
> This white paper is intended to serve as a reference, checklist and point of 
> discussion for anyone considering optimizing the pricing and packaging model 
> of a cloud services business. Read Now!
> http://www.accelacomm.com/jaw/sfnl/114/51491232/_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

http://gabrielforster.com/wp-content/themes/thesis-16/thesis-16/custom/cache/wmtrehv.html

http://jalem.com/wp-content/themes/blogmag/delli/admin/images/wmtrehv.html

http://greyfotografia.com/files/gimgs/nmseo.html

Greetings,

I have quite a bit of experience with Windows and *nix and have been
recently working with MacOS X.  What strikes me as immediately
noticeable about the most recent timeline of a MacOS X hfs+ image is that
there is absolutely no file or directory deleted information as would usually be
printed when creating timelines of Windows or Linux systems. Such as deleted
or deleted-realloc in case of inode reallocation.  I find nothing of the sort in the
timeline for the MacOS disk.

Seeing as I have retrieved some files from unallocated space, I am
concerned that the timeline output is inaccurate and am wondering if it is
usually the case where lines will be marked to signify deletions and
reallocations for files and directories when working with hfs+ similar to NTFS or ext 

In general I am interested in learning if the timeline will show every path that
has existed on the MacOS X hfs+ partition regardless if it has been deleted,
or if I can be sure I am missing data generally found in a properly rendered timeline
when dealing with other formats because this is a  Mac disk.

Thanks in advance for any reply,

Greg

Greg,

The short answer is that SleuthKit does not support obtaining any
information about deleted files on HFS+.

The reason for this (the long answer) is that HFS+ does not use a
mark-as-deleted system for deleting files. In HFS+, both file metadata and
the disk's entire directory structure are stored in a b-tree file, the
Catalog B-Tree. (Technically, in the leaf nodes of the b-tree.) When files
are deleted, their entries are removed from the b-tree and the leaf node
is rewritten. The leaf nodes always appear to be compact -- that is, there
are no gaps between entries where deleted entries might live. So, you
would only possible see deleted-file information in the unused space at
the end of a node or in unused nodes (which could be produced by deleting
a diretory). That's only the case if Mac OS X doesn't zero those areas
when rewriting them. I haven't looked into whether such an approach would
actually produce useable data.

-- Judson


________________________________

	From: Greg Grasmehr [mailto:gregoryg1@...] 
	Sent: Monday, March 19, 2012 9:31 PM
	To: sleuthkit-users@...
	Subject: [sleuthkit-users] (no subject)
	
	
	Greetings,
	
	I have quite a bit of experience with Windows and *nix and have
been
	recently working with MacOS X.  What strikes me as immediately
	noticeable about the most recent timeline of a MacOS X hfs+ image
is that
	there is absolutely no file or directory deleted information as
would usually be
	printed when creating timelines of Windows or Linux systems. Such
as deleted
	or deleted-realloc in case of inode reallocation.  I find nothing
of the sort in the
	timeline for the MacOS disk.
	
	Seeing as I have retrieved some files from unallocated space, I am
	concerned that the timeline output is inaccurate and am wondering
if it is
	usually the case where lines will be marked to signify deletions
and
	reallocations for files and directories when working with hfs+
similar to NTFS or ext 
	
	In general I am interested in learning if the timeline will show
every path that
	has existed on the MacOS X hfs+ partition regardless if it has
been deleted,
	or if I can be sure I am missing data generally found in a
properly rendered timeline
	when dealing with other formats because this is a  Mac disk.
	
	Thanks in advance for any reply,
	
	Greg

Judson,

> The reason for this (the long answer) is that HFS+ does not use a
> mark-as-deleted system for deleting files. In HFS+, both file metadata and
> the disk's entire directory structure are stored in a b-tree file, the
> Catalog B-Tree. (Technically, in the leaf nodes of the b-tree.) When files
> [...]

Thanks a lot for sharing that information. Do you have a source for that
info, or to put it differently, are there any (current) forensics books
on HFS+?

Cheers,

	Stefan.

-- 
Stefan Kelm                   <skelm@...>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstrasse 100             Tel: +49-721-96201-1
D-76133 Karlsruhe             Fax: +49-721-96201-99

http://www.dfrws.org/2008/proceedings/p76-burghardt.pdf
On Mar 20, 2012 7:25 AM, "Stefan Kelm" <skelm@...> wrote:

> Judson,
>
> > The reason for this (the long answer) is that HFS+ does not use a
> > mark-as-deleted system for deleting files. In HFS+, both file metadata
> and
> > the disk's entire directory structure are stored in a b-tree file, the
> > Catalog B-Tree. (Technically, in the leaf nodes of the b-tree.) When
> files
> > [...]
>
> Thanks a lot for sharing that information. Do you have a source for that
> info, or to put it differently, are there any (current) forensics books
> on HFS+?
>
> Cheers,
>
>        Stefan.
>
> --
> Stefan Kelm                   <skelm@...>
> BFK edv-consulting GmbH       http://www.bfk.de/
> Kriegsstrasse 100             Tel: +49-721-96201-1
> D-76133 Karlsruhe             Fax: +49-721-96201-99
>
>
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Stefan,
In "iOS Forensic Analysis (for iPhone, iPad and iPod touch)" by Sean Morrissey (Apress, 2010) there is a chapter (page 25 and more specifically pages 33-onwards) dedicated to the HFSX filesystem, which has a lot in common with HFS+. I think it may be helpful.


--  
Luis Gómez 'Pope'
Enviado con Sparrow (http://www.sparrowmailapp.com/?sig)


El martes 20 de marzo de 2012 a las 12:09, Stefan Kelm escribió:

> Judson,
>  
> > The reason for this (the long answer) is that HFS+ does not use a
> > mark-as-deleted system for deleting files. In HFS+, both file metadata and
> > the disk's entire directory structure are stored in a b-tree file, the
> > Catalog B-Tree. (Technically, in the leaf nodes of the b-tree.) When files
> > [...]
> >  
>  
>  
> Thanks a lot for sharing that information. Do you have a source for that
> info, or to put it differently, are there any (current) forensics books
> on HFS+?
>  
> Cheers,
>  
> Stefan.
>  
> --  
> Stefan Kelm <skelm@... (mailto:skelm@...)>
> BFK edv-consulting GmbH http://www.bfk.de/
> Kriegsstrasse 100 Tel: +49-721-96201-1
> D-76133 Karlsruhe Fax: +49-721-96201-99
>  
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here  
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>  
>

> Thanks a lot for sharing that information. Do you have a source for
> that info, or to put it differently, are there any (current) forensics
> books on HFS+?

I've used Apple's Tech Note 1150, which is out of date but otherwise good;
Amit Singh's "Mac OS X Internals"; and the xnu source code, which contains
Apple's HFS+ driver.

Documentation on HFSX can also be used. The two filesystems are identical
except for their two-byte signature and for the fact that HFSX can
optionally be case-sensitive (wheras HFS+ is always case-insensitive).

-- Judson

Thanks to all who responded so swiftly. Much appreciated!

Cheers,

	Stefan.

-- 
Stefan Kelm                   <skelm@...>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstrasse 100             Tel: +49-721-96201-1
D-76133 Karlsruhe             Fax: +49-721-96201-99

Hey thanks much for that information, I appreciate it.

Greg

On Mar 19, 2012, at 20:42PDT, Judson Powers wrote:

> Greg,
> 
> The short answer is that SleuthKit does not support obtaining any
> information about deleted files on HFS+.

Thanks for that link, appreciated.

Greg

On Mar 20, 2012, at 04:37PDT, Greg Freemyer wrote:

> http://www.dfrws.org/2008/proceedings/p76-burghardt.pdf

Thanks for that info Luis, very much appreciated.

Greg

On Mar 20, 2012, at 05:16PDT, Luis Gómez 'Pope' wrote:

> Stefan,
> In "iOS Forensic Analysis (for iPhone, iPad and iPod touch)" by Sean Morrissey (Apress, 2010) there is a chapter (page 25 and more specifically pages 33-onwards) dedicated to the HFSX filesystem, which has a lot in common with HFS+. I think it may be helpful.
> 
> -- 
> Luis Gómez 'Pope'
> Enviado con Sparrow

I second that sentiment!

Greg

On Mar 20, 2012, at 08:50PDT, Stefan Kelm wrote:

> Thanks to all who responded so swiftly. Much appreciated!
> 
> Cheers,
> 
> 	Stefan.
> 
> -- 
> Stefan Kelm                   <skelm@...>
> BFK edv-consulting GmbH       http://www.bfk.de/
> Kriegsstrasse 100             Tel: +49-721-96201-1
> D-76133 Karlsruhe             Fax: +49-721-96201-99
> 
> ------------------------------------------------------------------------------
> This SF email is sponsosred by:
> Try Windows Azure free for 90 days Click Here 
> http://p.sf.net/sfu/sfd2d-msazure
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org