sleuthkit-users Mailing List for The Sleuth Kit (Page 15)
Brought to you by:
carrier
Menu
▾
▴
sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.
You can subscribe to this list here.
| 2002 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(6) |
Aug
|
Sep
(11) |
Oct
(5) |
Nov
(4) |
Dec
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 |
Jan
(1) |
Feb
(20) |
Mar
(60) |
Apr
(40) |
May
(24) |
Jun
(28) |
Jul
(18) |
Aug
(27) |
Sep
(6) |
Oct
(14) |
Nov
(15) |
Dec
(22) |
| 2004 |
Jan
(34) |
Feb
(13) |
Mar
(28) |
Apr
(23) |
May
(27) |
Jun
(26) |
Jul
(37) |
Aug
(19) |
Sep
(20) |
Oct
(39) |
Nov
(17) |
Dec
(9) |
| 2005 |
Jan
(45) |
Feb
(43) |
Mar
(66) |
Apr
(36) |
May
(19) |
Jun
(64) |
Jul
(10) |
Aug
(11) |
Sep
(35) |
Oct
(6) |
Nov
(4) |
Dec
(13) |
| 2006 |
Jan
(52) |
Feb
(34) |
Mar
(39) |
Apr
(39) |
May
(37) |
Jun
(15) |
Jul
(13) |
Aug
(48) |
Sep
(9) |
Oct
(10) |
Nov
(47) |
Dec
(13) |
| 2007 |
Jan
(25) |
Feb
(4) |
Mar
(2) |
Apr
(29) |
May
(11) |
Jun
(19) |
Jul
(13) |
Aug
(15) |
Sep
(30) |
Oct
(12) |
Nov
(10) |
Dec
(13) |
| 2008 |
Jan
(2) |
Feb
(54) |
Mar
(58) |
Apr
(43) |
May
(10) |
Jun
(27) |
Jul
(25) |
Aug
(27) |
Sep
(48) |
Oct
(69) |
Nov
(55) |
Dec
(43) |
| 2009 |
Jan
(26) |
Feb
(36) |
Mar
(28) |
Apr
(27) |
May
(55) |
Jun
(9) |
Jul
(19) |
Aug
(16) |
Sep
(15) |
Oct
(17) |
Nov
(70) |
Dec
(21) |
| 2010 |
Jan
(56) |
Feb
(59) |
Mar
(53) |
Apr
(32) |
May
(25) |
Jun
(31) |
Jul
(36) |
Aug
(11) |
Sep
(37) |
Oct
(19) |
Nov
(23) |
Dec
(6) |
| 2011 |
Jan
(21) |
Feb
(20) |
Mar
(30) |
Apr
(30) |
May
(74) |
Jun
(50) |
Jul
(34) |
Aug
(34) |
Sep
(12) |
Oct
(33) |
Nov
(10) |
Dec
(8) |
| 2012 |
Jan
(23) |
Feb
(57) |
Mar
(26) |
Apr
(14) |
May
(27) |
Jun
(27) |
Jul
(60) |
Aug
(88) |
Sep
(13) |
Oct
(36) |
Nov
(97) |
Dec
(85) |
| 2013 |
Jan
(60) |
Feb
(24) |
Mar
(43) |
Apr
(32) |
May
(22) |
Jun
(38) |
Jul
(51) |
Aug
(50) |
Sep
(76) |
Oct
(65) |
Nov
(25) |
Dec
(30) |
| 2014 |
Jan
(19) |
Feb
(41) |
Mar
(43) |
Apr
(28) |
May
(61) |
Jun
(12) |
Jul
(10) |
Aug
(37) |
Sep
(76) |
Oct
(31) |
Nov
(41) |
Dec
(12) |
| 2015 |
Jan
(33) |
Feb
(28) |
Mar
(53) |
Apr
(22) |
May
(29) |
Jun
(20) |
Jul
(15) |
Aug
(17) |
Sep
(52) |
Oct
(3) |
Nov
(18) |
Dec
(21) |
| 2016 |
Jan
(20) |
Feb
(8) |
Mar
(21) |
Apr
(7) |
May
(13) |
Jun
(35) |
Jul
(34) |
Aug
(11) |
Sep
(14) |
Oct
(22) |
Nov
(31) |
Dec
(23) |
| 2017 |
Jan
(20) |
Feb
(7) |
Mar
(5) |
Apr
(6) |
May
(6) |
Jun
(22) |
Jul
(11) |
Aug
(16) |
Sep
(8) |
Oct
(1) |
Nov
(1) |
Dec
(1) |
| 2018 |
Jan
|
Feb
|
Mar
(16) |
Apr
(2) |
May
(6) |
Jun
(5) |
Jul
|
Aug
(2) |
Sep
(4) |
Oct
|
Nov
(16) |
Dec
(13) |
| 2019 |
Jan
|
Feb
(1) |
Mar
(25) |
Apr
(9) |
May
(2) |
Jun
(1) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2020 |
Jan
(2) |
Feb
|
Mar
(1) |
Apr
|
May
(1) |
Jun
(3) |
Jul
(2) |
Aug
|
Sep
|
Oct
(5) |
Nov
|
Dec
|
| 2021 |
Jan
|
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
(4) |
Jul
(1) |
Aug
|
Sep
(1) |
Oct
|
Nov
(1) |
Dec
|
| 2022 |
Jan
|
Feb
(2) |
Mar
|
Apr
|
May
(2) |
Jun
|
Jul
(3) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2023 |
Jan
(2) |
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2024 |
Jan
|
Feb
(3) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2025 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Hoyt H. <hoy...@gm...> - 2016-07-23 16:18:55
|
I'm just getting started exploring this new release and I want to emphatically say thank you to all who contributed! Are there release notes somewhere, also? Specifically I'm looking for version numbers of the various components, i.e. TSK version used, libewf version used, etc. Where should I be looking for this information? Hoyt On Wed, Jul 20, 2016 at 8:05 PM, Brian Carrier <ca...@sl...> wrote: > Another long awaited release has also come today, Autopsy 4.1.0. It’s > new features include: > > • New list view in Timeline tool > • VMWare virtual machine files (vmdk) and Microsoft Virtual Hard > Drives (vhd) can be added as data sources. > • New ingest module detects vmdk and vhd files embedded in other > data sources and adds them as data sources. > • Text associated with blackboard artifacts is indexed and > searched for keywords. > • Custom (user-defined) blackboard artifact and attribute types > are displayed in the UI and included in reports. > • File size and MIME type conditions can be specified for > interesting files set membership rules. > • Assorted bug fixes and minor enhancements. > > > You can download it here: > > http://sleuthkit.org/autopsy/download.php > > Thanks for the public contributions and work by the Basis team. > > brian > > > > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and > traffic > patterns at an interface-level. Reveals which users, apps, and protocols > are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity > planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > -- Hoyt ----------------- There are 11 kinds of people - those who think binary jokes are funny, those who don't, ...and those who don't know binary. |
|
From: DRSL M. <in...@ni...> - 2016-07-23 16:18:40
|
<html><head></head><body class="" lang="en-US" style="background-color: rgb(255, 255, 255); line-height: initial;"> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Thanks, but I couldn't find anything of value relating to my request on the site!</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Can you kindly shed more lights on what I should look for? May be I was checking a wrong link!</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Regards, </div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br style="display:initial"></div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Bolanle O. Omotoso, <br>Ceo, <br>Data Recovery Specialist Ltd <br>https://nigeriadatarecovery.com <br>08035639710 <br><br>Sent from Data Recovery Specialist wireless' device</div> <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;"> <div><b>From: </b>John Lehr</div><div><b>Sent: </b>Saturday, July 23, 2016 4:27 PM</div><div><b>To: </b>DRSL Mail</div><div><b>Cc: </b>Luís Filipe Nassif; sle...@li... users</div><div><b>Subject: </b>Re: [sleuthkit-users] Browser History Scanner</div></div></td></tr></tbody></table><div style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style=""><meta http-equiv="Content-Type" content="text/html charset=utf-8">Take a look at GRR Rapid Response. <a href="https://github.com/google/grr" class="">https://github.com/google/grr</a><div class=""><br class=""></div><div class="">It was designed exactly for the type of investigation you propose.<br class=""><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jul 23, 2016, at 7:55 AM, DRSL Mail <<a href="mailto:in...@ni..." class="">in...@ni...</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div lang="en-US" style="background-color: rgb(255, 255, 255); line-height: initial;" class=""> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class="">Hi,</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class="">Can anyone please advise a tool that can be run centrally on a network to uncover browsing history of the users?</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class="">This is urgently needed as our initial investigation revealed that a user created some malicious mails on this website : emkei.cz in order to defraud the Organization, although the attempt failed as the third party raised an alarm.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class="">However, we need to know the user whose system was used to launch the malicious mails, we have individually scanned all the users in the affected department but all returned negative.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class="">The firm has about 280 Machines, and so we need a tool that can be deployed centrally to check the browsing history of all the users.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class=""><br class=""></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class="">Please help.</div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class=""><br style="display:initial" class=""></div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);" class="">Bolanle O. Omotoso, <br class="">Ceo, <br class="">Data Recovery Specialist Ltd <br class=""><a href="https://nigeriadatarecovery.com" class="">https://nigeriadatarecovery.com</a> <br class="">08035639710 <br class=""><br class="">Sent from Data Recovery Specialist wireless' device</div> <div id="_originalContent" style="" class=""><!--end of _originalContent --><br class=""></div></div> ------------------------------------------------------------------------------<br class="">What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic<br class="">patterns at an interface-level. Reveals which users, apps, and protocols are <br class="">consuming the most bandwidth. Provides multi-vendor support for NetFlow, <br class="">J-Flow, sFlow and other flows. Make informed decisions using capacity planning<br class="">reports.<a href="http://sdm.link/zohodev2dev_______________________________________________" class="">http://sdm.link/zohodev2dev_______________________________________________</a><br class="">sleuthkit-users mailing list<br class=""><a href="https://lists.sourceforge.net/lists/listinfo/sleuthkit-users" class="">https://lists.sourceforge.net/lists/listinfo/sleuthkit-users</a><br class="">http://www.sleuthkit.org<br class=""></div></blockquote></div><br class=""></div></div><br><!--end of _originalContent --></div></body></html> |
|
From: John L. <slo...@gm...> - 2016-07-23 15:27:32
|
Take a look at GRR Rapid Response. https://github.com/google/grr It was designed exactly for the type of investigation you propose. > On Jul 23, 2016, at 7:55 AM, DRSL Mail <in...@ni...> wrote: > > Hi, > > Can anyone please advise a tool that can be run centrally on a network to uncover browsing history of the users? > > This is urgently needed as our initial investigation revealed that a user created some malicious mails on this website : emkei.cz in order to defraud the Organization, although the attempt failed as the third party raised an alarm. > > However, we need to know the user whose system was used to launch the malicious mails, we have individually scanned all the users in the affected department but all returned negative. > > The firm has about 280 Machines, and so we need a tool that can be deployed centrally to check the browsing history of all the users. > > Please help. > > Bolanle O. Omotoso, > Ceo, > Data Recovery Specialist Ltd > https://nigeriadatarecovery.com > 08035639710 > > Sent from Data Recovery Specialist wireless' device > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic > patterns at an interface-level. Reveals which users, apps, and protocols are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity planning > reports.http://sdm.link/zohodev2dev_______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Edward D. <eld...@tr...> - 2016-07-23 15:13:30
|
On 7/23/2016 10:01 AM, John Lehr wrote: > Eddie, > > It’s been a little while since I have used tools like tsk_loaddb and tsk_gettimes (and even longer for tsk_recover), but they were designed and did work on disk images, automatically identifying and processing the partitions. > > I’d suggest filing a bug report (https://github.com/sleuthkit/sleuthkit/issues). I files a report at https://github.com/sleuthkit/sleuthkit/issues/692. Eddie Diener > > John > >> On Jul 23, 2016, at 3:53 AM, Edward Diener <eld...@tr...> wrote: >> >> According to the documentation for the fully automated tools: >> >> "These tools integrate the volume and file system functionality. Instead >> of analyzing only a single file system, these tools take a disk image as >> input and identify the volumes and process the contents. " >> >> This implies to me that if I have ewf file sequence images which >> encompasses a number of different partitions, each partition having its >> own filesystem ( ntfs, fat32, ext3, ext4 as an example ) that the fully >> automated tools should process the ewf file sequence correctly. Yet when >> I tried using tsk_recover against such an image sequence it failed >> completely, whether with the 4.2.0 or 4.3.0 release. When I tried >> running tsk_recover, using the '-o sector offset' parameter to a >> particular filesystem in the image sequence it succeeded. >> >> So are these fuilly automated tools supposed to work correctly against a >> multi-partition image sequence, or are they supposed to work correctly >> only against a single particular partition in a multi-partition image >> sequence at a time ? >> >> Eddie Diener >> >> ------------------------------------------------------------------------------ >> What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic >> patterns at an interface-level. Reveals which users, apps, and protocols are >> consuming the most bandwidth. Provides multi-vendor support for NetFlow, >> J-Flow, sFlow and other flows. Make informed decisions using capacity planning >> reports.http://sdm.link/zohodev2dev >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org |
|
From: DRSL M. <in...@ni...> - 2016-07-23 14:56:15
|
<html><head></head><body lang="en-US" style="background-color: rgb(255, 255, 255); line-height: initial;"> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Hi,</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Can anyone please advise a tool that can be run centrally on a network to uncover browsing history of the users?</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">This is urgently needed as our initial investigation revealed that a user created some malicious mails on this website : emkei.cz in order to defraud the Organization, although the attempt failed as the third party raised an alarm.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">However, we need to know the user whose system was used to launch the malicious mails, we have individually scanned all the users in the affected department but all returned negative.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">The firm has about 280 Machines, and so we need a tool that can be deployed centrally to check the browsing history of all the users.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Please help.</div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br style="display:initial"></div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Bolanle O. Omotoso, <br>Ceo, <br>Data Recovery Specialist Ltd <br>https://nigeriadatarecovery.com <br>08035639710 <br><br>Sent from Data Recovery Specialist wireless' device</div> <div id="_originalContent" style=""><!--end of _originalContent --><br></div></body></html> |
|
From: Luís F. N. <lfc...@gm...> - 2016-07-23 14:22:30
|
Great news! Congratulations all sleuthkit team. One question: does the new vmdk and vhdi support work with virtual disks with snapshots? Thank you, Luis 2016-07-20 10:42 GMT-03:00 Brian Carrier <ca...@sl...>: > We’ve finally gotten a new Sleuth Kit release out. The new release, > version 4.3.0, has features from the Autopsy release last year (like > PostgreSQL support) that never got out and this release marks the start of > a new effort to have a TSK release for every Autopsy release (which should > be out later today) and we are shooting for releases every 2 months because > this current span has been way too long. > > 4.3.0 adds: > • PostgreSQL support (Windows only) > • Support for virtual machine formats via libvmdk and libvhdi > (Windows only) > • Schema updates (data sources table, mime type, attributes store > type) > • tsk_img_open can take externally created TSK_IMG_INFO > • New Release_ NoLibs Visual Studio target > • Various bug fixes > > I’m doing a test too and the downloads are now coming off of github > instead of source forge. Let me know if you have any problems. > > http://sleuthkit.org/sleuthkit/download.php > > Thanks to the public contributions and the Basis developers for this work. > > thanks, > brian > > > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and > traffic > patterns at an interface-level. Reveals which users, apps, and protocols > are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity > planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > |
|
From: John L. <slo...@gm...> - 2016-07-23 14:01:34
|
Eddie, It’s been a little while since I have used tools like tsk_loaddb and tsk_gettimes (and even longer for tsk_recover), but they were designed and did work on disk images, automatically identifying and processing the partitions. I’d suggest filing a bug report (https://github.com/sleuthkit/sleuthkit/issues). John > On Jul 23, 2016, at 3:53 AM, Edward Diener <eld...@tr...> wrote: > > According to the documentation for the fully automated tools: > > "These tools integrate the volume and file system functionality. Instead > of analyzing only a single file system, these tools take a disk image as > input and identify the volumes and process the contents. " > > This implies to me that if I have ewf file sequence images which > encompasses a number of different partitions, each partition having its > own filesystem ( ntfs, fat32, ext3, ext4 as an example ) that the fully > automated tools should process the ewf file sequence correctly. Yet when > I tried using tsk_recover against such an image sequence it failed > completely, whether with the 4.2.0 or 4.3.0 release. When I tried > running tsk_recover, using the '-o sector offset' parameter to a > particular filesystem in the image sequence it succeeded. > > So are these fuilly automated tools supposed to work correctly against a > multi-partition image sequence, or are they supposed to work correctly > only against a single particular partition in a multi-partition image > sequence at a time ? > > Eddie Diener > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic > patterns at an interface-level. Reveals which users, apps, and protocols are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Edward D. <eld...@tr...> - 2016-07-23 10:53:42
|
According to the documentation for the fully automated tools: "These tools integrate the volume and file system functionality. Instead of analyzing only a single file system, these tools take a disk image as input and identify the volumes and process the contents. " This implies to me that if I have ewf file sequence images which encompasses a number of different partitions, each partition having its own filesystem ( ntfs, fat32, ext3, ext4 as an example ) that the fully automated tools should process the ewf file sequence correctly. Yet when I tried using tsk_recover against such an image sequence it failed completely, whether with the 4.2.0 or 4.3.0 release. When I tried running tsk_recover, using the '-o sector offset' parameter to a particular filesystem in the image sequence it succeeded. So are these fuilly automated tools supposed to work correctly against a multi-partition image sequence, or are they supposed to work correctly only against a single particular partition in a multi-partition image sequence at a time ? Eddie Diener |
|
From: Edward D. <eld...@tr...> - 2016-07-22 22:11:10
|
On 7/22/2016 3:03 PM, Grundy Barry J TIGTA wrote: > Eddie, > > Are you providing tsk_recover with an offset to the filesysytem? No I am not. I thought it could recover files from all partitions ( filesystems ) in the image automatically. Are you saying TSK can only recover one partition at a time from the ewf image, and that I tell it which partition to recover by passing an '-o sector offset' parameter to tell it where in the image the partition I want it to recover begins ? That's not what I thought from the --help output for tsk_recover or from the man page. > You have to tell the tool which partition (filesystem) you are interested in. Have a look at the '--help' output for more info on the syntax. > > If you run mmls from TSK on the ewf first, it will show you the partitions in the image and the offset (in sectors) to the partition within the physical image. Use this in your tsk_recover command. Thanks ! I am testing that now. But the doc for tsk_recover implies that it can recover files from all partitions in an image instead of just a single partition at a time in the image via the '-o sector offset' parameter. Hopefully you or someone else can clarify this for me. Eddie Diener > > /******************************************* > Barry J. Grundy > Assistant Special Agent in Charge > Digital Forensic Support Group > Treasury Inspector General for Tax Administration > (301) 210-8741 (desk) > (202) 527-5778 (cell) > Bar...@ti... > ********************************************\ > > >> -----Original Message----- >> From: Edward Diener [mailto:eld...@tr...] >> Sent: Friday, July 22, 2016 11:54 AM >> To: sle...@li... >> Subject: [sleuthkit-users] Tsk_recover failure with ewf file >> >> The failure I am about to describe occurs on both TSK 4.2.0 and the recently >> released TSK 4.3.0 on Windows 8.1 using the binaries provided. >> >> I use a program called FTK Imager Lite 3.1.1.8 from AccessData to create ewf >> images. If I create ewf images from a single logical drive, which naturally has a >> single file system, TSK and tsk_recover work fine. >> Instead my problem with TSK is when creating ewf images from a physical >> drive, which has a number of different file systems. In my example I create >> ewf images from a physical drive which has separate FAT32, NTFS, EXT3, and >> EXT4 with files in each logical partition. The FTK Imager Lite program creates >> the ewf image for me in the directory of my choice from the physical drive >> without any problems. I then run tsk_recover with the -v verbose option, >> passing the full path to the ewf image and the directory where I want the >> files to be put. The results of running tsk_recover are: >> >> ---------------------------------------------------------------------------------------------- >> -------------------------- >> >> E:\Utilities\sleuthkit-4.3.0-win32\bin>tsk_recover -v >> C:\Utilities\FTImages\PhysDrive\MyPhys.E01 >> C:\Utilities\TSKDirs\Rec1\Unallocated >> tsk_img_open: Type: 0 NumImg: 1 Img1: >> C:\Utilities\FTImages\PhysDrive\MyPhys.E01 >> ewf_open: found 1 segment files via libewf_glob Error opening vmdk file >> Error checking file signature for vhd file >> fsopen: Auto detection mode at offset 0 >> ewf_image_read: byte offset: 0 len: 65536 >> ntfs_open: invalid cluster size: 0 >> fatxxfs_open: Invalid sector size (23552) >> exfatfs_get_fs_size_params: Invalid sector size base 2 logarithm (23552), not >> in >> range (9 - 12) >> fatxxfs_open: Invalid sector size (23552) >> ext2fs_open: invalid magic >> ewf_image_read: byte offset: 65536 len: 65536 >> ufs_open: Trying 256KB UFS2 location >> ewf_image_read: byte offset: 262144 len: 65536 >> ufs_open: Trying UFS1 location >> ufs_open: No UFS magic found >> ewf_image_read: byte offset: 156160 len: 65536 >> ewf_image_read: byte offset: 426496 len: 65536 >> ewf_image_read: byte offset: 561664 len: 65536 >> ewf_image_read: byte offset: 696832 len: 65536 >> ewf_image_read: byte offset: 832000 len: 65536 >> ewf_image_read: byte offset: 967168 len: 65536 >> ewf_image_read: byte offset: 1102336 len: 65536 >> ewf_image_read: byte offset: 1237504 len: 65536 >> ewf_image_read: byte offset: 1372672 len: 65536 >> ewf_image_read: byte offset: 1507840 len: 65536 >> ewf_image_read: byte offset: 1643008 len: 65536 >> ewf_image_read: byte offset: 1778176 len: 65536 >> ewf_image_read: byte offset: 1913344 len: 65536 >> ewf_image_read: byte offset: 2048512 len: 65536 >> ewf_image_read: byte offset: 2183680 len: 65536 >> ewf_image_read: byte offset: 2318848 len: 65536 >> ewf_image_read: byte offset: 2454016 len: 65536 >> ewf_image_read: byte offset: 2589184 len: 65536 >> ewf_image_read: byte offset: 2724352 len: 65536 >> ewf_image_read: byte offset: 2859520 len: 65536 >> ewf_image_read: byte offset: 2994688 len: 65536 >> ewf_image_read: byte offset: 3129856 len: 65536 >> ewf_image_read: byte offset: 3265024 len: 65536 >> ewf_image_read: byte offset: 3400192 len: 65536 >> ewf_image_read: byte offset: 3535360 len: 65536 >> ewf_image_read: byte offset: 3670528 len: 65536 >> ewf_image_read: byte offset: 3805696 len: 65536 >> ewf_image_read: byte offset: 3940864 len: 65536 >> ewf_image_read: byte offset: 4076032 len: 65536 >> ewf_image_read: byte offset: 4211200 len: 65536 >> ewf_image_read: byte offset: 4346368 len: 65536 >> ewf_image_read: byte offset: 4481536 len: 65536 >> ewf_image_read: byte offset: 4616704 len: 65536 >> ewf_image_read: byte offset: 4751872 len: 65536 >> ewf_image_read: byte offset: 4732928 len: 65536 >> ewf_image_read: byte offset: 4887040 len: 65536 >> ewf_image_read: byte offset: 5022208 len: 65536 >> ewf_image_read: byte offset: 5157376 len: 65536 >> ewf_image_read: byte offset: 5292544 len: 65536 >> ewf_image_read: byte offset: 5427712 len: 65536 >> ewf_image_read: byte offset: 5562880 len: 65536 >> ewf_image_read: byte offset: 5698048 len: 65536 >> ewf_image_read: byte offset: 5833216 len: 65536 >> ewf_image_read: byte offset: 5968384 len: 65536 >> ewf_image_read: byte offset: 6103552 len: 65536 >> ewf_image_read: byte offset: 6238720 len: 65536 >> ewf_image_read: byte offset: 6373888 len: 65536 >> ewf_image_read: byte offset: 6509056 len: 65536 >> ewf_image_read: byte offset: 6644224 len: 65536 >> ewf_image_read: byte offset: 6779392 len: 65536 >> ewf_image_read: byte offset: 6914560 len: 65536 >> ewf_image_read: byte offset: 7049728 len: 65536 >> ewf_image_read: byte offset: 7184896 len: 65536 >> ewf_image_read: byte offset: 7320064 len: 65536 >> ewf_image_read: byte offset: 7455232 len: 65536 >> ewf_image_read: byte offset: 7590400 len: 65536 >> ewf_image_read: byte offset: 7725568 len: 65536 >> ewf_image_read: byte offset: 7860736 len: 65536 >> ewf_image_read: byte offset: 7995904 len: 65536 >> ewf_image_read: byte offset: 8131072 len: 65536 >> ewf_image_read: byte offset: 8266240 len: 65536 >> ewf_image_read: byte offset: 8401408 len: 65536 >> ewf_image_read: byte offset: 8536576 len: 65536 >> ewf_image_read: byte offset: 8671744 len: 65536 >> ewf_image_read: byte offset: 8806912 len: 65536 >> ewf_image_read: byte offset: 8942080 len: 65536 >> ewf_image_read: byte offset: 9077248 len: 65536 >> ewf_image_read: byte offset: 9212416 len: 65536 >> ewf_image_read: byte offset: 9347584 len: 65536 >> ewf_image_read: byte offset: 9482752 len: 65536 >> ewf_image_read: byte offset: 9617920 len: 65536 >> ewf_image_read: byte offset: 9753088 len: 65536 >> ewf_image_read: byte offset: 9888256 len: 65536 >> ewf_image_read: byte offset: 10023424 len: 65536 >> ewf_image_read: byte offset: 10158592 len: 65536 >> ewf_image_read: byte offset: 10293760 len: 65536 >> ewf_image_read: byte offset: 10428928 len: 65536 >> ewf_image_read: byte offset: 10564096 len: 65536 >> ewf_image_read: byte offset: 10699264 len: 65536 >> ewf_image_read: byte offset: 10834432 len: 65536 >> ewf_image_read: byte offset: 10969600 len: 65536 >> ewf_image_read: byte offset: 11104768 len: 65536 >> ewf_image_read: byte offset: 11239936 len: 65536 >> ewf_image_read: byte offset: 11375104 len: 65536 >> ewf_image_read: byte offset: 11510272 len: 65536 >> ewf_image_read: byte offset: 11645440 len: 65536 >> ewf_image_read: byte offset: 11780608 len: 65536 >> ewf_image_read: byte offset: 11915776 len: 65536 >> ewf_image_read: byte offset: 12050944 len: 65536 >> ewf_image_read: byte offset: 12186112 len: 65536 >> ewf_image_read: byte offset: 12321280 len: 65536 >> ewf_image_read: byte offset: 12456448 len: 65536 >> ewf_image_read: byte offset: 12591616 len: 65536 >> ewf_image_read: byte offset: 12726784 len: 65536 >> ewf_image_read: byte offset: 12861952 len: 65536 >> ewf_image_read: byte offset: 12997120 len: 65536 >> ewf_image_read: byte offset: 13132288 len: 65536 >> ewf_image_read: byte offset: 13267456 len: 65536 >> ewf_image_read: byte offset: 13402624 len: 65536 >> ewf_image_read: byte offset: 13537792 len: 65536 >> ewf_image_read: byte offset: 13672960 len: 65536 >> ewf_image_read: byte offset: 13808128 len: 65536 >> ewf_image_read: byte offset: 13943296 len: 65536 >> ewf_image_read: byte offset: 14078464 len: 65536 >> ewf_image_read: byte offset: 14213632 len: 65536 >> ewf_image_read: byte offset: 14348800 len: 65536 >> ewf_image_read: byte offset: 14483968 len: 65536 >> ewf_image_read: byte offset: 14619136 len: 65536 >> ewf_image_read: byte offset: 14754304 len: 65536 >> ewf_image_read: byte offset: 14889472 len: 65536 >> ewf_image_read: byte offset: 15024640 len: 65536 >> ewf_image_read: byte offset: 15159808 len: 65536 >> ewf_image_read: byte offset: 15294976 len: 65536 >> ewf_image_read: byte offset: 15276032 len: 65536 >> ewf_image_read: byte offset: 15430144 len: 65536 >> ewf_image_read: byte offset: 15411200 len: 65536 >> ewf_image_read: byte offset: 15565312 len: 65536 >> ewf_image_read: byte offset: 15546368 len: 65536 >> ewf_image_read: byte offset: 15700480 len: 65536 >> ewf_image_read: byte offset: 15681536 len: 65536 >> ewf_image_read: byte offset: 15835648 len: 65536 >> ewf_image_read: byte offset: 15816704 len: 65536 >> ewf_image_read: byte offset: 15970816 len: 65536 >> ewf_image_read: byte offset: 15951872 len: 65536 >> ewf_image_read: byte offset: 16105984 len: 65536 >> ewf_image_read: byte offset: 16087040 len: 65536 >> ewf_image_read: byte offset: 16241152 len: 65536 >> ewf_image_read: byte offset: 16222208 len: 65536 >> ewf_image_read: byte offset: 16376320 len: 65536 >> ewf_image_read: byte offset: 16357376 len: 65536 >> yaffsfs_open: could not find valid spare area format See >> http://wiki.sleuthkit.org/index.php?title=YAFFS2 for help on Yaffs2 >> configuration >> ewf_image_read: byte offset: 1024 len: 65536 iso9660_open img_info: >> 34734152 ftype: 2048 test: 1 >> iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 Trying >> RAW ISO9660 with 16-byte pre-block size >> fs_prepost_read: Mapped 32768 to 37648 >> iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 Trying >> RAW ISO9660 with 24-byte pre-block size >> fs_prepost_read: Mapped 32768 to 37656 >> iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 >> iso9660_open: Error loading volume descriptor Cannot determine file system >> type (Sector offset: 0)Files Recovered: 0 >> >> ---------------------------------------------------------------------------------------------- >> ---------------------------------- >> >> Yet if I ask FTK Imager to show me the file in the ewf image, using its Add >> Evidence Item... >> functionality it does indeed show me the files in the image without any >> errors. >> >> Is TSK supposed to work with physical drives containin different file systems >> ? If so can anyone suggest how I can get TSK to work properly ? >> >> Eddie Diener >> >> ------------------------------------------------------------------------------ >> What NetFlow Analyzer can do for you? Monitors network bandwidth and >> traffic patterns at an interface-level. Reveals which users, apps, and >> protocols are consuming the most bandwidth. Provides multi-vendor support >> for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using >> capacity planning reports.http://sdm.link/zohodev2dev >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org |
|
From: Grundy B. J T. <Bar...@ti...> - 2016-07-22 19:04:07
|
Eddie, Are you providing tsk_recover with an offset to the filesysytem? You have to tell the tool which partition (filesystem) you are interested in. Have a look at the '--help' output for more info on the syntax. If you run mmls from TSK on the ewf first, it will show you the partitions in the image and the offset (in sectors) to the partition within the physical image. Use this in your tsk_recover command. /******************************************* Barry J. Grundy Assistant Special Agent in Charge Digital Forensic Support Group Treasury Inspector General for Tax Administration (301) 210-8741 (desk) (202) 527-5778 (cell) Bar...@ti... ********************************************\ > -----Original Message----- > From: Edward Diener [mailto:eld...@tr...] > Sent: Friday, July 22, 2016 11:54 AM > To: sle...@li... > Subject: [sleuthkit-users] Tsk_recover failure with ewf file > > The failure I am about to describe occurs on both TSK 4.2.0 and the recently > released TSK 4.3.0 on Windows 8.1 using the binaries provided. > > I use a program called FTK Imager Lite 3.1.1.8 from AccessData to create ewf > images. If I create ewf images from a single logical drive, which naturally has a > single file system, TSK and tsk_recover work fine. > Instead my problem with TSK is when creating ewf images from a physical > drive, which has a number of different file systems. In my example I create > ewf images from a physical drive which has separate FAT32, NTFS, EXT3, and > EXT4 with files in each logical partition. The FTK Imager Lite program creates > the ewf image for me in the directory of my choice from the physical drive > without any problems. I then run tsk_recover with the -v verbose option, > passing the full path to the ewf image and the directory where I want the > files to be put. The results of running tsk_recover are: > > ---------------------------------------------------------------------------------------------- > -------------------------- > > E:\Utilities\sleuthkit-4.3.0-win32\bin>tsk_recover -v > C:\Utilities\FTImages\PhysDrive\MyPhys.E01 > C:\Utilities\TSKDirs\Rec1\Unallocated > tsk_img_open: Type: 0 NumImg: 1 Img1: > C:\Utilities\FTImages\PhysDrive\MyPhys.E01 > ewf_open: found 1 segment files via libewf_glob Error opening vmdk file > Error checking file signature for vhd file > fsopen: Auto detection mode at offset 0 > ewf_image_read: byte offset: 0 len: 65536 > ntfs_open: invalid cluster size: 0 > fatxxfs_open: Invalid sector size (23552) > exfatfs_get_fs_size_params: Invalid sector size base 2 logarithm (23552), not > in > range (9 - 12) > fatxxfs_open: Invalid sector size (23552) > ext2fs_open: invalid magic > ewf_image_read: byte offset: 65536 len: 65536 > ufs_open: Trying 256KB UFS2 location > ewf_image_read: byte offset: 262144 len: 65536 > ufs_open: Trying UFS1 location > ufs_open: No UFS magic found > ewf_image_read: byte offset: 156160 len: 65536 > ewf_image_read: byte offset: 426496 len: 65536 > ewf_image_read: byte offset: 561664 len: 65536 > ewf_image_read: byte offset: 696832 len: 65536 > ewf_image_read: byte offset: 832000 len: 65536 > ewf_image_read: byte offset: 967168 len: 65536 > ewf_image_read: byte offset: 1102336 len: 65536 > ewf_image_read: byte offset: 1237504 len: 65536 > ewf_image_read: byte offset: 1372672 len: 65536 > ewf_image_read: byte offset: 1507840 len: 65536 > ewf_image_read: byte offset: 1643008 len: 65536 > ewf_image_read: byte offset: 1778176 len: 65536 > ewf_image_read: byte offset: 1913344 len: 65536 > ewf_image_read: byte offset: 2048512 len: 65536 > ewf_image_read: byte offset: 2183680 len: 65536 > ewf_image_read: byte offset: 2318848 len: 65536 > ewf_image_read: byte offset: 2454016 len: 65536 > ewf_image_read: byte offset: 2589184 len: 65536 > ewf_image_read: byte offset: 2724352 len: 65536 > ewf_image_read: byte offset: 2859520 len: 65536 > ewf_image_read: byte offset: 2994688 len: 65536 > ewf_image_read: byte offset: 3129856 len: 65536 > ewf_image_read: byte offset: 3265024 len: 65536 > ewf_image_read: byte offset: 3400192 len: 65536 > ewf_image_read: byte offset: 3535360 len: 65536 > ewf_image_read: byte offset: 3670528 len: 65536 > ewf_image_read: byte offset: 3805696 len: 65536 > ewf_image_read: byte offset: 3940864 len: 65536 > ewf_image_read: byte offset: 4076032 len: 65536 > ewf_image_read: byte offset: 4211200 len: 65536 > ewf_image_read: byte offset: 4346368 len: 65536 > ewf_image_read: byte offset: 4481536 len: 65536 > ewf_image_read: byte offset: 4616704 len: 65536 > ewf_image_read: byte offset: 4751872 len: 65536 > ewf_image_read: byte offset: 4732928 len: 65536 > ewf_image_read: byte offset: 4887040 len: 65536 > ewf_image_read: byte offset: 5022208 len: 65536 > ewf_image_read: byte offset: 5157376 len: 65536 > ewf_image_read: byte offset: 5292544 len: 65536 > ewf_image_read: byte offset: 5427712 len: 65536 > ewf_image_read: byte offset: 5562880 len: 65536 > ewf_image_read: byte offset: 5698048 len: 65536 > ewf_image_read: byte offset: 5833216 len: 65536 > ewf_image_read: byte offset: 5968384 len: 65536 > ewf_image_read: byte offset: 6103552 len: 65536 > ewf_image_read: byte offset: 6238720 len: 65536 > ewf_image_read: byte offset: 6373888 len: 65536 > ewf_image_read: byte offset: 6509056 len: 65536 > ewf_image_read: byte offset: 6644224 len: 65536 > ewf_image_read: byte offset: 6779392 len: 65536 > ewf_image_read: byte offset: 6914560 len: 65536 > ewf_image_read: byte offset: 7049728 len: 65536 > ewf_image_read: byte offset: 7184896 len: 65536 > ewf_image_read: byte offset: 7320064 len: 65536 > ewf_image_read: byte offset: 7455232 len: 65536 > ewf_image_read: byte offset: 7590400 len: 65536 > ewf_image_read: byte offset: 7725568 len: 65536 > ewf_image_read: byte offset: 7860736 len: 65536 > ewf_image_read: byte offset: 7995904 len: 65536 > ewf_image_read: byte offset: 8131072 len: 65536 > ewf_image_read: byte offset: 8266240 len: 65536 > ewf_image_read: byte offset: 8401408 len: 65536 > ewf_image_read: byte offset: 8536576 len: 65536 > ewf_image_read: byte offset: 8671744 len: 65536 > ewf_image_read: byte offset: 8806912 len: 65536 > ewf_image_read: byte offset: 8942080 len: 65536 > ewf_image_read: byte offset: 9077248 len: 65536 > ewf_image_read: byte offset: 9212416 len: 65536 > ewf_image_read: byte offset: 9347584 len: 65536 > ewf_image_read: byte offset: 9482752 len: 65536 > ewf_image_read: byte offset: 9617920 len: 65536 > ewf_image_read: byte offset: 9753088 len: 65536 > ewf_image_read: byte offset: 9888256 len: 65536 > ewf_image_read: byte offset: 10023424 len: 65536 > ewf_image_read: byte offset: 10158592 len: 65536 > ewf_image_read: byte offset: 10293760 len: 65536 > ewf_image_read: byte offset: 10428928 len: 65536 > ewf_image_read: byte offset: 10564096 len: 65536 > ewf_image_read: byte offset: 10699264 len: 65536 > ewf_image_read: byte offset: 10834432 len: 65536 > ewf_image_read: byte offset: 10969600 len: 65536 > ewf_image_read: byte offset: 11104768 len: 65536 > ewf_image_read: byte offset: 11239936 len: 65536 > ewf_image_read: byte offset: 11375104 len: 65536 > ewf_image_read: byte offset: 11510272 len: 65536 > ewf_image_read: byte offset: 11645440 len: 65536 > ewf_image_read: byte offset: 11780608 len: 65536 > ewf_image_read: byte offset: 11915776 len: 65536 > ewf_image_read: byte offset: 12050944 len: 65536 > ewf_image_read: byte offset: 12186112 len: 65536 > ewf_image_read: byte offset: 12321280 len: 65536 > ewf_image_read: byte offset: 12456448 len: 65536 > ewf_image_read: byte offset: 12591616 len: 65536 > ewf_image_read: byte offset: 12726784 len: 65536 > ewf_image_read: byte offset: 12861952 len: 65536 > ewf_image_read: byte offset: 12997120 len: 65536 > ewf_image_read: byte offset: 13132288 len: 65536 > ewf_image_read: byte offset: 13267456 len: 65536 > ewf_image_read: byte offset: 13402624 len: 65536 > ewf_image_read: byte offset: 13537792 len: 65536 > ewf_image_read: byte offset: 13672960 len: 65536 > ewf_image_read: byte offset: 13808128 len: 65536 > ewf_image_read: byte offset: 13943296 len: 65536 > ewf_image_read: byte offset: 14078464 len: 65536 > ewf_image_read: byte offset: 14213632 len: 65536 > ewf_image_read: byte offset: 14348800 len: 65536 > ewf_image_read: byte offset: 14483968 len: 65536 > ewf_image_read: byte offset: 14619136 len: 65536 > ewf_image_read: byte offset: 14754304 len: 65536 > ewf_image_read: byte offset: 14889472 len: 65536 > ewf_image_read: byte offset: 15024640 len: 65536 > ewf_image_read: byte offset: 15159808 len: 65536 > ewf_image_read: byte offset: 15294976 len: 65536 > ewf_image_read: byte offset: 15276032 len: 65536 > ewf_image_read: byte offset: 15430144 len: 65536 > ewf_image_read: byte offset: 15411200 len: 65536 > ewf_image_read: byte offset: 15565312 len: 65536 > ewf_image_read: byte offset: 15546368 len: 65536 > ewf_image_read: byte offset: 15700480 len: 65536 > ewf_image_read: byte offset: 15681536 len: 65536 > ewf_image_read: byte offset: 15835648 len: 65536 > ewf_image_read: byte offset: 15816704 len: 65536 > ewf_image_read: byte offset: 15970816 len: 65536 > ewf_image_read: byte offset: 15951872 len: 65536 > ewf_image_read: byte offset: 16105984 len: 65536 > ewf_image_read: byte offset: 16087040 len: 65536 > ewf_image_read: byte offset: 16241152 len: 65536 > ewf_image_read: byte offset: 16222208 len: 65536 > ewf_image_read: byte offset: 16376320 len: 65536 > ewf_image_read: byte offset: 16357376 len: 65536 > yaffsfs_open: could not find valid spare area format See > http://wiki.sleuthkit.org/index.php?title=YAFFS2 for help on Yaffs2 > configuration > ewf_image_read: byte offset: 1024 len: 65536 iso9660_open img_info: > 34734152 ftype: 2048 test: 1 > iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 Trying > RAW ISO9660 with 16-byte pre-block size > fs_prepost_read: Mapped 32768 to 37648 > iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 Trying > RAW ISO9660 with 24-byte pre-block size > fs_prepost_read: Mapped 32768 to 37656 > iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 > iso9660_open: Error loading volume descriptor Cannot determine file system > type (Sector offset: 0)Files Recovered: 0 > > ---------------------------------------------------------------------------------------------- > ---------------------------------- > > Yet if I ask FTK Imager to show me the file in the ewf image, using its Add > Evidence Item... > functionality it does indeed show me the files in the image without any > errors. > > Is TSK supposed to work with physical drives containin different file systems > ? If so can anyone suggest how I can get TSK to work properly ? > > Eddie Diener > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and > traffic patterns at an interface-level. Reveals which users, apps, and > protocols are consuming the most bandwidth. Provides multi-vendor support > for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using > capacity planning reports.http://sdm.link/zohodev2dev > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Edward D. <eld...@tr...> - 2016-07-22 15:54:10
|
The failure I am about to describe occurs on both TSK 4.2.0 and the recently released TSK 4.3.0 on Windows 8.1 using the binaries provided. I use a program called FTK Imager Lite 3.1.1.8 from AccessData to create ewf images. If I create ewf images from a single logical drive, which naturally has a single file system, TSK and tsk_recover work fine. Instead my problem with TSK is when creating ewf images from a physical drive, which has a number of different file systems. In my example I create ewf images from a physical drive which has separate FAT32, NTFS, EXT3, and EXT4 with files in each logical partition. The FTK Imager Lite program creates the ewf image for me in the directory of my choice from the physical drive without any problems. I then run tsk_recover with the -v verbose option, passing the full path to the ewf image and the directory where I want the files to be put. The results of running tsk_recover are: ------------------------------------------------------------------------------------------------------------------------ E:\Utilities\sleuthkit-4.3.0-win32\bin>tsk_recover -v C:\Utilities\FTImages\PhysDrive\MyPhys.E01 C:\Utilities\TSKDirs\Rec1\Unallocated tsk_img_open: Type: 0 NumImg: 1 Img1: C:\Utilities\FTImages\PhysDrive\MyPhys.E01 ewf_open: found 1 segment files via libewf_glob Error opening vmdk file Error checking file signature for vhd file fsopen: Auto detection mode at offset 0 ewf_image_read: byte offset: 0 len: 65536 ntfs_open: invalid cluster size: 0 fatxxfs_open: Invalid sector size (23552) exfatfs_get_fs_size_params: Invalid sector size base 2 logarithm (23552), not in range (9 - 12) fatxxfs_open: Invalid sector size (23552) ext2fs_open: invalid magic ewf_image_read: byte offset: 65536 len: 65536 ufs_open: Trying 256KB UFS2 location ewf_image_read: byte offset: 262144 len: 65536 ufs_open: Trying UFS1 location ufs_open: No UFS magic found ewf_image_read: byte offset: 156160 len: 65536 ewf_image_read: byte offset: 426496 len: 65536 ewf_image_read: byte offset: 561664 len: 65536 ewf_image_read: byte offset: 696832 len: 65536 ewf_image_read: byte offset: 832000 len: 65536 ewf_image_read: byte offset: 967168 len: 65536 ewf_image_read: byte offset: 1102336 len: 65536 ewf_image_read: byte offset: 1237504 len: 65536 ewf_image_read: byte offset: 1372672 len: 65536 ewf_image_read: byte offset: 1507840 len: 65536 ewf_image_read: byte offset: 1643008 len: 65536 ewf_image_read: byte offset: 1778176 len: 65536 ewf_image_read: byte offset: 1913344 len: 65536 ewf_image_read: byte offset: 2048512 len: 65536 ewf_image_read: byte offset: 2183680 len: 65536 ewf_image_read: byte offset: 2318848 len: 65536 ewf_image_read: byte offset: 2454016 len: 65536 ewf_image_read: byte offset: 2589184 len: 65536 ewf_image_read: byte offset: 2724352 len: 65536 ewf_image_read: byte offset: 2859520 len: 65536 ewf_image_read: byte offset: 2994688 len: 65536 ewf_image_read: byte offset: 3129856 len: 65536 ewf_image_read: byte offset: 3265024 len: 65536 ewf_image_read: byte offset: 3400192 len: 65536 ewf_image_read: byte offset: 3535360 len: 65536 ewf_image_read: byte offset: 3670528 len: 65536 ewf_image_read: byte offset: 3805696 len: 65536 ewf_image_read: byte offset: 3940864 len: 65536 ewf_image_read: byte offset: 4076032 len: 65536 ewf_image_read: byte offset: 4211200 len: 65536 ewf_image_read: byte offset: 4346368 len: 65536 ewf_image_read: byte offset: 4481536 len: 65536 ewf_image_read: byte offset: 4616704 len: 65536 ewf_image_read: byte offset: 4751872 len: 65536 ewf_image_read: byte offset: 4732928 len: 65536 ewf_image_read: byte offset: 4887040 len: 65536 ewf_image_read: byte offset: 5022208 len: 65536 ewf_image_read: byte offset: 5157376 len: 65536 ewf_image_read: byte offset: 5292544 len: 65536 ewf_image_read: byte offset: 5427712 len: 65536 ewf_image_read: byte offset: 5562880 len: 65536 ewf_image_read: byte offset: 5698048 len: 65536 ewf_image_read: byte offset: 5833216 len: 65536 ewf_image_read: byte offset: 5968384 len: 65536 ewf_image_read: byte offset: 6103552 len: 65536 ewf_image_read: byte offset: 6238720 len: 65536 ewf_image_read: byte offset: 6373888 len: 65536 ewf_image_read: byte offset: 6509056 len: 65536 ewf_image_read: byte offset: 6644224 len: 65536 ewf_image_read: byte offset: 6779392 len: 65536 ewf_image_read: byte offset: 6914560 len: 65536 ewf_image_read: byte offset: 7049728 len: 65536 ewf_image_read: byte offset: 7184896 len: 65536 ewf_image_read: byte offset: 7320064 len: 65536 ewf_image_read: byte offset: 7455232 len: 65536 ewf_image_read: byte offset: 7590400 len: 65536 ewf_image_read: byte offset: 7725568 len: 65536 ewf_image_read: byte offset: 7860736 len: 65536 ewf_image_read: byte offset: 7995904 len: 65536 ewf_image_read: byte offset: 8131072 len: 65536 ewf_image_read: byte offset: 8266240 len: 65536 ewf_image_read: byte offset: 8401408 len: 65536 ewf_image_read: byte offset: 8536576 len: 65536 ewf_image_read: byte offset: 8671744 len: 65536 ewf_image_read: byte offset: 8806912 len: 65536 ewf_image_read: byte offset: 8942080 len: 65536 ewf_image_read: byte offset: 9077248 len: 65536 ewf_image_read: byte offset: 9212416 len: 65536 ewf_image_read: byte offset: 9347584 len: 65536 ewf_image_read: byte offset: 9482752 len: 65536 ewf_image_read: byte offset: 9617920 len: 65536 ewf_image_read: byte offset: 9753088 len: 65536 ewf_image_read: byte offset: 9888256 len: 65536 ewf_image_read: byte offset: 10023424 len: 65536 ewf_image_read: byte offset: 10158592 len: 65536 ewf_image_read: byte offset: 10293760 len: 65536 ewf_image_read: byte offset: 10428928 len: 65536 ewf_image_read: byte offset: 10564096 len: 65536 ewf_image_read: byte offset: 10699264 len: 65536 ewf_image_read: byte offset: 10834432 len: 65536 ewf_image_read: byte offset: 10969600 len: 65536 ewf_image_read: byte offset: 11104768 len: 65536 ewf_image_read: byte offset: 11239936 len: 65536 ewf_image_read: byte offset: 11375104 len: 65536 ewf_image_read: byte offset: 11510272 len: 65536 ewf_image_read: byte offset: 11645440 len: 65536 ewf_image_read: byte offset: 11780608 len: 65536 ewf_image_read: byte offset: 11915776 len: 65536 ewf_image_read: byte offset: 12050944 len: 65536 ewf_image_read: byte offset: 12186112 len: 65536 ewf_image_read: byte offset: 12321280 len: 65536 ewf_image_read: byte offset: 12456448 len: 65536 ewf_image_read: byte offset: 12591616 len: 65536 ewf_image_read: byte offset: 12726784 len: 65536 ewf_image_read: byte offset: 12861952 len: 65536 ewf_image_read: byte offset: 12997120 len: 65536 ewf_image_read: byte offset: 13132288 len: 65536 ewf_image_read: byte offset: 13267456 len: 65536 ewf_image_read: byte offset: 13402624 len: 65536 ewf_image_read: byte offset: 13537792 len: 65536 ewf_image_read: byte offset: 13672960 len: 65536 ewf_image_read: byte offset: 13808128 len: 65536 ewf_image_read: byte offset: 13943296 len: 65536 ewf_image_read: byte offset: 14078464 len: 65536 ewf_image_read: byte offset: 14213632 len: 65536 ewf_image_read: byte offset: 14348800 len: 65536 ewf_image_read: byte offset: 14483968 len: 65536 ewf_image_read: byte offset: 14619136 len: 65536 ewf_image_read: byte offset: 14754304 len: 65536 ewf_image_read: byte offset: 14889472 len: 65536 ewf_image_read: byte offset: 15024640 len: 65536 ewf_image_read: byte offset: 15159808 len: 65536 ewf_image_read: byte offset: 15294976 len: 65536 ewf_image_read: byte offset: 15276032 len: 65536 ewf_image_read: byte offset: 15430144 len: 65536 ewf_image_read: byte offset: 15411200 len: 65536 ewf_image_read: byte offset: 15565312 len: 65536 ewf_image_read: byte offset: 15546368 len: 65536 ewf_image_read: byte offset: 15700480 len: 65536 ewf_image_read: byte offset: 15681536 len: 65536 ewf_image_read: byte offset: 15835648 len: 65536 ewf_image_read: byte offset: 15816704 len: 65536 ewf_image_read: byte offset: 15970816 len: 65536 ewf_image_read: byte offset: 15951872 len: 65536 ewf_image_read: byte offset: 16105984 len: 65536 ewf_image_read: byte offset: 16087040 len: 65536 ewf_image_read: byte offset: 16241152 len: 65536 ewf_image_read: byte offset: 16222208 len: 65536 ewf_image_read: byte offset: 16376320 len: 65536 ewf_image_read: byte offset: 16357376 len: 65536 yaffsfs_open: could not find valid spare area format See http://wiki.sleuthkit.org/index.php?title=YAFFS2 for help on Yaffs2 configuration ewf_image_read: byte offset: 1024 len: 65536 iso9660_open img_info: 34734152 ftype: 2048 test: 1 iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 Trying RAW ISO9660 with 16-byte pre-block size fs_prepost_read: Mapped 32768 to 37648 iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 Trying RAW ISO9660 with 24-byte pre-block size fs_prepost_read: Mapped 32768 to 37656 iso_load_vol_desc: Bad volume descriptor: Magic number is not CD001 iso9660_open: Error loading volume descriptor Cannot determine file system type (Sector offset: 0)Files Recovered: 0 -------------------------------------------------------------------------------------------------------------------------------- Yet if I ask FTK Imager to show me the file in the ewf image, using its Add Evidence Item... functionality it does indeed show me the files in the image without any errors. Is TSK supposed to work with physical drives containin different file systems ? If so can anyone suggest how I can get TSK to work properly ? Eddie Diener |
|
From: Brian C. <ca...@sl...> - 2016-07-21 01:10:07
|
Hey David, My first disclaimer is that I’ve never used pytsk. However, I can speak in general terms that some file systems that have a large number of files (and large MFTs) can be slow to open large directories because it preloads all of the information about the directory when it is opened. Is it for all file systems and all directories or are you just seeing it now with a new image? brian > On Jul 18, 2016, at 11:11 AM, David Nides <dav...@gm...> wrote: > > On windows, running Python 2.7 and pytsk3 version 20140506 opening a file entity is slow on the order of 2 – 4 seconds. The fs_info object is for an active drive. We have tried directly opening the entity using fs_info.open and fs_info.open_dir with similar results. Is there a more performant option to opening directories when traversing a directory tree? Are these times abnormal? > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic > patterns at an interface-level. Reveals which users, apps, and protocols are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity planning > reports.http://sdm.link/zohodev2dev_______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Brian C. <ca...@sl...> - 2016-07-21 01:05:53
|
Another long awaited release has also come today, Autopsy 4.1.0. It’s new features include:
• New list view in Timeline tool
• VMWare virtual machine files (vmdk) and Microsoft Virtual Hard Drives (vhd) can be added as data sources.
• New ingest module detects vmdk and vhd files embedded in other data sources and adds them as data sources.
• Text associated with blackboard artifacts is indexed and searched for keywords.
• Custom (user-defined) blackboard artifact and attribute types are displayed in the UI and included in reports.
• File size and MIME type conditions can be specified for interesting files set membership rules.
• Assorted bug fixes and minor enhancements.
You can download it here:
http://sleuthkit.org/autopsy/download.php
Thanks for the public contributions and work by the Basis team.
brian
|
|
From: Brian C. <ca...@sl...> - 2016-07-21 00:52:23
|
All that should be required is some autoconf/automake magic to get libvmdk and libvhdi working with TSK on Linux / OS X. We just haven’t had the cycles. I’ll be honest that it is my intent to get PostgreSQL, virtual machine formats, etc. in to the auto* build process when start on these efforts, but other things come up and we’ve been slow enough with getting releases out that I don’t want to hold them up even more. So, if someone can update configure.ac, etc. to look for the libraries and test them, we’d love a pull request! > On Jul 20, 2016, at 10:20 AM, RB <ao...@gm...> wrote: > > On Wed, Jul 20, 2016 at 7:42 AM, Brian Carrier <ca...@sl...> wrote: >> >> Thanks to the public contributions and the Basis developers for this work. >> > > Thanks to all indeed for the continued work! > > While I know much of the work is predicated on what both analysts and > developers are familiar with, I must confess my trepidation at seeing > yet more Windows-only features creeping in. We've already seen this > happen with Autopsy, to the point that the tools' origin platform is > now a third-class citizen. With that same process now happening to > the core tool, I start to worry that the process will complete and we > who practice the art in, say, non-mainstream environments, will be > left in the cold. > > How, exactly, is the libvmdk and libvhdi (both primarily developed on > Linux) support Windows-only? Their APIs aren't platform-sensitive, so > is there at least a configure-time option to enable their use on other > platforms? > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic > patterns at an interface-level. Reveals which users, apps, and protocols are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Brian C. <ca...@sl...> - 2016-07-21 00:48:34
|
Yes, it will find E02, E03, etc. > On Jul 20, 2016, at 1:17 PM, Edward Diener <eld...@tr...> wrote: > > The doc for tsk_recover specifies for the image(s): > > "The disk or partition image to read, whose format is given with ’-i’. > Multiple image file names can be given if the image is split into > multiple segments. If only one image file is given, and its name is the > first in a sequence (e.g., as indicated by ending in ’.001’), subsequent > image segments will be included automatically. " > > Does this also refer to ewf images whose sequence has endings starting > with .E01, E02, E03 etc. ? In other words if I pass as my image an ewf > image such as 'some_ewf_image.E01' will tsk_recover also process all the > other images in the sequence ? > > The same question goes for all the other TSK tools which take the -i > parameter indicating the image(s) to pass to the tool. > > Eddie Diener > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic > patterns at an interface-level. Reveals which users, apps, and protocols are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Edward D. <eld...@tr...> - 2016-07-20 17:17:31
|
The doc for tsk_recover specifies for the image(s): "The disk or partition image to read, whose format is given with ’-i’. Multiple image file names can be given if the image is split into multiple segments. If only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in ’.001’), subsequent image segments will be included automatically. " Does this also refer to ewf images whose sequence has endings starting with .E01, E02, E03 etc. ? In other words if I pass as my image an ewf image such as 'some_ewf_image.E01' will tsk_recover also process all the other images in the sequence ? The same question goes for all the other TSK tools which take the -i parameter indicating the image(s) to pass to the tool. Eddie Diener |
|
From: Grundy B. J T. <Bar...@ti...> - 2016-07-20 17:03:56
|
> -----Original Message----- > From: RB [mailto:ao...@gm...] > To: Brian Carrier > Cc: sle...@li... users; sleuthkit- > Subject: Re: [sleuthkit-users] TSK 4.3.0 Release > > Thanks to all indeed for the continued work! Agreed. > While I know much of the work is predicated on what both analysts and > developers are familiar with, I must confess my trepidation at seeing yet > more Windows-only features creeping in. We've already seen this happen > with Autopsy, to the point that the tools' origin platform is now a third-class > citizen. With that same process now happening to the core tool, I start to > worry that the process will complete and we who practice the art in, say, > non-mainstream environments, will be left in the cold. <slow_clap.gif> I don't generally use Autopsy, but I have a very real fear of TSK's continued development following in its wake. > How, exactly, is the libvmdk and libvhdi (both primarily developed on > Linux) support Windows-only? Their APIs aren't platform-sensitive, so is > there at least a configure-time option to enable their use on other > platforms? I was just getting ready to test exactly this. My first thought was perhaps Windows *guests* rather than platform support for the library features, but that makes no sense. I'm hoping to test over the coming week as time allows. /******************************************* Barry J. Grundy Assistant Special Agent in Charge Digital Forensic Support Group Treasury Inspector General for Tax Administration (301) 210-8741 (desk) (202) 527-5778 (cell) Bar...@ti... ********************************************\ |
|
From: RB <ao...@gm...> - 2016-07-20 14:20:28
|
On Wed, Jul 20, 2016 at 7:42 AM, Brian Carrier <ca...@sl...> wrote: > > Thanks to the public contributions and the Basis developers for this work. > Thanks to all indeed for the continued work! While I know much of the work is predicated on what both analysts and developers are familiar with, I must confess my trepidation at seeing yet more Windows-only features creeping in. We've already seen this happen with Autopsy, to the point that the tools' origin platform is now a third-class citizen. With that same process now happening to the core tool, I start to worry that the process will complete and we who practice the art in, say, non-mainstream environments, will be left in the cold. How, exactly, is the libvmdk and libvhdi (both primarily developed on Linux) support Windows-only? Their APIs aren't platform-sensitive, so is there at least a configure-time option to enable their use on other platforms? |
|
From: Brian C. <ca...@sl...> - 2016-07-20 13:42:57
|
We’ve finally gotten a new Sleuth Kit release out. The new release, version 4.3.0, has features from the Autopsy release last year (like PostgreSQL support) that never got out and this release marks the start of a new effort to have a TSK release for every Autopsy release (which should be out later today) and we are shooting for releases every 2 months because this current span has been way too long.
4.3.0 adds:
• PostgreSQL support (Windows only)
• Support for virtual machine formats via libvmdk and libvhdi (Windows only)
• Schema updates (data sources table, mime type, attributes store type)
• tsk_img_open can take externally created TSK_IMG_INFO
• New Release_ NoLibs Visual Studio target
• Various bug fixes
I’m doing a test too and the downloads are now coming off of github instead of source forge. Let me know if you have any problems.
http://sleuthkit.org/sleuthkit/download.php
Thanks to the public contributions and the Basis developers for this work.
thanks,
brian
|
|
From: Simson G. <si...@ac...> - 2016-07-20 02:24:56
|
Try changing the “return 1” to a “return 0”. > On Jul 19, 2016, at 3:55 PM, Jon Stewart <JSt...@St...> wrote: > > We've got an evidence file of a Windows Server 2012/NTFS system that's failing to parse with the Sleuthkit. Only a few hundred files are shown on the filesystem. > > We are receiving this error message: > > "fs_attr_add_run: error adding additional run (84481): No filler entry for 0. Final: 1" > > This appears to be from the error-handling block around lines 531-567 of fs_attr.c. > > Any ideas? > > > Jon Stewart > Development Manager > > STROZ FRIEDBERG > 1150 Connecticut Avenue, NW, Suite 700, Washington, DC 20036 > > T: +1 202.534.3290 > M: +1 202.492.4412 > F: +1 202.534.5700 > JSt...@St... www.strozfriedberg.com > > This message and/or its attachments may contain information that is confidential and/or protected by privilege from disclosure. If you have reason to believe you are not the intended recipient, please immediately notify the sender by reply e-mail or by telephone, then delete this message (and any attachments), as well as all copies, including any printed copies. Thank you. > > ------------------------------------------------------------------------------ > What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic > patterns at an interface-level. Reveals which users, apps, and protocols are > consuming the most bandwidth. Provides multi-vendor support for NetFlow, > J-Flow, sFlow and other flows. Make informed decisions using capacity planning > reports.http://sdm.link/zohodev2dev > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Jon S. <JSt...@St...> - 2016-07-19 20:16:10
|
We've got an evidence file of a Windows Server 2012/NTFS system that's failing to parse with the Sleuthkit. Only a few hundred files are shown on the filesystem. We are receiving this error message: "fs_attr_add_run: error adding additional run (84481): No filler entry for 0. Final: 1" This appears to be from the error-handling block around lines 531-567 of fs_attr.c. Any ideas? Jon Stewart Development Manager STROZ FRIEDBERG 1150 Connecticut Avenue, NW, Suite 700, Washington, DC 20036 T: +1 202.534.3290 M: +1 202.492.4412 F: +1 202.534.5700 JSt...@St... www.strozfriedberg.com This message and/or its attachments may contain information that is confidential and/or protected by privilege from disclosure. If you have reason to believe you are not the intended recipient, please immediately notify the sender by reply e-mail or by telephone, then delete this message (and any attachments), as well as all copies, including any printed copies. Thank you. |
|
From: Ted H. <cyb...@gm...> - 2016-07-18 16:21:25
|
Hello, I'm new to Autopsy so perhaps this issue was discussed already. Can someone point me in the right direction?...I processed 750 GB HDD. Of course I ended up with thousands of image files. Autopsy hangs every time I try to view the list even in the table view. I get stuck on "please wait". It there any way around this? (I hope my system is not the issue - Win 7, 24GB RAM, Intel Core i7) my case file is on the same drive as evidence file. thank you, Ted Hiler |
|
From: David N. <dav...@gm...> - 2016-07-18 15:11:55
|
On windows, running Python 2.7 and pytsk3 version 20140506 opening a file entity is slow on the order of 2 – 4 seconds. The fs_info object is for an active drive. We have tried directly opening the entity using fs_info.open and fs_info.open_dir with similar results. Is there a more performant option to opening directories when traversing a directory tree? Are these times abnormal? |
|
From: Edward D. <eld...@tr...> - 2016-07-12 12:27:09
|
<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 7/9/2016 10:47 AM, Kam Woods wrote:<br>
</div>
<blockquote
cite="mid:CAAOjFxDEtW+UfisAW4gb--uPDYuxz=o8s...@ma..."
type="cite">
<div dir="ltr">Yes - I have been using 20140608 for some time with
both 4.2.0 and the TSK GitHub master. Configuring with
--enable-v1-api and compiling on stock Ubuntu 14.04 and 16.04
64-bit boxes. No code changes, compiles clean and everything
seems to work.</div>
</blockquote>
I did not know about an " --enable-v1-api" switch, but this sounds
as if I am compiling with an old version of libewf when using it.
Also the libewf-20140608.tar.gz file has Unix line endings and I am
working on Windows with VC++.<br>
<br>
Eddie Diener<br>
<blockquote
cite="mid:CAAOjFxDEtW+UfisAW4gb--uPDYuxz=o8s...@ma..."
type="cite">
<div dir="ltr">
<div>
<div><br>
</div>
<div>Kam</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Sat, Jul 9, 2016 at 10:08 AM, Brian
Carrier <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:ca...@sl..." target="_blank">ca...@sl...</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Has anyone
tried libewf-20140608.tar.gz to see if it works without TSK
code changes?<br>
<br>
We tried the latest experimental a while back, but ran into
some problems with that and backed off.<br>
<div class="HOEnZb">
<div class="h5"><br>
<br>
> On Jul 9, 2016, at 12:28 AM, Edward Diener <<a
moz-do-not-send="true"
href="mailto:eld...@tr...">eld...@tr...</a>>
wrote:<br>
><br>
> On 7/8/2016 11:56 PM, Brian Carrier wrote:<br>
>> We use the 64-bit version on github, but I have
an email from Joachim a while back saying to go to <a
moz-do-not-send="true"
href="https://github.com/libyal/libewf/wiki"
rel="noreferrer" target="_blank">https://github.com/libyal/libewf/wiki</a>
for the older stable releases, which eventually directs
you to this google drive: <a moz-do-not-send="true"
href="https://53efc0a7187d0baa489ee347026b8278fe4020f6.googledrive.com/host/0B3fBvzttpiiSMTdoaVExWWNsRjg/"
rel="noreferrer" target="_blank">https://53efc0a7187d0baa489ee347026b8278fe4020f6.googledrive.com/host/0B3fBvzttpiiSMTdoaVExWWNsRjg/</a><br>
> None of those versions are compatible with the
latest TSK, whether<br>
> 'develop' or 'master' branch. For the reason why
please see<br>
> <a moz-do-not-send="true"
href="http://forum.sleuthkit.org/viewtopic.php?f=9&t=2740&sid=cc46e2042f4e0696d6e7c22ed2efc90a"
rel="noreferrer" target="_blank">http://forum.sleuthkit.org/viewtopic.php?f=9&t=2740&sid=cc46e2042f4e0696d6e7c22ed2efc90a</a>.<br>
> I have been using the 64-bit version on Sleuthkit's
github configured<br>
> for both 32-bit and 64-bit configurations, but I
believe this may be a<br>
> very old libewf version.<br>
><br>
> Eddie Diener<br>
>><br>
>><br>
>>> On Jun 24, 2016, at 3:31 PM, Edward Diener
<<a moz-do-not-send="true"
href="mailto:eld...@tr...">eld...@tr...</a>>
wrote:<br>
>>><br>
>>> In the instructions for building Sleuthkit
from source on Windows with<br>
>>> the VC++ compiler it says in the
win32/BUILDING.txt file:<br>
>>><br>
>>> "1) Download libewf-20130128 (or later).
The official releases are from:<br>
>>> <a moz-do-not-send="true"
href="http://sourceforge.net/projects/libewf/"
rel="noreferrer" target="_blank">http://sourceforge.net/projects/libewf/</a>"<br>
>>><br>
>>> There is no longer a libewf-20130128
release ( or any other libewf<br>
>>> release ) at Sourceforge and the only
releases offered after that from<br>
>>> the libewf Github site are in Linux line
ending format, come after the<br>
>>> libewf-20130128 release, and are
incompatible with the current Sleuthkit<br>
>>> source, whether 'master' or 'develop'
branch. Furthermore the libewf<br>
>>> Github source is also incompatible with
SleuthKit, as explained at<br>
>>> <a moz-do-not-send="true"
href="http://forum.sleuthkit.org/viewtopic.php?f=9&t=2740"
rel="noreferrer" target="_blank">http://forum.sleuthkit.org/viewtopic.php?f=9&t=2740</a>.<br>
>>><br>
>>> How can I get the libewf-20130128 release
for Windows so I can build<br>
>>> Sleuthkit from source using VC++ ?<br>
>>><br>
>>><br>
>>><br>
>>>
------------------------------------------------------------------------------<br>
>>> Attend Shape: An AT&T Tech Expo July
15-16. Meet us at AT&T Park in San<br>
>>> Francisco, CA to explore cutting-edge tech
and listen to tech luminaries<br>
>>> present their vision of the future. This
family event has something for<br>
>>> everyone, including kids. Get more
information and register today.<br>
>>> <a moz-do-not-send="true"
href="http://sdm.link/attshape" rel="noreferrer"
target="_blank">http://sdm.link/attshape</a><br>
>>>
_______________________________________________<br>
>>> sleuthkit-users mailing list<br>
>>> <a moz-do-not-send="true"
href="https://lists.sourceforge.net/lists/listinfo/sleuthkit-users"
rel="noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/sleuthkit-users</a><br>
>>> <a moz-do-not-send="true"
href="http://www.sleuthkit.org" rel="noreferrer"
target="_blank">http://www.sleuthkit.org</a><br>
><br>
><br>
><br>
>
------------------------------------------------------------------------------<br>
> Attend Shape: An AT&T Tech Expo July 15-16.
Meet us at AT&T Park in San<br>
> Francisco, CA to explore cutting-edge tech and
listen to tech luminaries<br>
> present their vision of the future. This family
event has something for<br>
> everyone, including kids. Get more information and
register today.<br>
> <a moz-do-not-send="true"
href="http://sdm.link/attshape" rel="noreferrer"
target="_blank">http://sdm.link/attshape</a><br>
> _______________________________________________<br>
> sleuthkit-users mailing list<br>
> <a moz-do-not-send="true"
href="https://lists.sourceforge.net/lists/listinfo/sleuthkit-users"
rel="noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/sleuthkit-users</a><br>
> <a moz-do-not-send="true"
href="http://www.sleuthkit.org" rel="noreferrer"
target="_blank">http://www.sleuthkit.org</a><br>
<br>
<br>
------------------------------------------------------------------------------<br>
Attend Shape: An AT&T Tech Expo July 15-16. Meet us
at AT&T Park in San<br>
Francisco, CA to explore cutting-edge tech and listen to
tech luminaries<br>
present their vision of the future. This family event
has something for<br>
everyone, including kids. Get more information and
register today.<br>
<a moz-do-not-send="true"
href="http://sdm.link/attshape" rel="noreferrer"
target="_blank">http://sdm.link/attshape</a><br>
_______________________________________________<br>
sleuthkit-users mailing list<br>
<a moz-do-not-send="true"
href="https://lists.sourceforge.net/lists/listinfo/sleuthkit-users"
rel="noreferrer" target="_blank">https://lists.sourceforge.net/lists/listinfo/sleuthkit-users</a><br>
<a moz-do-not-send="true"
href="http://www.sleuthkit.org" rel="noreferrer"
target="_blank">http://www.sleuthkit.org</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>
|
|
From: Kam W. <kam...@gm...> - 2016-07-09 14:47:18
|
Yes - I have been using 20140608 for some time with both 4.2.0 and the TSK GitHub master. Configuring with --enable-v1-api and compiling on stock Ubuntu 14.04 and 16.04 64-bit boxes. No code changes, compiles clean and everything seems to work. Kam On Sat, Jul 9, 2016 at 10:08 AM, Brian Carrier <ca...@sl...> wrote: > Has anyone tried libewf-20140608.tar.gz to see if it works without TSK > code changes? > > We tried the latest experimental a while back, but ran into some problems > with that and backed off. > > > > On Jul 9, 2016, at 12:28 AM, Edward Diener < > eld...@tr...> wrote: > > > > On 7/8/2016 11:56 PM, Brian Carrier wrote: > >> We use the 64-bit version on github, but I have an email from Joachim a > while back saying to go to https://github.com/libyal/libewf/wiki for the > older stable releases, which eventually directs you to this google drive: > https://53efc0a7187d0baa489ee347026b8278fe4020f6.googledrive.com/host/0B3fBvzttpiiSMTdoaVExWWNsRjg/ > > None of those versions are compatible with the latest TSK, whether > > 'develop' or 'master' branch. For the reason why please see > > > http://forum.sleuthkit.org/viewtopic.php?f=9&t=2740&sid=cc46e2042f4e0696d6e7c22ed2efc90a > . > > I have been using the 64-bit version on Sleuthkit's github configured > > for both 32-bit and 64-bit configurations, but I believe this may be a > > very old libewf version. > > > > Eddie Diener > >> > >> > >>> On Jun 24, 2016, at 3:31 PM, Edward Diener < > eld...@tr...> wrote: > >>> > >>> In the instructions for building Sleuthkit from source on Windows with > >>> the VC++ compiler it says in the win32/BUILDING.txt file: > >>> > >>> "1) Download libewf-20130128 (or later). The official releases are > from: > >>> http://sourceforge.net/projects/libewf/" > >>> > >>> There is no longer a libewf-20130128 release ( or any other libewf > >>> release ) at Sourceforge and the only releases offered after that from > >>> the libewf Github site are in Linux line ending format, come after the > >>> libewf-20130128 release, and are incompatible with the current > Sleuthkit > >>> source, whether 'master' or 'develop' branch. Furthermore the libewf > >>> Github source is also incompatible with SleuthKit, as explained at > >>> http://forum.sleuthkit.org/viewtopic.php?f=9&t=2740. > >>> > >>> How can I get the libewf-20130128 release for Windows so I can build > >>> Sleuthkit from source using VC++ ? > >>> > >>> > >>> > >>> > ------------------------------------------------------------------------------ > >>> Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San > >>> Francisco, CA to explore cutting-edge tech and listen to tech > luminaries > >>> present their vision of the future. This family event has something for > >>> everyone, including kids. Get more information and register today. > >>> http://sdm.link/attshape > >>> _______________________________________________ > >>> sleuthkit-users mailing list > >>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > >>> http://www.sleuthkit.org > > > > > > > > > ------------------------------------------------------------------------------ > > Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San > > Francisco, CA to explore cutting-edge tech and listen to tech luminaries > > present their vision of the future. This family event has something for > > everyone, including kids. Get more information and register today. > > http://sdm.link/attshape > > _______________________________________________ > > sleuthkit-users mailing list > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > > http://www.sleuthkit.org > > > > ------------------------------------------------------------------------------ > Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San > Francisco, CA to explore cutting-edge tech and listen to tech luminaries > present their vision of the future. This family event has something for > everyone, including kids. Get more information and register today. > http://sdm.link/attshape > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > |
38 messages has been excluded from this view by a project administrator.
