sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] Mounting a dd image under windows

[youcef b. <ybi...@ya...>]

Try Cygwin. it supports Sleuthkit too.

--- esrkq yahoo <es...@ya...> wrote:

> Hi Guys,
> slightly off topic but does anyone know of a utility
> that will mount a dd image under windows xp.
> 
> Thanks,
> JP
> 
> 
> 		
>
___________________________________________________________
> 
> How much free photo storage do you get? Store your
> holiday 
> snaps for FREE with Yahoo! Photos
> http://uk.photos.yahoo.com
> 
> 
>
-------------------------------------------------------
> This SF.Net email is sponsored by: NEC IT Guy Games.
>  How far can you shotput
> a projector? How fast can you ride your desk chair
> down the office luge track?
> If you want to score the big prize, get to know the
> little guy.  
> Play to win an NEC 61" plasma display:
> http://www.necitguy.com/?r=20
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 



		
___________________________________________________________ 
How much free photo storage do you get? Store your holiday 
snaps for FREE with Yahoo! Photos http://uk.photos.yahoo.com

[sleuthkit-users] Mounting a dd image under windows

[esrkq y. <es...@ya...>]

Hi Guys,
slightly off topic but does anyone know of a utility
that will mount a dd image under windows xp.

Thanks,
JP


		
___________________________________________________________ 
How much free photo storage do you get? Store your holiday 
snaps for FREE with Yahoo! Photos http://uk.photos.yahoo.com

Re: [sleuthkit-users] fls ext2fs_dinode_lookup error

[Angus M. <an...@n-...>]

On Wednesday 08 June 2005 00:38, Ed wrote:
<snip>
> I don't care too much now really, and this is probably more a samba
> question now, but shouldn't it work OK with a samba share? I can imagine
> plenty of scenarios where you don't have linux installs with large amounts
> of hdd space (e.g. running of a 'live' distro/toolkit) when it would be
> very helpful.
>
> Thanks
>
> Ed

ISTR going through this problem a few months ago - I think Samba suffers from 
a 2Gb file size limit so even if the file shows up, you can only access the 
first 2Gb - anyone know the current situation ? My "solution" to it is to 
keep some USB-IDE adapters around so I can attach drives directly to the 
analysis station.

RE: [sleuthkit-users] fls ext2fs_dinode_lookup error

[Ed <wh...@dm...>]

Thanks for the response, I was about to send a detailed email full of df's
fdisk -l's etc, but then I remembered that I was accessing the image through
a samba share to an XP machine, so I thought I'd try copying it onto the
local filesystem and suddenly all works :)  It's always the silly things
that get you.

I don't care too much now really, and this is probably more a samba question
now, but shouldn't it work OK with a samba share? I can imagine plenty of
scenarios where you don't have linux installs with large amounts of hdd
space (e.g. running of a 'live' distro/toolkit) when it would be very
helpful.

Thanks

Ed
-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Brian
Carrier
Sent: 07 June 2005 15:37
To: Ed
Cc: sle...@li...
Subject: Re: [sleuthkit-users] fls ext2fs_dinode_lookup error


On Jun 6, 2005, at 5:13 PM, Ed wrote:

> Hi
>
> I'm trying to recover some deleted files from an ext3 volume group 
> spanned
> across 2 physical disks on a CentOS 4 system.  I've done a dd of the
> volgroup (/dev/mapper/VolGroup00-LogVol00), but when I try to fls this 
> image
> (fls -f linux-ext3 -d image.dd) I get the following error:
>
> /usr/local/sleuthkit/bin/fls: ext2fs_dinode_lookup: Error reading inode
> 386305 from 322233664

This error occurs when it tries to read part of the image file that 
does not exist because the file is too small.  Are you sure the image 
file is the same size as the original spanned volume? Can you send me 
the first 25 or 30 lines of running fsstat on it?  Can you mount it 
read only using loopback?

brian



-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you
shotput
a projector? How fast can you ride your desk chair down the office luge
track?
If you want to score the big prize, get to know the little guy.  
Play to win an NEC 61" plasma display: http://www.necitguy.com/?r=20
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] fls ext2fs_dinode_lookup error

[Brian C. <ca...@sl...>]

On Jun 6, 2005, at 5:13 PM, Ed wrote:

> Hi
>
> I'm trying to recover some deleted files from an ext3 volume group 
> spanned
> across 2 physical disks on a CentOS 4 system.  I've done a dd of the
> volgroup (/dev/mapper/VolGroup00-LogVol00), but when I try to fls this 
> image
> (fls -f linux-ext3 -d image.dd) I get the following error:
>
> /usr/local/sleuthkit/bin/fls: ext2fs_dinode_lookup: Error reading inode
> 386305 from 322233664

This error occurs when it tries to read part of the image file that 
does not exist because the file is too small.  Are you sure the image 
file is the same size as the original spanned volume? Can you send me 
the first 25 or 30 lines of running fsstat on it?  Can you mount it 
read only using loopback?

brian

[sleuthkit-users] fls ext2fs_dinode_lookup error

[Ed <wh...@dm...>]

Hi

I'm trying to recover some deleted files from an ext3 volume group spanned
across 2 physical disks on a CentOS 4 system.  I've done a dd of the
volgroup (/dev/mapper/VolGroup00-LogVol00), but when I try to fls this image
(fls -f linux-ext3 -d image.dd) I get the following error:

/usr/local/sleuthkit/bin/fls: ext2fs_dinode_lookup: Error reading inode
386305 from 322233664

This error is also output to the autopsy console when doing file analysis
(which doesn't correctly list the contents of the partition)

Also fsstat gives a similar error from the 'image details' page in autopsy.

My suspicion is that this is something to do with the volume group, but I
can't find any suggestions on Google or the mailing list.

Can anyone provide any pointers on how to get this to work?

Many thanks

Ed

Re: [sleuthkit-users] File system detection issue with fsstat

[Brian C. <ca...@sl...>]

On Jun 6, 2005, at 10:58 AM, Jaime Chang wrote:

> Hi all,
>
> I run the fsstat command against an ext3 hard drive partition and I 
> got the following error:
>
>   fsstat: Cannot determine if EXT2/3 or FAT
>
> I am wondering if any of you guys have seen this before. Is this an 
> isolated case?... What are the probabilities that fsstat can not 
> detect the supported file systems?

This occurs when you have both a valid FAT boot sector (in sector 0) 
and a valid EXT2/3 superblock (in sectors 2 & 3).  Instead of assuming 
which you want to use, the tools will force you to specify.

This was covered in the last Informer:

http://www.sleuthkit.org/informer/sleuthkit-informer-20.html#autodetect

This can also occur with NTFS and Ext2/3 or UFS.  There are some test 
images on dftt.sf.net.

brian

[sleuthkit-users] File system detection issue with fsstat

[Jaime C. <jc...@id...>]

Hi all,

I run the fsstat command against an ext3 hard drive partition and I got 
the following error:

   fsstat: Cannot determine if EXT2/3 or FAT

I am wondering if any of you guys have seen this before. Is this an 
isolated case?... What are the probabilities that fsstat can not detect 
the supported file systems?

This is the output I get if I run fsstat -f fat against the same 
partition. Note: there is an error at the end...

FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: FAT32

OEM Name: MSDOS5.0
Volume ID: 0x7d2041b
Volume Label (Boot Sector): NO NAME
Volume Label (Root Directory):
File System Type Label: FAT32
Next Free Sector (FS Info): 4294986352
Free Sector Count (FS Info): 0

Sectors before file system: 63

File System Layout (in sectors)
Total Range: 0 - 39086081
* Reserved: 0 - 31
** Boot Sector: 0
** FS Info Sector: 1
** Backup Boot Sector: 6
* FAT 0: 32 - 9575
* FAT 1: 9576 - 19119
* Data Area: 19120 - 39086081
** Cluster Area: 19120 - 39086063
fsstat: getFAT: return cluster too large

Thanks in advance

Jimmy

[sleuthkit-users] Imaging Drives

[John C. <jca...@gm...>]

Thank you all for telling me what I feel I already knew regarding
Ghost. I will push harder to use another method.

John Castiglia

Re: [sleuthkit-users] Imaging Drives (From John Castiglia)

[Dave G. <all...@ya...>]

I would not use Ghost for forensic imaging.  As Angus
indicated, Ghost was not designed or marketed, as far
as I know, as a forensic imaging tool.  It's a great
tool for admins to have for production (not
investigative) drive copies, i.e., mass fielding of a
standard OS/applications load.

From my own experience, I would suggest using a tool
that performs a bitstream copy of the affected media. 
There are several commercial options available.  But,
dd is a good choice and there is at least one open
source version of an enhanced dd available that
provides for MD5 hashing as a drive is being imaged. 
Check Sourceforge.

Thought it important to emphasize Angus' point,
especially since there was a question about a chain of
custody document...

Good Luck

Dave Gilbert

--- Angus Marshall <an...@n-...> wrote:

> Google is your friend - Symantec have some guidance
> on it here :
> 
>
http://service1.symantec.com/SUPPORT/ghost.nsf/pfdocs/1999110813413225
> 
> 
> Personally, I like to steer clear of Ghost (even if
> it is capable of bitwise 
> imaging) because of the issue of proving the
> validity of the copy. There's 
> also the problem that, since it hasn't been designed
> as a forensic tool, it's 
> likely to be highly challengable if anything gets to
> court.
> 
> On Saturday 04 June 2005 17:15, Brian Carrier wrote:
> > [Posted on behalf of John.  Does anyone know the
> Ghost flags that can
> > make a raw image?]
> >
> >
> > Everyone,
> >
> > I am tasked with doing a forensic analysis of a
> drive. My boss thinks
> > that doing a ghost image (in DOS) of the drive
> would give me a exact
> > copy. I prefer to use dd but he feels that Ghost
> would do the same. Is
> > he correct? I know Brian has probably answered
> this question (privately
> > and publicly) a thousand times. I have glanced
> through the Informer
> > pages, but I did not see this issue specifically
> addressed anywhere
> > (unless I missed it). If it was in Informer please
> someone just point
> > me to the issue number. If not a link to a good
> explanantion would do
> > nicely.
> >
> > I am also looking for templates that people have
> been using throughout
> > the analysis. Right now I am looking for a good
> chain of custody
> > document.
> >
> > Any help is always appreciated!
> >
> > Cheers!
> > --
> > John Castiglia
> > Security Analyst
> >
> >
> >
> >
>
-------------------------------------------------------
> > This SF.Net email is sponsored by: NEC IT Guy
> Games.  How far can you
> > shotput a projector? How fast can you ride your
> desk chair down the office
> > luge track? If you want to score the big prize,
> get to know the little guy.
> > Play to win an NEC 61" plasma display:
> http://www.necitguy.com/?r=20
> > _______________________________________________
> > sleuthkit-users mailing list
> >
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> 
> 
>
-------------------------------------------------------
> This SF.Net email is sponsored by: NEC IT Guy Games.
>  How far can you shotput
> a projector? How fast can you ride your desk chair
> down the office luge track?
> If you want to score the big prize, get to know the
> little guy.  
> Play to win an NEC 61" plasma display:
> http://www.necitguy.com/?r=20
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 



		
__________________________________ 
Discover Yahoo! 
Find restaurants, movies, travel and more fun for the weekend. Check it out! 
http://discover.yahoo.com/weekend.html 

Re: [sleuthkit-users] Imaging Drives (From John Castiglia)

[Angus M. <an...@n-...>]

Google is your friend - Symantec have some guidance on it here :

http://service1.symantec.com/SUPPORT/ghost.nsf/pfdocs/1999110813413225


Personally, I like to steer clear of Ghost (even if it is capable of bitwise 
imaging) because of the issue of proving the validity of the copy. There's 
also the problem that, since it hasn't been designed as a forensic tool, it's 
likely to be highly challengable if anything gets to court.

On Saturday 04 June 2005 17:15, Brian Carrier wrote:
> [Posted on behalf of John.  Does anyone know the Ghost flags that can
> make a raw image?]
>
>
> Everyone,
>
> I am tasked with doing a forensic analysis of a drive. My boss thinks
> that doing a ghost image (in DOS) of the drive would give me a exact
> copy. I prefer to use dd but he feels that Ghost would do the same. Is
> he correct? I know Brian has probably answered this question (privately
> and publicly) a thousand times. I have glanced through the Informer
> pages, but I did not see this issue specifically addressed anywhere
> (unless I missed it). If it was in Informer please someone just point
> me to the issue number. If not a link to a good explanantion would do
> nicely.
>
> I am also looking for templates that people have been using throughout
> the analysis. Right now I am looking for a good chain of custody
> document.
>
> Any help is always appreciated!
>
> Cheers!
> --
> John Castiglia
> Security Analyst
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you
> shotput a projector? How fast can you ride your desk chair down the office
> luge track? If you want to score the big prize, get to know the little guy.
> Play to win an NEC 61" plasma display: http://www.necitguy.com/?r=20
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] TSK Unicode support

[Brian C. <ca...@sl...>]

Yes, you are correct.   The patches exist for NTFS Unicode, but that 
does not change the strings issue because they are separate tools.

brian

On Jun 4, 2005, at 7:21 AM, youcef bichbiche wrote:

> Hi,
> Am I right in conlcuding that TSK doesnt support
> UNICODE not just at the presentation layer i.e. is not
> capable of converting the retreived string into a
> format that preserves their state like UTF8, but also
> at the analysis layer because the underlying tools
> used dont support UNICODE.
>
> for instance the informer 8 article says that Autopsy
> will not find UNICODE strings because it uses the
> 'string' command which displays only ASCII strings. So
> running 'grep' with any regular expression is futile
> afterwrds as the damage is already done.

[sleuthkit-users] Imaging Drives (From John Castiglia)

[Brian C. <ca...@sl...>]

[Posted on behalf of John.  Does anyone know the Ghost flags that can 
make a raw image?]


Everyone,

I am tasked with doing a forensic analysis of a drive. My boss thinks 
that doing a ghost image (in DOS) of the drive would give me a exact 
copy. I prefer to use dd but he feels that Ghost would do the same. Is 
he correct? I know Brian has probably answered this question (privately 
and publicly) a thousand times. I have glanced through the Informer 
pages, but I did not see this issue specifically addressed anywhere 
(unless I missed it). If it was in Informer please someone just point 
me to the issue number. If not a link to a good explanantion would do 
nicely.

I am also looking for templates that people have been using throughout 
the analysis. Right now I am looking for a good chain of custody 
document.

Any help is always appreciated!

Cheers!
--
John Castiglia
Security Analyst

[sleuthkit-users] TSK Unicode support

[youcef b. <ybi...@ya...>]

Hi,
Am I right in conlcuding that TSK doesnt support
UNICODE not just at the presentation layer i.e. is not
capable of converting the retreived string into a
format that preserves their state like UTF8, but also
at the analysis layer because the underlying tools
used dont support UNICODE.

for instance the informer 8 article says that Autopsy
will not find UNICODE strings because it uses the
'string' command which displays only ASCII strings. So
running 'grep' with any regular expression is futile
afterwrds as the damage is already done.



	
	
		
___________________________________________________________ 
Yahoo! Messenger - NEW crystal clear PC to PC calling worldwide with voicemail http://uk.messenger.yahoo.com

Re: [sleuthkit-users] running `sorter' on raw filesystem

[Brian C. <ca...@sl...>]

On Jun 2, 2005, at 1:40 PM, ben scent wrote:

> Hello all,
>
> I am wondering if I can run `sorter' on a raw image with fstype of
> raw.

Nope.  Sorter uses the file system structure, so it needs to know a 
file system type.  Some of the TSK tools support raw because they do 
not really need to know file system details.  There are only a few 
tools that support raw.

> Right now the files I want
> to analyze with `sorter' are in a directory on my hard disk (I am
> running a Mac OS X system and they are on an HFS+ drive) but I know
> TSK can't work directly with a directory.

Use the following to get the file types:

# find . -exec file {} \;

brian

Re: [sleuthkit-users] TSK Unicode support

[Brian C. <ca...@sl...>]

On Jun 2, 2005, at 10:20 AM, Jaime Chang wrote:

> All,
>
> I know that TSK does not support Unicode (except for some patches).
>
> My main question is if this is just a limitation for presentation 
> (i.e. what the TSK command prints out) or for how the data is stored 
> internally.

Currently, it internally saves everything in ASCII.  The patches 
convert the NTFS names to UTF-8 and store them instead.  I have tried 
to do a global fix, but usually run out of time.  My goal eventually is 
to store both the ASCII and Unicode names in an internal data structure 
(as well as the short and long FAT names as we previously discussed).  
I have been waiting on this because I do not fully understand how UTF-8 
and UTF-16 and internally handled by the OS and within C.

brian

Re: [sleuthkit-users] running `sorter' on raw filesystem

[ben s. <ben...@gm...>]

Thanks for your help, Barry. Maybe this is not true for all TSK
utilities, but `fsstat' recognizes an fstype of raw. (Not exactly sure
what that means, though, so maybe I am approaching this wrong.)

Running `fsstat' without any options tells you:
valid fstypes are -- ufs, fat, ext, ntfs, raw, swap
valid imgtypes are -- raw, split


-ben


On 6/2/05, Barry J. Grundy <bg...@im...> wrote:
> On Thu, 2005-06-02 at 14:40 -0400, ben scent wrote:
> > I am wondering if I can run `sorter' on a raw image with fstype of
> > raw. I know that fstype of raw works with TSK (if I run `fsstat -f raw
> > IMAGEFILE' then it detects it), but running `sorter' with this command
> > says that I am using an invalid fstype:
> > `sorter -v -h -d ~ -f raw -i raw IMAGEFILE'
>=20
> I think you are confusing "imgtype" with "fstype".  You are specifying
> "raw" for both in your command above.
>=20
> imgtype refers to the *format* of the image.  A "raw" dd type image or a
> "split" image file set.
>=20
> fstype refers to the filesystem type.  NTFS, FAT, ext, etc.
>=20
> The "raw" disk image you created has the file system type you created on
> the CD.  Might not be supported by TSK (AFAIK).
>=20
> Barry
>=20
> --
> /***************************************
> Special Agent Barry J. Grundy
> NASA Office of Inspector General
> Computer Crimes Division
> Goddard Space Flight Center
> Code 190
> Greenbelt Rd.
> Greenbelt, MD 20771
> (301)286-3358
> **************************************/
>=20
>=20
>

Re: [sleuthkit-users] running `sorter' on raw filesystem

[Barry J. G. <bg...@im...>]

On Thu, 2005-06-02 at 14:40 -0400, ben scent wrote:
> I am wondering if I can run `sorter' on a raw image with fstype of
> raw. I know that fstype of raw works with TSK (if I run `fsstat -f raw
> IMAGEFILE' then it detects it), but running `sorter' with this command
> says that I am using an invalid fstype:
> `sorter -v -h -d ~ -f raw -i raw IMAGEFILE' 

I think you are confusing "imgtype" with "fstype".  You are specifying
"raw" for both in your command above.

imgtype refers to the *format* of the image.  A "raw" dd type image or a
"split" image file set.

fstype refers to the filesystem type.  NTFS, FAT, ext, etc.

The "raw" disk image you created has the file system type you created on
the CD.  Might not be supported by TSK (AFAIK).

Barry

-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/

[sleuthkit-users] running `sorter' on raw filesystem

[ben s. <ben...@gm...>]

Hello all,

I am wondering if I can run `sorter' on a raw image with fstype of
raw. I know that fstype of raw works with TSK (if I run `fsstat -f raw
IMAGEFILE' then it detects it), but running `sorter' with this command
says that I am using an invalid fstype:
`sorter -v -h -d ~ -f raw -i raw IMAGEFILE'=20

Am I doing something wrong, or can `sorter' not work with that kind of
image file the way the other TSK utilities can?

Here is what I am ultimately trying to do: I had a Linux ext2
partition with many problems on it. I don't have access to that disk
any more, but I have recovered some of the data and copied it onto a
CD. I have a bunch of files in one directory named based on the inode
they were formerly stored in on my disk, but now they have lost their
names and extensions, and I want to determine the file type of each.

I put these files on an ISO 9660 format CD-R. Then I used `dd' to make
a raw disk image:
`dd -if=3D/dev/disk1s0 -of=3DIMAGEFILE -conv=3Dnoerror, sync'

Can TSK work with a disk image made in this type of way? If not, how
can I create the right type of image file? Right now the files I want
to analyze with `sorter' are in a directory on my hard disk (I am
running a Mac OS X system and they are on an HFS+ drive) but I know
TSK can't work directly with a directory.

I am using SleuthKit 2.0.1.

Thanks for your help!

[sleuthkit-users] TSK Unicode support

[Jaime C. <jc...@id...>]

All,

I know that TSK does not support Unicode (except for some patches).

My main question is if this is just a limitation for presentation (i.e. 
what the TSK command prints out) or for how the data is stored internally.

Thanks in advance,

-- 
Jaime E. Chang
Software Engineer
[T]  407.999.9870 x18
[F]  407.999.9850

I.D.E.A.L. Technology Corporation
http://www.idealcorp.com

"The Leader in Linux and Open Source Solutions"

[sleuthkit-users] RE: [sleuthkit-developers] compile tsk 2.01 error cygwin

[Paul B. <ba...@fo...>]

Robert-Jan,

I just downloaded sleuthkit 2.01 to check for you.

Under my cygwin with the latest install of the tools (gcc, automake,
libtool ,autoconf, make and such) it compiles in one run without any
errors...

So I think it has to do with the version of your tools or an ommission
of one required tool in your cygwin install.

I hope this helps a bit..

Paul Bakker

> -----Original Message-----
> From: ro...@mo... [mailto:ro...@mo...]=20
> Sent: Wednesday 25 May 2005 6:02
> To: sle...@li...
> Cc: sle...@li...
> Subject: [sleuthkit-developers] compile tsk 2.01 error cygwin
>=20
> Hello,
>=20
> I want to compile the latest sleuthkit 2.01 under cygwin. But=20
> I keep getting error messages about magic file. Error messages:
>=20
> Error file could not find any magic files!
> Make 2 magic.mgc error 255?
>=20
> Has anyone been succesfull installing the latest TSK and autopsy?
>=20
>=20
> Thanks,
>=20
> RJM
>=20
>=20
>=20
>=20
> -------------------------------------------------------
> This SF.Net email is sponsored by Yahoo.
> Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
> Search APIs Find out how you can build Yahoo! directly into=20
> your own Applications - visit=20
> http://developer.yahoo.net/?fr=3Doffad-ysdn-ostg-q22005
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>=20

[sleuthkit-users] compile tsk 2.01 error cygwin

[<ro...@mo...>]

Hello,

I want to compile the latest sleuthkit 2.01 under cygwin. But I keep getting error
messages about magic file. Error messages:

Error file could not find any magic files!
Make 2 magic.mgc error 255?

Has anyone been succesfull installing the latest TSK and autopsy?


Thanks,

RJM

Re: [sleuthkit-users] Sigfind issue?

[Brian C. <ca...@sl...>]

On May 22, 2005, at 8:12 AM, Surago Jones wrote:

> Hi All,
>
> I am attempting to locate the JPEG end of file marker in an image file.
> The Signature for the end of file marker is 'ff d9' in hex.
>
> I can find this using hexdump and grep no worries, however I figured it
> would be easier to use sigfind.  However I'm not sure if I'm just doing
> something stupid or dumb, but for some reason I can't get it to work.

Currently, sigfind will not allow you to find this type of signature.  
sigfind currently needs to know the specific offset into a block that 
the signature should be found.  The footer signature for a JPEG is not 
at a constant offset and therefore you would need to try every offset 
value (which is not very effecient).  In the future, I guess I could 
assign '-o -1' to be an offset of "anywhere".

brian

> Below are some examples o fwhat I have tried without any luck
>
>
> # hexdump -C /forensics/images/sotm26/scan26 | grep "ff d9"
> 0000c150  88 88 08 88 80 88 88 3f  ff d9 00 00 00 00 00 00
> |.......?........|
> # ./sigfind ffd9 /forensics/images/sotm26/scan26
> Block size: 512  Offset: 0  Signature: FFD9
> # ./sigfind -l ffd9 /forensics/images/sotm26/scan26
> Block size: 512  Offset: 0  Signature: D9FF
>
> Any help here would be much appreciated. Cheers

[sleuthkit-users] Sigfind issue?

[Surago J. <su...@sj...>]

Hi All,

I am attempting to locate the JPEG end of file marker in an image file.
The Signature for the end of file marker is 'ff d9' in hex. =20

I can find this using hexdump and grep no worries, however I figured it
would be easier to use sigfind.  However I'm not sure if I'm just doing
something stupid or dumb, but for some reason I can't get it to work.

Below are some examples o fwhat I have tried without any luck


# hexdump -C /forensics/images/sotm26/scan26 | grep "ff d9"
0000c150  88 88 08 88 80 88 88 3f  ff d9 00 00 00 00 00 00
|.......?........|
# ./sigfind ffd9 /forensics/images/sotm26/scan26
Block size: 512  Offset: 0  Signature: FFD9
# ./sigfind -l ffd9 /forensics/images/sotm26/scan26
Block size: 512  Offset: 0  Signature: D9FF

Any help here would be much appreciated. Cheers

Surago.

RE: [sleuthkit-users] What are indirect blocks?

[Baskin, B. <ba...@dc...>]

Hi Aaron,
  Indirect blocks allow for larger file sizes within the Extended FS.  =
In a very basic summary, there are 15 pointers in an inode, and the =
first 12 act as direct pointers.  Each of these pointers holds an =
address to an 8K data block that stores the contents of the file.  =
However, by using just the 12 direct pointers, a file can only acheive =
96KB of size (12*8K). =20

The 13th pointer then acts as a single indirect.  This single indirect =
points to another 8KB data block, but instead of holding file contents, =
it is split into 2048 direct pointers (similar to the 12 in the inode).  =
Each of these 2048 pointers then point to an 8KB data block.  Using a =
single indirect pointer allows a file to acheive about 16MB of size =
((2048*8K)+96K).

The 14th pointer then acts as a double indirect.  This pointer holds the =
address for another 8KB data block, but instead of this data block =
containing contents or direct pointers, it contains 2048 single =
indirects.  So, each of these single indirects point to another 8KB data =
block that contains 2048 direct pointers.  All filled, a file can =
acheive 32GB of size. ((2048*2048*8K)+96K)

Along with the pattern, the 15th pointer acts as a triple indirect.  =
Each pointer points to a 8KB data block that contains 2048 double =
indirects, each of these points to a data block that contains 2048 =
single indirect, each of these point to a data block that contains 2048 =
directs, and each of these direct pointers point to a 8KB data block =
that contains file contents.  All said and done, around 70TB. =
((2048*2048*2048*8K)+96K)

I hope that helps a bit.  I found a simple diagram here: =
http://www.bb-zone.com/SLGFG/figures/Inode.gif

Now, from my limited experience, the istat tool will display all the =
direct pointers for a file.  It will follow each indirect stream and =
display the end direct pointers that they use, which is why it shows =
thousands and thousands of them.  As far as the error:
istat: Invalid address in indirect list (too large): 136081568

I can only guess that a corrupted value was placed in one of the =
pointers.  If it's an indirect pointer value that was corrupted, that =
could mean the loss of quite a bit of information (16MB), but when =
recovered it may not be too dramatic of a loss.  However, seeing as how =
the direct blocks are sequential, with none missing, it may just be the =
loss of a single direct pointer value, which can be insignificant once =
recovered.  I would try viewing the contents of the data blocks =
immediately before and after the error, either through the GUI or =
through dcat, and seeing if they report errors or seem bad:
	dcat -f ext AaronOldImage.ext3 534533 | less =20
	dcat -f ext AaronOldImage.ext3 534534 | less =20

To pull this file out, is the image a full disk image or a partition?  =
If a partition, just run:
	icat -f ext AaronOldImage.ext3 193 > file.dat

If part of a full disk image, get the offset of the filesystem by =
running:
	sfdisk -luS ./AaronOldImage.ext3

and record the Start sector of the partition that holds the file, then:
	icat -f ext -o <start sector> -i raw AaronOldImage.ext3 193 > file.dat



I welcome any opinions from the group if my information is wrong in any =
way, or could be made better :)

-BB

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...]On Behalf Of Aaron
Stone
Sent: Monday, May 16, 2005 2:59 AM
To: sle...@li...
Subject: [sleuthkit-users] What are indirect blocks?


Hey folks,

I've been Googling for days to try to recover what appears to be a =
pretty
bad image of my old 60GB /home partition. I've given up on e2retieve and
e2salvage, and am now working with TSK and e2extract:

http://dreamscape.org/toolkit/README.html

The scoop is that buried in this image is another image of my old =
laptop's
hard drive. I desperately need to grab a 6GB needle out of a 60GB
haystack.

What are indirect blocks, and what does this output from 'istat' mean?

bash$ istat AaronOldImage.ext3 193
inode: 193
Allocated
Group: 0
Generation Id: 4016250406
uid / gid: 0 / 0
mode: -rw-r--r--
Flags: Immutable,
size: 6045548544
num of links: 1

Inode Times:
Accessed:       Sun Jan 30 17:24:05 2005
File Modified:  Wed May 12 14:40:18 2004
Inode Modified: Wed May 12 14:42:13 2004

Direct Blocks:
9373 9600 9602 9603 9604 9605 9606 9799
[snip about 60 lines of block listings]
512422 512423 512424 534529 534530 534531 534532 534533
istat: Invalid address in indirect list (too large): 136081568
534534 534535 534536 534537=20
bash$

Thanks,
Aaron


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=3D7393&alloc_id=3D16281&op=3Dclick
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org