sleuthkit-users Mailing List for The Sleuth Kit (Page 165)
Brought to you by:
carrier
Menu
▾
▴
sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.
You can subscribe to this list here.
| 2002 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(6) |
Aug
|
Sep
(11) |
Oct
(5) |
Nov
(4) |
Dec
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 |
Jan
(1) |
Feb
(20) |
Mar
(60) |
Apr
(40) |
May
(24) |
Jun
(28) |
Jul
(18) |
Aug
(27) |
Sep
(6) |
Oct
(14) |
Nov
(15) |
Dec
(22) |
| 2004 |
Jan
(34) |
Feb
(13) |
Mar
(28) |
Apr
(23) |
May
(27) |
Jun
(26) |
Jul
(37) |
Aug
(19) |
Sep
(20) |
Oct
(39) |
Nov
(17) |
Dec
(9) |
| 2005 |
Jan
(45) |
Feb
(43) |
Mar
(66) |
Apr
(36) |
May
(19) |
Jun
(64) |
Jul
(10) |
Aug
(11) |
Sep
(35) |
Oct
(6) |
Nov
(4) |
Dec
(13) |
| 2006 |
Jan
(52) |
Feb
(34) |
Mar
(39) |
Apr
(39) |
May
(37) |
Jun
(15) |
Jul
(13) |
Aug
(48) |
Sep
(9) |
Oct
(10) |
Nov
(47) |
Dec
(13) |
| 2007 |
Jan
(25) |
Feb
(4) |
Mar
(2) |
Apr
(29) |
May
(11) |
Jun
(19) |
Jul
(13) |
Aug
(15) |
Sep
(30) |
Oct
(12) |
Nov
(10) |
Dec
(13) |
| 2008 |
Jan
(2) |
Feb
(54) |
Mar
(58) |
Apr
(43) |
May
(10) |
Jun
(27) |
Jul
(25) |
Aug
(27) |
Sep
(48) |
Oct
(69) |
Nov
(55) |
Dec
(43) |
| 2009 |
Jan
(26) |
Feb
(36) |
Mar
(28) |
Apr
(27) |
May
(55) |
Jun
(9) |
Jul
(19) |
Aug
(16) |
Sep
(15) |
Oct
(17) |
Nov
(70) |
Dec
(21) |
| 2010 |
Jan
(56) |
Feb
(59) |
Mar
(53) |
Apr
(32) |
May
(25) |
Jun
(31) |
Jul
(36) |
Aug
(11) |
Sep
(37) |
Oct
(19) |
Nov
(23) |
Dec
(6) |
| 2011 |
Jan
(21) |
Feb
(20) |
Mar
(30) |
Apr
(30) |
May
(74) |
Jun
(50) |
Jul
(34) |
Aug
(34) |
Sep
(12) |
Oct
(33) |
Nov
(10) |
Dec
(8) |
| 2012 |
Jan
(23) |
Feb
(57) |
Mar
(26) |
Apr
(14) |
May
(27) |
Jun
(27) |
Jul
(60) |
Aug
(88) |
Sep
(13) |
Oct
(36) |
Nov
(97) |
Dec
(85) |
| 2013 |
Jan
(60) |
Feb
(24) |
Mar
(43) |
Apr
(32) |
May
(22) |
Jun
(38) |
Jul
(51) |
Aug
(50) |
Sep
(76) |
Oct
(65) |
Nov
(25) |
Dec
(30) |
| 2014 |
Jan
(19) |
Feb
(41) |
Mar
(43) |
Apr
(28) |
May
(61) |
Jun
(12) |
Jul
(10) |
Aug
(37) |
Sep
(76) |
Oct
(31) |
Nov
(41) |
Dec
(12) |
| 2015 |
Jan
(33) |
Feb
(28) |
Mar
(53) |
Apr
(22) |
May
(29) |
Jun
(20) |
Jul
(15) |
Aug
(17) |
Sep
(52) |
Oct
(3) |
Nov
(18) |
Dec
(21) |
| 2016 |
Jan
(20) |
Feb
(8) |
Mar
(21) |
Apr
(7) |
May
(13) |
Jun
(35) |
Jul
(34) |
Aug
(11) |
Sep
(14) |
Oct
(22) |
Nov
(31) |
Dec
(23) |
| 2017 |
Jan
(20) |
Feb
(7) |
Mar
(5) |
Apr
(6) |
May
(6) |
Jun
(22) |
Jul
(11) |
Aug
(16) |
Sep
(8) |
Oct
(1) |
Nov
(1) |
Dec
(1) |
| 2018 |
Jan
|
Feb
|
Mar
(16) |
Apr
(2) |
May
(6) |
Jun
(5) |
Jul
|
Aug
(2) |
Sep
(4) |
Oct
|
Nov
(16) |
Dec
(13) |
| 2019 |
Jan
|
Feb
(1) |
Mar
(25) |
Apr
(9) |
May
(2) |
Jun
(1) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2020 |
Jan
(2) |
Feb
|
Mar
(1) |
Apr
|
May
(1) |
Jun
(3) |
Jul
(2) |
Aug
|
Sep
|
Oct
(5) |
Nov
|
Dec
|
| 2021 |
Jan
|
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
(4) |
Jul
(1) |
Aug
|
Sep
(1) |
Oct
|
Nov
(1) |
Dec
|
| 2022 |
Jan
|
Feb
(2) |
Mar
|
Apr
|
May
(2) |
Jun
|
Jul
(3) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2023 |
Jan
(2) |
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2024 |
Jan
|
Feb
(3) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2025 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Eric <er...@ho...> - 2006-07-31 16:51:13
|
I was wondering if someone could point me in the right "free" direction into getting started with some simple commands using sleuth kit, connectivty, and most of all creating images and/or how to specify them. I 've been on the list a while and have realized that most of you are very experienced with the tools, so I don't want to be a bother until I learn more on my own ;) Thank you, Eric |
|
From: Brian C. <ca...@sl...> - 2006-07-28 21:59:19
|
Version 2.05 of The Sleuth Kit is out. It contains minor bug fixes
and new features.
* Bug Fixes
o Upgraded versions of AFFLIB and libewf to fix compile bugs.
o Extra warning messages are no longer printed when
deleted FAT files cannot be recovered.
* Updates
o NTFS compressed file support (initial patch by
I.D.E.A.L. Technology).
o Added more templates to sigfind.
o Added more DOS partition sanity checks.
o Changed method for displaying supported format types
(kenshin).
o Modified library design and compile process.
http://www.sleuthkit.org/sleuthkit/download.php
MD5: 01cb88a7ebbd1ebb34159605dbaeef6b
brian
|
|
From: Robert M. <ro...@ze...> - 2006-07-19 23:40:14
|
Barry J. Grundy wrote: >(I accidently sent this to sleuthkit-informer...sorry. The wonders of autocompletion) > >Wondering if anyone has found a patch or workaround for adding SATA >support to TSK's disk_stat. We are dealing with more and more SATA >drives, and HPA detection with TSK has been useful (since 1.73, anyway). > >I was thinking of something along the lines of the passthrough ioctl for >libata. Any ideas? > > Hey! There is already a patch that should help (good for kernels >= 2.6.9) you can take a look at a discussion about it at *http://tinyurl.com/h6wb3 and the actual patch set is at **http://tinyurl.com/5el5w The patch includes exactly what you are suggesting. I haven't used the patch myself **yet** so I can't vouch for the stability -- we are working on some tools that will need it in the near future though. Cheers, Rob McCrea, CISSP ro...@ze... Zebra Logic Inc. - Ensuring Data Survival http://www.zebralogic.ca 1.866.699.3272 ext 101 ** * |
|
From: Barry J. G. <bg...@im...> - 2006-07-19 17:54:14
|
(I accidently sent this to sleuthkit-informer...sorry. The wonders of autocompletion) Wondering if anyone has found a patch or workaround for adding SATA support to TSK's disk_stat. We are dealing with more and more SATA drives, and HPA detection with TSK has been useful (since 1.73, anyway). I was thinking of something along the lines of the passthrough ioctl for libata. Any ideas? Barry -- /*************************************** Special Agent Barry J. Grundy Resident Agent in Charge NASA Office of Inspector General Computer Crimes Division Eastern Region (301)286-3358 (w) (202)246-6497 (c) **************************************/ |
|
From: Brian C. <ca...@sl...> - 2006-07-12 16:43:17
|
The easiest way to do this is to make a timeline using 'mactime', but make the comma delimited format. You can do this in Autopsy and then import the comma delimited format into Excel (or something). brian frman3 wrote: > I am looking for a way to either: > 1) list MFT entries based on the "Last MFT modification Time field" or > 2) export all of a disks MFT entries to a file that I can import into a > database program and manipulate myself (So I can sort by MFT modification > time). > > At worst I suppose I could write a script to run istat for each entry, > export the results to a file which I could then parse the results. But the > output does not seem to lend itself to easy importing to a database. Is > there an easier way, or has someone else done this? > > Forgive me if the answer was easily available if I just knew which keywords > to google. I am experienced with disk editing tools, but trying to make the > plunge to the more powerful features in The Sleuthkit and still learning > where to look for answers. |
|
From: Angus M. <an...@n-...> - 2006-07-11 20:58:24
|
I am pleased to announce that "early-bird" registration for ECCE 2006 is now open. The early-bird rate is available until 1st August only. The full programme for the conference will be online on Wednesday 12th July. The conference encompasses technical, procedural and legal issues relating to e-crime and computer evidence including forensic methods, criminological issues, training and international law. |
|
From: frman3 <amu...@ai...> - 2006-07-11 18:20:18
|
I am looking for a way to either: 1) list MFT entries based on the "Last MFT modification Time field" or 2) export all of a disks MFT entries to a file that I can import into a database program and manipulate myself (So I can sort by MFT modification time). At worst I suppose I could write a script to run istat for each entry, export the results to a file which I could then parse the results. But the output does not seem to lend itself to easy importing to a database. Is there an easier way, or has someone else done this? Forgive me if the answer was easily available if I just knew which keywords to google. I am experienced with disk editing tools, but trying to make the plunge to the more powerful features in The Sleuthkit and still learning where to look for answers. -- View this message in context: http://www.nabble.com/export-all-mft-entries-tf1926132.html#a5274661 Sent from the sleuthkit-users forum at Nabble.com. |
|
From: Matthew M. S. <msh...@ag...> - 2006-07-07 14:27:38
|
To all- Agile Risk Management is committed to advancing information security concepts, technology, and techniques. As such, we have recently released Nigilant32, a freeware Windows GUI Incident Response tool based on the source code provided by Sleuthkit. Nigilant32 is an incident response tool designed to capture as much information as possible from a running system with the smallest potential impact. Nigilant32 has been developed with Windows 2000, XP, and 2003 in mind, and should work fine with computers running one of those operating systems. Nigilant32 is beta software and may not work in all instances. The third article in our series of "Nigilant32 For First Responders" articles is "Active Memory Imaging". This article covers using Nigilant32 to image the active physical memory (RAM) of the suspect workstation or server to secure portable media. Make sure you download the article, as the last pages contain a sneak preview of the current project being developed in the Agile Research Lab. We sincerely hope you find Nigilant32 useful, however please remember, it is beta software therefore you should exercise good judgment when using it in your IT environment. Nigilant32, articles (as they are released), and modified Sleuthkit source code (libsleuthkit) is available at http://www.agilerm.net/publications_4.html Warmest Regards, Matthew M Shannon, CIFI, CISSP Principal - Computer Forensics and Litigation Support Agile Risk Management LLC 2202 N Westshore Blvd, Suite 200 Tampa, FL 33607 (M) 813.732.5076 (O) 1.877.AGILE13 (877.244.5313) <http://www.agileriskmanagement.com/> www.agileriskmanagement.com |
|
From: farmer d. <far...@ya...> - 2006-07-06 02:18:51
|
Hi Slade, Can you provide your syntax for the commands you used to create your image files (or the tools and any options)? You're certain you made logical images (of a file system, and not of a physical device containing one or more file systems), yes? Can you copy and paste this; xxd -s 1024 -l 512 your_image_file regards, farmerdude http://www.forensicbootcd.com/ --- Slade Griffin <se...@ss...> wrote: > All, > > I made three images of an EXT3 file system for > examination. The > images completed with no errors, but when I try to > add them in > Autopsy it says they are not an EXT file system. I > am using a laptop > and both the drive being imaged, and the drive where > the image is > stored are external HDD enclosures attached via USB. > Any help would > be greatly appreciated. > > Slade E. Griffin, GCIH, GCFA __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com |
|
From: Jean-Francois B. <jfb...@gm...> - 2006-07-05 17:16:29
|
> I made three images of an EXT3 file system for examination. The > images completed with no errors, but when I try to add them in > Autopsy it says they are not an EXT file system. I am using a laptop > and both the drive being imaged, and the drive where the image is > stored are external HDD enclosures attached via USB. Any help would > be greatly appreciated. You can try "disktype" to detect the partitions properties of the images (http://disktype.sourceforge.net/) if "mmls" don't give you usefull output. -- Jean-Francois BECKERS |
|
From: Slade G. <se...@ss...> - 2006-07-03 13:42:05
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 All, I made three images of an EXT3 file system for examination. The images completed with no errors, but when I try to add them in Autopsy it says they are not an EXT file system. I am using a laptop and both the drive being imaged, and the drive where the image is stored are external HDD enclosures attached via USB. Any help would be greatly appreciated. Slade E. Griffin, GCIH, GCFA Security Engineer -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBRKkemP5Rxktn+1WcEQIV0gCeO9amhsmKWrKR5gYaOce/hG4ivwgAoPoW GJNvrP4nyrTj1vcAqCOtYszk =kb+G -----END PGP SIGNATURE----- |
|
From: Matthew M. S. <msh...@ag...> - 2006-06-27 11:48:49
|
To all- Agile Risk Management is committed to advancing information security concepts, technology, and techniques. As such, we have recently released Nigilant32, a freeware Windows GUI Incident Response tool based on the source code provided by Sleuthkit. Nigilant32 is an incident response tool designed to capture as much information as possible from a running system with the smallest potential impact. Nigilant32 has been developed with Windows 2000, XP, and 2003 in mind, and should work fine with computers running one of those operating systems. Nigilant32 is beta software and may not work in all instances. The second article in our series of "Nigilant32 For First Responders" articles is "The Filesystem". This article covers using Nigilant32 to review the active filesystem using the code and technology provided by The Sleuthkit Project.. We sincerely hope you find Nigilant32 useful, however please remember, it is beta software therefore you should exercise good judgment when using it in your IT environment. Nigilant32, articles (as they are released), and modified Sleuthkit source code (libsleuthkit) is available at http://www.agilerm.net/publications_4.html Warmest Regards, Matthew M Shannon, CIFI, CISSP Principal - Computer Forensics and Litigation Support Agile Risk Management LLC 2202 N Westshore Blvd, Suite 200 Tampa, FL 33607 msh...@ag... (M) 813.732.5076 (O) 1.877.AGILE13 (877.244.5313) <http://www.agileriskmanagement.com/> www.agileriskmanagement.com |
|
From: Matthew M. S. <msh...@ag...> - 2006-06-20 21:18:55
|
To all- Agile Risk Management is committed to advancing information security concepts, technology, and techniques. As such, we have developed Nigilant32, a freeware Windows GUI Incident Response tool based on the source code provided by Sleuthkit. Nigilant32 is an incident response tool designed to capture as much information as possible from a running system with the smallest potential impact. Nigilant32 has been developed with Windows 2000, XP, and 2003 in mind, and should work fine with computers running one of those operating systems. Nigilant32 is beta software and may not work in all instances. In addition, over the next three weeks we'll be releasing one article each week covering how to use Nigilant32 to perform different Incident Response tasks. The first article is "Nigilant32 For First Responders: The SnapShot". This article covers using Nigilant32 to review and save a report of the running system that includes Processes, Services, User accounts, Scheduled Tasks, Network Ports, etc. We sincerely hope you find Nigilant32 useful, however please remember, it is beta software therefore you should exercise good judgment when using it in your IT environment. Nigilant32, articles (as they are released), and modified Sleuthkit source code (libsleuthkit) is available at http://www.agilerm.net/publications_4.html Warmest Regards Matthew M Shannon, CIFI, CISSP Principal - Computer Forensics and Litigation Support Agile Risk Management LLC 2202 N Westshore Blvd, Suite 200 Tampa, FL 33607 msh...@ag... (M) 813.732.5076 (O) 1.877.AGILE13 (877.244.5313) <http://www.agileriskmanagement.com/> www.agileriskmanagement.com |
|
From: Paul B. <p.j...@br...> - 2006-06-20 20:04:06
|
Hi everybody, After a long while I finally got back to searchtools. While not really adding any new functionality (Save for functionality now supported by the Sleuthkit) I have updated the Searchtools to work with Sleuthkit version 2.04. The Autopsy patch may still take a while as that costs a lot more effort. But don't worry. It will come. And I will update you if it finaly arrives. Searchtools is located at: http://brainspark.nl/tools#searchtools_patch But faster is: http://brainspark.nl/downloads/sleuthkit-2.04-searchtools-3.2.patch If you have any questions, don't hesitate to ask. If I can I will answer and help you. Regards, Paul Bakker |
|
From: <rob...@ve...> - 2006-06-19 10:22:31
|
Hello, We've released a new version of libewf. This release now supports writing EWF (EnCase) files using the ewfacquire tool. This tool supports reading devices in Linux, FreeBSD, NetBSD, OpenBSD, MacOS-X/Darwin. On other platforms it can convert a raw (dd) image into a EWF file. You can download the sourcecode on the project website: https://www.uitwisselplatform.nl/projects/libewf/ Regards, Joachim Metz & Robert-Jan Mora at Hoffmann Investigations |
|
From: Michael H. <lin...@gm...> - 2006-06-13 21:11:18
|
have you used Icat to carve the file using the inode-which if i read correctly is 22? Do the hashes match then? On 6/13/06, Jelle S. <fo...@em...> wrote: > > Hi list, > > I'm running some tests on an image with foremost and dd and I bumped upon > this which I can't really explain: > > #istat floppy1.001 22 > > Directory Entry: 22 > Allocated > File Attributes: File, Archive > Size: 51712 > Name: REPORT~1.DOC > > Directory Entry Times: > Written: Thu Apr 27 17:56:34 2006 > Accessed: Wed May 24 00:00:00 2006 > Created: Wed May 24 09:21:08 2006 > > Sectors: > 33 34 35 36 37 38 39 40 > 41 42 43 44 45 46 47 48 > 49 50 51 52 53 54 55 56 > 57 58 59 60 61 62 63 64 > 65 66 67 68 69 70 71 72 > 73 74 75 76 77 78 79 80 > 81 82 83 84 85 86 87 88 > 89 90 91 92 93 94 95 96 > 97 98 99 100 101 102 103 104 > 105 106 107 108 109 110 111 112 > 113 114 115 116 117 118 119 120 > 121 122 123 124 125 126 127 128 > 129 130 131 132 133 > > > Given this information we do 133-33+1= 101 and use this for the count > parameter. > > #dd if=../../floppy1.001 of=./test_recovery-1.doc skip=33 count=101 > #md5sum test_recovery-1.doc > 9a1715b9b66de7839d8010496d027c05 test_recovery-1.doc > > > When using foremost to carve through this image a .doc file is found. > The foremost audit.txt file contains this information: > > Foremost version 1.2 by Jesse Kornblum, Kris Kendall, and Nick Mikus > Audit File > > Foremost started at Thu Jun 1 20:07:09 2006 > Invocation: /usr/local/bin/foremost -t all -i floppy1.001 > Output directory: /home/jelle/forensics/output > Configuration file: /usr/local/etc/foremost.conf > > ------------------------------------------------------------------ > File: floppy1.001 > Start: Thu Jun 1 20:07:09 2006 > Length: 1 MB (1474560 bytes) > > Num Name (bs=512) Size File Offset Comment > > 0: 33.doc 51 KB 16896 > 1: 190.doc 80 KB 97280 > 2: 253.png 15 KB 129607 (800 x 600) > 3: 285.png 13 KB 146153 (800 x 600) > Finish: Thu Jun 1 20:07:09 2006 > > 4 FILES EXTRACTED > ole:= 2 > png:= 2 > > ------------------------------------------------------------------ > > Foremost finished at Thu Jun 1 20:07:09 2006 > > when I check the MD5 sum of file 33.doc I get: > aa7f9b9be2ca9be17a668eb00e2ea209 00000033.doc > > > This means the 2 files we're talking about arent the same. > While I'm pretty shure they should be the same! > Even better: > > dd if=../../floppy1.001 of=./test_recovery-2.doc skip=33 count=103 > When I check the MD5 sum of the file test_recovery-2.doc I get: > aa7f9b9be2ca9be17a668eb00e2ea209 est_recovery-2.doc > > > Which Is the same hash as the file foremost has recovered! > > > Now my question is: > > why do I need to count 103 sectors? Shouldn't I based upon the output of > the istat command only count 101 sectors? > quid? > > Thanks in advance, > > Jelle S. > > > > > > > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > > > -- Ave caesar! Morituri te salutamus |
|
From: Geert V. A. <gee...@pa...> - 2006-06-13 18:50:34
|
Jelle S. wrote: > Hi list, > why do I need to count 103 sectors? Shouldn't I based upon the output of > the istat command only count 101 sectors? > quid? Maybe because foremost takes the whole last block/cluster which is allocated to that file (fat12, 8 sectors/cluster)? In your dd extraction, you would indeed have the content of the file, but not all the slack space. -- Geert VAN ACKER |
|
From: Jelle S. <fo...@em...> - 2006-06-13 13:07:47
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> <div class="moz-text-flowed" style="font-family: -moz-fixed; font-size: 15px;" lang="x-western">Hi list, <br> <br> I'm running some tests on an image with foremost and dd and I bumped upon this which I can't really explain: <br> <br> #istat floppy1.001 22 <br> <br> Directory Entry: 22 <br> Allocated <br> File Attributes: File, Archive <br> Size: 51712 <br> Name: REPORT~1.DOC <br> <br> Directory Entry Times: <br> Written: Thu Apr 27 17:56:34 2006 <br> Accessed: Wed May 24 00:00:00 2006 <br> Created: Wed May 24 09:21:08 2006 <br> <br> Sectors: <br> 33 34 35 36 37 38 39 40 <br> 41 42 43 44 45 46 47 48 <br> 49 50 51 52 53 54 55 56 <br> 57 58 59 60 61 62 63 64 <br> 65 66 67 68 69 70 71 72 <br> 73 74 75 76 77 78 79 80 <br> 81 82 83 84 85 86 87 88 <br> 89 90 91 92 93 94 95 96 <br> 97 98 99 100 101 102 103 104 <br> 105 106 107 108 109 110 111 112 <br> 113 114 115 116 117 118 119 120 <br> 121 122 123 124 125 126 127 128 <br> 129 130 131 132 133 <br> <br> <br> Given this information we do 133-33+1= 101 and use this for the count parameter. <br> <br> #dd if=../../floppy1.001 of=./test_recovery-1.doc skip=33 count=101 <br> #md5sum test_recovery-1.doc <br> 9a1715b9b66de7839d8010496d027c05 test_recovery-1.doc <br> <br> <br> When using foremost to carve through this image a .doc file is found. <br> The foremost audit.txt file contains this information: <br> <br> Foremost version 1.2 by Jesse Kornblum, Kris Kendall, and Nick Mikus <br> Audit File <br> <br> Foremost started at Thu Jun 1 20:07:09 2006 <br> Invocation: /usr/local/bin/foremost -t all -i floppy1.001 <br> Output directory: /home/jelle/forensics/output <br> Configuration file: /usr/local/etc/foremost.conf <br> ------------------------------------------------------------------ <br> File: floppy1.001 <br> Start: Thu Jun 1 20:07:09 2006 <br> Length: 1 MB (1474560 bytes) <br> <br> Num Name (bs=512) Size File Offset Comment <br> <br> 0: 33.doc 51 KB 16896 <br> 1: 190.doc 80 KB 97280 <br> 2: 253.png 15 KB 129607 (800 x 600) <br> 3: 285.png 13 KB 146153 (800 x 600) <br> Finish: Thu Jun 1 20:07:09 2006 <br> <br> 4 FILES EXTRACTED <br> ole:= 2 <br> png:= 2 <br> ------------------------------------------------------------------ <br> <br> Foremost finished at Thu Jun 1 20:07:09 2006 <br> <br> when I check the MD5 sum of file 33.doc I get: <br> aa7f9b9be2ca9be17a668eb00e2ea209 00000033.doc <br> <br> <br> This means the 2 files we're talking about arent the same. <br> While I'm pretty shure they should be the same! <br> Even better: <br> <br> dd if=../../floppy1.001 of=./test_recovery-2.doc skip=33 count=103 <br> When I check the MD5 sum of the file test_recovery-2.doc I get: <br> aa7f9b9be2ca9be17a668eb00e2ea209 est_recovery-2.doc <br> <br> <br> Which Is the same hash as the file foremost has recovered! <br> <br> <br> Now my question is: <br> <br> why do I need to count 103 sectors? Shouldn't I based upon the output of the istat command only count 101 sectors? <br> quid? <br> <br> Thanks in advance, <br> <br> Jelle S. <br> <br> <br> <br> </div> </body> </html> |
|
From: <ale...@si...> - 2006-06-07 12:25:25
|
Canon use his own DRYOS operating system. New IR photocopier machines use HD for storing data. Does anyone knows what file system are they using. It seems that is not win/linux familiar? -- regards, alex |
|
From: <fu...@gm...> - 2006-06-07 10:11:24
|
Hi sleuthkit users I added a new feature for Allin1 for Sleuthkit. It's now possible to extract files from images using MagicRescue. Like foremost, MagicRescue digs through an image looking for header and footers. Additionally it does make some checks on the results and therefore has less false positives than foremost but has not so many file types like foremost. I think it's a good completion. Allin1: Allin1 is a tool to perform time consuming Autopsy/Sleuthkit-tasks in one step. You can download the new vesion at http://www.netmon.ch/forensic/allin1.html Reports, hints and corrections are very welcome! Regards David -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer |
|
From: Brian C. <ca...@sl...> - 2006-06-06 13:38:38
|
The recovery will depend on how fragmented the files originally were.=20 To recover files from FAT, a recovery tool will need to piece each=20 sector / cluster together. One incorrectly placed sector could make the=20 recovered file unusable. You can try to use TSK / Autopsy to see if the names for the deleted=20 files exist and they can be recovered. You may also need to try some=20 data carving tools, which look for known headers and footers for=20 specific file types. An example of an open source and free carving tool=20 is scalpel. And, no you should not mount the partition until you have tried to=20 recover the files. brian BRE...@te... wrote: > Hello, last night trying to delete a file I deleted all the files (larg= e=20 > files) in a subdirectory on an VFAT file system mounted in my Fedora=20 > Core 4 installation (W-XP shared). I rebooted the system and the=20 > partition remounted for a while until I dismounted manually: this=20 > partition is only used as a repository so I would not expect all these=20 > blocks (around 15 GB) have been overwritten. > The obvious questions are : > how can I check is the files can be undeleted? > how can I undelete securely all these files? > I assume I should not mount it anymore. >=20 > Thanks in advance. >=20 >=20 >=20 >=20 > **Prueba el Nuevo Correo Terra; Seguro, r=C3=A1pido, fiable.**=20 > <http://www.terra.es/correo> >=20 >=20 > -----------------------------------------------------------------------= - >=20 > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Brian C. <ca...@sl...> - 2006-06-06 13:31:58
|
What version of 'make' do you have? Running 'Makefile' should fail because it is not an executable. it is simply a configuration file for 'make'. I've never seen the other messages or compile order that you have though. It should try to compile a lot of other tools before it bothers with 'file'. Did you change any of the permissions? brian w de klerk wrote: > *_Sleuthkit and Autopsy on Suse 9_* > > *Hi all,* > *I know this must sound like another pain,* > *but I have absolutely no idea where to go from here.* > * * > *I downloaded the latest version of both mentioned apps* > *and had them unzipped to root directory,* > *set the permissions to all.* > * * > *If I run the make command,* > *(as it says on the site,)* > * * > *linux:~/sleuthkit-2.04 # '/root/sleuthkit-2.04/Makefile' > bash: /root/sleuthkit-2.04/Makefile: Permission denied > linux:~/sleuthkit-2.04 # > > linux:~/sleuthkit-2.04 # make > make all-recursive > make[1]: Entering directory `/root/sleuthkit-2.04' > Making all in src > make[2]: Entering directory `/root/sleuthkit-2.04/src' > make[2]: Nothing to be done for `all'. > make[2]: Leaving directory `/root/sleuthkit-2.04/src' > Making all in magic > make[2]: Entering directory `/root/sleuthkit-2.04/magic' > ../src/file -C -m magic > make[2]: execvp: ../src/file: Permission denied > make[2]: *** [magic.mgc] Error 127 > make[2]: Leaving directory `/root/sleuthkit-2.04/magic' > make[1]: *** [all-recursive] Error 1 > make[1]: Leaving directory `/root/sleuthkit-2.04' > make: *** [all] Error 2 > linux:~/sleuthkit-2.04 #* > * * > *Any help will be highly appreciated,* > * * > *Cheers* > * * > *WDK* > > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam protection around > http://mail.yahoo.com > > > ------------------------------------------------------------------------ > > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Brian C. <ca...@sl...> - 2006-06-06 13:23:54
|
Floppy disks do not have partitions on them, but the signature value for FAT file systems and DOS partitions is the same (0xAAFF). Therefore, it is possible for a FAT file system to be interpreted as a DOS partition table, but the results do not typically make sense (as you observed). You could have also run fdisk on the image and gotten the same results. The latest version of TSK added some more sanity checks and would not have printed these results. It checks to make sure that the partitions start in the image file (and the partitions in this case are much larger than a floppy). You could simply run 'fls' on the image to list the files using TSK. brian js wrote: > Hi list, > > I have a dd image of a floppy. > > when examining this floppy with the disktype command I get: > >> disktype floppy1.001 >> >> --- floppy1.001 >> Regular file, size 1.406 MiB (1474560 bytes) >> FAT12 file system (hints score 5 of 5) >> Volume size 1.390 MiB (1457664 bytes, 2847 clusters of 512 bytes) > > When I want to list the partitions on this image i do: > >> mmls floppy1.001 >> DOS Partition Table >> Sector: 0 >> Units are in 512-byte sectors >> >> Slot Start End Length Description >> 00: ----- 0000000000 0000000000 0000000001 Primary Table (#0) >> 01: ----- 0000000001 1112359496 1112359496 Unallocated >> 02: 00:01 1112359497 1651347857 0538988361 Novell Netware (0x65) >> 03: 00:02 1126178899 1126198689 0000019791 Win LVM / Secure >> FS (0x42) >> 04: ----- 1126198690 1869562399 0743363710 Unallocated >> 05: 00:00 1869562400 3503645331 1634082932 GoBack (0x44) > > When I want some extra info about this FAT12 disk I do: > This also confirms its a FAT12. >> dosfsck -v floppy1.001 >> dosfsck 2.11 (12 Mar 2005) >> dosfsck 2.11, 12 Mar 2005, FAT32, LFN >> Checking we can access the last sector of the filesystem >> Boot sector contents: >> System ID "IBM 3.3" >> Media byte 0xf0 (5.25" or 3.5" HD floppy) >> 512 bytes per logical sector >> 512 bytes per cluster >> 1 reserved sector >> First FAT starts at byte 512 (sector 1) >> 2 FATs, 12 bit entries >> 4608 bytes per FAT (= 9 sectors) >> Root directory starts at byte 9728 (sector 19) >> 224 root directory entries >> Data area starts at byte 16896 (sector 33) >> 2847 data clusters (1457664 bytes) >> 18 sectors/track, 2 heads >> 0 hidden sectors >> 2880 sectors total >> Checking for unused clusters. >> floppy1.001: 1 files, 0/2847 clusters > > > When I check how many space there is left on the disk I get : > >> df -h >> Filesystem Size Used Avail Use% Mounted on >> /dev/floppy/0 1.4M 51K 1.4M 4% /mnt/floppy > > I can list the contents of this disk, no problem. > > > Where does the information that mmls produces come from? > Why can I read the disk without any problems on my linux box and windows > box? > How can the OS handle this disk since the partition layout is completely > wrong? > > > Thanks in advance list, > > Js. > > > > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: <BRE...@te...> - 2006-06-06 10:01:38
|
Hello, last night trying to delete a file I deleted all the files (large files) in a subdirectory on an VFAT file system mounted in my Fedora Core 4 installation (W-XP shared). I rebooted the system and the partition remounted for a while until I dismounted manually: this partition is only used as a repository so I would not expect all these blocks (around 15 GB) have been overwritten. The obvious questions are : how can I check is the files can be undeleted? how can I undelete securely all these files? I assume I should not mount it anymore. Thanks in advance. Prueba el Nuevo Correo Terra; Seguro, rápido, fiable. |
|
From: w de k. <dek...@ya...> - 2006-06-05 20:42:24
|
Sleuthkit and Autopsy on Suse 9
Hi all,
I know this must sound like another pain,
but I have absolutely no idea where to go from here.
I downloaded the latest version of both mentioned apps
and had them unzipped to root directory,
set the permissions to all.
If I run the make command,
(as it says on the site,)
linux:~/sleuthkit-2.04 # '/root/sleuthkit-2.04/Makefile'
bash: /root/sleuthkit-2.04/Makefile: Permission denied
linux:~/sleuthkit-2.04 #
linux:~/sleuthkit-2.04 # make
make all-recursive
make[1]: Entering directory `/root/sleuthkit-2.04'
Making all in src
make[2]: Entering directory `/root/sleuthkit-2.04/src'
make[2]: Nothing to be done for `all'.
make[2]: Leaving directory `/root/sleuthkit-2.04/src'
Making all in magic
make[2]: Entering directory `/root/sleuthkit-2.04/magic'
../src/file -C -m magic
make[2]: execvp: ../src/file: Permission denied
make[2]: *** [magic.mgc] Error 127
make[2]: Leaving directory `/root/sleuthkit-2.04/magic'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/root/sleuthkit-2.04'
make: *** [all] Error 2
linux:~/sleuthkit-2.04 #
Any help will be highly appreciated,
Cheers
WDK
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com |
38 messages has been excluded from this view by a project administrator.
