sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: AW: [sleuthkit-users] Win98 registry

[<sec...@hu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

RegDat did the trick.  Thanks a bunch. In fact, I did not see this
documented anywhere but there were three registry files from the
Windows 98 c:\Windows directory that RegDat was able to view:
system.dat, user.dat and hwinfo.dat (there was no policy.pol file):

system.dat === HKEY_LOCAL_MACHINE
user.dat ===== HKEY_CURRENT_USER
hwinfo.dat === HKEY_USERS

I installed RegDat on a Win2K machine and copied the *.dat files
over and examined them there.

Again, very helpful.

Regards,

SH

On Thu, 10 Feb 2005 05:16:35 -0800 =?iso-8859-1?Q?Marcus_M=FCller?=
<mu...@lo...> wrote:
>You can use Regdat from H.Ulbrich for Windows 98 (or RegdatXP for
>other
>Windows versions) to view the registry from system.dat and
>user.dat files
>only. You can either extract these files via sleuthkit/autopsy
>from a dd
>image or use a BartPE Boot CD to access these files. In the latter
>case you
>should always use a VMWare with a copy of the image as BartPE
>modifies the
>file system and thus the MD5 values of the image changes.
>
>Marcus
>
>> -----Ursprüngliche Nachricht-----
>> Von: sle...@li...
>> [mailto:sle...@li...] Im
>> Auftrag von sec...@hu...
>> Gesendet: Mittwoch, 9. Februar 2005 16:44
>> An: sle...@li...
>> Betreff: [sleuthkit-users] Win98 registry
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Is there a way to view the Windows 98 (or any other version)
>> registry with Sleuthkit? If not, anyone know of a
>> tool/technique (e.g. vmware) where I can mount an image
>> read-only and view its registry?
>>
>> Thanks,
>>
>> SH
>> -----BEGIN PGP SIGNATURE-----
>> Note: This signature can be verified at
>> https://www.hushtools.com/verify
>> Version: Hush 2.4
>>
>>
>wkYEARECAAYFAkIJ6ZIACgkQRBFe1uc9INpPFACaAhldqv0Yb2JxlqmJwsq0Hn3+rao
>A
>> niw5NrV1kq+QyP5nerbhPF7qC0ZA
>> =YNxW
>> -----END PGP SIGNATURE-----
>>
>>
>>
>> -------------------------------------------------------
>> SF email is sponsored by - The IT Product Guide Read honest &
>> candid reviews on hundreds of IT Products from real users.
>> Discover which products truly live up to the hype. Start reading
>now.
>> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>
>
>
>-------------------------------------------------------
>SF email is sponsored by - The IT Product Guide
>Read honest & candid reviews on hundreds of IT Products from real
>users.
>Discover which products truly live up to the hype. Start reading
>now.
>http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
>_______________________________________________
>sleuthkit-users mailing list
>https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>http://www.sleuthkit.org
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkIOvuwACgkQRBFe1uc9INrf2ACgt4I/b9QCCYw8ywThvBQgo2lj8F0A
niDdmfI+SsqMKeqLzZI8mCE31a39
=F2rH
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Win98 registry

[Nathan C. <na...@cc...>]

On Wed, 2005-02-09 at 07:44 -0800, sec...@hu... wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Is there a way to view the Windows 98 (or any other version)
> registry with Sleuthkit? If not, anyone know of a tool/technique
> (e.g. vmware) where I can mount an image read-only and view its
> registry?
> 
> Thanks,
> 
> SH

Off the top of my head two programs exist on linux that understand the
windows registry format;

This is primarily concerned with editing NT hashes but obviously
understands the reg format;

http://home.eunet.no/~pnordahl/ntpasswd/editor.html

and this one which mounts registry files under linux (which I think is a
much better idea as it allows searching etc using standard fs tools
(grep etc.);

http://www.bindview.com/Support/RAZOR/Utilities/Unix_Linux/ntreg_readme.cfm

unfortunately it hasn't been updated for a while and only runs on
2.2/2.3 kernels although I did hack it to run on 2.4.

regards,

Nathan.
---
Computer Crime Consultants Ltd
http://www.ccc-ltd.com

Support the fight against software patents:
http://www.NoSoftwarePatents.com
http://swpat.ffii.org

AW: [sleuthkit-users] Win98 registry

[<mu...@lo...>]

You can use Regdat from H.Ulbrich for Windows 98 (or RegdatXP for other
Windows versions) to view the registry from system.dat and user.dat =
files
only. You can either extract these files via sleuthkit/autopsy from a dd
image or use a BartPE Boot CD to access these files. In the latter case =
you
should always use a VMWare with a copy of the image as BartPE modifies =
the
file system and thus the MD5 values of the image changes.

Marcus

> -----Urspr=FCngliche Nachricht-----
> Von: sle...@li...=20
> [mailto:sle...@li...] Im=20
> Auftrag von sec...@hu...
> Gesendet: Mittwoch, 9. Februar 2005 16:44
> An: sle...@li...
> Betreff: [sleuthkit-users] Win98 registry
>=20
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>=20
> Is there a way to view the Windows 98 (or any other version)=20
> registry with Sleuthkit? If not, anyone know of a=20
> tool/technique (e.g. vmware) where I can mount an image=20
> read-only and view its registry?
>=20
> Thanks,
>=20
> SH
> -----BEGIN PGP SIGNATURE-----
> Note: This signature can be verified at=20
> https://www.hushtools.com/verify
> Version: Hush 2.4
>=20
> wkYEARECAAYFAkIJ6ZIACgkQRBFe1uc9INpPFACaAhldqv0Yb2JxlqmJwsq0Hn3+raoA
> niw5NrV1kq+QyP5nerbhPF7qC0ZA
> =3DYNxW
> -----END PGP SIGNATURE-----
>=20
>=20
>=20
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide Read honest &=20
> candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=3D6595&alloc_id=3D14396&op=3Dclick
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Win98 registry

[Jon N. <qu...@li...>]

Seth Arnold said:
> On Wed, Feb 09, 2005 at 07:44:29AM -0800, sec...@hu... wrote=
:
>> Is there a way to view the Windows 98 (or any other version)
>> registry with Sleuthkit? If not, anyone know of a tool/technique (e.g.
vmware) where I can mount an image read-only and view its registry?
>
> You could extract the registry files (memory fails me, but osmething
like user.dat and system.dat comes to mind) from the system using
sleuthkit and then import them into another windows ssystem for viewing.

Uhhhhh...Just so you know that will hose the current registry on the Win9=
8
box.  From
http://www.microsoft.com/technet/archive/win98/maintain/reg.mspx :

----------------------snip-------------------snip------------------------=
--

Often, the best tools for the job aren't programs at all; they're scripts=
,
INF files, and REG files. You use these files to specify changes to the
Registry. When you run, install, or import these files, the operating
system implements the changes that you describe in the file. These are
particularly hard-working tools for administrators because they enable yo=
u
to distribute changes to users across the network.

----------------------snip-------------------snip------------------------=
--

If you make a backup before you import and then restore it before
rebooting you should be ok.

That page has info on some Window$ tools to parse the registry.

Jon
>
> (I think encase has history tools for the registry, but i can't promise
that.)
>

Re: [sleuthkit-users] Win98 registry

[Seth A. <sa...@im...>]

On Wed, Feb 09, 2005 at 07:44:29AM -0800, sec...@hu... wrote:
> Is there a way to view the Windows 98 (or any other version)
> registry with Sleuthkit? If not, anyone know of a tool/technique
> (e.g. vmware) where I can mount an image read-only and view its
> registry?

You could extract the registry files (memory fails me, but osmething
like user.dat and system.dat comes to mind) from the system using
sleuthkit and then import them into another windows ssystem for viewing.

(I think encase has history tools for the registry, but i can't promise
that.)

RE: [sleuthkit-users] Win98 registry

[Schmitt, B. <ben...@td...>]

There are a couple of options but none appear to be easy right now:

1. A component of the Wine project appears to have registry support
beginning with Windows 3.1: registry.c  The source can be found in the misc
directory of the latest Wine tarball.  It appears not to be a standalone
tool but a component of Wine itself - re-coding will be required.

2. Peter Nordahl's NT password tool may help but its support of the Win98
registry is unknown:

http://home.eunet.no/~pnordahl/ntpasswd/

You can get the source and look @ the chntpw.c/ntreg.c files - they are
components of a registry viewer and writer and will certainly work on NT and
newer systems.  You can download the binaries or source from the URL above.

3. Samba has registry support in its editreg.c tool:
/current_samba_tarrball/source/utils/editreg.c - brief tracing of the code
shows that Win98 support isn't there.

I am currently working on a tool to create registry "timelines" on the *nix
platform to compliment mactime output from the file system.  The registry
can't provide full MAC times but can provide LastWrite time on keys.  Once I
complete that part, perhaps the next step is to meet the need you have
expressed below (read-only registry viewing on all Windows platforms from
*nix).

-- ben


> Is there a way to view the Windows 98 (or any other version) 
> registry with Sleuthkit? If not, anyone know of a 
> tool/technique (e.g. vmware) where I can mount an image 
> read-only and view its registry?
> 
> Thanks,
> 
> SH

[sleuthkit-users] Win98 registry

[<sec...@hu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Is there a way to view the Windows 98 (or any other version)
registry with Sleuthkit? If not, anyone know of a tool/technique
(e.g. vmware) where I can mount an image read-only and view its
registry?

Thanks,

SH
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkIJ6ZIACgkQRBFe1uc9INpPFACaAhldqv0Yb2JxlqmJwsq0Hn3+raoA
niw5NrV1kq+QyP5nerbhPF7qC0ZA
=YNxW
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] TimeZones when configuring Host?

[Brian C. <ca...@sl...>]

On Feb 8, 2005, at 2:24 PM, Seth Arnold wrote:

> On Tue, Feb 08, 2005 at 07:56:22AM -0500, Brian Carrier wrote:
>> It depends on what values that your OS supports.  The safest setting 
>> is
>> to use CST6CDT (because this also takes day light savings into account
>> - GMT-6 does not).   If anyone knows of a list of valid timezone
>> strings, I will make a pull down list for them...
>
> Heh, there's way too many. :)

Maybe I should have phrased the question as "does anyone know of a 
basic, but not necessarily comprehensive, list of timezones"... :)

I think the easiest thing is to make a list of valid strings and put 
them in one of the help pages.

brian

Re: [sleuthkit-users] TimeZones when configuring Host?

[Seth A. <sa...@im...>]

On Tue, Feb 08, 2005 at 07:56:22AM -0500, Brian Carrier wrote:
> It depends on what values that your OS supports.  The safest setting is=
=20
> to use CST6CDT (because this also takes day light savings into account=20
> - GMT-6 does not).   If anyone knows of a list of valid timezone=20
> strings, I will make a pull down list for them...

Heh, there's way too many. :)

/usr/share/zoneinfo on glibc systems has the support files for all the
timezones the glibc people know about.

The heirarchy is arranged by "major areas" having their own directories,
posix, SystemV, and 'right' directories for standardised names, and a
mess of 'old-style' names.

$ ls -F /usr/share/zoneinfo
Africa/      Chile/   Factory    Iceland      Mexico/   posix/      Univers=
al
America/     CST6CDT  GB         Indian/      Mideast/  posixrules  US/
Antarctica/  Cuba     GB-Eire    Iran         MST       PRC         UTC
Arctic/      EET      GMT        iso3166.tab  MST7MDT   PST8PDT     WET
Asia/        Egypt    GMT0       Israel       Navajo    right/      W-SU
Atlantic/    Eire     GMT-0      Jamaica      NZ        ROK         zone.tab
Australia/   EST      GMT+0      Japan        NZ-CHAT   Singapore   Zulu
Brazil/      EST5EDT  Greenwich  Kwajalein    Pacific/  SystemV/
Canada/      Etc/     Hongkong   Libya        Poland    Turkey
CET          Europe/  HST        MET          Portugal  UCT
$ ls -F /usr/share/zoneinfo/SystemV
AST4     CST6     EST5     HST10  MST7MDT  PST8PDT  YST9YDT
AST4ADT  CST6CDT  EST5EDT  MST7   PST8     YST9
$ ls -F /usr/share/zoneinfo/Canada/
Atlantic  Eastern            Mountain      Pacific       Yukon
Central   East-Saskatchewan  Newfoundland  Saskatchewan

etc etc...

This way, one can simply use: TZ=3DCanada/Pacific instead of trying to
get the right mixture of daylight savings time rules and correct offsets.

The tzset(3) manpage describes how you can create your own timezone
strings, in case you're not interested in having access to only the
timezones already on the system.

RE: [sleuthkit-users] TimeZones when configuring Host?

[Surago J. <su...@sj...>]

My initial problem was simply knowing what time zone GMT-0600 actually
was, fortunately I found the following list (However it isn't complete,
and I ended up guessing/assuming that GMT-0600 was CST6CDT)

Definitely some form of Drop box or lookup list would take the guess
work out of these things.

http://www.ctan.org/tex-archive/tools/vvcode/local.h

**  NST-12NDT   New Zealand Standard Time
**  ???-11???   GMT+1100
**  EST-10???   Eastern Australia Standard Time
**  JST-9???    Japanese Standard Time
**  WST-8???    Western Australia Standard Time
**  ???-7???    GMT+0700=20
**  ???-6???    GMT+0600
**  ???-5???    GMT+0500
**  ???-4???    GMT+0400
**  ???-3???    GMT+0300
**  EET-2EST    East European Time
**  CET-1CST    Central European Time
**
**  UTC0        Coordinated universal time (GMT)
**  GMT0BST     Greenwich Mean Time, British Summer Time
**
**  ???1???     GMT-0100
**  ???2???     GMT-0200
**  ???3???     GMT-0300
**  AST4ADT     Atlantic Standard Time  (I guess this is GMT-0400)
**  EST5EDT     Eastern Standard Time   (I guess this is GMT-0500)
**  CST6CDT     Central Standard Time   (I guess this is GMT-0600)
**  MST7MDT     Mountain Standard Time
**  PST8PDT     Pacific Standard Time
**  YST9YDT     Yukon Standard Time
**  HST10HDT    Hawaii Standard Time
**  BST11BDT    Bering Standard Time



-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...]=20
Sent: Wednesday, 9 February 2005 01:56
To: Surago Jones
Cc: sle...@li...
Subject: Re: [sleuthkit-users] TimeZones when configuring Host?


On Feb 8, 2005, at 4:39 AM, Surago Jones wrote:

> Hi all,
>
> It might just be me being dumb (Very dumb), but when configuring a
host
> with Autopsy v2.01, is it possible to enter the time zone in the GMT
> format (i.e. 'GMT-0600'), or must one enter it like 'CST6CDT' ??

It depends on what values that your OS supports.  The safest setting is=20
to use CST6CDT (because this also takes day light savings into account=20
- GMT-6 does not).   If anyone knows of a list of valid timezone=20
strings, I will make a pull down list for them...

brian

Re: [sleuthkit-users] DateTime Info on each line of Timeline

[Brian C. <ca...@sl...>]

On Feb 8, 2005, at 4:52 AM, Surago Jones wrote:

> Yet another question,
>
> When creating timelines (from within Autopsy), is it possible to have
> the DateTime information inserted on every line of the output, as when
> using Grep to extract information for certain dates from a timeline it
> would (I assume) exclude lines that do not have the date information on
> them.

If you use the '-d' flag, you get a comma delimited format that is 
better for sorting and excluding data.  it has a time value for each 
line.

brian

Re: [sleuthkit-users] TimeZones when configuring Host?

[Brian C. <ca...@sl...>]

On Feb 8, 2005, at 4:39 AM, Surago Jones wrote:

> Hi all,
>
> It might just be me being dumb (Very dumb), but when configuring a host
> with Autopsy v2.01, is it possible to enter the time zone in the GMT
> format (i.e. 'GMT-0600'), or must one enter it like 'CST6CDT' ??

It depends on what values that your OS supports.  The safest setting is 
to use CST6CDT (because this also takes day light savings into account 
- GMT-6 does not).   If anyone knows of a list of valid timezone 
strings, I will make a pull down list for them...

brian

Re: [sleuthkit-users] DateTime Info on each line of Timeline

[Michel R. <mi...@ro...>]

Surago Jones wrote:

>Yet another question,
>
>When creating timelines (from within Autopsy), is it possible to have
>the DateTime information inserted on every line of the output, as when
>using Grep to extract information for certain dates from a timeline it
>would (I assume) exclude lines that do not have the date information on
>them.
>  
>
To have DateTime Info on each line of Timeline, I have written the 
following script in awk, and it seems to be working :)

BEGIN {Dname=""
        mm=""
        dd=""
        yy=""
        hh=""}

{ if ($1 ~ /[0-9]+/) {print Dname " " mm " " dd " " yy " " hh " " 
substr($0,26)}
 else { Dname=$1
        mm=$2
        dd=$3
        yy=$4
        hh=$5
        print $0 }
}


-- 
Michel Roukine
Expertise et investigation en informatique
Tel: 33 4 75 56 71 71, Fax: 33 4 75 56 58 61

[sleuthkit-users] DateTime Info on each line of Timeline

[Surago J. <su...@sj...>]

Yet another question,

When creating timelines (from within Autopsy), is it possible to have
the DateTime information inserted on every line of the output, as when
using Grep to extract information for certain dates from a timeline it
would (I assume) exclude lines that do not have the date information on
them.

Cheers

Surago

[sleuthkit-users] TimeZones when configuring Host?

[Surago J. <su...@sj...>]

Hi all,

It might just be me being dumb (Very dumb), but when configuring a host
with Autopsy v2.01, is it possible to enter the time zone in the GMT
format (i.e. 'GMT-0600'), or must one enter it like 'CST6CDT' ??

The only reason I noticed this issue, was when creating a timeline for
an image, all my dates/times did not match up with another investigators
when I had entered 'GMT-0600' as opposed to 'CST6CDT'.  Fortunately I am
currently only doing research, so this isn't a big deal at the moment.

If this is not possible in the current version, perhaps this
functionality could be included in future versions?

Cheers

Surago.

Re: Re: [sleuthkit-users] Split images

[Angus M. <an...@ng...>]

Sometime, when I've finished current cases, edited the ECCE proceedings, and completed the Forensic Imaging (graphics) module that I'm teaching right now, I'm going to sit down with a "skipware" PC and the batch of 300Gb drives I bought six months ago and build a LVM-based 1.2Tb server just for the hell of it....



> Message date : Feb 07 2005, 02:37 PM
> From : "Nicholas Sharples" <nic...@nt...>
> To : "Horner, Jonathan J (JH8)" <ho...@y1...>
> Copy to : sle...@li...
> Subject : Re: [sleuthkit-users] Split images
> 
> Horner, Jonathan J (JH8) wrote:
> 
> > I generally have to work with my customers to see what media they prefer then
> > work around them.  Some have no DVD drives, while others want Encase, while
> > others would just prefer the images and examination records copied to a large
> > drive.
> 
> Yeah, I've started providing the image chunks on a hard drive. But, I rarely 
> give out the Encase case files because I keep getting a problem reloading NTFS 
> images.
> 
> > Now that 300GB drives are getting cheaper, my drive space will be okay for a
> > while.  Once the average user buys a 300GB drive, I'm off to the races again.
> 
> I guess RAID. I've been meaning to setup a BIG storage machine and image across 
> my network to that.
> 
> > I do love this profession.  So much excitement.
> 
> It has it "moments".
> 
> ..Nick
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 

-- 

Whatever you Wanadoo:
http://www.wanadoo.co.uk/time/

This email has been checked for most known viruses - find out more at: http://www.wanadoo.co.uk/help/id/7098.htm

Re: [sleuthkit-users] Split images

[Nicholas S. <nic...@nt...>]

Horner, Jonathan J (JH8) wrote:

> I generally have to work with my customers to see what media they prefer then
> work around them.  Some have no DVD drives, while others want Encase, while
> others would just prefer the images and examination records copied to a large
> drive.

Yeah, I've started providing the image chunks on a hard drive. But, I rarely 
give out the Encase case files because I keep getting a problem reloading NTFS 
images.

> Now that 300GB drives are getting cheaper, my drive space will be okay for a
> while.  Once the average user buys a 300GB drive, I'm off to the races again.

I guess RAID. I've been meaning to setup a BIG storage machine and image across 
my network to that.

> I do love this profession.  So much excitement.

It has it "moments".

..Nick

Re: [sleuthkit-users] Split images

[Brian C. <ca...@sl...>]

Split Image Update:

I added support for caching the file descriptors for split images, 
which means that there will not be a limit on the number of files in a 
split image.   The only limitation will be based on the command line 
length that  your system supports.  Seth's testing shows that this 
should not be a problem for modern systems.

Because each command is going to be very long when split images are 
used, I need to figure out what to do about command logging.  
Currently, each TSK command executed is logged, but logging the full 
path of each image could cause extremely long lines...

brian
  

Re: [sleuthkit-users] filesystem recovery using sleuthkit

[Brian C. <ca...@sl...>]

On Feb 6, 2005, at 12:53 PM, Linux Tard wrote:

> --- Brian Carrier <ca...@sl...> wrote:
>> Nope.  Magic / sigs are all in the boot sector /
>> superblock in the
>> first few sectors.  The root directory has the same
>> structure as a
>> normal directory.
>>
>
> QUESTION - what is the magic signature for FAT12/16/32
> and NTFS?  I can't find it.  So I guess I'm asking
> what and where do you look Brian?

FAT12/16/32, NTFS, and DOS Partitions all have the same signature 
value, which is 0x55AA in the last two bytes of the first sector (there 
are also several data structures within FAT32 that use the same 
signature).   The new autodetect code in v2 first checks the signature 
value and then checks other values to narrow down NTFS versus FAT, such 
as valid cluster size and FAT size.  FAT and NTFS also have a label in 
the boot sector that typically contains "FAT12" or "NTFS", but this 
label is not required to exist or to be accurate, so it isn't a good 
test.

brian

RE: [sleuthkit-users] Split images

[Horner, J. J (JH8) <ho...@y1...>]

I generally have to work with my customers to see what media they prefer =
then
work around them.  Some have no DVD drives, while others want Encase, =
while
others would just prefer the images and examination records copied to a =
large
drive.

Now that 300GB drives are getting cheaper, my drive space will be okay =
for a
while.  Once the average user buys a 300GB drive, I'm off to the races =
again.

I do love this profession.  So much excitement.

JJ=20

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of =
Nicholas
Sharples
Sent: Monday, February 07, 2005 7:38 AM
To: sle...@li...
Subject: [sleuthkit-users] Split images

AFternoon!

Just following up on this split image question. Here's what I do with =
split
images

When I image an exhibit I produce a series of image chunks, each 630Mb =
in
size.=20
  I do this so that I can secure the exhibit to CDROM. Saying that, =
since
hard=20
drives are so big these days I never have a call to do that anymore. =
Chunks
are=20
named:

exhibit_number.000 - exhibit_number.999

These, and some meta data about the exhibit, are stored in a separate
directory,=20
  named exhibit_number. I produce a MD5 hash of the complete image, for=20
validation purposes.

I often image 160Gb or 120Gb hard drives and reassemble the chunks into =
a
disk=20
image (cat `ls --color=3Dnever -1 exhibit_number.?00` > exhibit.img), so =
I can=20
pull out a partition. This is a real pain with big drives.

If I want to use Encase I add a "Raw Image" to the case and do a =
reverse,
group=20
selection. That is, select the last file in the set, hold the shift key =
down,

and select the first file in the set.

I always image to a FAT32 partition because I image under Linux but need =
to
keep=20
Windows compatible. This causes a problem, since the FAT32 partition =
limit is

somewhere around 130Gb. I have to hold the first 120Gb or so on one =
partition

and the rest on another partition.

..Nick



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[sleuthkit-users] Split images

[Nicholas S. <nic...@nt...>]

AFternoon!

Just following up on this split image question. Here's what I do with split images

When I image an exhibit I produce a series of image chunks, each 630Mb in size. 
  I do this so that I can secure the exhibit to CDROM. Saying that, since hard 
drives are so big these days I never have a call to do that anymore. Chunks are 
named:

exhibit_number.000 - exhibit_number.999

These, and some meta data about the exhibit, are stored in a separate directory, 
  named exhibit_number. I produce a MD5 hash of the complete image, for 
validation purposes.

I often image 160Gb or 120Gb hard drives and reassemble the chunks into a disk 
image (cat `ls --color=never -1 exhibit_number.?00` > exhibit.img), so I can 
pull out a partition. This is a real pain with big drives.

If I want to use Encase I add a "Raw Image" to the case and do a reverse, group 
selection. That is, select the last file in the set, hold the shift key down, 
and select the first file in the set.

I always image to a FAT32 partition because I image under Linux but need to keep 
Windows compatible. This causes a problem, since the FAT32 partition limit is 
somewhere around 130Gb. I have to hold the first 120Gb or so on one partition 
and the rest on another partition.

..Nick

Re: [sleuthkit-users] filesystem recovery using sleuthkit

[Linux T. <lin...@ya...>]

--- Brian Carrier <ca...@sl...> wrote:
> Nope.  Magic / sigs are all in the boot sector /
> superblock in the 
> first few sectors.  The root directory has the same
> structure as a 
> normal directory.
> 

QUESTION - what is the magic signature for FAT12/16/32
and NTFS?  I can't find it.  So I guess I'm asking
what and where do you look Brian?


BACKUP SUPERBLOCK - use 'findsuper' to locate back up
superblock.  Works good for ext2/3 fs.


-lt



		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - now with 250MB free storage. Learn more.
http://info.mail.yahoo.com/mail_250

Re: [sleuthkit-developers] Re: [sleuthkit-users] Split Image Question

[David C. <dav...@gm...>]

seq -w will solve that problem a little more elegantly :)


On Wed, 2 Feb 2005 13:41:58 -0800, Seth Arnold <sa...@im...> wrote:
> On Tue, Feb 01, 2005 at 11:38:23AM -0500, Brian Carrier wrote:
> > >1.  I feel that there should be a maximum command line size, but
> > >cannot seem to find one.  I just ran some tests that had over 60KB of
> > >data in arguments (390 file names each over 160 bytes long) and there
> > >were no problems.  This was on OS X, so I'm not sure if other OSes are
> > >different.  Anyone know?
> >
> > Actually, I guess this should be shell dependent and not OS dependent.
> > I am using:
> 
> I don't expect any shells would implement the limit on their own. Some
> experiementation shows that it is around 128k on my SuSE 9.2 system with
> a 2.6 kernel and on my Debian 3.0 system with a 2.2 kernel.
> 
> (The exact limit varies based on the environment as well as command line
> arguments.)
> 
> I've heard that some Unix systems have limits of one megabyte! Others
> (such as an old SCO 3.2.4.2 system I used to use) have much lower limits,
> perhaps 8k or 16k or so.. I've since reclaimed those brain cells.
> 
> For 'numbered files' support, I've found that there are -two- popular
> ways to show lists:
>   foo.1
>   foo.2
>   foo.3
>   ...
>   foo.10
>   foo.11
>   ...
> 
> and
>   foo.001
>   foo.002
>   ...
>   foo.010
>   ...
> 
> I've found that the first style can be easily handled with seq(1):
> for f in `seq 1 100` ; do echo foo.${f} ; done
> The second style is only slightly harder:
> for f in `seq 1 100` ; do F=`printf %03d $f` ; echo foo.${F} ; done
> 
> Analogues in perl are left as an exercise for the reader. :)
> 
> 
>

Re: [sleuthkit-developers] Re: [sleuthkit-users] Split Image Question

[Seth A. <sa...@im...>]

On Tue, Feb 01, 2005 at 11:38:23AM -0500, Brian Carrier wrote:
> >1.  I feel that there should be a maximum command line size, but=20
> >cannot seem to find one.  I just ran some tests that had over 60KB of=20
> >data in arguments (390 file names each over 160 bytes long) and there=20
> >were no problems.  This was on OS X, so I'm not sure if other OSes are=
=20
> >different.  Anyone know?
>=20
> Actually, I guess this should be shell dependent and not OS dependent. =
=20
> I am using:

I don't expect any shells would implement the limit on their own. Some
experiementation shows that it is around 128k on my SuSE 9.2 system with
a 2.6 kernel and on my Debian 3.0 system with a 2.2 kernel.

(The exact limit varies based on the environment as well as command line
arguments.)

I've heard that some Unix systems have limits of one megabyte! Others
(such as an old SCO 3.2.4.2 system I used to use) have much lower limits,
perhaps 8k or 16k or so.. I've since reclaimed those brain cells.

For 'numbered files' support, I've found that there are -two- popular
ways to show lists:
  foo.1
  foo.2
  foo.3
  ...
  foo.10
  foo.11
  ...

and
  foo.001
  foo.002
  ...
  foo.010
  ...

I've found that the first style can be easily handled with seq(1):
for f in `seq 1 100` ; do echo foo.${f} ; done
The second style is only slightly harder:
for f in `seq 1 100` ; do F=3D`printf %03d $f` ; echo foo.${F} ; done

Analogues in perl are left as an exercise for the reader. :)

Re: [sleuthkit-developers] Re: [sleuthkit-users] Split Image Question

[Aaron P. <dop...@gm...>]

Not sure about others, but I believe on FreeBSD at least (and likely
other BSDs) there is a kernel level argument max as well...  Don't
know that it matters, but thought I'd share anyway :-)  If I had over
100 of any kind of media to reassemble for forensic work I might just
shoot myself instead, heh.

main% sysctl -a |grep argmax
kern.argmax: 65536
main%


On Tue, 1 Feb 2005 11:38:23 -0500, Brian Carrier <ca...@sl...> wrote:
> On Feb 1, 2005, at 11:33 AM, Brian Carrier wrote:
> 
> > 1.  I feel that there should be a maximum command line size, but
> > cannot seem to find one.  I just ran some tests that had over 60KB of
> > data in arguments (390 file names each over 160 bytes long) and there
> > were no problems.  This was on OS X, so I'm not sure if other OSes are
> > different.  Anyone know?
> 
> Actually, I guess this should be shell dependent and not OS dependent.
> I am using:
> 
> % bash --version
> bash --version
> GNU bash, version 2.05b.0(1)-release (powerpc-apple-darwin7.0)
> Copyright (C) 2002 Free Software Foundation, Inc.
> 
> brian
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>