sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

[sleuthkit-users] Sorter

[Brian S. <Br...@Pe...>]

When trying to run the sorter on my image file, I am getting this error:
Missing Sleuth Kit fls executable:
/usr/local/src/Packages/sleuthkit-1.61/build-tree/sleuthkit-1.61//bin/fls.
Not sure what this means.  I am using TSK on Penquin Sleuth Bootable CD and
fls at the command line works totally fine.  
 

Re: [sleuthkit-users] Reporting, Autopsy Customization

[Brian C. <ca...@sl...>]

I'm not quite sure if I understand what you are looking for.  Are you 
looking to make a timeline of only image files and have the thumbnail 
in each timeline entry?  If so, that is actually a lot of work given 
the current design.  The timeline tool and file type sorting tool are 
completely separate.

It is fairly trivial to make the sorting output contain the MAC times 
next to the picture though.  The pictures would not be sorted by time.  
Is that what you are looking for?

brian



On Mar 18, 2005, at 12:50 PM, John T. Hoffoss wrote:

> So my foray into Autopsy/Sleuthkit has thus far been fairly
> successful. This engagement I've been involved in ultimately boils
> down to working with images found on a few systems. The image
> extraction was a huge help in this, but part of my work is to turn
> around and create a report for a client showing browsing activity. I'm
> modifying the output from image extraction, combined with the timeline
> output and the image data file to create files that will look
> something like:
>
> image1 thumb - timestamp1 - image1 data
> image2 thumb - timestamp1 - image2 data
> image3 thumb - timestamp1 - image3 data
> image2 thumb - timestamp2 - image2 data
> image4 thumb - timestamp1 - image4 data
> etc.
>
> Thus far, I've been manually copying names of images that I'll want to
> have included in this report for input into another script. Has anyone
> done something similar?
>
> How complex would it be to modify autopsy to include a check-box of
> some sort to generate trimmed thumbnail/data pages for interesting
> images to manipulate later, rather than my "copy url, paste into file,
> clean up file, script/filter data" sort of process?
>
> In extracting the images, would it be possible to include a reference
> to each timeline entry that prompted the inclusion of an image? Or in
> many cases, the repeating of an image?
>
> -John
>

[sleuthkit-users] Reporting, Autopsy Customization

[John T. H. <joh...@gm...>]

So my foray into Autopsy/Sleuthkit has thus far been fairly
successful. This engagement I've been involved in ultimately boils
down to working with images found on a few systems. The image
extraction was a huge help in this, but part of my work is to turn
around and create a report for a client showing browsing activity. I'm
modifying the output from image extraction, combined with the timeline
output and the image data file to create files that will look
something like:

image1 thumb - timestamp1 - image1 data
image2 thumb - timestamp1 - image2 data
image3 thumb - timestamp1 - image3 data
image2 thumb - timestamp2 - image2 data
image4 thumb - timestamp1 - image4 data
etc.

Thus far, I've been manually copying names of images that I'll want to
have included in this report for input into another script. Has anyone
done something similar?

How complex would it be to modify autopsy to include a check-box of
some sort to generate trimmed thumbnail/data pages for interesting
images to manipulate later, rather than my "copy url, paste into file,
clean up file, script/filter data" sort of process?

In extracting the images, would it be possible to include a reference
to each timeline entry that prompted the inclusion of an image? Or in
many cases, the repeating of an image?

-John

Re: [sleuthkit-users] TSK v2.00 and Autopsy v2.04 Released

[Brian C. <ca...@sl...>]

It did the conversion, but Autopsy didn't like the conversion.  I had a 
bug in the regular expression when it reads swap or raw entries created 
by the conversion.  Edit the host.aut file and add a space to the end 
and any word (it will be ignored).  i.e.

part vol5 img5 0 0 swap foo

thanks!

brian

On Mar 17, 2005, at 5:08 AM, Surago Jones wrote:

> Attached should be a copy of the Host.aut file.
>
> The Error I receive is as follows....
>
> Error: invalid entry in
> /forensics/thesis/ev.locker/ForensicChallenge01/apollo/host.aut:19
> part vol5 img5 0 0 swap

RE: [sleuthkit-users] TSK v2.00 and Autopsy v2.04 Released

[Surago J. <su...@sj...>]

Attached should be a copy of the Host.aut file.

The Error I receive is as follows....

Error: invalid entry in
/forensics/thesis/ev.locker/ForensicChallenge01/apollo/host.aut:19
part vol5 img5 0 0 swap

Note: This host is basically a test run using the Forensic Challenge
details from the Honeynet website.
(http://www.honeynet.org/challenge/index.html )

Cheers

Surago.

-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...]=20
Sent: Thursday, 17 March 2005 02:31
To: Surago Jones
Cc: sle...@li...
Subject: Re: [sleuthkit-users] TSK v2.00 and Autopsy v2.04 Released


It should convert the host file to the new format.  If you send me a=20
copy of it I can convert it and figure out why it didn't trigger the=20
conversion.  It is the host.aut file in the host directory.

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Linux T. <lin...@ya...>]

You should put this on the PSK forum because it
focuses on that, not Autopsy and The Sleuth Kit.

All we do here is guess, but Ernie created it so he
should have answer for you quickly.

Perhaps KDE is not starting with appropriate
permissions for you to write directories?  

-lt

--- Brian Starr <Br...@Pe...> wrote:

> OK, i mounted with write permissions from the
> command line and created a new
> directory from the command line, and it worked. 
> However, from within
> Konqueror, I still cannot create directories.  Why
> would that be?
> 
> -----Original Message-----
> From: Poldervaart, Christopher A
> [mailto:chr...@lm...]
> Sent: Wednesday, March 16, 2005 4:39 PM
> To: Brian Starr;
> sle...@li...
> Subject: RE: [sleuthkit-users] Help!! New to TSK and
> Linux
> 
> 
> Am I crazy...or is the latest release of the Penguin
> Sleuth Kit Live CD
> still from July of 2003?  Just curious, since I was
> going to download it
> to look into your write problems.  
> 
> Have you tried going into the terminal and mounting
> the device rw
> manually, such as mount -o rw /dev/hda1 /mnt/hda1 ?
> 
> I would try that (you'll need to unmount it first,
> of course)
> 
> The lost+found is normal with ext3.
> 
> 
> Chris A. Poldervaart
> 
> -----Original Message-----
> From: sle...@li...
> [mailto:sle...@li...]
> On Behalf Of Brian
> Starr
> Sent: Wednesday, March 16, 2005 5:17 PM
> To: sle...@li...
> Subject: RE: [sleuthkit-users] Help!! New to TSK and
> Linux
> 
> 
> OK - I created an ext3 partition and formatted it. 
> I rebooted with PSK
> disc in the cd rom.  I right clicked the hda1 hard
> disk I partitioned
> and formatted and deselected read only on the device
> tab.  If I now
> attempt to create a directory called 'Directory' on
> this drive, I get
> the error Access denied to /mnt/hda1/Directory . One
> other thing, there
> is a lost+found lock ed directory on this drive
> subsequent to
> formatting.  Is that normal?
> -----Original Message-----
> From: Enda Cronnolly [mailto:en...@co...]
> Sent: Wednesday, March 16, 2005 6:26 AM
> To: sle...@li...
> Subject: Re: [sleuthkit-users] Help!! New to TSK and
> Linux
> 
> 
> 
> Alan wrote:
> 
> 
> > Hi Brian, Yes, both NTFS and Ext3 filesystems
> support files much 
> > larger than 17 GB. NTFS I think is 2 TB, and Ext3
> 16 exibytes. Alan
> 
> I'm making an assumption here that you're going to
> continue running
> linux, and then of course writing anything to an
> NTFS parition is going
> to be problematic without a valid licenced copy of
> windows and a tool
> such as:
> http://www.jankratochvil.net/project/captive/
> 
>  -Enda.
> 
> 
> >
> >
> >
>
-------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> Read honest & candid 
> > reviews on hundreds of IT Products from real
> users.
> > Discover which products truly live up to the hype.
> Start reading now.
> >
>
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> > _______________________________________________
> > sleuthkit-users mailing list
> >
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >
> 
> 
> 
>
-------------------------------------------------------
> SF email is sponsored by - The IT Product Guide Read
> honest & candid
> reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype.
> Start reading now.
>
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
>
-------------------------------------------------------
> SF email is sponsored by - The IT Product Guide Read
> honest & candid
> reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype.
> Start reading now.
>
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
> 
>
-------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT
> Products from real users.
> Discover which products truly live up to the hype.
> Start reading now.
>
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 



		
__________________________________ 
Do you Yahoo!? 
Yahoo! Small Business - Try our new resources site!
http://smallbusiness.yahoo.com/resources/ 

Re: [sleuthkit-users] Help!! New to TSK and Linux

[Seth A. <sa...@im...>]

On Wed, Mar 16, 2005 at 04:16:54PM -0800, Brian Starr wrote:
> If I now attempt to create a directory called 'Directory' on this
> drive, I get the error Access denied to /mnt/hda1/Directory . One

File system permission semantics take some time to get used to. In order
for your user (lets call the account "brian" :) to create a directory in
/mnt/hda1, brian would need execute access to /mnt, to /mnt/hda1, and
write access to /mnt/hda1.

Run ls -ld / /mnt /mnt/hda1  -- this will show you information on all
three directories, so you can find out if you've got sufficient
permissions.

Typically, user accounts won't have such access to /mnt/<foo>.

> other thing, there is a lost+found lock ed directory on this drive
> subsequent to formatting.  Is that normal?

Every ext2 and ext3 filesystem has a lost+found directory, used when
running fsck(8). I've seen this idiom on other Unix systems, so it isn't
special to just ext2 and ext3, it is just those are the two filesystems
I use. :)

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Brian S. <Br...@Pe...>]

OK, i mounted with write permissions from the command line and created a new
directory from the command line, and it worked.  However, from within
Konqueror, I still cannot create directories.  Why would that be?

-----Original Message-----
From: Poldervaart, Christopher A
[mailto:chr...@lm...]
Sent: Wednesday, March 16, 2005 4:39 PM
To: Brian Starr; sle...@li...
Subject: RE: [sleuthkit-users] Help!! New to TSK and Linux


Am I crazy...or is the latest release of the Penguin Sleuth Kit Live CD
still from July of 2003?  Just curious, since I was going to download it
to look into your write problems.  

Have you tried going into the terminal and mounting the device rw
manually, such as mount -o rw /dev/hda1 /mnt/hda1 ?

I would try that (you'll need to unmount it first, of course)

The lost+found is normal with ext3.


Chris A. Poldervaart

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Brian
Starr
Sent: Wednesday, March 16, 2005 5:17 PM
To: sle...@li...
Subject: RE: [sleuthkit-users] Help!! New to TSK and Linux


OK - I created an ext3 partition and formatted it.  I rebooted with PSK
disc in the cd rom.  I right clicked the hda1 hard disk I partitioned
and formatted and deselected read only on the device tab.  If I now
attempt to create a directory called 'Directory' on this drive, I get
the error Access denied to /mnt/hda1/Directory . One other thing, there
is a lost+found lock ed directory on this drive subsequent to
formatting.  Is that normal?
-----Original Message-----
From: Enda Cronnolly [mailto:en...@co...]
Sent: Wednesday, March 16, 2005 6:26 AM
To: sle...@li...
Subject: Re: [sleuthkit-users] Help!! New to TSK and Linux



Alan wrote:


> Hi Brian, Yes, both NTFS and Ext3 filesystems support files much 
> larger than 17 GB. NTFS I think is 2 TB, and Ext3 16 exibytes. Alan

I'm making an assumption here that you're going to continue running
linux, and then of course writing anything to an NTFS parition is going
to be problematic without a valid licenced copy of windows and a tool
such as:
http://www.jankratochvil.net/project/captive/

 -Enda.


>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide Read honest & candid 
> reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide Read honest & candid
reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide Read honest & candid
reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Poldervaart, C. A <chr...@lm...>]

Am I crazy...or is the latest release of the Penguin Sleuth Kit Live CD
still from July of 2003?  Just curious, since I was going to download it
to look into your write problems.  

Have you tried going into the terminal and mounting the device rw
manually, such as mount -o rw /dev/hda1 /mnt/hda1 ?

I would try that (you'll need to unmount it first, of course)

The lost+found is normal with ext3.


Chris A. Poldervaart

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Brian
Starr
Sent: Wednesday, March 16, 2005 5:17 PM
To: sle...@li...
Subject: RE: [sleuthkit-users] Help!! New to TSK and Linux


OK - I created an ext3 partition and formatted it.  I rebooted with PSK
disc in the cd rom.  I right clicked the hda1 hard disk I partitioned
and formatted and deselected read only on the device tab.  If I now
attempt to create a directory called 'Directory' on this drive, I get
the error Access denied to /mnt/hda1/Directory . One other thing, there
is a lost+found lock ed directory on this drive subsequent to
formatting.  Is that normal?
-----Original Message-----
From: Enda Cronnolly [mailto:en...@co...]
Sent: Wednesday, March 16, 2005 6:26 AM
To: sle...@li...
Subject: Re: [sleuthkit-users] Help!! New to TSK and Linux



Alan wrote:


> Hi Brian, Yes, both NTFS and Ext3 filesystems support files much 
> larger than 17 GB. NTFS I think is 2 TB, and Ext3 16 exibytes. Alan

I'm making an assumption here that you're going to continue running
linux, and then of course writing anything to an NTFS parition is going
to be problematic without a valid licenced copy of windows and a tool
such as:
http://www.jankratochvil.net/project/captive/

 -Enda.


>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide Read honest & candid 
> reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide Read honest & candid
reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide Read honest & candid
reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Brian S. <Br...@Pe...>]

OK - I created an ext3 partition and formatted it.  I rebooted with PSK disc
in the cd rom.  I right clicked the hda1 hard disk I partitioned and
formatted and deselected read only on the device tab.  If I now attempt to
create a directory called 'Directory' on this drive, I get the error Access
denied to /mnt/hda1/Directory . One other thing, there is a lost+found lock
ed directory on this drive subsequent to formatting.  Is that normal?
-----Original Message-----
From: Enda Cronnolly [mailto:en...@co...]
Sent: Wednesday, March 16, 2005 6:26 AM
To: sle...@li...
Subject: Re: [sleuthkit-users] Help!! New to TSK and Linux



Alan wrote:


> Hi Brian, Yes, both NTFS and Ext3 filesystems support files much larger
> than 17 GB. NTFS I think is 2 TB, and Ext3 16 exibytes. Alan

I'm making an assumption here that you're going to continue running linux,
and then of course writing anything to an NTFS parition is going to be
problematic without a valid licenced copy of windows and a tool such as:
http://www.jankratochvil.net/project/captive/

 -Enda.


>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] sleuthkit on cygwin

[Alan <ts...@as...>]

Hi Youcef, Check out this document
http://www.memophage.net/Running_Sleuthkit_and_Autopsy_Under_Windows.pdf
I have TSK 1.73 and Autopsy 2.03 set up as described here. I'm sure there 
are probably limitations, but as a person learning forensics it seems to 
work fine. Alan

At 18:25 3/16/2005, you wrote:
>Hello there,
>I would like to share you experience on using
>sleuthkit.
>
>did anyone used sleuthkit and autopsy on cygwin, and
>if so is there any limitation comparatively to other
>linux environment.
>
>thanks
>
>youcef
>
>
>Send instant messages to your online friends http://uk.messenger.yahoo.com
>
>
>-------------------------------------------------------
>SF email is sponsored by - The IT Product Guide
>Read honest & candid reviews on hundreds of IT Products from real users.
>Discover which products truly live up to the hype. Start reading now.
>http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
>_______________________________________________
>sleuthkit-users mailing list
>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>http://www.sleuthkit.org

[sleuthkit-users] sleuthkit on cygwin

[youcef b. <ybi...@ya...>]

Hello there,
I would like to share you experience on using
sleuthkit.

did anyone used sleuthkit and autopsy on cygwin, and
if so is there any limitation comparatively to other
linux environment.

thanks

youcef


Send instant messages to your online friends http://uk.messenger.yahoo.com 

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Brian S. <Br...@Pe...>]

Hey thanks Brian.  This has been very helpful.

-----Original Message-----
From: Baskin, Brian [mailto:ba...@dc...]
Sent: Wednesday, March 16, 2005 4:57 AM
To: sle...@li...
Subject: RE: [sleuthkit-users] Help!! New to TSK and Linux


If you would like to continue using a FAT32 as an image repository, the
files need to be split.  To do this, leave off the "of=..." section of
dcfldd, and pipe the output to the split command.  Others have already
covered the aspect of using EXT2/3 or NTFS.
 
ie:  dcfldd if=/dev/hda1 conv=noerror,sync hashwindow=0 hashlog=hash.txt |
split -b 650m - /mnt/hdb1/image.
 
The above will create files called image.aa, image.ab, image.ac... in the
/mnt/hdb1 directory, each being 650MB (for burning to a CD).  You can change
the filename, and file size in that command line.  Now, with the new version
of Autopsy/TSK, you can import those split images directly into Autopsy
(/mnt/hdb/image.a*).   In prior version, they had to be concatenated back
together.  ie:  cat image.a* > image.dd
 
Creating an image vs. a clone is beneficial in that you don't need to keep a
cache of spare hard drives available.  All images can just be stored on one
large hard drive and analyzed from there.  When cloning, extra work, and
care, must be taken to each individial hard drive.  They have to be wiped
and verified prior to receiving data, and if the original hard drive is
smaller than then clone hard drive, there'll be an amount of slack space on
the clone drive.
 
Good luck!
 

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...]On Behalf Of Brian Starr
Sent: Tuesday, March 15, 2005 7:06 PM
To: 'sle...@li...'
Subject: [sleuthkit-users] Help!! New to TSK and Linux


Hi, I am new to Linux and have a lot of questions.  Any help is HUGELY
appreciated . . . here is what I am trying to do. 
IMAGING
I need to image a 17 Gig hard drive that is FAT32 (has Windows ME on it). I
am using the TSK bootable cd to do the imaging. My target drive is a FAT32
formatted hard disk that is partitioned several times - All FAT32. I am
using the following command: 

dcfldd if=/dev/hda1 of=/mnt/hdb1/image.dd conv=noerror,sync hashwindow=0
hashlog= hash.txt 

This stops after 2 Gigs of copying due to the FAT32 file size limit being
exceeded. How do I get around this? Is it even possible with any filesystem
to create a 17 Gig image file?  Would I use a formatted ext3 file system?  

What is the advantage of imaging a drive over just cloning it? In other
words, why would I want to create an image as opposed to a bit-for-bit copy
of one drive to another?  Does it allow the forensic analyses to be
performed quicker?  

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Brian S. <Br...@Pe...>]

Thanks Chris . . . what you are saying about imaging versus clone makes
complete sense.  I think I have decided with going to ext2 and copying the
17gig image to the ext2 file system.

-----Original Message-----
From: Poldervaart, Christopher A
[mailto:chr...@lm...]
Sent: Tuesday, March 15, 2005 6:08 PM
To: Br...@Pe...; sle...@li...
Subject: Re: [sleuthkit-users] Help!! New to TSK and Linux


One advantage of imaging a drive vs. cloning is the fact that with an image
you are simply creating a file (or files if you are splitting) on an
existing file system. This makes for portability.  You can copy the image
files, move them, mount them. With a clone you are tying up an entire
partition to create the cloned filesystem. I always image to file, then if
needed I can always blow that image off to a device for a cloned copy. 

  The best way to handle imaging to FAT32 is just to split the image during
the dd by piping the output to split.  The caveat with this is that mounting
multiple image files as one is a little more tricky, unless you are using a
tool like SMART, which is very good at seamlessly putting back together
chunks of images.  

Chris A. Poldervaart, Investigator
Lockheed Martin Corporation - EIS
Corporate Information Security Office
Computing System Investigations-CSI
3600 Ridgecrest Dr. Casper, WY 82604
Office:  307.265.2152
Cell:  307.258.1292

-----Original Message-----
From: sle...@li...
<sle...@li...>
To: 'sle...@li...'
<sle...@li...>
Sent: Tue Mar 15 17:05:50 2005
Subject: [sleuthkit-users] Help!!  New to TSK and Linux

Hi, I am new to Linux and have a lot of questions.  Any help is HUGELY
appreciated . . . here is what I am trying to do. 
IMAGING
I need to image a 17 Gig hard drive that is FAT32 (has Windows ME on it). I
am using the TSK bootable cd to do the imaging. My target drive is a FAT32
formatted hard disk that is partitioned several times - All FAT32. I am
using the following command: 

dcfldd if=/dev/hda1 of=/mnt/hdb1/image.dd conv=noerror,sync hashwindow=0
hashlog= hash.txt 

This stops after 2 Gigs of copying due to the FAT32 file size limit being
exceeded. How do I get around this? Is it even possible with any filesystem
to create a 17 Gig image file?  Would I use a formatted ext3 file system?  

What is the advantage of imaging a drive over just cloning it? In other
words, why would I want to create an image as opposed to a bit-for-bit copy
of one drive to another?  Does it allow the forensic analyses to be
performed quicker?  
Also, why wouldn't I use bs=8k as opposed bs=512?
 
AUTOPSY 
Because of the file size limit, I created a bit for bit clone of the disk,
from which I am attempting to use TSK forensic tools (which may or may not
be the correct approach).

So with that, I began using autopsy.  I added a new case.  Gave it a host
name of 192.168.1.1 and timezone of PST.  I then added an image location of
/dev/hda1, symlink as the import method, fstype of fat32, mounting point of
/mnt/hda1, and ignore md5.  Is this a correct setup?  With this setup I
began to use the autopsy tools with the following results:
 
-The keyword search didn't work - is this because I am using /mnt/hda1
instead of an image file?  Does this version of autopsy work using
/mnt/hda1?
-The sorter also did not work.  No output files in the directories
specified.  Is this also because I am not using an image as well?
 
GREP
Also, I have a general linux question.  Is there a way to speed up grep?  I
am searching the unallocated/slack space and it is taking forever . . . here
is the command I am using:
            tr '[:cntrl:]' '\n' < /dev/hda1 | grep -aib tonja /dev/hda1 >
grephits.txt
 
I would really like to use TSK - just need these issues addressed.  I really
want to use linux.  Heaven forbid purchasing a windows forensic software
package.  

Thanks so much in advance. 

Brian
 

Re: [sleuthkit-users] Help!! New to TSK and Linux

[Enda C. <en...@co...>]

Alan wrote:


> Hi Brian, Yes, both NTFS and Ext3 filesystems support files much larger
> than 17 GB. NTFS I think is 2 TB, and Ext3 16 exibytes. Alan

I'm making an assumption here that you're going to continue running linux,
and then of course writing anything to an NTFS parition is going to be
problematic without a valid licenced copy of windows and a tool such as:
http://www.jankratochvil.net/project/captive/

 -Enda.


>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] TSK v2.00 and Autopsy v2.04 Released

[Brian C. <ca...@sl...>]

On Mar 16, 2005, at 7:28 AM, Surago Jones wrote:

> Hi,
>
> I am just having a play around with TSK v2.00 and Autopsy v2.04 and 
> have
> come across a few issues/ideas/things...
>
> I assume that Host files are not transferable from earlier versions of
> Autopsy (Specifically talking about v2.01), as I get an invalid entry
> error when attempting to open a host that had been configured 
> previously
> with v2.01.

It should convert the host file to the new format.  If you send me a 
copy of it I can convert it and figure out why it didn't trigger the 
conversion.  It is the host.aut file in the host directory.

> This is okay, as for my testing it's not a big deal to set up the hosts
> again.  However in configuring the hosts when defining 'Image File
> Details' such as the File Integrity and File System Details it would be
> beneficial if the form displayed the name of the image file that had
> been entered on the previous form.  No major deal here, but in the half
> a second it takes to go from one form to the next my brain decided to
> forget what partition I was actually working on. :)  (Easy enough to
> find out, but it would be handy to have a visual reminder so I know 
> what
> image file I am actually configuring).

Good idea.  I just added a line with the "local name", which is 
'images/file_name.dd'.

Thanks!
brian

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Baskin, B. <ba...@dc...>]

If you would like to continue using a FAT32 as an image repository, the =
files need to be split.  To do this, leave off the "of=3D..." section of =
dcfldd, and pipe the output to the split command.  Others have already =
covered the aspect of using EXT2/3 or NTFS.
=20
ie:  dcfldd if=3D/dev/hda1 conv=3Dnoerror,sync hashwindow=3D0 =
hashlog=3Dhash.txt | split -b 650m - /mnt/hdb1/image.
=20
The above will create files called image.aa, image.ab, image.ac... in =
the /mnt/hdb1 directory, each being 650MB (for burning to a CD).  You =
can change the filename, and file size in that command line.  Now, with =
the new version of Autopsy/TSK, you can import those split images =
directly into Autopsy (/mnt/hdb/image.a*).   In prior version, they had =
to be concatenated back together.  ie:  cat image.a* > image.dd
=20
Creating an image vs. a clone is beneficial in that you don't need to =
keep a cache of spare hard drives available.  All images can just be =
stored on one large hard drive and analyzed from there.  When cloning, =
extra work, and care, must be taken to each individial hard drive.  They =
have to be wiped and verified prior to receiving data, and if the =
original hard drive is smaller than then clone hard drive, there'll be =
an amount of slack space on the clone drive.
=20
Good luck!
=20

-----Original Message-----
From: sle...@li... =
[mailto:sle...@li...]On Behalf Of Brian =
Starr
Sent: Tuesday, March 15, 2005 7:06 PM
To: 'sle...@li...'
Subject: [sleuthkit-users] Help!! New to TSK and Linux


Hi, I am new to Linux and have a lot of questions.  Any help is HUGELY =
appreciated . . . here is what I am trying to do.=20
IMAGING
I need to image a 17 Gig hard drive that is FAT32 (has Windows ME on =
it). I am using the TSK bootable cd to do the imaging. My target drive =
is a FAT32 formatted hard disk that is partitioned several times - All =
FAT32. I am using the following command:=20

dcfldd if=3D/dev/hda1 of=3D/mnt/hdb1/image.dd conv=3Dnoerror,sync =
hashwindow=3D0 hashlog=3D hash.txt=20

This stops after 2 Gigs of copying due to the FAT32 file size limit =
being exceeded. How do I get around this? Is it even possible with any =
filesystem to create a 17 Gig image file?  Would I use a formatted ext3 =
file system? =20

What is the advantage of imaging a drive over just cloning it? In other =
words, why would I want to create an image as opposed to a bit-for-bit =
copy of one drive to another?  Does it allow the forensic analyses to be =
performed quicker? =20

RE: [sleuthkit-users] TSK v2.00 and Autopsy v2.04 Released

[Surago J. <su...@sj...>]

Hi,

I am just having a play around with TSK v2.00 and Autopsy v2.04 and have
come across a few issues/ideas/things...

I assume that Host files are not transferable from earlier versions of
Autopsy (Specifically talking about v2.01), as I get an invalid entry
error when attempting to open a host that had been configured previously
with v2.01.

This is okay, as for my testing it's not a big deal to set up the hosts
again.  However in configuring the hosts when defining 'Image File
Details' such as the File Integrity and File System Details it would be
beneficial if the form displayed the name of the image file that had
been entered on the previous form.  No major deal here, but in the half
a second it takes to go from one form to the next my brain decided to
forget what partition I was actually working on. :)  (Easy enough to
find out, but it would be handy to have a visual reminder so I know what
image file I am actually configuring).

Anyways, those are just two issues/ideas/things I was having; I shall
continue my testing...

Fun fun fun.

Cheers

Surago.





-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Brian
Carrier
Sent: Wednesday, 16 March 2005 16:42
To: sle...@li...;
sle...@li...
Subject: [sleuthkit-users] TSK v2.00 and Autopsy v2.04 Released

New versions of the tools  are available!


TSK v2:
     *  Minor Bug Fixes
           o NTFS could go into an infinite loop if attribute list entry

was reallocated.
           o Last block group in ExtX fsstat output had incorrect=20
percentage of free blocks.
     * Major Updates
           o Support for split and disk images
           o File system type can be detected (-f no longer required)
           o New file system type names (for -f)
           o Updated internal design
           o New 'img_stat' tool to display details about the image file

format
           o New 'mmls' flag (-b) to print sizes in bytes
           o New 'mmstat' tool to give details about the volume (media=20
management) system
           o Non-printable charactors in UFS/ExtX names are replaced=20
with '.'
           o New Linux 'disk_sreset' tool to reset HPA on an ATA disk.
           o Renamed 'diskstat' to 'disk_stat' and 'sstrings' to=20
'srch_strings' to make names less cryptic.

MD5 Value: 757f76f245493ebff2d0daeb64f37b5d
http://www.sleuthkit.org/sleuthkit/download.php



Autopsy v2.04:
     *  Bug Fixes:
           o none.
     * Updates:
           o Disk and split image support
           o Timeline can be created in comma delimited format
           o File listing of NTFS searches for deleted files by parent=20
MFT entry
           o Notes now contain metadata from the file

MD5 Value: 776edcd060ea7a0f187f5732e6bfeacc
http://www.sleuthkit.org/autopsy/download.php

brian



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=3D6595&alloc_id=3D14396&op=3Dclick
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Help!! New to TSK and Linux

[Brian C. <ca...@sl...>]

On Mar 15, 2005, at 7:05 PM, Brian Starr wrote:
>
> AUTOPSY=A0
> Because of the file size limit, I created a bit for bit clone of the=20=

> disk, from which I am attempting to use TSK forensic tools (which may=20=

> or may not be the correct approach).
> So with that, I began using autopsy.=A0 I added a new case.=A0 Gave it =
a=20
> host name of 192.168.1.1 and timezone of PST.=A0 I then added an image=20=

> location of /dev/hda1, symlink as the import method, fstype of fat32,=20=

> mounting point of /mnt/hda1, and ignore md5.=A0 Is this a correct=20
> setup?=A0 With this setup I began to use the autopsy tools with the=20
> following results:

The image location should be the name of the file that you create using=20=

'dd' (or similar tool). The mounting point is the location where the=20
file system originally existed (i.e. C:\ or '/usr/').  It is cosmetic=20
only.

> =A0-The keyword search=A0didn't work=A0- is this because I am using=20
> /mnt/hda1 instead of an image file?=A0 Does this version of autopsy =
work=20
> using /mnt/hda1?

Can you be more specific about how it didn't work?  Did you run autopsy=20=

in live analysis mode or just with (./autopsy)?

> -The sorter also did not work.=A0 No output files in the directories=20=

> specified.=A0 Is this also because I am not using an image as well?

Are sure it completed?  It takes a while.  There should be an=20
index.html file that lists how many files existed, how many were=20
ignored, and which were put into different categories.

brian

[sleuthkit-users] TSK v2.00 and Autopsy v2.04 Released

[Brian C. <ca...@sl...>]

New versions of the tools  are available!


TSK v2:
     *  Minor Bug Fixes
           o NTFS could go into an infinite loop if attribute list entry 
was reallocated.
           o Last block group in ExtX fsstat output had incorrect 
percentage of free blocks.
     * Major Updates
           o Support for split and disk images
           o File system type can be detected (-f no longer required)
           o New file system type names (for -f)
           o Updated internal design
           o New 'img_stat' tool to display details about the image file 
format
           o New 'mmls' flag (-b) to print sizes in bytes
           o New 'mmstat' tool to give details about the volume (media 
management) system
           o Non-printable charactors in UFS/ExtX names are replaced 
with '.'
           o New Linux 'disk_sreset' tool to reset HPA on an ATA disk.
           o Renamed 'diskstat' to 'disk_stat' and 'sstrings' to 
'srch_strings' to make names less cryptic.

MD5 Value: 757f76f245493ebff2d0daeb64f37b5d
http://www.sleuthkit.org/sleuthkit/download.php



Autopsy v2.04:
     *  Bug Fixes:
           o none.
     * Updates:
           o Disk and split image support
           o Timeline can be created in comma delimited format
           o File listing of NTFS searches for deleted files by parent 
MFT entry
           o Notes now contain metadata from the file

MD5 Value: 776edcd060ea7a0f187f5732e6bfeacc
http://www.sleuthkit.org/autopsy/download.php

brian

Re: [sleuthkit-users] Help!! New to TSK and Linux

[Poldervaart, C. A <chr...@lm...>]

One advantage of imaging a drive vs. cloning is the fact that with an image you are simply creating a file (or files if you are splitting) on an existing file system. This makes for portability.  You can copy the image files, move them, mount them. With a clone you are tying up an entire partition to create the cloned filesystem. I always image to file, then if needed I can always blow that image off to a device for a cloned copy. 

  The best way to handle imaging to FAT32 is just to split the image during the dd by piping the output to split.  The caveat with this is that mounting multiple image files as one is a little more tricky, unless you are using a tool like SMART, which is very good at seamlessly putting back together chunks of images.  

Chris A. Poldervaart, Investigator
Lockheed Martin Corporation - EIS
Corporate Information Security Office
Computing System Investigations-CSI
3600 Ridgecrest Dr. Casper, WY 82604
Office:  307.265.2152
Cell:  307.258.1292

-----Original Message-----
From: sle...@li... <sle...@li...>
To: 'sle...@li...' <sle...@li...>
Sent: Tue Mar 15 17:05:50 2005
Subject: [sleuthkit-users] Help!!  New to TSK and Linux

Hi, I am new to Linux and have a lot of questions.  Any help is HUGELY appreciated . . . here is what I am trying to do. 
IMAGING
I need to image a 17 Gig hard drive that is FAT32 (has Windows ME on it). I am using the TSK bootable cd to do the imaging. My target drive is a FAT32 formatted hard disk that is partitioned several times - All FAT32. I am using the following command: 

dcfldd if=/dev/hda1 of=/mnt/hdb1/image.dd conv=noerror,sync hashwindow=0 hashlog= hash.txt 

This stops after 2 Gigs of copying due to the FAT32 file size limit being exceeded. How do I get around this? Is it even possible with any filesystem to create a 17 Gig image file?  Would I use a formatted ext3 file system?  

What is the advantage of imaging a drive over just cloning it? In other words, why would I want to create an image as opposed to a bit-for-bit copy of one drive to another?  Does it allow the forensic analyses to be performed quicker?  
Also, why wouldn't I use bs=8k as opposed bs=512?
 
AUTOPSY 
Because of the file size limit, I created a bit for bit clone of the disk, from which I am attempting to use TSK forensic tools (which may or may not be the correct approach).

So with that, I began using autopsy.  I added a new case.  Gave it a host name of 192.168.1.1 and timezone of PST.  I then added an image location of /dev/hda1, symlink as the import method, fstype of fat32, mounting point of /mnt/hda1, and ignore md5.  Is this a correct setup?  With this setup I began to use the autopsy tools with the following results:
 
-The keyword search didn't work - is this because I am using /mnt/hda1 instead of an image file?  Does this version of autopsy work using /mnt/hda1?
-The sorter also did not work.  No output files in the directories specified.  Is this also because I am not using an image as well?
 
GREP
Also, I have a general linux question.  Is there a way to speed up grep?  I am searching the unallocated/slack space and it is taking forever . . . here is the command I am using:
            tr '[:cntrl:]' '\n' < /dev/hda1 | grep -aib tonja /dev/hda1 > grephits.txt
 
I would really like to use TSK - just need these issues addressed.  I really want to use linux.  Heaven forbid purchasing a windows forensic software package.  

Thanks so much in advance. 

Brian
 

Re: [sleuthkit-users] Help!! New to TSK and Linux

[Alan <ts...@as...>]

Brian, I am not sure whether you can import a /dev file into Autopsy. But I 
do know all dead forensics analysis methodologies I've read import the 
image, not raw devices like /dev/hda1.

I do not know the answer to your question re grep. Alan

At 19:05 3/15/2005, you wrote:
>Hi, I am new to Linux and have a lot of questions.  Any help is HUGELY 
>appreciated . . . here is what I am trying to do.
>IMAGING
>I need to image a 17 Gig hard drive that is FAT32 (has Windows ME on it). 
>I am using the TSK bootable cd to do the imaging. My target drive is a 
>FAT32 formatted hard disk that is partitioned several times - All FAT32. I 
>am using the following command:
>
>dcfldd if=/dev/hda1 of=/mnt/hdb1/image.dd conv=noerror,sync hashwindow=0 
>hashlog= hash.txt
>
>This stops after 2 Gigs of copying due to the FAT32 file size limit being 
>exceeded. How do I get around this? Is it even possible with any 
>filesystem to create a 17 Gig image file?  Would I use a formatted ext3 
>file system?
>
>What is the advantage of imaging a drive over just cloning it? In other 
>words, why would I want to create an image as opposed to a bit-for-bit 
>copy of one drive to another?  Does it allow the forensic analyses to be 
>performed quicker?
>Also, why wouldn't I use bs=8k as opposed bs=512?
>
>AUTOPSY
>Because of the file size limit, I created a bit for bit clone of the disk, 
>from which I am attempting to use TSK forensic tools (which may or may not 
>be the correct approach).
>So with that, I began using autopsy.  I added a new case.  Gave it a host 
>name of 192.168.1.1 and timezone of PST.  I then added an image location 
>of /dev/hda1, symlink as the import method, fstype of fat32, mounting 
>point of /mnt/hda1, and ignore md5.  Is this a correct setup?  With this 
>setup I began to use the autopsy tools with the following results:
>
>-The keyword search didn't work - is this because I am using /mnt/hda1 
>instead of an image file?  Does this version of autopsy work using /mnt/hda1?
>-The sorter also did not work.  No output files in the directories 
>specified.  Is this also because I am not using an image as well?
>
>GREP
>Also, I have a general linux question.  Is there a way to speed up 
>grep?  I am searching the unallocated/slack space and it is taking forever 
>. . . here is the command I am using:
>             tr '[:cntrl:]' '\n' < /dev/hda1 | grep -aib tonja /dev/hda1 > 
> grephits.txt
>
>I would really like to use TSK - just need these issues addressed.  I 
>really want to use linux.  Heaven forbid purchasing a windows forensic 
>software package.
>
>Thanks so much in advance.
>
>Brian
>

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Brian S. <Br...@Pe...>]

Thanks so much.  Any insight on the TSK/autopsy issues I am having?

-----Original Message-----
From: Alan [mailto:ts...@as...]
Sent: Tuesday, March 15, 2005 4:50 PM
To: sle...@li...
Subject: Re: [sleuthkit-users] Help!! New to TSK and Linux


Hi Brian, Yes, both NTFS and Ext3 filesystems support files much larger 
than 17 GB. NTFS I think is 2 TB, and Ext3 16 exibytes. Alan



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Help!! New to TSK and Linux

[Alan <ts...@as...>]

Hi Brian, Yes, both NTFS and Ext3 filesystems support files much larger 
than 17 GB. NTFS I think is 2 TB, and Ext3 16 exibytes. Alan

RE: [sleuthkit-users] Help!! New to TSK and Linux

[Brian S. <Br...@Pe...>]

Thanks, Alan.  Ext3 will support a 17 gig file size?  NTFS as well?

-----Original Message-----
From: Alan [mailto:ts...@as...]
Sent: Tuesday, March 15, 2005 4:16 PM
To: sle...@li...
Subject: Re: [sleuthkit-users] Help!! New to TSK and Linux


Hi Brian, Here are a few answers to your first questions.

Imaging to a Fat32 partition...
Either split up the image (I don't know the specific syntax to do this 
specifically) or format your hdb1 output partition in a filesystem that 
supports larger files. Ext3 will work, NTFS will also.

 >What is the advantage of imaging a drive over just cloning it? In other 
words, why would I want to create an image as opposed to a bit-for->bit 
copy of one drive to another?

When you image using dd, you are creating a bit-for-bit copy. dd reads each 
raw sector from input and writes to output. I think the distinction is 
grey. I consider imaging generally as writing the bit-for-bit to a file, 
while cloning as writing a bit-for-bit image directly to a blank drive.

 >Also, why wouldn't I use bs=8k as opposed bs=512?

Larger block sizes generally makes the imaging go faster. HTH

Alan

At 19:05 3/15/2005, you wrote:
>Hi, I am new to Linux and have a lot of questions.  Any help is HUGELY 
>appreciated . . . here is what I am trying to do.
>IMAGING
>I need to image a 17 Gig hard drive that is FAT32 (has Windows ME on it). 
>I am using the TSK bootable cd to do the imaging. My target drive is a 
>FAT32 formatted hard disk that is partitioned several times - All FAT32. I 
>am using the following command:
>
>dcfldd if=/dev/hda1 of=/mnt/hdb1/image.dd conv=noerror,sync hashwindow=0 
>hashlog= hash.txt
>
>This stops after 2 Gigs of copying due to the FAT32 file size limit being 
>exceeded. How do I get around this? Is it even possible with any 
>filesystem to create a 17 Gig image file?  Would I use a formatted ext3 
>file system?
>
>What is the advantage of imaging a drive over just cloning it? In other 
>words, why would I want to create an image as opposed to a bit-for-bit 
>copy of one drive to another?  Does it allow the forensic analyses to be 
>performed quicker?
>Also, why wouldn't I use bs=8k as opposed bs=512?
>
>AUTOPSY
>Because of the file size limit, I created a bit for bit clone of the disk, 
>from which I am attempting to use TSK forensic tools (which may or may not 
>be the correct approach).
>So with that, I began using autopsy.  I added a new case.  Gave it a host 
>name of 192.168.1.1 and timezone of PST.  I then added an image location 
>of /dev/hda1, symlink as the import method, fstype of fat32, mounting 
>point of /mnt/hda1, and ignore md5.  Is this a correct setup?  With this 
>setup I began to use the autopsy tools with the following results:
>
>-The keyword search didn't work - is this because I am using /mnt/hda1 
>instead of an image file?  Does this version of autopsy work using
/mnt/hda1?
>-The sorter also did not work.  No output files in the directories 
>specified.  Is this also because I am not using an image as well?
>
>GREP
>Also, I have a general linux question.  Is there a way to speed up 
>grep?  I am searching the unallocated/slack space and it is taking forever 
>. . . here is the command I am using:
>             tr '[:cntrl:]' '\n' < /dev/hda1 | grep -aib tonja /dev/hda1 > 
> grephits.txt
>
>I would really like to use TSK - just need these issues addressed.  I 
>really want to use linux.  Heaven forbid purchasing a windows forensic 
>software package.
>
>Thanks so much in advance.
>
>Brian
>



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org