sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] Autopsy: The image format type could not be determined for this image file

[John L. <jl...@sl...>]

> Why are you using TSK 2.05 with AFF 1.6.26? It was released with 1.6.28. =
 Are the images from DFTT?

I was following some instructions you posted for Cygwin... I thought that =
it might be version dependent.  I have since recompiled with v. 1.6.31 =
with the same results.

> Are the images from DFTT?

Yes, from http://dftt.sourceforge.net/.  I also tried Barry Grundy's =
practical.floppy.dd image from ftp://ftp.hq.nasa.gov/pub/ig/ccd/linuxintro/=
 and received the same error message (I'm looking to start out with TSK =
using some known images).

> Make sure you have the correct "volume" image versus "disk" image.

I know the difference, but tried both anyway: same error message.

Re: [sleuthkit-users] Autopsy over SSL?

[Brooks, P. <pre...@tw...>]

I started it, that was the "internal documentation" I alluded to =
earlier.  I still have the basic concept in my head and can (and =
probably should) take the time to document it in detail for everyone's =
usage.  I am adding it to my todo now ;)

That, however, is not as complex as what I am currently working to have =
done.  We have a home grown IR database built using HTML Mason and =
Postgresql to track our incident documentation and provide a single =
interface to our investigative tools.  I started working and have now =
delegated to my developer the task of managing most of the case creation =
process through Mason.  My goal is to actually bypass everything up =
through the selection of Investigator and have the system select that =
based on the authentication that has already occurred.  Then, I can =
remove access to the file system and create automated mechanisms for =
image acquisition and have a strong authentication mechanism wrapped =
around autopsy.


-----Original Message-----
From: sle...@li... on behalf of Angus =
Marshall
Sent: Mon 8/21/2006 6:09 PM
To: sle...@li...
Subject: Re: [sleuthkit-users] Autopsy over SSL?
=20
Not adding anything to the debate - but isn't it wonderful that, in the =
space of
a couple of hours, we've come up with 4 ways to do this - meanwhile, I =
know of
someone who is struggling to do the same thing using a very popular =
commercial
tool on a dominant proprietary O/S.

I love the smell of open source in the morning ;-)

I think it would help us if the original poster could give us a bigger =
clue about
what they're trying to achieve...

My personal preference is for a ssh type solution since it adds an =
auditable
authentication step - aiding continuity, but I can see situations where =
the
apache proxy could be useful too. The ssh + VNC solution is nice as it =
solves the
interrupted session problem and would allow the investigator to launch a =
lengthy
process (e.g. string search, file sorting) and leave the machine in a =
secure
state while it processes.

The "farm" of ssh + apache sounds like a horrendously complex case to =
have worked
on! Have you written the method up for publication anywhere ?

-------------------------------------------------------------------------=

Using Tomcat but need to do more? Need to support web services, =
security?
Get stuff done quickly with pre-integrated technology to make your job =
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache =
Geronimo
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D=
121642
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy over SSL?

[Angus M. <an...@n-...>]

Not adding anything to the debate - but isn't it wonderful that, in the space of
a couple of hours, we've come up with 4 ways to do this - meanwhile, I know of
someone who is struggling to do the same thing using a very popular commercial
tool on a dominant proprietary O/S.

I love the smell of open source in the morning ;-)

I think it would help us if the original poster could give us a bigger clue about
what they're trying to achieve...

My personal preference is for a ssh type solution since it adds an auditable
authentication step - aiding continuity, but I can see situations where the
apache proxy could be useful too. The ssh + VNC solution is nice as it solves the
interrupted session problem and would allow the investigator to launch a lengthy
process (e.g. string search, file sorting) and leave the machine in a secure
state while it processes.

The "farm" of ssh + apache sounds like a horrendously complex case to have worked
on! Have you written the method up for publication anywhere ?

Re: [sleuthkit-users] Autopsy over SSL?

[james <ja...@ne...>]

I would recommend tunneling vnc through ssh and then running autopsy on the
vnc desktop.

If the ssh connection is interrupted or shutdown, the autopsy process will
continue to run on the vnc desktop.  

2sense 

-----Original Message-----
From: Angus Marshall [mailto:an...@n-...] 
Sent: Monday, August 21, 2006 5:16 PM
To: sle...@li...
Subject: Re: [sleuthkit-users] Autopsy over SSL?

A little idea for everyone - how about running it using SSH rather than
HTTPS ? 

I've just tried 

               ssh -L 1234:127.0.0.1:9999 amarshall@myhost 

to log in to one of my workstations and launch autopsy

and then aimed a browser on the remote workstation to
http://localhost:1234/autopsy

it works - my autopsy session on "myhost" is visible to the remote machine
and
totally dependent on the ssh tunnel existing between the two hosts. 

This gives a transient session, requiring an authentication process from the
remote end.


On Mon Aug 21 21:01 , 'Brooks, Prentis' <pre...@tw...> sent:

>Here is a sample from the apache 2.2 documentation that I have modified to
reflect how I did this before.  These commands have not changed since 2.0,
so
this will work.
>
>ProxyRequests Off
>
># This is to control access, I highly recommend configuring apache to
require
some level of authentication before 
># proxying the connections.
>
>Order deny,allow
>Allow from all
>
>
>ProxyPass /autopsy http://127.0.0.1/autopsy
>ProxyPassReverse /autopsy http://127.0.0.1/autopsy
>
> 
>


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy over SSL?

[Brooks, P. <pre...@tw...>]

Yes, that works as well, but requires that all users of autopsy have =
shell access to the system.  The apache solution provides a mechanism by =
which you can provide a means for users who may not be as proficient =
with ssh and other unix based commands.

I have actually used a combination of those mechanisms to create a =
distributed forensic environment.  We had situations where a single case =
spanned several systems and we wanted a single interface into each.  By =
setting up ssh tunnels to the autopsy daemons running on each forensic =
host, we were able to use different proxy paths on the apache server to =
allow us to easily step from one system to the other.  This also made it =
easier for several investigators to work at the same time and provided =
for a strong authentication mechanism to boot.


-----Original Message-----
From: sle...@li... on behalf of Angus =
Marshall
Sent: Mon 8/21/2006 5:16 PM
To: sle...@li...
Subject: Re: [sleuthkit-users] Autopsy over SSL?
=20
A little idea for everyone - how about running it using SSH rather than =
HTTPS ?=20

I've just tried=20

               ssh -L 1234:127.0.0.1:9999 amarshall@myhost=20

to log in to one of my workstations and launch autopsy

and then aimed a browser on the remote workstation to =
http://localhost:1234/autopsy

it works - my autopsy session on "myhost" is visible to the remote =
machine and
totally dependent on the ssh tunnel existing between the two hosts.=20

This gives a transient session, requiring an authentication process from =
the
remote end.


On Mon Aug 21 21:01 , 'Brooks, Prentis' <pre...@tw...> =
sent:

>Here is a sample from the apache 2.2 documentation that I have modified =
to
reflect how I did this before.  These commands have not changed since =
2.0, so
this will work.
>
>ProxyRequests Off
>
># This is to control access, I highly recommend configuring apache to =
require
some level of authentication before=20
># proxying the connections.
>
>Order deny,allow
>Allow from all
>
>
>ProxyPass /autopsy http://127.0.0.1/autopsy
>ProxyPassReverse /autopsy http://127.0.0.1/autopsy
>
>=20
>


-------------------------------------------------------------------------=

Using Tomcat but need to do more? Need to support web services, =
security?
Get stuff done quickly with pre-integrated technology to make your job =
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache =
Geronimo
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D=
121642
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy over SSL?

[Angus M. <an...@n-...>]

A little idea for everyone - how about running it using SSH rather than HTTPS ? 

I've just tried 

               ssh -L 1234:127.0.0.1:9999 amarshall@myhost 

to log in to one of my workstations and launch autopsy

and then aimed a browser on the remote workstation to http://localhost:1234/autopsy

it works - my autopsy session on "myhost" is visible to the remote machine and
totally dependent on the ssh tunnel existing between the two hosts. 

This gives a transient session, requiring an authentication process from the
remote end.


On Mon Aug 21 21:01 , 'Brooks, Prentis' <pre...@tw...> sent:

>Here is a sample from the apache 2.2 documentation that I have modified to
reflect how I did this before.  These commands have not changed since 2.0, so
this will work.
>
>ProxyRequests Off
>
># This is to control access, I highly recommend configuring apache to require
some level of authentication before 
># proxying the connections.
>
>Order deny,allow
>Allow from all
>
>
>ProxyPass /autopsy http://127.0.0.1/autopsy
>ProxyPassReverse /autopsy http://127.0.0.1/autopsy
>
> 
>

Re: [sleuthkit-users] Autopsy over SSL?

[Brooks, P. <pre...@tw...>]

Here is a sample from the apache 2.2 documentation that I have modified =
to reflect how I did this before.  These commands have not changed since =
2.0, so this will work.

ProxyRequests Off

# This is to control access, I highly recommend configuring apache to =
require some level of authentication before=20
# proxying the connections.
<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ProxyPass /autopsy http://127.0.0.1/autopsy
ProxyPassReverse /autopsy http://127.0.0.1/autopsy

=20




-----Original Message-----
From: sle...@li... on behalf of Angus =
Marshall
Sent: Mon 8/21/2006 3:56 PM
To: sle...@li...
Subject: Re: [sleuthkit-users] Autopsy over SSL?
=20
Installing apache as a server won't help you - Autopsy is a server in =
its own
right and doesn't speak HTTPS itself.

OTOH - you could probably use Apache's proxy pass through functionality =
to enable
it to act as a HTTPS proxy to the Autopsy process. That would take a =
little bit
of hacking around in the config file, but should be possible. If you can =
wait a
couple of days, I'll see if I can find time to try it out.



On Mon Aug 21 20:47 , 'Sorrelle Michael W Ctr AFOSI/DOZI'
<mic...@og...> sent:

>
>
>
>
>
>I need to be able to=20
>use Autopsy over a secure encrypted connection between the client=20
>machine (where the browser is running) and the server (where autopsy is =

>running).  I'm assuming I will need Apache installed on the server, in=20
>order to use SSL over port 443 (and then change the port number on the =
autopsy=20
>command line).  But before I proceed on that assumption, I wanted to =
check=20
>if there were other options, and if so, what those might be.
>I've searched the=20
>Informer archives, and Googled this, but didn't find anything=20
>applicable.
>=20
>I know the image=20
>file could be transferred securely from server to client, and then =
simply run=20
>Autopsy locally (thereby avoiding the issue), but that doesn't meet the =

>requirements of the situation.
>=20
>Thanks,
>- -
>Mike=20
>Sorrelle
>Sr. Software=20
>Engineer
>FPMI Solutions,=20
>Inc.


-------------------------------------------------------------------------=

Using Tomcat but need to do more? Need to support web services, =
security?
Get stuff done quickly with pre-integrated technology to make your job =
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache =
Geronimo
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D=
121642
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy over SSL?

[Angus M. <an...@n-...>]

Installing apache as a server won't help you - Autopsy is a server in its own
right and doesn't speak HTTPS itself.

OTOH - you could probably use Apache's proxy pass through functionality to enable
it to act as a HTTPS proxy to the Autopsy process. That would take a little bit
of hacking around in the config file, but should be possible. If you can wait a
couple of days, I'll see if I can find time to try it out.



On Mon Aug 21 20:47 , 'Sorrelle Michael W Ctr AFOSI/DOZI'
<mic...@og...> sent:

>
>
>
>
>
>I need to be able to 
>use Autopsy over a secure encrypted connection between the client 
>machine (where the browser is running) and the server (where autopsy is 
>running).  I'm assuming I will need Apache installed on the server, in 
>order to use SSL over port 443 (and then change the port number on the autopsy 
>command line).  But before I proceed on that assumption, I wanted to check 
>if there were other options, and if so, what those might be.
>I've searched the 
>Informer archives, and Googled this, but didn't find anything 
>applicable.
> 
>I know the image 
>file could be transferred securely from server to client, and then simply run 
>Autopsy locally (thereby avoiding the issue), but that doesn't meet the 
>requirements of the situation.
> 
>Thanks,
>- -
>Mike 
>Sorrelle
>Sr. Software 
>Engineer
>FPMI Solutions, 
>Inc.

Re: [sleuthkit-users] Autopsy over SSL?

[Brooks, P. <pre...@tw...>]

I have done this, in fact, I basically setup apache as a reverse proxy =
server and used digital certificate authentication to provide another =
layer of protection before reaching the autopsy server. =20

I have switched companies, so I don't have the mini-howto that I wrote =
for internal use at that time.  I could put it together again, but it =
essentially just discusses how to configure apache for digital =
certificate authentication and as a reverse proxy back to localhost.



-----Original Message-----
From: sle...@li... on behalf of =
Sorrelle Michael W Ctr AFOSI/DOZI
Sent: Mon 8/21/2006 3:47 PM
To: sle...@li...
Subject: [sleuthkit-users] Autopsy over SSL?
=20
I need to be able to use Autopsy over a secure encrypted connection =
between the client machine (where the browser is running) and the server =
(where autopsy is running).  I'm assuming I will need Apache installed =
on the server, in order to use SSL over port 443 (and then change the =
port number on the autopsy command line).  But before I proceed on that =
assumption, I wanted to check if there were other options, and if so, =
what those might be.
I've searched the Informer archives, and Googled this, but didn't find =
anything applicable.
=20
I know the image file could be transferred securely from server to =
client, and then simply run Autopsy locally (thereby avoiding the =
issue), but that doesn't meet the requirements of the situation.
=20
Thanks,
- -
Mike Sorrelle
Sr. Software Engineer
FPMI Solutions, Inc.

[sleuthkit-users] Autopsy over SSL?

[Sorrelle M. W C. AFOSI/D. <mic...@og...>]

I need to be able to use Autopsy over a secure encrypted connection
between the client machine (where the browser is running) and the server
(where autopsy is running).  I'm assuming I will need Apache installed
on the server, in order to use SSL over port 443 (and then change the
port number on the autopsy command line).  But before I proceed on that
assumption, I wanted to check if there were other options, and if so,
what those might be.
I've searched the Informer archives, and Googled this, but didn't find
anything applicable.
=20
I know the image file could be transferred securely from server to
client, and then simply run Autopsy locally (thereby avoiding the
issue), but that doesn't meet the requirements of the situation.
=20
Thanks,
- -
Mike Sorrelle
Sr. Software Engineer
FPMI Solutions, Inc.

Re: [sleuthkit-users] fls reporting existing files in NTFS asdeleted

[Svein Y. W. <sv...@wi...>]

> Should I modify ntfs_dent_copy() to copy the time stamps from the
> ntfs_attr_fname ?   It seems this could have unwanted side effects, since
> other parts of the program may depend on the current implementation of
> this
> function.

Just a followup on this:  I just did what I suggested here and the observed
results are: 

- For existing files, time stamps in the $FILE_NAME attribute of the index
match those in the $STANDARD_INFORMATION attribute in the MFT entry.

- For deleted file pointers in the index, time stamps in the $FILE_NAME
attribute _do not necessarily_ match the time stamps in the MFT entry.
Obviously, when the file pointers are not a part of the file system anymore,
it's time stamps will not be updated.

These are the results I expected, and what I was looking for.

Svein Willassen
--
Researcer, Dept. of Telematics,
Norwegian University of Science and Technology

Re: [sleuthkit-users] fls reporting existing files in NTFS as deleted

[Svein Y. W. <sv...@wi...>]

Thanks Brian!

I've done some homework now... ;)

What I'm actually interested in is the time stamps of each file entry. I've
made some slight changes to ntfs.c so I get the 64-bit FILETIME value as
output from 'istat' an not the time_t value through ctime().  This way I get
the time stamps from the $STANDARD_INFORMATION and $FILE_NAME attributes in
the MFT entry. But how do I get the time stamps from the $FILE_NAME
attribute in the directory? 'fls -l' (or 'fls -m') gives time stamps
(although for NTFS, the creation time is missing), but in ntfs_dent_copy()
(in ntfs_dent.c) it seems these are taken from the MFT entry as well. 

Should I modify ntfs_dent_copy() to copy the time stamps from the
ntfs_attr_fname ?   It seems this could have unwanted side effects, since
other parts of the program may depend on the current implementation of this
function.

Regards,

Svein 


> -----Original Message-----
> From: Brian Carrier [mailto:ca...@sl...]
> Sent: 15. august 2006 05:28
> To: Svein Yngvar Willassen
> Cc: sle...@li...
> Subject: Re: [sleuthkit-users] fls reporting existing files in NTFS as
> deleted
> 
> This is because of the way that NTFS file names are stored.  They are
> stored in a sorted fashion in a B-tree and when files are deleted and
> created, the tree moves around.  So, files move to different nodes so
> that they stay in a sorted order and the file names can be found in
> the unallocated space of directories.  Autopsy uses the fls flags so
> that only allocated NTFS files are shown and then it uses 'ifind -p'
> to find the unallocated names that are part of that directory.
> 
> brian
> 
> 
> On Aug 14, 2006, at 1:48 PM, Svein Yngvar Willassen wrote:
> 
> > Hello everyone,
> >
> > I'm experiencing an issue with running fls on an NTFS file system. It
> > reports many of the existing files as reallocated, even though they
> > are not
> > deleted, and can be viewed in Windows. See example below.  This is
> > on a
> > dual-boot machine where I run fls from TSK 2.05 on a Fedora Core 5
> > installation against the Win XP installation on another disk on the
> > same
> > machine.
> >
> > I want to investigate this further, but I just wanted to check if
> > this is a
> > known issue, or perhaps I'm missing something out completely?
> >
> > --
> > Svein Willassen
> > Researcher, Norwegian Institute of Science and Technology
> >
> >
> > Excerpt from fls output:
> >
> > r/r 4-128-4:	$AttrDef
> > r/r 8-128-2:	$BadClus
> > r/r 8-128-1:	$BadClus:$Bad
> > r/r 6-128-1:	$Bitmap
> > r/r 7-128-1:	$Boot
> > d/d 11-144-4:	$Extend
> > r/r 2-128-1:	$LogFile
> > r/r 0-128-1:	$MFT
> > r/r 1-128-1:	$MFTMirr
> > r/r 9-144-17:	$Secure:$SDH
> > r/r 9-144-16:	$Secure:$SII
> > r/r 9-128-0:	$Secure:$SDS
> > r/r 10-128-1:	$UpCase
> > d/d 67623-144-1:	$VAULT$.AVG
> > r/r 3-128-3:	$Volume
> > r/r 120570-128-4:	%backup%~
> > d/d 120527-144-1:	.emacs.d
> > r/r 44644-128-4:	ADMINPAK-README.TXT
> > d/d 130722-144-1:	artikkeltest
> > r/r 6950-128-1:	AUTOEXEC.BAT
> > r/r 44646-128-0:	B3-web-version-adminpak.msi
> > r/r * 87596-128-1(realloc):	ErrorLog.txt
> > d/d * 44474-144-6(realloc):	etc
> > r/r * 88890-128-3(realloc):	faq.htm
> > r/r * 71520-128-3(realloc):	faq.zip
> > r/r * 65787-128-3(realloc):	gustav.pdf
> > r/r * 87463-128-3(realloc):	index2.php
> > r/r * 87515-128-3(realloc):	index3.php
> > r/r * 54974-128-4(realloc):	insideout.zip
> > r/r * 6951-128-1(realloc):	IO.SYS
> > d/d * 118408-144-1(realloc):	localtexmf
> > r/r 69116-128-3:	makeinst.c
> > r/r 61369-128-3:	makeinst.c~
> > r/r 69140-128-3:	makekey.c
> > r/r 58203-128-3:	makekey.c~
> > r/r 14294-128-3:	MPMSetup.log
> >
> >
> > The same file system as seen from XP:
> >
> > C:\>dir
> >  Volumet i stasjon C er uten navn.
> >  Volumserienummeret er 9095-66B8
> >
> >  Innhold i C:\
> >
> > 11.10.2005  16:08             7 809 %backup%~
> > 04.04.2005  20:16    <DIR>          .emacs.d
> > 20.06.2005  11:12    <DIR>          artikkeltest
> > 09.09.2004  21:56                 0 AUTOEXEC.BAT
> > 16.03.2006  10:16            18 581 buy.zip
> > 16.03.2006  10:34             1 677 callback.php
> > 03.08.2005  22:05         1 073 152 CCS.exe
> > 09.09.2004  21:56                 0 CONFIG.SYS
> > 23.03.2006  14:47            13 439 Country.xls
> > 17.06.2005  14:26    <DIR>          dest
> > 30.10.2005  20:40    <DIR>          Documents and Settings
> > 20.06.2005  12:56    <DIR>          empty
> > 17.04.2005  20:47    <DIR>          emulator_configurations
> > 29.03.2005  15:53               364 ErrorLog.txt   <---
> > 28.12.2004  22:15    <DIR>          etc            <---
> > 02.04.2005  19:26             4 406 faq.htm        <---
> > 25.02.2005  23:12           167 864 faq.zip        <---
> > 20.06.2005  13:16    <DIR>          filer
> > 20.06.2005  12:42               992 filer.tgz
> > 17.08.2005  21:27    <DIR>          fotoknudsen
> > 10.04.2005  20:26           231 921 gustav.pdf     <---
> > 06.11.2002  14:51         1 505 792 heltsikkert.ppt
> > 24.08.2005  19:06        14 293 063 HomeGallery.zip
> > 08.05.2005  22:16    <DIR>          img
> > 01.08.2005  13:18             2 981 index.htm.htm
> > 29.03.2005  15:29             2 305 index2.php     <---
> > 29.03.2005  15:29             2 632 index3.php     <---
> > 15.08.2005  15:14    <DIR>          insideout
> > 10.11.2004  22:00            22 503 insideout.zip  <---
> > 16.08.2005  11:59             4 125 iobott.gif
> > 26.07.2005  12:50             2 039 kannel.conf
> > 26.07.2005  12:43             1 935 kannel.conf~
> >
> >
> > ----------------------------------------------------------------------
> > ---
> > Using Tomcat but need to do more? Need to support web services,
> > security?
> > Get stuff done quickly with pre-integrated technology to make your
> > job easier
> > Download IBM WebSphere Application Server v.1.0.1 based on Apache
> > Geronimo
> > http://sel.as-us.falkag.net/sel?
> > cmd=lnk&kid=120709&bid=263057&dat=121642
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> 

Re: [sleuthkit-users] Installing Sleuthkit on Solaris 10

[Brian C. <ca...@sl...>]

What errors did you get?

You may need to install GNU make (gmake), zlib, and the OpenSSL  
libraries.  Recent additions to TSK have required these additional  
libraries.

brian


On Aug 11, 2006, at 5:04 PM, je...@ru... wrote:

> I saw on www.sleuthkit.org that you could install sleuthkit on a  
> solaris OS.  I downloaded the v10 from SUN and tried to install it  
> but the MAKE command gives several errors.  Has anyone successfully  
> installed Sleuthkit and Autopsy onto a solaris box?  If you can  
> point me in the right direction for instructions, I would  
> appreciate it.
>
> Jeff
> ---------------------------------------------------------------------- 
> ---
> Using Tomcat but need to do more? Need to support web services,  
> security?
> Get stuff done quickly with pre-integrated technology to make your  
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache  
> Geronimo
> http://sel.as-us.falkag.net/sel? 
> cmd=lnk&kid=120709&bid=263057&dat=121642______________________________ 
> _________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] fls reporting existing files in NTFS as deleted

[Brian C. <ca...@sl...>]

This is because of the way that NTFS file names are stored.  They are  
stored in a sorted fashion in a B-tree and when files are deleted and  
created, the tree moves around.  So, files move to different nodes so  
that they stay in a sorted order and the file names can be found in  
the unallocated space of directories.  Autopsy uses the fls flags so  
that only allocated NTFS files are shown and then it uses 'ifind -p'  
to find the unallocated names that are part of that directory.

brian


On Aug 14, 2006, at 1:48 PM, Svein Yngvar Willassen wrote:

> Hello everyone,
>
> I'm experiencing an issue with running fls on an NTFS file system. It
> reports many of the existing files as reallocated, even though they  
> are not
> deleted, and can be viewed in Windows. See example below.  This is  
> on a
> dual-boot machine where I run fls from TSK 2.05 on a Fedora Core 5
> installation against the Win XP installation on another disk on the  
> same
> machine.
>
> I want to investigate this further, but I just wanted to check if  
> this is a
> known issue, or perhaps I'm missing something out completely?
>
> --
> Svein Willassen
> Researcher, Norwegian Institute of Science and Technology
>
>
> Excerpt from fls output:
>
> r/r 4-128-4:	$AttrDef
> r/r 8-128-2:	$BadClus
> r/r 8-128-1:	$BadClus:$Bad
> r/r 6-128-1:	$Bitmap
> r/r 7-128-1:	$Boot
> d/d 11-144-4:	$Extend
> r/r 2-128-1:	$LogFile
> r/r 0-128-1:	$MFT
> r/r 1-128-1:	$MFTMirr
> r/r 9-144-17:	$Secure:$SDH
> r/r 9-144-16:	$Secure:$SII
> r/r 9-128-0:	$Secure:$SDS
> r/r 10-128-1:	$UpCase
> d/d 67623-144-1:	$VAULT$.AVG
> r/r 3-128-3:	$Volume
> r/r 120570-128-4:	%backup%~
> d/d 120527-144-1:	.emacs.d
> r/r 44644-128-4:	ADMINPAK-README.TXT
> d/d 130722-144-1:	artikkeltest
> r/r 6950-128-1:	AUTOEXEC.BAT
> r/r 44646-128-0:	B3-web-version-adminpak.msi
> r/r * 87596-128-1(realloc):	ErrorLog.txt
> d/d * 44474-144-6(realloc):	etc
> r/r * 88890-128-3(realloc):	faq.htm
> r/r * 71520-128-3(realloc):	faq.zip
> r/r * 65787-128-3(realloc):	gustav.pdf
> r/r * 87463-128-3(realloc):	index2.php
> r/r * 87515-128-3(realloc):	index3.php
> r/r * 54974-128-4(realloc):	insideout.zip
> r/r * 6951-128-1(realloc):	IO.SYS
> d/d * 118408-144-1(realloc):	localtexmf
> r/r 69116-128-3:	makeinst.c
> r/r 61369-128-3:	makeinst.c~
> r/r 69140-128-3:	makekey.c
> r/r 58203-128-3:	makekey.c~
> r/r 14294-128-3:	MPMSetup.log
>
>
> The same file system as seen from XP:
>
> C:\>dir
>  Volumet i stasjon C er uten navn.
>  Volumserienummeret er 9095-66B8
>
>  Innhold i C:\
>
> 11.10.2005  16:08             7 809 %backup%~
> 04.04.2005  20:16    <DIR>          .emacs.d
> 20.06.2005  11:12    <DIR>          artikkeltest
> 09.09.2004  21:56                 0 AUTOEXEC.BAT
> 16.03.2006  10:16            18 581 buy.zip
> 16.03.2006  10:34             1 677 callback.php
> 03.08.2005  22:05         1 073 152 CCS.exe
> 09.09.2004  21:56                 0 CONFIG.SYS
> 23.03.2006  14:47            13 439 Country.xls
> 17.06.2005  14:26    <DIR>          dest
> 30.10.2005  20:40    <DIR>          Documents and Settings
> 20.06.2005  12:56    <DIR>          empty
> 17.04.2005  20:47    <DIR>          emulator_configurations
> 29.03.2005  15:53               364 ErrorLog.txt   <---
> 28.12.2004  22:15    <DIR>          etc            <---
> 02.04.2005  19:26             4 406 faq.htm        <---
> 25.02.2005  23:12           167 864 faq.zip        <---
> 20.06.2005  13:16    <DIR>          filer
> 20.06.2005  12:42               992 filer.tgz
> 17.08.2005  21:27    <DIR>          fotoknudsen
> 10.04.2005  20:26           231 921 gustav.pdf     <---
> 06.11.2002  14:51         1 505 792 heltsikkert.ppt
> 24.08.2005  19:06        14 293 063 HomeGallery.zip
> 08.05.2005  22:16    <DIR>          img
> 01.08.2005  13:18             2 981 index.htm.htm
> 29.03.2005  15:29             2 305 index2.php     <---
> 29.03.2005  15:29             2 632 index3.php     <---
> 15.08.2005  15:14    <DIR>          insideout
> 10.11.2004  22:00            22 503 insideout.zip  <---
> 16.08.2005  11:59             4 125 iobott.gif
> 26.07.2005  12:50             2 039 kannel.conf
> 26.07.2005  12:43             1 935 kannel.conf~
>
>
> ---------------------------------------------------------------------- 
> ---
> Using Tomcat but need to do more? Need to support web services,  
> security?
> Get stuff done quickly with pre-integrated technology to make your  
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache  
> Geronimo
> http://sel.as-us.falkag.net/sel? 
> cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy: The image format type could not be determined for this image file

[Brian C. <ca...@sl...>]

Why are you using TSK 2.05 with AFF 1.6.26? It was released with  
1.6.28.  Are the images from DFTT?  Make sure you have the correct  
"volume" image versus "disk" image.

brian



On Aug 13, 2006, at 1:52 AM, John Lehr wrote:

> I sucessfully compiled sleuthkit-2.05 and autopsy-2.07 in cygwin using
> afflib 1.6.26.  When I try to open a raw disk image (FTT:
> ext-part-test-2.dd) I get the following error:
>
> The image format type could not be determined for this image file
>
> The md5 for the image is good, and I get the same error with a  
> partition
> image from FTT as well.  Any ideas?
>
> John
>
> ---------------------------------------------------------------------- 
> ---
> Using Tomcat but need to do more? Need to support web services,  
> security?
> Get stuff done quickly with pre-integrated technology to make your  
> job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache  
> Geronimo
> http://sel.as-us.falkag.net/sel? 
> cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] fls reporting existing files in NTFS as deleted

[Svein Y. W. <sv...@wi...>]

Hello everyone,

I'm experiencing an issue with running fls on an NTFS file system. It
reports many of the existing files as reallocated, even though they are =
not
deleted, and can be viewed in Windows. See example below.  This is on a
dual-boot machine where I run fls from TSK 2.05 on a Fedora Core 5
installation against the Win XP installation on another disk on the same
machine.

I want to investigate this further, but I just wanted to check if this =
is a
known issue, or perhaps I'm missing something out completely?

--
Svein Willassen
Researcher, Norwegian Institute of Science and Technology


Excerpt from fls output:

r/r 4-128-4:	$AttrDef
r/r 8-128-2:	$BadClus
r/r 8-128-1:	$BadClus:$Bad
r/r 6-128-1:	$Bitmap
r/r 7-128-1:	$Boot
d/d 11-144-4:	$Extend
r/r 2-128-1:	$LogFile
r/r 0-128-1:	$MFT
r/r 1-128-1:	$MFTMirr
r/r 9-144-17:	$Secure:$SDH
r/r 9-144-16:	$Secure:$SII
r/r 9-128-0:	$Secure:$SDS
r/r 10-128-1:	$UpCase
d/d 67623-144-1:	$VAULT$.AVG
r/r 3-128-3:	$Volume
r/r 120570-128-4:	%backup%~
d/d 120527-144-1:	.emacs.d
r/r 44644-128-4:	ADMINPAK-README.TXT
d/d 130722-144-1:	artikkeltest
r/r 6950-128-1:	AUTOEXEC.BAT
r/r 44646-128-0:	B3-web-version-adminpak.msi
r/r * 87596-128-1(realloc):	ErrorLog.txt
d/d * 44474-144-6(realloc):	etc
r/r * 88890-128-3(realloc):	faq.htm
r/r * 71520-128-3(realloc):	faq.zip
r/r * 65787-128-3(realloc):	gustav.pdf
r/r * 87463-128-3(realloc):	index2.php
r/r * 87515-128-3(realloc):	index3.php
r/r * 54974-128-4(realloc):	insideout.zip
r/r * 6951-128-1(realloc):	IO.SYS
d/d * 118408-144-1(realloc):	localtexmf
r/r 69116-128-3:	makeinst.c
r/r 61369-128-3:	makeinst.c~
r/r 69140-128-3:	makekey.c
r/r 58203-128-3:	makekey.c~
r/r 14294-128-3:	MPMSetup.log


The same file system as seen from XP:

C:\>dir
 Volumet i stasjon C er uten navn.
 Volumserienummeret er 9095-66B8

 Innhold i C:\

11.10.2005  16:08             7=A0809 %backup%~
04.04.2005  20:16    <DIR>          .emacs.d
20.06.2005  11:12    <DIR>          artikkeltest
09.09.2004  21:56                 0 AUTOEXEC.BAT
16.03.2006  10:16            18=A0581 buy.zip
16.03.2006  10:34             1=A0677 callback.php
03.08.2005  22:05         1=A0073=A0152 CCS.exe
09.09.2004  21:56                 0 CONFIG.SYS
23.03.2006  14:47            13=A0439 Country.xls
17.06.2005  14:26    <DIR>          dest
30.10.2005  20:40    <DIR>          Documents and Settings
20.06.2005  12:56    <DIR>          empty
17.04.2005  20:47    <DIR>          emulator_configurations
29.03.2005  15:53               364 ErrorLog.txt   <---
28.12.2004  22:15    <DIR>          etc            <---
02.04.2005  19:26             4=A0406 faq.htm        <---
25.02.2005  23:12           167=A0864 faq.zip        <---
20.06.2005  13:16    <DIR>          filer
20.06.2005  12:42               992 filer.tgz
17.08.2005  21:27    <DIR>          fotoknudsen
10.04.2005  20:26           231=A0921 gustav.pdf     <---
06.11.2002  14:51         1=A0505=A0792 heltsikkert.ppt
24.08.2005  19:06        14=A0293=A0063 HomeGallery.zip
08.05.2005  22:16    <DIR>          img
01.08.2005  13:18             2=A0981 index.htm.htm
29.03.2005  15:29             2=A0305 index2.php     <---
29.03.2005  15:29             2=A0632 index3.php     <---
15.08.2005  15:14    <DIR>          insideout
10.11.2004  22:00            22=A0503 insideout.zip  <---
16.08.2005  11:59             4=A0125 iobott.gif
26.07.2005  12:50             2=A0039 kannel.conf
26.07.2005  12:43             1=A0935 kannel.conf~

[sleuthkit-users] Autopsy: The image format type could not be determined for this image file

[John L. <jl...@sl...>]

I sucessfully compiled sleuthkit-2.05 and autopsy-2.07 in cygwin using
afflib 1.6.26.  When I try to open a raw disk image (FTT:
ext-part-test-2.dd) I get the following error: 

The image format type could not be determined for this image file

The md5 for the image is good, and I get the same error with a partition
image from FTT as well.  Any ideas?

John

[sleuthkit-users] Installing Sleuthkit on Solaris 10

[<je...@ru...>]

<div>I saw on&nbsp;<A
href="http://www.sleuthkit.org">www.sleuthkit.org</A> that you could
install sleuthkit on a solaris OS.&nbsp; I downloaded the v10 from SUN
and tried to install it but the MAKE command gives several
errors.&nbsp; Has anyone successfully installed Sleuthkit and Autopsy
onto a solaris box?&nbsp; If you can point me in the right direction
for instructions, I would appreciate it.</div>
<div>&nbsp;</div>
<div>Jeff</div>

Re: [sleuthkit-users] Strange files found by "fsd"

[Brian C. <ca...@sl...>]

I'm assuming you mean "fls" and not "fsd"?

fls checks the inode value though and won't print the name if the inode 
is larger than the max inode, so I'm a little surprised in your case 
that inode 14386 doesn't exist.  What happens if you do an 'istat' on 
it?  What is the maximum inode for the file system (you can find out 
using 'fsstat' if the other tools won't tell you)?

Just because different files are shown does not necessarily mean that it 
is a problem since you are comparing code with different purposes. 
readdir() is only supposed to show you allocated files. TSK wants to 
show you everything that could be evidence and it is possible (and not 
uncommon) to create directories with a name that is only a space or 
control character and use it to hide files.  There are also problems 
sometimes when doing these types of things on a live system where some 
data has not been flushed from the buffers.

Can you send me an example of the raw directory data and the 'fls' 
output.  For example, /etc/ntp.  Find the inode for it and send me 
(offline) the output of 'icat /dev/hda2 INUM > foo.dat' and 'fls 
/dev/hda2 INUM'.  No file content will be included in this data and I 
can find out what a "(" name is being shown.

thanks,
brian

jisse wrote:
> Hi,
> I had the wonderful idea of cross-checking the files on a Ext2/Ext3 
> filesystem seen by "fsd" with the files seen with a simple "readdir()" 
> statement.
> The result was interesting: I found a lot of files that weren't supposed 
> to be there.
> 
> The command "fsd -rupfm / /dev/hda2" run on a default Fedora Core 5 
> installation showed some weird entries that could not be seen by a 
> "readdir()" in a Perl script. One of the entries was the following:
> 0|/etc/rc.d/init.d/^T|0|14386|0|-/----------|0|0|0|0|0|0|0|0|4096|0
> I had sent the output to a logfile, so I could determine that the 
> filename was "/etc/rc.d/init.d/^T" were the "^T" was a control 
> character. A simple "ls" of this file of course didn't show up.
> 
> I opened up "debugfs" and did a "stat" on the file name: The file could 
> not be found. Hmm, so 'fls' finds it and 'debugfs' does not? I checked 
> the validity of the inode-number 14386 with "ncheck" and discovered 
> "debugfs" could not find any inode with that number either. But still if 
> I ran "fsd" again, the same file popped-up again.
> 
> Other strange files included:
> /etc/pam.d/  (with a space as filename)
> /etc/ntp/(
> 
> Any ideas?
> 
> Regards,
> 
> Jisse
> 
> This mail signature is distributed under the GNU General Public License.
> For more information visit http://www.gnu.org/copyleft/gpl.html
> 
> 
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Strange files found by "fsd"

[jisse <ji...@ko...>]

Hi,
I had the wonderful idea of cross-checking the files on a Ext2/Ext3 
filesystem seen by "fsd" with the files seen with a simple "readdir()" 
statement.
The result was interesting: I found a lot of files that weren't supposed 
to be there.

The command "fsd -rupfm / /dev/hda2" run on a default Fedora Core 5 
installation showed some weird entries that could not be seen by a 
"readdir()" in a Perl script. One of the entries was the following:
0|/etc/rc.d/init.d/^T|0|14386|0|-/----------|0|0|0|0|0|0|0|0|4096|0
I had sent the output to a logfile, so I could determine that the 
filename was "/etc/rc.d/init.d/^T" were the "^T" was a control 
character. A simple "ls" of this file of course didn't show up.

I opened up "debugfs" and did a "stat" on the file name: The file could 
not be found. Hmm, so 'fls' finds it and 'debugfs' does not? I checked 
the validity of the inode-number 14386 with "ncheck" and discovered 
"debugfs" could not find any inode with that number either. But still if 
I ran "fsd" again, the same file popped-up again.

Other strange files included:
/etc/pam.d/  (with a space as filename)
/etc/ntp/(

Any ideas?

Regards,

Jisse

This mail signature is distributed under the GNU General Public License.
For more information visit http://www.gnu.org/copyleft/gpl.html

Re: [sleuthkit-users] creating an image

[Robert-Jan M. <rob...@ve...>]

Hello group,

If someone is using the ewfacuire tool, we like hear to from you about
your experiences with the tool. Maybe you have some suggestions. Let us
know.

Regards,

Robert-Jan Mora.

rob...@ve... wrote:
> When compiling the libewf ewfacquire tool run the following command 
> from within the libewf directory to get system specifics working:
>
> sh make.sh or sh make.sh remake
>
> Otherwhise you'll probably get an 0 size device error.
>
> Regards,
>
> Robert-Jan Mora.
>
> Citeren Brian Carrier <ca...@sl...>:
>
>   
>> For those who are looking for the ewfacquire tool, the tools in libewf
>> and afflib are not compiled with TSK, only the corresponding libraries
>> are.  You'll have to type 'make' in src/libewf or src/afflib to get all
>> of the tools.
>>
>> brian
>>
>>
>> Robert-Jan Mora wrote:
>>     
>>> Hello Eric,
>>>
>>> We've just added a tool called 'ewfacquire' within the latest sleuthkit
>>> 2.05. With the tool you can create disk images for free. The images are
>>> compatible with Encase or FTK and metadata case information is saved
>>> within the evidence file created.
>>>
>>> ewfacquire can be found in the /sleuthkit/src/libewf directory.
>>>
>>> Ewfacquire usage:
>>>
>>> ./efwacquire /dev/hda (or sda hard disk devices) After executing it will
>>> guide you through the process of creating an image.
>>>
>>> Or you can always use the dd command to create an image.
>>>
>>> Regards,
>>>
>>> Robert-Jan Mora.
>>>
>>> Eric wrote:
>>>       
>>>> I was wondering if someone could point me in the right "free" direction
>>>> into getting started with some simple commands using sleuth kit,
>>>> connectivty, and most of all creating images and/or how to specify them.
>>>> I 've been on the list a while and have realized that most of you are
>>>> very experienced with the tools, so I don't want to be a bother until I
>>>> learn more on my own ;)
>>>>
>>>> Thank you,
>>>> Eric
>>>>
>>>> -------------------------------------------------------------------------
>>>> Take Surveys. Earn Cash. Influence the Future of IT
>>>> Join SourceForge.net's Techsay panel and you'll get the chance to 
>>>> share your
>>>> opinions on IT & business topics through brief surveys -- and earn cash
>>>> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>>>> _______________________________________________
>>>> sleuthkit-users mailing list
>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>> http://www.sleuthkit.org
>>>>
>>>>
>>>>         
>>> -------------------------------------------------------------------------
>>> Take Surveys. Earn Cash. Influence the Future of IT
>>> Join SourceForge.net's Techsay panel and you'll get the chance to share your
>>> opinions on IT & business topics through brief surveys -- and earn cash
>>> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>>> _______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>>>       
>> -------------------------------------------------------------------------
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to share your
>> opinions on IT & business topics through brief surveys -- and earn cash
>> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>     
>
>
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>   

Re: [sleuthkit-users] creating an image

[<rob...@ve...>]

When compiling the libewf ewfacquire tool run the following command 
from within the libewf directory to get system specifics working:

sh make.sh or sh make.sh remake

Otherwhise you'll probably get an 0 size device error.

Regards,

Robert-Jan Mora.

Citeren Brian Carrier <ca...@sl...>:

> For those who are looking for the ewfacquire tool, the tools in libewf
> and afflib are not compiled with TSK, only the corresponding libraries
> are.  You'll have to type 'make' in src/libewf or src/afflib to get all
> of the tools.
>
> brian
>
>
> Robert-Jan Mora wrote:
>> Hello Eric,
>>
>> We've just added a tool called 'ewfacquire' within the latest sleuthkit
>> 2.05. With the tool you can create disk images for free. The images are
>> compatible with Encase or FTK and metadata case information is saved
>> within the evidence file created.
>>
>> ewfacquire can be found in the /sleuthkit/src/libewf directory.
>>
>> Ewfacquire usage:
>>
>> ./efwacquire /dev/hda (or sda hard disk devices) After executing it will
>> guide you through the process of creating an image.
>>
>> Or you can always use the dd command to create an image.
>>
>> Regards,
>>
>> Robert-Jan Mora.
>>
>> Eric wrote:
>>> I was wondering if someone could point me in the right "free" direction
>>> into getting started with some simple commands using sleuth kit,
>>> connectivty, and most of all creating images and/or how to specify them.
>>> I 've been on the list a while and have realized that most of you are
>>> very experienced with the tools, so I don't want to be a bother until I
>>> learn more on my own ;)
>>>
>>> Thank you,
>>> Eric
>>>
>>> -------------------------------------------------------------------------
>>> Take Surveys. Earn Cash. Influence the Future of IT
>>> Join SourceForge.net's Techsay panel and you'll get the chance to 
>>> share your
>>> opinions on IT & business topics through brief surveys -- and earn cash
>>> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>>> _______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>>>
>>>
>>
>> -------------------------------------------------------------------------
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to share your
>> opinions on IT & business topics through brief surveys -- and earn cash
>> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] creating an image

[Brian C. <ca...@sl...>]

For those who are looking for the ewfacquire tool, the tools in libewf 
and afflib are not compiled with TSK, only the corresponding libraries 
are.  You'll have to type 'make' in src/libewf or src/afflib to get all 
of the tools.

brian


Robert-Jan Mora wrote:
> Hello Eric,
> 
> We've just added a tool called 'ewfacquire' within the latest sleuthkit
> 2.05. With the tool you can create disk images for free. The images are
> compatible with Encase or FTK and metadata case information is saved
> within the evidence file created.
> 
> ewfacquire can be found in the /sleuthkit/src/libewf directory.
> 
> Ewfacquire usage:
> 
> ./efwacquire /dev/hda (or sda hard disk devices) After executing it will
> guide you through the process of creating an image.
> 
> Or you can always use the dd command to create an image.
> 
> Regards,
> 
> Robert-Jan Mora.
> 
> Eric wrote:
>> I was wondering if someone could point me in the right "free" direction
>> into getting started with some simple commands using sleuth kit,
>> connectivty, and most of all creating images and/or how to specify them.
>> I 've been on the list a while and have realized that most of you are
>> very experienced with the tools, so I don't want to be a bother until I
>> learn more on my own ;)
>>
>> Thank you,
>> Eric
>>
>> -------------------------------------------------------------------------
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to share your
>> opinions on IT & business topics through brief surveys -- and earn cash
>> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>   
> 
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] creating an image

[Simson G. <si...@ac...>]

Hi, Eric.

There is a tool that's part of the AFF software system called  
"aimage". This tool will acquire images in either AFF, raw, or split  
raw format. It also captures metadata such as the time that the  
acquisition was made and the drive's serial number. If you run the  
tool on FreeBSD or Linux, aimage will automatically scan for and  
attach an ATA, IDE, or SCSI drive.




> Eric wrote:
>> I was wondering if someone could point me in the right "free"  
>> direction
>> into getting started with some simple commands using sleuth kit,
>> connectivty, and most of all creating images and/or how to specify  
>> them.
>> I 've been on the list a while and have realized that most of you are
>> very experienced with the tools, so I don't want to be a bother  
>> until I
>> learn more on my own ;)
>>
>> Thank you,
>> Eric
>>
>> --------------------------------------------------------------------- 
>> ----
>> Take Surveys. Earn Cash. Influence the Future of IT
>> Join SourceForge.net's Techsay panel and you'll get the chance to  
>> share your
>> opinions on IT & business topics through brief surveys -- and earn  
>> cash
>> http://www.techsay.com/default.php? 
>> page=join.php&p=sourceforge&CID=DEVDEV
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>

Re: [sleuthkit-users] creating an image

[Robert-Jan M. <rob...@ve...>]

Hello Eric,

We've just added a tool called 'ewfacquire' within the latest sleuthkit
2.05. With the tool you can create disk images for free. The images are
compatible with Encase or FTK and metadata case information is saved
within the evidence file created.

ewfacquire can be found in the /sleuthkit/src/libewf directory.

Ewfacquire usage:

./efwacquire /dev/hda (or sda hard disk devices) After executing it will
guide you through the process of creating an image.

Or you can always use the dd command to create an image.

Regards,

Robert-Jan Mora.

Eric wrote:
> I was wondering if someone could point me in the right "free" direction
> into getting started with some simple commands using sleuth kit,
> connectivty, and most of all creating images and/or how to specify them.
> I 've been on the list a while and have realized that most of you are
> very experienced with the tools, so I don't want to be a bother until I
> learn more on my own ;)
>
> Thank you,
> Eric
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>