sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] New version?

[Brian C. <ca...@sl...>]

It's out.  NTFS compression will hopefully be in the next release.

brian

Jennifer Smith wrote:
> Brian,
> 
> You mentioned a new version of sleuthkit coming soon...is that 
> still planned?  The addition of support for NTFS compression would 
> be great!  Can you give us any other hints to what else is being 
> added?
> 
> Thanks,
> gg  8)
> 
> 

[sleuthkit-users] TSK 2.04 and Autopsy 2.07 release

[Brian C. <ca...@sl...>]

New versions of TSK and Autopsy are now available (after the longest 
duration of no releases in the history of the tools).  There are several 
new features including Expert Witness (EnCase) images, AFF images, and 
ISO 9660 file systems, which were primarily developed by people other 
than myself (see below).  There are also new features that are listed below.

http://www.sleuthkit.org


TSK

Bug Fixes
o Verbose statement in img_open could cause a crash (Wyatt Banks).
o NTFS sanity check improvements (Wyatt Banks)
o Indirect blocks for Ext2 and UFS were not found (reported by Bernhard 
Reiter)
o File names in UFS and Ext may not be shown if first entry is 
unallocated (reported by John Langezaal)

Updates
o Expert Witness (EnCase) image file support using libewf (Joachim Metz 
and Robert Jan Mora).
o Advanced File Format image file support using AFFLIB (Simson Garfinkel).
o ISO 9660 file system support (Wyatt Banks, Crucial Security)
o mmls now displays the unpartitioned space at end of disk (suggested by 
Wyatt Banks).
o New img_cat tool to output the raw contents of an image file.
o Improved internal error handling for library usage.
o New internal flag FS_FLAG_DATA_RES to show resident data during a file 
walk.
o The file system byte offset is now passed to the file system code 
instead of imgtools, this allows for better library usage.


Autopsy

Bug Fixes:
o incorrect variable name fix .

Updates
o Support for Expert Witness and AFF file formats
o Support for ISO9660 file systems
o Hex view for file analysis


TSK 2.04 MD5: abb1511e2ec53c6d34d745a348c94b33
Autopsy 2.07 MD5: c7dab20ab26fd04404ccd199e1c05c7a

[sleuthkit-users] New version?

[Jennifer S. <g33...@li...>]

Brian,

You mentioned a new version of sleuthkit coming soon...is that=20
still planned?  The addition of support for NTFS compression would=20
be great!  Can you give us any other hints to what else is being=20
added?

Thanks,
gg  8)


--=20
_______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze

Re: [sleuthkit-users] dls

[Brian C. <ca...@sl...>]

Geert VAN ACKER wrote:
> Dear brian and list members,
> 
> two little questions about dls.
> 
> 1. dls extracts all unallocated data blocks (addressable disk units)
> Assumption: dls also copies the slack space of an image, as long as 
> these are addressable disk units.
> Question: What about the bytes between the last byte of a regular file 
> and the beginning of the next data block? Is there a way to copy them out?

They are only copied out if you use the '-s' flag, in which case only 
the slack space blocks are copied out (and the file data is zeroed out).

> 2. What is the file structure of a dls output file. dls keeps the byte 
> offset of the fragment, so is it something like:
> 254: data_of_the_block 289: data_of_another_block ... ?

the default output of dls is a raw data file that is block aligned. 
I.e. if the first unallocated block is block 50 then it would be the 
first block in the output.  You can use dcalc to link between dls 
addresses and normal addresses.  'dls -l' will also give you that 
information.

brian

[sleuthkit-users] dls

[Geert V. A. <gee...@pa...>]

Dear brian and list members,

two little questions about dls.

1. dls extracts all unallocated data blocks (addressable disk units)
Assumption: dls also copies the slack space of an image, as long as 
these are addressable disk units.
Question: What about the bytes between the last byte of a regular file 
and the beginning of the next data block? Is there a way to copy them out?

2. What is the file structure of a dls output file. dls keeps the byte 
offset of the fragment, so is it something like:
254: data_of_the_block 289: data_of_another_block ... ?

Thanks for your help !

Geert

Re: [sleuthkit-users] Suggestion for activity time line

[Keith R W. <kw...@be...>]

Yes the short FAT name is what I was referring to. I understand your point.

Brian Carrier wrote:

> I like the idea of a separate column for deleted status when the comma 
> delimited output is given.  I'm reluctant to add the short FAT name 
> though (I'm assuming that is what you are referring to as the DOS 
> alias file name) because that is specific to a single file system.
>
> brian
>
>
> Keith R Wood wrote:
>
>> When creating the time line for file activity, place the deleted 
>> indicator, as well as the DOS alias file name in their own separate 
>> column. This would make those elements stand out more when loaded 
>> into a spread sheet.
>>
>

Re: [sleuthkit-users] Suggestion for activity time line

[Brian C. <ca...@sl...>]

I like the idea of a separate column for deleted status when the comma 
delimited output is given.  I'm reluctant to add the short FAT name 
though (I'm assuming that is what you are referring to as the DOS alias 
file name) because that is specific to a single file system.

brian


Keith R Wood wrote:
> When creating the time line for file activity, place the deleted 
> indicator, as well as the DOS alias file name in their own separate 
> column. This would make those elements stand out more when loaded into a 
> spread sheet.
> 
> 
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job 
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Suggestion for activity time line

[Keith R W. <kw...@be...>]

When creating the time line for file activity, place the deleted 
indicator, as well as the DOS alias file name in their own separate 
column. This would make those elements stand out more when loaded into a 
spread sheet.

Re: [sleuthkit-users] HPA error - disk_stat and SATA

[farmer d. <far...@ya...>]

-- Brian Carrier <ca...@sl...> wrote:
> > I know there's an HPA there...does disk_stat not
> work yet with SATA drives? This is Linux 2.6.16 on a
> Dell Inspiron e1705. thx!
> 
> I guess not.  I haven't had a chance to test it yet,
> but I would not be 
> surprised.  disk_stat doesn't work when USB is
> involved either. 

It doesn't currently work with SCSI, and since USB,
1394, and SATA drives all fall under SCSI modulation
then disk_stat and disk_sreset won't work with them. 
You probably get;

ioctl(3, 0x31f, 0xbffff690) = -1 EINVAL (Invalid
argument)

regards,

farmerdude

http://www.forensicbootcd.com/

http://www.farmerdude.com/




__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Re: [sleuthkit-users] HPA error - disk_stat and SATA

[Robert M. <ro...@ze...>]

> I guess not.  I haven't had a chance to test it yet, but I would not 
> be surprised.  disk_stat doesn't work when USB is involved either.  I 
> need to investigate Linux more to figure this out.  I just created 
> some bug reports for these cases.
>
> Anyone here an expert with ATA commands and Linux?

Might want to take a look at:

http://smartmontools.sourceforge.net/#testinghelp

Bruce describes the Linux situation pretty well... and there is a 
potential kernel patch specifically for this type of SATA problem.

Cheers,

Rob McCrea
ro...@ze...
http://www.zebralogic.ca

Re: [sleuthkit-users] HPA error - disk_stat and SATA

[Brian C. <ca...@sl...>]

rob...@us... wrote:
> # disk_stat /dev/sda
> Maximum Disk Sector: 0
> Maximum User Sector: 153356489
> 
> ** HPA Detected (Sectors 153356490 - 0) **
> 
> 
> I know there's an HPA there...does disk_stat not work yet with SATA drives? This is Linux 2.6.16 on a Dell Inspiron e1705. thx!

I guess not.  I haven't had a chance to test it yet, but I would not be 
surprised.  disk_stat doesn't work when USB is involved either.  I need 
to investigate Linux more to figure this out.  I just created some bug 
reports for these cases.

Anyone here an expert with ATA commands and Linux?

brian

[sleuthkit-users] HPA error - disk_stat and SATA

[<rob...@us...>]

# disk_stat /dev/sda
Maximum Disk Sector: 0
Maximum User Sector: 153356489

** HPA Detected (Sectors 153356490 - 0) **


I know there's an HPA there...does disk_stat not work yet with SATA drives? This is Linux 2.6.16 on a Dell Inspiron e1705. thx!

[sleuthkit-users] e-crime and computer evidence 2006 CFP reminder & extension

[Angus M. <an...@n-...>]

Several potential authors/speakers for the ECCE 2006 conference have requested 
an extension to the deadline for submission of abstracts. As a result, to be 
fair to all possible contributors, the conference committee has decided to 
extend the deadline to 22nd May 2006.

Details of the call are given below.

"

                                      Call for Papers

   ECCE2005 set the tone for all future conferences by attracting papers from 
a diverse population of researchers and practitioners. It is our intention, 
therefore, to build on previous success by hosting sessions of technical and 
non-technical topics.

Papers

   Key themes for ECCE2006 have not been finalised yet, but we would welcome 
papers (typically around 40 minutes per paper) in any of the following 
categories :
     * Technical aspects of data recovery and analysis
     * Technical aspects of network and/or internet investigation
     * Legal apsects of investigation, prosecution or defence
     * Criminological studies, theories and issues
     * Use of computers in court
     * Use of computers to support other investigations
     * Education and training related topics
     * Workshop/tutorial proposals (up to 2 hours)

Posters

   We are keen to encourage new researchers and practitioners to share their 
work and experience. Poster presentations are particularly welcome for this 
conference. Posters should be A1 in size and describe work relevant to the 
themes of the conference (see above for example themes).

Acceptance Process

   Authors should submit abstracts of up to 400 words online using the 
ABSTRACT SUBMISSION FORM at http://www.ecce-conference.com/

Submission deadline extended to 22nd May 2006

   All abstracts will the be subject to anonymous review by 2 or more 
reviewers. Authors will be notified by the end of May of the decision of the 
review panel.

   Accepted  authors  will  then  be requested to supply camera-ready copy of 
inclusion in the conference proceedings, in advance of the conference date.

[sleuthkit-users] CFP - 4th Australian Digital Forensics Conference

[Craig V. <c....@ec...>]

4th Australian Digital Forensics Conference=20
"Going Mobile"=20

December 4th, 2006=20
Edith Cowan University (ECU)
Mount Lawley Campus,=20
Western Australia=20

Background
The 4th Australian Digital Forensics Conference 2006 will be held on
Monday, December 4th at the Edith Cowan University (ECU), Mount Lawley
Campus, Western Australia by the School of Computer and Information
Science.=20

The aim of ADFC 2006 is to bring together IT managers, system and
network administrators, security specialists, academics, security
solutions vendors, practitioners and anyone interested in computer
forensics its role and application.

The focus theme this year is  "Going Mobile" examining the emerging area
of mobile device forensics. The merger between the computer and the
mobile phone is happening with almost geometric proportions. Mobile
phones are about to be released that will have in-built hard disks of
4GB or better capacity and the ability to store and edit a variety of
documents as well as take photos and several hours of video.

Full papers are invited in the following areas (but not limited to):

*	Forensic Computing
*	Incident Management
*	Incident Response
*	Forensic Method
*	Case Studies
*	Investigation Frameworks and Methods
*	Network Forensics
*	Cyber Crime Detection and Investigation
*	Response Team Cooperation and Legal Issues=20
*	Legal aspects of Computer Forensics
*	Enterprise level forensic computing
*	Forensic Computer training and education

Conference Paper
You are hereby invited to submit full papers. Submitted papers must be
in English, should be typed in a single column, single-spaced format,
and must adhere to the maximum word limit of 5000 words.=20
They must include the author's name, affiliation and e-mail address, a
200 word abstract and keywords identifying the paper's area of
application in digital forensics.

Paper Review Process
All submitted papers will be double blind peer reviewed before
acceptance for publication. All papers must be submitted via the
conference website.=20
For more detailed information regarding submissions requirements, please
visit the website at http://scissec.scis.ecu.edu.au/conferences2006/

Joint Conferences=20
The 4th Australian Digital Forensics Conference (ADFC 2006) will be run
in conjunction with the 4th  Australian Information Security Management
Conference=20
and the 7th Australian Information Warfare and Security Conference
jointly from 4-5th December 2006 at Edith Cowan University, Mount Lawley
Campus, Western Australia.

Accommodation in Western Australia=20
The Mount Lawley Campus of ECU is less than 5kms from the Perth CBD.
Special rates for ADFC 2006 will be arranged with several Western
Australian hotels. Conference delegates should make their bookings
directly with these hotels referring to ADFC 2006 Conference site.

Conference Committee
Dr. Craig Valli			Edith Cowan University, Australia
Dr. Andrew Woodward		Edith Cowan University, Australia
Dr. Glenn Dardick		      Longwood University, USA
Prof. Bill Hutchinson		Edith Cowan University, Australia
Trish Williams		      Edith Cowan UNiversity, Australia
Chris Bolan 			Edith Cowan University, Australia
Suen Yek			      Edith Cowan University, Australia
Dr. Andy Jones			BT Security Labs, UK
Prof. Matthew Warren		Deakin University, Australia
Dr. Jill Slay			UniSA, Australia
Dr. Steven Furnell		Plymouth University, UK

Key Dates=20
Papers Due 			      1st October 2006=20
Acceptance Notification		15th October 2006
Camera ready paper		1st November 2006
Early Bird Registration		1st November 2006

Conference Chair
Dr. Craig Valli  =20
c....@ec...
Edith Cowan University
School of Computer and Information Science
Mount Lawley=20
Western Australia   6050              =20
Phone +61-8-9370-6162

--
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Dr. Craig Valli
Edith Cowan University
Senior Lecturer - Computer and Network Security
SCISSEC Research Group
http://scissec.scis.ecu.edu.au
c....@ec...
Phone +61-8-9370-6162
Fax   +61-8-9370-6100

7th Australian Information Warfare and Security Conference
4th Australian Information Security Management Conference
4th Australian Digital Forensics Conference
http://scissec.scis.ecu.edu.au/conferences2006

CRICOS Institution Provider Code 00279B=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This message may contain privileged and confidential information
intended
only for the use of the addressee named above.If you are not the
intended
recipient of this message you are hereby notified that any use,
dissemination, distribution or reproduction of this message or any
attachment is prohibited.

If you have received this message in error please notify Craig Valli
c....@ec... immediately by return email and delete this message
and all attachments
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
 =20

[sleuthkit-users] Fwd: ECCE 2006 - Conference CFP reminder

[Angus M. <an...@n-...>]

Just to remind you that the CFP for ECCE2006 (e-crime and computer evidence
2006) closes next week.

Full details of  the call are on the conference website at
http://www.ecce-conference.com/

Re: [sleuthkit-users] MUTEX_LOCK with sorter

[Brian C. <ca...@sl...>]

That looks like a Cygwin Perl issue.  The panics are not in TSK code, so 
I'm not sure what can be fixed...  You could try to run sorter with '-v' 
to get verbose output and see if it crashes in the same place again.

brian

DePriest, Jason R. wrote:
> I ran 'Sort Files by Type' via Autopsy over the weekend on a 40 GB
> hard disk drive image created with dd of an NTFS hard disk drive.
> 
> It was giving me the requisite errors about compressed files, but at
> some point, it generated this:
>    1224 [main] perl 3752 child_copy: linked dll data write copy
> failed, 0x6E94A000..0x6E952880, done 0, windows pid 2288004, Win32
> error 1455
> panic: MUTEX_LOCK (45) [util.c:2266] at /incoming/sleuthkit/bin/sorter line 669.
> panic: MUTEX_LOCK (45) [op.c:354].
> 
> and stopped dead in its tracks.
> 
> The system this is running on:
> Microsoft Windows Server 2003 with SP1
> CYGWIN_NT-5.2 ebizsrvb 1.5.19(0.150/4/2) 2006-01-20 13:28 i686 Cygwin
> sleuthkit 2.03
> autopsy 2.06
> 
> Any idea on what this error was caused by?
> 
> Thanks in advance,
> 
> -Jason
> 
> 
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=k&kid0709&bid&3057&dat1642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] MUTEX_LOCK with sorter

[DePriest, J. R. <jrd...@gm...>]

I ran 'Sort Files by Type' via Autopsy over the weekend on a 40 GB
hard disk drive image created with dd of an NTFS hard disk drive.

It was giving me the requisite errors about compressed files, but at
some point, it generated this:
   1224 [main] perl 3752 child_copy: linked dll data write copy
failed, 0x6E94A000..0x6E952880, done 0, windows pid 2288004, Win32
error 1455
panic: MUTEX_LOCK (45) [util.c:2266] at /incoming/sleuthkit/bin/sorter line=
 669.
panic: MUTEX_LOCK (45) [op.c:354].

and stopped dead in its tracks.

The system this is running on:
Microsoft Windows Server 2003 with SP1
CYGWIN_NT-5.2 ebizsrvb 1.5.19(0.150/4/2) 2006-01-20 13:28 i686 Cygwin
sleuthkit 2.03
autopsy 2.06

Any idea on what this error was caused by?

Thanks in advance,

-Jason

Re: [sleuthkit-users] Creating practice images/drives

[eric <er...@ho...>]

I was wondering if sleuthkit tasks can be spawned on muliple computers 
with something like PVM?

J B wrote:

> Brian's got some practice images at
>
> http://dftt.sourceforge.net/
>
> What's great is they're small, so you get the effect without waiting 
> for 10 GB searches.
>
> Sigfind using my systems can take hours.
>
> -Jessop
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job 
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache 
> Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Gentoo Questions

[vattini g. <ha...@ya...>]

Why don't you try a knoppix-std or othere oriented
distro in forencies?also i will suggest to you
openbsd,or do a your own distro
ciao


		
___________________________________ 
Yahoo! Messenger with Voice: chiama da PC a telefono a tariffe esclusive 
http://it.messenger.yahoo.com

Re: [sleuthkit-users] Error in sorter - what am I missing?

[Brian C. <ca...@sl...>]

Support for NTFS compressed files will exist in a near future release. 
The next release will be next week.

brian

DePriest, Jason R. wrote:
> Reading the NTFS entry in Wikipedia states that NTFS compresses uses
> the same compression algorithm as regular Zip files (LZ77):
> http://en.wikipedia.org/wiki/Ntfs
> 
> That article had a link to the Microsoft website here:
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/file_compression_and_decompression.asp
> 
> The site is pretty high level and doesn't really give much more detail
> than what apps or functions to call to perform an operation.
> 
> It looks like someone would need to recreate the functionality of
> LzExpand.dll in an open source manner and I have no idea if any
> development is being done on this.  I also don't know what the
> existing NTFS drivers and bolt-ons for Linux can already do natively.
> 
> You could always note the files that cannot be decompressed, manually
> pull them out of the image and then use a Windows system to decompress
> them.  Of course, that would compromise your evidence, but it is an
> idea.
> 
> -Jason
> 
> On 4/19/06, Jennifer Smith <> wrote:
>> Ok, I got the offset from mmls (thanks Barry, that was exactly what I needed to do!) and now sorter is running beautifully, with just one hangup.
>>
>> It appears that there are some file system compressed files in this image and when sorter gets to them it throws out an error that it can not access NTFS compressed files and then it aborts trying to access that particular file. These appear to be file system compressed files, not standard archive files, since it was able to sort and catalog .cab, .dat, and .zip files with no problem.
>>
>> According to some research on this end, it seems that NTFS uses something similar to DriveSpace3 for it's compression (please correct me if I'm wrong) - has anyone found/created any method to work through this error with sorter so that instead of aborting the file, it uncompresses it and sorts it as intended?
>>
>> farmer dude, thanks for the response - any suggestions on sites to look for practice images (especially if they include a "results" list, so I know if I actually find everything); also, is there a how-to anywhere on creating images for practicing?
>>
>> Thanks again for all the help,
>> gg
>>
>>
> 
> 
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=k&kid0709&bid&3057&dat1642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Gentoo Questions

[Robert M. <ro...@ze...>]

Stuart Bird wrote:

> Hi All
>
> Having recently had my linux exam box upgraded I decided to have a 
> crack at a new setup so I took the plunge and had a go at installing 
> Gentoo from their new installer CD. After a few weeks of general use I 
> am very happy with it and it seems very stable.
>
Good to hear - another potential Gentoo convert! It's a great distro but 
a little high maintenance when things go off the rails. We've been using 
it for the past couple years.

> The first thing I wanted to ask is whether Gentoo is a good base for 
> forensic work. As far as I can tell it does not auto mount anything 
> without my say so, but are there any other areas of the distro I need 
> to look at to make the environment forensically sound?
>
Can't speak directly to this but we do have an in house data recovery 
live CD based off Gentoo - which we are planning to release in the not 
to distant future - which performs many of the same tasks as a forensic 
exam and uses Sleuthkit and have had great success with few modification 
from the standard install.

> Secondly, I have installed sleuthkit and autopsy via portage. I can 
> run autopsy alright but cannot for the life of me find the directory 
> that sleuthkit was installed to so that I can run stuff from the 
> commandline. I have tried "find" and "locate" etc but I still can't 
> find the folder containing all the commands.

make sure you have gentoolkit installed 'emerge -a gentoolkit' and then 
run 'equery files sleuthkit' and that will tell you all the files 
portage installed and where it installed them.

> I am on Gentoo 2006.0 with  kernel-genkernel-x86-2.6.15-gentoo-r5 if 
> that helps.
>
> Any advice appreciated.
>
> Stu Bird

Best Regards,

Rob McCrea
ro...@ze...
http://www.zebralogic.ca

Re: [sleuthkit-users] Creating practice images/drives

[Alonso C. Q. / R. <re...@gm...>]

Saludos:

> http://dftt.sourceforge.net/
>
> What's great is they're small, so you get the effect without waiting for =
10
> GB searches.
>

Yes, and also you can try with imagenes of the "Reto forense" You can
locate it in this url:http://www.seguridad.unam.mx/eventos/reto/  .
Somebody has some images to share and to analyze, welcome. X)

Excuse my english.

  Atte:

--
Alonso Caballero Quezada aka ReYDeS - Re...@gm...
http://alonsocaballero.informatizate.net - LRU # 307242
http://www.SWP-scene.org

Re: [sleuthkit-users] Creating practice images/drives

[J B <je...@ad...>]

Brian's got some practice images at

http://dftt.sourceforge.net/

What's great is they're small, so you get the effect without waiting for 10 
GB searches.

Sigfind using my systems can take hours.

-Jessop 

Re: [sleuthkit-users] Creating practice images/drives

[Eagle I. S. Inc. <in...@ea...>]

One easy way to do this is to simply image your usualy workstation. The
one where you work every day, and analyse that.

For example, if you know you've sent mail to Mr. X, then simply shutdown
your machine, image your drive, analyse it in whatever you like, and then
off you go.

Every day you'll literally have a different image file to play with if you
like.

Niall.

Jennifer Smith wrote:
> I mentioned this in an earlier message, but I thought it might be better
> to break it off into a separate posting and to clarify my
> question a little.
>
> I asked if there is a how-to on creating images to practice with,
> basically so that I can (in my spare time) work out the quirks in
> what I am trying to do.
>
> What I probably should have said was, what is the best way of setting up a
> drive in order to use it as a "forensic test case"?  In other words, if I
> want to have a drive that has X, Y, and Z items and then create the image
> (using dd) so that when I go to search the drive (using TSK, Autopsy, &/or
> other tools), I know that I should be able to find X, Y and Z, what is the
> best way to go about that?  That way I can set up my own practice drive.
>
> Barry, thanks for that reference guide - it looks like a great read, and I
> plan to use the .dd image for practice :)
>
> Thanks for all the help!
>
> -gg
>
> --
> _______________________________________________
> Check out the latest SMS services @ http://www.linuxmail.org
> This allows you to send and receive SMS through your mailbox.
>
> Powered by Outblaze
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] Creating practice images/drives

[Jennifer S. <g33...@li...>]

I mentioned this in an earlier message, but I thought it might be better to=
 break it off into a separate posting and to clarify my=20
question a little.

I asked if there is a how-to on creating images to practice with, basically=
 so that I can (in my spare time) work out the quirks in=20
what I am trying to do.

What I probably should have said was, what is the best way of setting up a =
drive in order to use it as a "forensic test case"?  In other words, if I w=
ant to have a drive that has X, Y, and Z items and then create the image (u=
sing dd) so that when I go to search the drive (using TSK, Autopsy, &/or ot=
her tools), I know that I should be able to find X, Y and Z, what is the be=
st way to go about that?  That way I can set up my own practice drive.

Barry, thanks for that reference guide - it looks like a great read, and I =
plan to use the .dd image for practice :)

Thanks for all the help!

-gg

--=20
_______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze