sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

[sleuthkit-users] New interim version

[Brian C. <ca...@sl...>]

There is a really stupid (but potentially serious) bug in 2.00 that can 
cause issues with icat and split images. It is caused by a simple typo 
and when icat is closing down, it MAY close the file handle for 
standard output, which means that you may not see the file output.  It 
doesn't always occur.  It depends on what happens to be in memory when 
the program closes.  I never saw the problem on my OS X system, but I 
did confirm the behavior on a Linux system and the original report came 
from a Linux system.   When using the command line, the content will be 
printed, but you can't redirect it and it will not be shown in Autopsy.

I want to wait a few days to release a new version in case there are 
any other little bugs in the new 2.00 features, but here is an interim 
patch / fix.  The new icat.c file can be found  at:

http://sleuthkit.sourceforge.net/sleuthkit/icat.c

Save it to src/fstools/ and recompile.  Or, the patch is here.  It is a 
simple fix (just the argument to img->close()).

--- sleuthkit-2.00/src/fstools/icat.c   Tue Mar 15 19:42:30 2005
+++ sleuthkit-03.24/src/fstools/icat.c  Thu Mar 24 21:51:16 2005
@@ -165,7 +165,7 @@
         fs_icat(fs, 0, inum, type, id, flags | FS_FLAG_FILE_NOID);

      fs->close(fs);
-    img->close(fs);
+    img->close(img);

      exit(0);
  }


brian

Re: [sleuthkit-users] Access from other than localhost?

[Brian C. <ca...@sl...>]

On Mar 25, 2005, at 11:11 AM, John T. Hoffoss wrote:
>
> autopsy.log:
> Thu Mar 24 17:18:12 2005: ERROR: Unauthorized Connection from: 
> 192.168.1.40
> Thu Mar 24 17:18:20 2005: ERROR: Unauthorized Connection from: 
> 192.168.1.40
> Thu Mar 24 17:18:20 2005: ERROR: Unauthorized Connection from: 
> 192.168.1.40
>
> This is the remote host I'm trying to connect to. I started autopsy
> with "autopsy -C ornthanc" (the computer name)

Try running with autopsy -C 192.168.1.40.  It may not be able to 
resolve the name to the IP.

brian

Re: [sleuthkit-users] Access from other than localhost?

[Linux T. <lin...@ya...>]

> 
> It's running on Gentoo, but no firewall issues; the
> host I'm trying to
> access autopsy from is on the LAN.
> 


So you can both SSH and/or VNC into that box that's
running Autopsy, yes?  




		
__________________________________ 
Do you Yahoo!? 
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/ 

Re: [sleuthkit-users] Access from other than localhost?

[John T. H. <joh...@gm...>]

On Thu, 24 Mar 2005 22:03:58 -0800 (PST), Linux Tard
<lin...@ya...> wrote:
> John
> 
> what you have for distribution?  Perhaps firewall
> preventing access to host running autopsy?  Perhaps
> you have xhosts file preventing access?

It's running on Gentoo, but no firewall issues; the host I'm trying to
access autopsy from is on the LAN.

Re: [sleuthkit-users] Access from other than localhost?

[John T. H. <joh...@gm...>]

On Thu, 24 Mar 2005 22:00:55 -0500, Brian Carrier <ca...@sl...> wrote:
> 
> On Mar 24, 2005, at 6:23 PM, John T. Hoffoss wrote:
> 
> > That's what I tried before; I'm getting "access deneid, connection
> > logged" messages though.
> >
> > Am I missing something? Is there a permission that needs to be set
> > somewhere?
> 
> What does the autopsy.log log file in the evidence locker say? It
> should report the IP address that it thinks you are coming from.

autopsy.log:
Thu Mar 24 17:18:12 2005: ERROR: Unauthorized Connection from: 192.168.1.40
Thu Mar 24 17:18:20 2005: ERROR: Unauthorized Connection from: 192.168.1.40
Thu Mar 24 17:18:20 2005: ERROR: Unauthorized Connection from: 192.168.1.40

This is the remote host I'm trying to connect to. I started autopsy
with "autopsy -C ornthanc" (the computer name)

Re: [sleuthkit-users] Access from other than localhost?

[Linux T. <lin...@ya...>]

John

what you have for distribution?  Perhaps firewall
preventing access to host running autopsy?  Perhaps
you have xhosts file preventing access?

-lt

--- "John T. Hoffoss" <joh...@gm...>
wrote:
> What must be done for me to access autopsy accross
> my LAN?
> 
> I tried changing "my $rema" from localhost to the
> hostname, and it
> generated a random string in the URL (which makes
> sense) but when my
> coworker attempted to access autopsy, it wouldn't
> allow him access.
> 
> -John
> 
> 
>
-------------------------------------------------------
> This SF.net email is sponsored by: 2005 Windows
> Mobile Application Contest
> Submit applications for Windows Mobile(tm)-based
> Pocket PCs or Smartphones
> for the chance to win $25,000 and application
> distribution. Enter today at
>
http://ads.osdn.com/?ad_id=6882&alloc_id=15148&op=click
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 


		
__________________________________ 
Do you Yahoo!? 
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/ 

Re: [sleuthkit-users] Access from other than localhost?

[Brian C. <ca...@sl...>]

On Mar 24, 2005, at 6:23 PM, John T. Hoffoss wrote:

> That's what I tried before; I'm getting "access deneid, connection
> logged" messages though.
>
> Am I missing something? Is there a permission that needs to be set 
> somewhere?

What does the autopsy.log log file in the evidence locker say? It 
should report the IP address that it thinks you are coming from.

brian

Re: [sleuthkit-users] Access from other than localhost?

[John T. H. <joh...@gm...>]

That's what I tried before; I'm getting "access deneid, connection
logged" messages though.

Am I missing something? Is there a permission that needs to be set somewhere?

Thanks,

-John


On Thu, 24 Mar 2005 01:06:49 -0500, Brian Carrier <ca...@sl...> wrote:
> 
> On Mar 23, 2005, at 9:34 AM, John T. Hoffoss wrote:
> 
> > What must be done for me to access autopsy accross my LAN?
> 
> Just supply the IP or host name on the command line. There is no need
> to modify the source code.
> 
> ./autopsy 192.168.1.12
> 
> > I tried changing "my $rema" from localhost to the hostname, and it
> > generated a random string in the URL (which makes sense) but when my
> > coworker attempted to access autopsy, it wouldn't allow him access.
> 
> You can use the '-C' flag to skip the random number.  The number is
> used by default for remote access as a "cookie".
> 
> brian
> 
> 


-- 
John T. Hoffoss

Re: [sleuthkit-users] Access from other than localhost?

[Brian C. <ca...@sl...>]

On Mar 23, 2005, at 9:34 AM, John T. Hoffoss wrote:

> What must be done for me to access autopsy accross my LAN?

Just supply the IP or host name on the command line. There is no need 
to modify the source code.

./autopsy 192.168.1.12

> I tried changing "my $rema" from localhost to the hostname, and it
> generated a random string in the URL (which makes sense) but when my
> coworker attempted to access autopsy, it wouldn't allow him access.

You can use the '-C' flag to skip the random number.  The number is 
used by default for remote access as a "cookie".

brian

Re: [sleuthkit-users] dls

[Brian C. <ca...@sl...>]

On Mar 23, 2005, at 12:33 PM, Brian Starr wrote:

> Hi everyone,
> =A0
> =46rom the command line, I used dls to extract the unallocated space=20=

> from my image file.=A0 I then used strings to pull=A0the text out=A0from=
 the=20
> dls file.=A0 I then used grep to do a keyword search.=A0 My question =
is=20
> what does the number (address) mean from the dls file?=A0

What number are you referring to?  Is the number from strings?  Or=20
grep?  If you extract the unallocated content, dls is not giving a=20
number.  If grep or stings is, then it is the byte offset.

> How can I go from the number=A0in the dls file to the exact location =
in=20
> the image?=A0

Check out the dcalc tool.  Its purpose is to calculate the location of=20=

a block in a dls image to a block in the original image.

> Also, does anyone know when the book, File System Forensic Analysis=20
> will be available?

It was shipped from the warehouse late last week, so it should be in=20
stores this week and it seems that those who ordered it from the=20
publisher already have it...

brian
 =20=

Re: [sleuthkit-users] dls

[Matthew M S. <mm...@ta...>]

Thanks for the info Jacob..

Now a review of the book would be really great....


M. Shannon

On Wed, 2005-03-23 at 15:19, Jacob Kitchel wrote:
> File System Forensic Analysis book:
> 
> I pre-ordered the book from www.awprofessional.com and received it in
> the mail yesterday. If you become a "member" of the site (which
> consists of signing up for a free account) they sell the book for
> $34.99. AW sends promotional codes for 35% off your next purchase in
> the notification emails too. Not to toot AW's horn, but it sure beats
> paying $49.99 at amazon or bn.com. (Hopefully, this doesn't take away
> from anything that you make Brian. Sorry.)
> 
> Jacob
> 
> 
> On Wed, 23 Mar 2005 09:33:13 -0800, Brian Starr <Br...@pe...> wrote:
> >  
> > Hi everyone, 
> >   
> > From the command line, I used dls to extract the unallocated space from my
> > image file.  I then used strings to pull the text out from the dls file.  I
> > then used grep to do a keyword search.  My question is what does the number
> > (address) mean from the dls file?  How can I go from the number in the dls
> > file to the exact location in the image?  Or, how would I get to the sector
> > that the data from the search resides in?  The image is fat32.  If someone
> > can offer explanation how to do this using the command line and autopsy,
> > that would really help out.  I reviewed the sleuth-kit informers, but was
> > unable to find how the specifics of how this could be done.  I obviously
> > need to study up on fat 32 file system.  Any help is mucho appreciated. 
> >   
> > Also, does anyone know when the book, File System Forensic Analysis will be
> > available? 
> >   
> > Thanks, 
> > Brian 
> >  
> > 
> >   
> >
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by Microsoft Mobile & Embedded DevCon 2005
> Attend MEDC 2005 May 9-12 in Vegas. Learn more about the latest Windows
> Embedded(r) & Windows Mobile(tm) platforms, applications & content.  Register
> by 3/29 & save $300 http://ads.osdn.com/?ad_id=6883&alloc_id=15149&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
-- 
Matthew M. Shannon, CIFI, CISSP
Principal 
Agile Risk Management LLC
www.agilerm.net
msh...@ag...
(c)813.732.5076
(o)1.877.AGILE13 (244.5313)

Re: [sleuthkit-users] dls

[Jacob K. <jac...@gm...>]

File System Forensic Analysis book:

I pre-ordered the book from www.awprofessional.com and received it in
the mail yesterday. If you become a "member" of the site (which
consists of signing up for a free account) they sell the book for
$34.99. AW sends promotional codes for 35% off your next purchase in
the notification emails too. Not to toot AW's horn, but it sure beats
paying $49.99 at amazon or bn.com. (Hopefully, this doesn't take away
from anything that you make Brian. Sorry.)

Jacob


On Wed, 23 Mar 2005 09:33:13 -0800, Brian Starr <Br...@pe...> wrote:
>  
> Hi everyone, 
>   
> From the command line, I used dls to extract the unallocated space from my
> image file.  I then used strings to pull the text out from the dls file.  I
> then used grep to do a keyword search.  My question is what does the number
> (address) mean from the dls file?  How can I go from the number in the dls
> file to the exact location in the image?  Or, how would I get to the sector
> that the data from the search resides in?  The image is fat32.  If someone
> can offer explanation how to do this using the command line and autopsy,
> that would really help out.  I reviewed the sleuth-kit informers, but was
> unable to find how the specifics of how this could be done.  I obviously
> need to study up on fat 32 file system.  Any help is mucho appreciated. 
>   
> Also, does anyone know when the book, File System Forensic Analysis will be
> available? 
>   
> Thanks, 
> Brian 
>  
> 
>   
>

[sleuthkit-users] dls

[Brian S. <Br...@Pe...>]

Hi everyone,
 
From the command line, I used dls to extract the unallocated space from my
image file.  I then used strings to pull the text out from the dls file.  I
then used grep to do a keyword search.  My question is what does the number
(address) mean from the dls file?  How can I go from the number in the dls
file to the exact location in the image?  Or, how would I get to the sector
that the data from the search resides in?  The image is fat32.  If someone
can offer explanation how to do this using the command line and autopsy,
that would really help out.  I reviewed the sleuth-kit informers, but was
unable to find how the specifics of how this could be done.  I obviously
need to study up on fat 32 file system.  Any help is mucho appreciated.
 
Also, does anyone know when the book, File System Forensic Analysis will be
available?
 
Thanks,
Brian

 

 

[sleuthkit-users] Access from other than localhost?

[John T. H. <joh...@gm...>]

What must be done for me to access autopsy accross my LAN?

I tried changing "my $rema" from localhost to the hostname, and it
generated a random string in the URL (which makes sense) but when my
coworker attempted to access autopsy, it wouldn't allow him access.

-John

Re: [sleuthkit-users] ifind bombing with max cpu

[Nico C. K. <nka...@gm...>]

Absolutely brilliant! I upgraded to the new versions of TSK and Autopsy 
and everything runs like a charm.
Brian, thank you very much...you're a scholar and a gentleman.

Cheers!

Nico



Brian Carrier wrote:

> Try the new version. This looks exactly like a bug that was fixed in 
> 2.00 that occurs when a deleted file with a non-resident attribute 
> list is processed and the attribute list has been overwritten. TSK 
> tries to process the new data as a list and gets stuck in a loop while 
> "advancing" by 0 each time.
>
> brian
>
>
>
>
> On Mar 22, 2005, at 3:05 PM, Nico C. Kalteis wrote:
>
>> Good afternoon!
>>
>> I have perused the archives and googled my eyes out but to no avail. 
>> I am hoping somebody on here has seen this and knows how to fix it:
>>
>> Problem:
>> -----------
>> Autopsy file analysis of a disk image remains stuck without listing 
>> any files whatsoever while the browser's status bar says 
>> "transferring...". "top" on the host shows 99% CPU usage by ifind. I 
>> killed Autopsy and proceeded to run ifind directly with the same 
>> parameters as Autopsy plus "-v". It ran fine for a few minutes at 
>> <10% CPU and then got stuck at an error message (see following) and 
>> 99% CPU.
>>
>> Error Message (and 20 preceeding lines from ifind -v output):
>> -------------------
>> ntfs_mft_lookup: Processing MFT 91425
>> ntfs_mft_lookup: Found in offset: 19829635 size: 82672 at offset: 
>> 38115328
>> ntfs_mft_lookup: Entry address at: 10190888448
>> fs_read_random: read byte offs 10190888448 len 1024 (mft read)
>> ntfs_mft_lookup: upd_seq 1 Replacing: 0006 With: 0000
>> ntfs_mft_lookup: upd_seq 2 Replacing: 0006 With: 1147
>> ntfs_proc_attrseq: Processing MFT 91425 (maybe)
>> ntfs_proc_attrseq: Resident Attribute in 91425 Type: 16 Id: 0 Name: N/A
>> ntfs_proc_attrseq: Non-Resident Attribute in 91425 Type: 32 Id: 6 
>> Name: N/A Start VCN: 0
>> ntfs_make_data_run: Len idx: 0 cur: 2 (2) tot: 2 (2)
>> ntfs_make_data_run: Off idx: 0 cur: 38 (26) tot: 38 (26)
>> ntfs_make_data_run: Off idx: 1 cur: 243 (f3) tot: 62246 (f326)
>> ntfs_make_data_run: Off idx: 2 cur: 6 (6) tot: 455462 (6f326)
>> ntfs_make_data_run: Signed offset: 455462 Previous address: 0
>> ntfs_proc_attrseq: Resident Attribute in 91425 Type: 48 Id: 3 Name: N/A
>> ntfs_proc_attrseq: Resident Attribute in 91425 Type: 48 Id: 2 Name: N/A
>> ntfs_proc_attrlist: MFT 91425
>> fs_read_block: read block 455462 offs 233196544 len 512 (data block)
>> fs_read_block: read block 7325743 offs 3750780416 len 512 (bmap)
>> ntfs_proc_attrlist: mft: 1174425602 type 1283502595 id 16 VCN: 
>> 1342177812
>> Invalid MFT file reference (1174425602) in the unallocated attribute 
>> list of MFT 91425
>>
>>
>> System specs:
>> ------------------
>> - x86
>> - 1GHz CPU
>> - 512MB RAM
>> - Red Hat Enterprise Linux AS4
>> - Sleuthkit 1.73
>> - Autopsy 2.03
>> - Perl 5.8.6 w/64bitint and large file support
>> - Apache 2.x
>>
>
>

Re: [sleuthkit-users] ifind bombing with max cpu

[Brian C. <ca...@ce...>]

Try the new version.  This looks exactly like a bug that was fixed in 
2.00 that occurs when a deleted file with a non-resident attribute list 
is processed and the attribute list has been overwritten.   TSK tries 
to process the new data as a list and gets stuck in a loop while 
"advancing" by 0 each time.

brian




On Mar 22, 2005, at 3:05 PM, Nico C. Kalteis wrote:

> Good afternoon!
>
> I have perused the archives and googled my eyes out but to no avail.  
> I am hoping somebody on here has seen this and knows how to fix it:
>
> Problem:
> -----------
> Autopsy file analysis of a disk image remains stuck without listing 
> any files whatsoever while the browser's status bar says 
> "transferring...".  "top" on the host shows 99% CPU usage by ifind.  I 
> killed Autopsy and proceeded to run ifind directly with the same 
> parameters as Autopsy plus "-v".  It ran fine for a few minutes at 
> <10% CPU and then got stuck at an error message (see following) and 
> 99% CPU.
>
> Error Message (and 20 preceeding lines from ifind -v output):
> -------------------
> ntfs_mft_lookup: Processing MFT 91425
> ntfs_mft_lookup: Found in offset: 19829635  size: 82672 at offset: 
> 38115328
> ntfs_mft_lookup: Entry address at: 10190888448
> fs_read_random: read byte offs 10190888448 len 1024 (mft read)
> ntfs_mft_lookup: upd_seq 1   Replacing: 0006   With: 0000
> ntfs_mft_lookup: upd_seq 2   Replacing: 0006   With: 1147
> ntfs_proc_attrseq: Processing MFT 91425 (maybe)
> ntfs_proc_attrseq: Resident Attribute in 91425 Type: 16 Id: 0 Name: N/A
> ntfs_proc_attrseq: Non-Resident Attribute in 91425 Type: 32 Id: 6 
> Name: N/A  Start VCN: 0
> ntfs_make_data_run: Len idx: 0 cur: 2 (2) tot: 2 (2)
> ntfs_make_data_run: Off idx: 0 cur: 38 (26) tot: 38 (26)
> ntfs_make_data_run: Off idx: 1 cur: 243 (f3) tot: 62246 (f326)
> ntfs_make_data_run: Off idx: 2 cur: 6 (6) tot: 455462 (6f326)
> ntfs_make_data_run: Signed offset: 455462 Previous address: 0
> ntfs_proc_attrseq: Resident Attribute in 91425 Type: 48 Id: 3 Name: N/A
> ntfs_proc_attrseq: Resident Attribute in 91425 Type: 48 Id: 2 Name: N/A
> ntfs_proc_attrlist: MFT 91425
> fs_read_block: read block 455462 offs 233196544 len 512 (data block)
> fs_read_block: read block 7325743 offs 3750780416 len 512 (bmap)
> ntfs_proc_attrlist: mft: 1174425602 type 1283502595 id 16  VCN: 
> 1342177812
> Invalid MFT file reference (1174425602) in the unallocated attribute 
> list of MFT 91425
>
>
> System specs:
> ------------------
> - x86
> - 1GHz CPU
> - 512MB RAM
> - Red Hat Enterprise Linux AS4
> - Sleuthkit 1.73
> - Autopsy 2.03
> - Perl 5.8.6 w/64bitint and large file support
> - Apache 2.x
>

[sleuthkit-users] ifind bombing with max cpu

[Nico C. K. <nka...@gm...>]

Good afternoon!

I have perused the archives and googled my eyes out but to no avail.  I 
am hoping somebody on here has seen this and knows how to fix it:

Problem:
-----------
Autopsy file analysis of a disk image remains stuck without listing any 
files whatsoever while the browser's status bar says "transferring...".  
"top" on the host shows 99% CPU usage by ifind.  I killed Autopsy and 
proceeded to run ifind directly with the same parameters as Autopsy plus 
"-v".  It ran fine for a few minutes at <10% CPU and then got stuck at 
an error message (see following) and 99% CPU.

Error Message (and 20 preceeding lines from ifind -v output):
-------------------
ntfs_mft_lookup: Processing MFT 91425
ntfs_mft_lookup: Found in offset: 19829635  size: 82672 at offset: 38115328
ntfs_mft_lookup: Entry address at: 10190888448
fs_read_random: read byte offs 10190888448 len 1024 (mft read)
ntfs_mft_lookup: upd_seq 1   Replacing: 0006   With: 0000
ntfs_mft_lookup: upd_seq 2   Replacing: 0006   With: 1147
ntfs_proc_attrseq: Processing MFT 91425 (maybe)
ntfs_proc_attrseq: Resident Attribute in 91425 Type: 16 Id: 0 Name: N/A
ntfs_proc_attrseq: Non-Resident Attribute in 91425 Type: 32 Id: 6 Name: 
N/A  Start VCN: 0
ntfs_make_data_run: Len idx: 0 cur: 2 (2) tot: 2 (2)
ntfs_make_data_run: Off idx: 0 cur: 38 (26) tot: 38 (26)
ntfs_make_data_run: Off idx: 1 cur: 243 (f3) tot: 62246 (f326)
ntfs_make_data_run: Off idx: 2 cur: 6 (6) tot: 455462 (6f326)
ntfs_make_data_run: Signed offset: 455462 Previous address: 0
ntfs_proc_attrseq: Resident Attribute in 91425 Type: 48 Id: 3 Name: N/A
ntfs_proc_attrseq: Resident Attribute in 91425 Type: 48 Id: 2 Name: N/A
ntfs_proc_attrlist: MFT 91425
fs_read_block: read block 455462 offs 233196544 len 512 (data block)
fs_read_block: read block 7325743 offs 3750780416 len 512 (bmap)
ntfs_proc_attrlist: mft: 1174425602 type 1283502595 id 16  VCN: 1342177812
Invalid MFT file reference (1174425602) in the unallocated attribute 
list of MFT 91425


System specs:
------------------
- x86
- 1GHz CPU
- 512MB RAM
- Red Hat Enterprise Linux AS4
- Sleuthkit 1.73
- Autopsy 2.03
- Perl 5.8.6 w/64bitint and large file support
- Apache 2.x

File to be analyzed:
-------------------------
30GB NTFS image from Windows XP laptop

Any insight would be greatly appreciated.

Thanks!

Nico Kalteis

[sleuthkit-users] Autopsy Add Host Bug

[Brian C. <ca...@sl...>]

I just came across a stupid bug in the new Autopsy that has an easy 
work around. I made it more simple in the last version to add new hosts 
and cases, but there is a bug when you add a host  to a case with no 
defined investigators.  After you add the host, it will try to bring 
you to the Add Image window, but will stop because it wants you to 
select an investigator name from an empty list...

There are some work arounds until the next version is released:

1. Create an investigator name for each case.

2.  Add '&inv=unknown' (without the quotes) to the end of the URL and 
hit enter (so that it loads the new URL).

3.  Go back several windows and go in the normal way.

brian

Re: [sleuthkit-users] Serial number of drive from dd image

[Matthew M S. <mm...@ta...>]

On Mon, 2005-03-21 at 13:58, Lisa Muir wrote:
> Hello group, 
> 
> I've recently been assigned a case where I will have the opportunity
> to examine a drive while supervised by the other side.
> 
> We're basically validating/refuting evidence that has already been presented. 
> 
> One thing that has been requested of me, is to verify the serial
> number of the drive in question - however, I'll only have access to
> the actual dd image, which is supposed to be a dd image of the entire
> device.
> 
> *if* the serial number was in there, where would I look? or how can I
> determine this?

Depends on the operating system...

Linux, I'd check the /var/log/messages file for the kernel boot
messages.

Windows..

Well, you might be stuck here, you can always check the event log files
for failed drive events, these typically append the physical drive label
and serial number to the event message. 

The registry is not going to be of much help, as the registry entries
that contain hardware specific data are mapped directly to memory, they
are not serialized to the disk (HKLM\HARDWARE,
HKEY_LOCAL_MACHINE\HARDWARE).

My next suggestion would be to look at the installed programs and see if
they are running any products that use the Hard drive serial number to
provide some manner of copy protection.

Good Luck!



-- 
Matthew M. Shannon, CIFI, CISSP
Principal 
Agile Risk Management LLC
www.agilerm.net
msh...@ag...
(c)813.732.5076
(o)1.877.AGILE13 (244.5313)

[sleuthkit-users] Serial number of drive from dd image

[Lisa M. <34....@gm...>]

Hello group, 

I've recently been assigned a case where I will have the opportunity
to examine a drive while supervised by the other side.

We're basically validating/refuting evidence that has already been presented. 

One thing that has been requested of me, is to verify the serial
number of the drive in question - however, I'll only have access to
the actual dd image, which is supposed to be a dd image of the entire
device.

*if* the serial number was in there, where would I look? or how can I
determine this?

I'd like to be prepared either way before I go under the spotlight. 

Thank you for any assistance you can provide...

Lisa.

Re: [sleuthkit-users] RE: sleuthkit-users digest, Vol 1 #277 - 2 msgs

[Brian C. <ca...@sl...>]

On Mar 21, 2005, at 9:14 AM, Reava, Jeffrey wrote:
>
> "%0\..\.." in Windows unfortunately is different than the output of
> 'pwd', since I might be sitting in a temp directory when running 
> sorter.
> To work in all situations, the path needs to be relative to the script
> directory, not the current directory.
>
> Stumped on this one, mostly for lack of really trying ...

That is why I did the full path.  For example, when autopsy runs 
sorter, it is being run from the autopsy directory (or somewhere else 
if autopsy is in their path).

I guess it is time to make a real installation process for the tools 
and put them in a specific location.  The tools can also have 
configuration files in /etc/ or /usr/local/etc/ so that autopsy does 
not have to ask where TSK is and the autopsy config file will live 
between installations....

brian

[sleuthkit-users] RE: sleuthkit-users digest, Vol 1 #277 - 2 msgs

[Reava, J. <jef...@pf...>]

Brian Carrier:

I've noticed this is a common problem among several Linux bootable CDs
that feature the sleuthkit. For the ones that do execute sorter
correctly, the workaround seems to be that the authors hard-code the
path statements in the script.

Is it (easily) available to use relative path references in perl, so
that the only relationship that needs to be maintained is that of the
sorter script to its executables?

If it were a windows script, here's how I'd handle it:

sorter.bat
bindir=%0\..\..\bin
..
%bindir%\fls
..

"%0\..\.." in Windows unfortunately is different than the output of
'pwd', since I might be sitting in a temp directory when running sorter.
To work in all situations, the path needs to be relative to the script
directory, not the current directory.

Stumped on this one, mostly for lack of really trying ... 

Jeff

--------------

On Mar 18, 2005, at 4:42 PM, Brian Starr wrote:
> When trying to run the sorter on my image file, I am getting this =20
> error:=A0 Missing Sleuth Kit fls executable: =20
>
/usr/local/src/Packages/sleuthkit-1.61/build-tree/sleuthkit-1.61//bin/=2
0=
> fls. 
> Bootable CD and fls at the command line works totally fine.=A0

It sounds like they moved the sleuth kit directory after compiling it.
=20=

Re: [sleuthkit-users] Reporting, Autopsy Customization

[Brian C. <ca...@sl...>]

I don't know of any other scripts to do what you are looking for.

As I mentioned in the previous e-mail, it is fairly easy to change the  
thumbnail page so that it includes more metadata, but it would still be  
sorted by file name and not by MAC time.

It is possible to add flagging capabilities to Autopsy, but I don't  
have it scheduled for a while...

brian


On Mar 18, 2005, at 5:00 PM, John T. Hoffoss wrote:

> On Fri, 18 Mar 2005 16:35:11 -0500, Brian Carrier  
> <ca...@sl...> wrote:
>> I'm not quite sure if I understand what you are looking for.  Are you
>> looking to make a timeline of only image files and have the thumbnail
>> in each timeline entry?  If so, that is actually a lot of work given
>> the current design.  The timeline tool and file type sorting tool are
>> completely separate.
>>
>> It is fairly trivial to make the sorting output contain the MAC times
>> next to the picture though.  The pictures would not be sorted by time.
>> Is that what you are looking for?
>>
>> brian
>
> Sort of, yes. Bear with me...I'll explain what *I'm* trying to do,
> then what I was talking about below.
>
> What I have done is this:
>
> I've gone through extracted images/thumbnails, copied & pasted
> references to each image (i.e.
> /mnt/evidence/case/host/output/sort-graphics../images/dd- 
> filename.dat2-58389-128-4.jpg)
> and will (when done) strip up to /dd-filename... (or use a regex) to
> get just the filename.
>
> I'll then run this file through a script a coworker and I have been
> working on which will extract entries from images.html (the file
> containing Linux, Windows paths, image data, etc.) for only the images
> I specify and output these to a new file.
>
> We then ran the autopsy-generated timeline file through a script that
> put the date/time next to each individual MAC time in the file so each
> line indicates the date/time of each activity.
>
> We'll then run these two files through another script that is nearly
> working to make a new HTML table that will copy the info block for
> each image in chronological order (so there will be multipe copies of
> each image's entry). In addition, we're going to parse through some
> proxy logs to see if we can find this activity in them.
>
> Ultimately, I want a document that allows me to show that the
> browsing/image-viewing habits of an individual known to look at
> material of this individual's computer. This guy spent a lot of time
> looking at mundane stuff of one specific type (we'll say puppies
> here...) and we found some adult materials as well. I want to link the
> adult stuff to him in arbitration by denying him the chance to say it
> was someone else looking at the adult stuff, he just looked at
> puppies. This document should be able to do that.
>
> So, it might show the following (with a screenshot of each):
> Jan 01 14:30 puppy3.jpg
> Jan 01 14:30 cute-puppy4.jpg
> Jan 01 14:31 puppy5.jpg
> Jan 01 14:32 naked-lady21.jpg
> Jan 01 14:33 puppy6.jpg
> Jan 01 14:34 puppy7.jpg
> Jan 01 14:34 naked-lady17.jpg
> Jan 01 14:35 puppy8.jpg
>
> And then, to make this more usable for me, I'd include file location
> info off to the right of this. So each entry might be:
>
> [thumbnail]  [date/time]  [filename]  [path to file]  [proxy log entry]
>
> ----
> So what I'm trying to ask:
>
> Has anyone done something similar?
>
> Is there a way, in autopsy, to add an "interesting" checkbox which
> flags it for filtering somewhere? That way I don't have to copy/paste
> each individual image reference for my scripts. It's time-intensive
> enough that I have to look through 600 pages of images to do this...
>
> This if this was done, I could just run that output list of
> image-names and find each relevant entry in the timeline. That, or
> include that information in the generated images.html file that you
> already generate. That way, I can at least see what/why this guy did
> something to gerneate six entries of the same image in a relatively
> short amount of time.
>
> Does that make sense? Perhaps I need to wait til Monday morning to
> explain this stuff...

Re: [sleuthkit-users] Sorter

[Brian C. <ca...@sl...>]

On Mar 18, 2005, at 4:42 PM, Brian Starr wrote:

> When trying to run the sorter on my image file, I am getting this =20
> error:=A0 Missing Sleuth Kit fls executable: =20
> /usr/local/src/Packages/sleuthkit-1.61/build-tree/sleuthkit-1.61//bin/=20=

> fls.=A0 Not sure what this means.=A0 I am using TSK on Penquin Sleuth =20=

> Bootable CD and fls at the command line works totally fine.=A0

It sounds like they moved the sleuth kit directory after compiling it.  =20=

I don't have a copy of PSK, so I can't help you much (note that the =20
Penguin Sleuth Kit has nothing to do with The Sleuth Kit).

brian

Re: [sleuthkit-users] Reporting, Autopsy Customization

[John T. H. <joh...@gm...>]

On Fri, 18 Mar 2005 16:35:11 -0500, Brian Carrier <ca...@sl...> wrote:
> I'm not quite sure if I understand what you are looking for.  Are you
> looking to make a timeline of only image files and have the thumbnail
> in each timeline entry?  If so, that is actually a lot of work given
> the current design.  The timeline tool and file type sorting tool are
> completely separate.
> 
> It is fairly trivial to make the sorting output contain the MAC times
> next to the picture though.  The pictures would not be sorted by time.
> Is that what you are looking for?
> 
> brian

Sort of, yes. Bear with me...I'll explain what *I'm* trying to do,
then what I was talking about below.

What I have done is this:

I've gone through extracted images/thumbnails, copied & pasted
references to each image (i.e. 
/mnt/evidence/case/host/output/sort-graphics../images/dd-filename.dat2-58389-128-4.jpg)
and will (when done) strip up to /dd-filename... (or use a regex) to
get just the filename.

I'll then run this file through a script a coworker and I have been
working on which will extract entries from images.html (the file
containing Linux, Windows paths, image data, etc.) for only the images
I specify and output these to a new file.

We then ran the autopsy-generated timeline file through a script that
put the date/time next to each individual MAC time in the file so each
line indicates the date/time of each activity.

We'll then run these two files through another script that is nearly
working to make a new HTML table that will copy the info block for
each image in chronological order (so there will be multipe copies of
each image's entry). In addition, we're going to parse through some
proxy logs to see if we can find this activity in them.

Ultimately, I want a document that allows me to show that the
browsing/image-viewing habits of an individual known to look at
material of this individual's computer. This guy spent a lot of time
looking at mundane stuff of one specific type (we'll say puppies
here...) and we found some adult materials as well. I want to link the
adult stuff to him in arbitration by denying him the chance to say it
was someone else looking at the adult stuff, he just looked at
puppies. This document should be able to do that.

So, it might show the following (with a screenshot of each):
Jan 01 14:30 puppy3.jpg
Jan 01 14:30 cute-puppy4.jpg
Jan 01 14:31 puppy5.jpg
Jan 01 14:32 naked-lady21.jpg
Jan 01 14:33 puppy6.jpg
Jan 01 14:34 puppy7.jpg
Jan 01 14:34 naked-lady17.jpg
Jan 01 14:35 puppy8.jpg

And then, to make this more usable for me, I'd include file location
info off to the right of this. So each entry might be:

[thumbnail]  [date/time]  [filename]  [path to file]  [proxy log entry]

----
So what I'm trying to ask:

Has anyone done something similar?

Is there a way, in autopsy, to add an "interesting" checkbox which
flags it for filtering somewhere? That way I don't have to copy/paste
each individual image reference for my scripts. It's time-intensive
enough that I have to look through 600 pages of images to do this...

This if this was done, I could just run that output list of
image-names and find each relevant entry in the timeline. That, or
include that information in the generated images.html file that you
already generate. That way, I can at least see what/why this guy did
something to gerneate six entries of the same image in a relatively
short amount of time.

Does that make sense? Perhaps I need to wait til Monday morning to
explain this stuff...