sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] Why is block size important

[Rich T. <te...@ya...>]

Well I found that setting the block size determines
how big a chunk of data dd is going to process at one
time.  I did some testing and found a significant
increase in speed of imaging based on larger block
sizes.  If I remember correctly speed increased until
It flattened out above 32k (I got the same imaging
speed when setting bs=32k and bs=1m)

I could forward the white paper I wrote about it if
you'd like.

Have a great day,
Richard Thompson
Applied Forensics
www.apfor.com

--- Fra...@ps... wrote:

> This is a two part question...
> 
> Why is block size important when imaging a drive or
> partition?  (ie.  dd 
> if=/dev/hda of=./hda.dd bs=2k, provides a file in
> blocks of 2048-bytes)
> 
> Also, how do you know which block size to use for
> the image?
> 
> Frank Kenisky IV, CISSP, CISA, CISM 
> Information Technical Security Specialist 
> (210) 301-6433 or (210) 887-6985 

[sleuthkit-users] Why is block size important

[<Fra...@ps...>]

This is a two part question...

Why is block size important when imaging a drive or partition?  (ie.  dd 
if=/dev/hda of=./hda.dd bs=2k, provides a file in blocks of 2048-bytes)

Also, how do you know which block size to use for the image?

Frank Kenisky IV, CISSP, CISA, CISM 
Information Technical Security Specialist 
(210) 301-6433 or (210) 887-6985 

Re: [sleuthkit-users] ntfs file ownership

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Aug 2, 2004, at 7:29 AM, Aaron Peterson wrote:

> so is there a way to see who owns files on an ntfs filesystem through
> the use of sleuthkit tools?

The ownerid of the file is given in the 'istat' output, but it is not 
tied to a full user name.


brian


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBDlT2OK1gLsdFTIsRAp5BAJ4gvFkdgrXioq4vObYpGh7aADMsyQCfQzld
8TE1SAnB85hqZS1XJ7c3yiY=
=+85X
-----END PGP SIGNATURE-----

[sleuthkit-users] ntfs file ownership

[Aaron P. <aa...@al...>]

so is there a way to see who owns files on an ntfs filesystem through
the use of sleuthkit tools?

Aaron

Re: [sleuthkit-users] Help: invalid MFT magic error message

[Paul <es...@ya...>]

Hi Brian,

a quick test shows that it now works :)

Cheers,
Paul.

On Sunday 01 August 2004 20:02, Brian Carrier wrote:
> Download the file and try it again.  I removed the MAGIC check because
> some testing shows that XP doesn't even care if the MAGIC value exists.
>   So, neither should I.  There are some other checks that will detect a
> corrupt image.
>
> brian
>
> On Jul 30, 2004, at 5:09 PM, Paul wrote:
> > Hi Brian,
> > thanks for your reply.
> >
> > I downloaded the ntfs.c source into the fstools directory and reran
> > 'make'.  I
> > was not sure that everything recompiled so I deleted the sleuthkit
> > directory
> > and redownloaded the sleuthkit source and overwrote the ntfs.c.
> > It recompiled but unfortunately I still get the same error in Autopsy.
> >  (Have
> > I missed a step?)
> >
> >> Replace src/fstools/ntfs.c with the one at:
> >> http://www.sleuthkit.org/sleuthkit/ntfs.c

Re: [sleuthkit-users] Help: invalid MFT magic error message

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 30, 2004, at 12:26 PM, Paul wrote:

> Hi,
> I am getting an error message using Autopsy when I press the link to 
> 'Find
> Meta Data Address' in the the 'keyword search' results window.
...
> The result in the console window is: ifind: entry 16 has an invalid 
> MFT magic:
> 1

1?  I hadn't seen that yet.  There is a 4 byte magic value at the start 
of each MFT entry and it should say "FILE" (or "BAAD" if it is 
corrupt). Some users have reported a value of 0. I had been planning a 
larger scale fix to these errors with 'ifind' when it finds a strange 
image, but I've made a more specific fix (since others run into this as 
well).

Replace src/fstools/ntfs.c with the one at:
http://www.sleuthkit.org/sleuthkit/ntfs.c

This will still give the magic error for normal analysis, but not for 
running 'ifind'.

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBCqNlOK1gLsdFTIsRAmf5AJ9Vkws2+cZBQN5QQbo/O53lzN5CEQCeOtmZ
hH7LfNzrXsOeJtlehVXA9Qc=
=Kx7z
-----END PGP SIGNATURE-----

[sleuthkit-users] Help: invalid MFT magic error message

[Paul <es...@ya...>]

Hi,
I am getting an error message using Autopsy when I press the link to 'Find 
Meta Data Address' in the the 'keyword search' results window.

I press the link:  'Find Meta Data Address' (in Autopsy) and .....

Result reported in Autopsy is: 'Error getting meta address'

Command in Paul.exec.log log file is:
Fri Jul 30 17:17:08 2004: '/home/Paul/dl/sleuthkit/sleuthkit-1.71//bin/ifind' 
-f ntfs -d 1882138 '/mnt/evidence/evlocker/ST/ABCserver/images/imagehdb5.img'

The result in the console window is: ifind: entry 16 has an invalid MFT magic: 
1

The versions I am using are: Sleuthkit version 1.71 , Autopsy version 2.02

I Got the same error in the previous versions.

Any suggestions gratefully received.

Cheers
Paul.

[sleuthkit-users] TSK 1.71 & Autopsy 2.02 release

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

New releases of both tools are available with bug fixes and new 
features. I went through the NTFS code and added some more details and 
features.  FFS is next.


TSK 1.71
http://www.sleuthkit.org/sleuthkit/

Bug Fixes
- - Type / size casting errors with FAT.
- - NTFS handling of sparse files
- - Filler errors with NTFS files and 'icat' (rare)
- - Missing name with NTFS attribute (rare)

Major Updates
- - Improved istat & fsstat output for NTFS.
- - 'ifind -p' will find deleted NTFS files based on their parent 
directory, which results in more deleted files being found.
- - Encrypted and compressed files are noted, but not processed.
- - Improved slack support in dls -s.
- - dcalc can calculte original location of data in dls -s output.
- - GPT disk support in mmls.



Autopsy 2.02
http://www.sleuthkit.org/autopsy/

Bug Fixes:
- - An error message was not properly printed.

Updates:
- - More deleted NTFS files are now listed in file mode because a search 
is done for unallocated files that have a given parent directory.
- - A filter removes duplicate deleted NTFS names from the file listings.
- - OS X no longer needs the strings wrapper.


brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBCe4WOK1gLsdFTIsRAjt8AJ9rrNpfwcuX8f3k2RtCIQfHUDkcMACeKDJM
WgX1tFFAB+qBIDzHn5cjTxU=
=s3Z4
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Question about cygwin capacity

[Aaron P. <aa...@al...>]

On Thu, 2004-07-29 at 15:28, Fra...@ps... wrote:
> thanks for the info, but I'm afraid that on w2k there is no file size
> limit.
>=20
> But that still doesn't answer the question about cygwin.

Well what do you know.

dd if=3D/dev/zero of=3Dc:\test.cygwin.dd

I'm up over 5G now and still writing...

Aaron

[sleuthkit-users] Question about cygwin capacity

[<Fra...@ps...>]

If linux had a 4.3 gig file size limitation, does cygwin?

I've got an image that I think might uncompress out to 139gig.  I'm using 
cygwin on an ntfs box.  Anyone know if it has the same file size 
limitations as linux?

Frank Kenisky IV, CISSP, CISA, CISM 
Information Technical Security Specialist 
(210) 301-6433 or (210) 887-6985 

Re: [sleuthkit-users] FreeBSD 5.x and fls - not a FFS file system

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 29, 2004, at 9:18 AM, Aristeu Gil Alves Junior wrote:

> I am trying to use fls on a FreeBSD partition and some problems came 
> up.
>
> # fls -f freebsd /dev/ad0s1d
> fls: Error: /dev/ad0s1d is not a FFS file system


FreeBSD 5 has a new UFS file system and TSK doesn't support it yet.  
I'm hoping to work on it in the next couple of weeks though.  TCT 
supports it from the inode and block level, but not with autopsy or 
'fls' etc.

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBCRPtOK1gLsdFTIsRAgLlAJwPQ/vXOobbsVlliRFjVj9fzdgIFgCeIJcX
dwGeiMg3gjK4oFiHyTyfxIo=
=BVeU
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] NIST NSRL hash databases, do i concatenate?

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 29, 2004, at 9:03 AM, Aaron Peterson wrote:

> I downloaded the 4 ISO images for the NIST NSRL hash databases.  Do I
> concatenate the databases (NSRLFile.txt) to use with "sorter"?  which
> files do I concatenate?

yea, concat the big NSRLFile.txt files.

> i mainly want to use the OS database and known applications database.

You can add only the ones that you want.

brian


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBCROJOK1gLsdFTIsRAiOhAJ0Us/zhLBm4zVacjzOPwZyz8UzRkwCfS0Ut
qV7P8sqDSutR3Vf6R5jNSNM=
=T08K
-----END PGP SIGNATURE-----

[sleuthkit-users] FreeBSD 5.x and fls - not a FFS file system

[Aristeu G. A. J. <ar...@te...>]

I am trying to use fls on a FreeBSD partition and some problems came up.

# fls -f freebsd /dev/ad0s1d
fls: Error: /dev/ad0s1d is not a FFS file system

-  Some details:

# uname -a
FreeBSD firewall.intranet 5.2.1-RC FreeBSD 5.2.1-RC #0: Mon Feb  2 18:16:=
53 BRST 2004     arisjr@intranet:/usr/src/sys/i386/compile/Fi-Fa-Fo-Fun  =
i386

# cat /etc/fstab
# Device                Mountpoint      FStype  Options         Dump    P=
ass#
/dev/ad0s1b             none            swap    sw              0       0=

/dev/ad0s1a             /               ufs     rw              1       1=

/dev/ad0s1d             /usr            ufs     rw              2       2=

/dev/ad0s1e             /var            ufs     rw              2       2=

/dev/acd0               /cdrom          cd9660  ro,noauto       0       0=

/dev/acd1               /cdrom1         cd9660  ro,noauto       0       0=


# pkg_info | grep sleuthkit
sleuthkit-1.64      The @stake Sleuth Kit for forensic analysis

Installed from ports, just cvsup=92ed.


Thanks for your help.
-- 
Aristeu Gil Alves Junior

[sleuthkit-users] NIST NSRL hash databases, do i concatenate?

[Aaron P. <aa...@al...>]

I downloaded the 4 ISO images for the NIST NSRL hash databases.  Do I
concatenate the databases (NSRLFile.txt) to use with "sorter"?  which
files do I concatenate?

i mainly want to use the OS database and known applications database.

Aaron

RE: [sleuthkit-users] Fw: dd file size limitations?

[Altheide, C. B. (IARC) <Alt...@nv...>]

> -----Original Message-----
> Ok I got autopsy to see the file on the other drive.
> 
> Can I use the portion of the image that I was able to 
> uncompress and use 
> it in Autopsy?

Magic 8-ball says: Outlook not so good.

You *might* see some logical structure from the truncated image, but you're
going to have to shadowbox with tons of errors.

If this log file is that important, have them buy a 160+ Gig drive for you.
;)

Cory Altheide
Senior Network Forensics Specialist
NNSA Information Assurance Response Center (IARC)
alt...@nv...

RE: [sleuthkit-users] Problems Recovering EXT3 File Sleuthkit 1.7 /Autopsy 2.0.1

[Altheide, C. B. (IARC) <Alt...@nv...>]

"Inside Windows 2000" is probably your best bet for NTFS.
"Linux File Systems" is getting a little long in the tooth, but is a great
resource for the various Linux file systems (although reading the source
works too ;p)
The FAT32 specification is avaialable here:
http://www.microsoft.com/whdc/system/platform/firmware/fatgen.mspx

Cory Altheide
Senior Network Forensics Specialist
NNSA Information Assurance Response Center (IARC)
alt...@nv...


> -----Original Message-----
> From: sle...@li... 
> [mailto:sle...@li...] On 
> Behalf Of Fiscus, Kevin
> Sent: Friday, July 23, 2004 5:19 AM
> To: Altheide, Cory B. (IARC); dar...@li...
> Cc: sle...@li...
> Subject: RE: [sleuthkit-users] Problems Recovering EXT3 File 
> Sleuthkit 1.7 /Autopsy 2.0.1
> 
> 
> Along these lines, does anyone know of a good resource (book, 
> web site, etc.) that discusses various file systems and how 
> they operate?  Even better, is there a resource that does 
> that with forensics in mind?
>  
> Thanks,
>  
> Kevin B. Fiscus, CISSP

Re: [sleuthkit-users] Fw: dd file size limitations?

[<Fra...@ps...>]

Ok I got autopsy to see the file on the other drive.

Here's another one of my dumb questions...

The image I have is of a windows 2000 server which is on a raid=20
configuration.  I think the drive is about 139gig.  I'm not sure how large =

the image would be...

As most security forensics people who are jack of all trades I've been=20
asked to try and undelete a log file that might be within the image.  But=20
I only have a 40 gig hd.  I've tried to uncompress the the files sent to=20
me and it got to 32 gig and stopped due to the limit of the drive.

Can I use the portion of the image that I was able to uncompress and use=20
it in Autopsy?

I have added as an image, and received the following...
Linking /cygdrive/h/scd/scd/scd0004.tst to=20
/cygdrive/h/scd/SCD0001/scd0001/images/scd0004.tst
Calculating MD5 of images/scd0004.tst (this could take a while)
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----=
+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----=
+----+----+----+----+=20
Current MD5: 1EE487013EFE27AFFA3CC964DA4CEA56
The problem is that I don't get the cute "OK" button.  And when I open=20
another browser with autospy it doesn't show the image.
Apparently it created the MD5 hash...
I think I did open a partical image once and got the "OK" button.
Do I need to wait for that button?  If so how long?  And the browser=20
(FoxFire) at the bottom left corner says "done".

Frank Kenisky IV, CISSP, CISA, CISM=20
Information Technical Security Specialist=20
(210) 301-6433 or (210) 887-6985=20



Brian Carrier <ca...@sl...>=20
Sent by: sle...@li...
07/22/2004 11:29 PM

To
Frank=5FK...@ps...
cc
sle...@li...
Subject
Re: [sleuthkit-users] Fw: dd file size limitations?






-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 22, 2004, at 3:53 PM, Frank=5FK...@ps... wrote:
> The thing is
>  > that the server is on a raid and the dd file had to be compressed
>  > (gzip'ed) and broken into about 9 separate 1 gig files.
>  >
>  > The problem is hardware resources.
>  >
>  > Currently I'm running Autopsy from cygwin on a Windows 2000 desktop.
>  > (Got
>  > it running! - thanks to Charles Lucas for the great directions).=20
>  I've
>  > got
>  > cygwin on the root directory which currently only has less than 4=20
> gig of
>  > hd space left.  I've got a "D" partition of about 12 gig free space=20
> and
>  > I've just installed a 40 gig hd.
>  >
>  > Here's my question(s)...
>  >
>  > Once I've configured autopsy do I have to re-run 'make' every time=20
> I want
>  > to restart it or everytime I have to restart windows?  If not how?

Nope.  'make' compiles the program and configures it.  All you have to=20
do to run autopsy is to run the 'autopsy' command.

>  > The second question is regarding the "ADD a New Image"...
>  >
>  > The location of the image on the windows 2000 workstation is;
>  >
>  > h:\folder1\folder2\folder3\file.dd
>  >
>  > The evidence folder is located according to the Lucas explaination
>  > (/usr/local/evidence/casename
>  >
>  > How do I make Autopsy point to this file.  When add an image it=20
> doesn't
>  > find the file I point to when I put in something like the following;
>  >
>  > /cygdrive/h/folder1/folder2/folder3/file.dd

Is it saying that it can't find the file or that it isn't a valid=20
partition.  Did you merge the 1GB slices back into one big file?=20
Autopsy / TSK do not currently support slices.  They support only a=20
full image.  Is the image of the entire disk or of each partition?=20
Autopsy / TSK currently only support partitions.  Can you see the image=20
file by typing 'ls /cygwin/h/folder1/....'?

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBAJQUOK1gLsdFTIsRAvokAJ0fFIHZSxL7hDTSYiCE6qaUdY7TZACfZxcn
2b7jzkUBSefH0UK8rEBahY8=3D
=3Dn6jN
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad=5FidG21&alloc=5Fid=10040&op=3Dclick
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

RE: [sleuthkit-users] Problems Recovering EXT3 File Sleuthkit 1.7 /Autopsy 2.0.1

[Fiscus, K. <kf...@al...>]

Along these lines, does anyone know of a good resource (book, web site, =
etc.) that discusses various file systems and how they operate?  Even =
better, is there a resource that does that with forensics in mind?
=20
Thanks,
=20
Kevin B. Fiscus, CISSP
GIAC Certified Forensics Analyst
CCNA, SCSA, RCSE
Senior Information Security Engineer
Alliant Technologies, LLC.
____________________________________
=20
Phone: (973) 267-5236 x 4224
Cell: (201) 650-4172
mailto:kf...@al...
http://www.allianttech.com
=20

________________________________

From: sle...@li... on behalf of Altheide, =
Cory B. (IARC)
Sent: Thu 7/22/2004 6:51 PM
To: 'dar...@li...'
Cc: 'sle...@li...'
Subject: RE: [sleuthkit-users] Problems Recovering EXT3 File Sleuthkit =
1.7 /Autopsy 2.0.1



> -----Original Message-----
> When I try to export, I get a zero length JPEG file. Is it
> possible to recover EXT3 files? Or is this going to be an
> RTFM post? :)

EXT3 zeroes the block pointers in the inode when a file is deleted, so
logical file recovery is basically impossible.  If it's JPEGs (or =
anything
else with reliable headers/footers) you can use foremost or SMART to =
carve
the data out of unallocated space, but you won't have any of the =
associated
metadata (file name, MAC times, etc).

Cory Altheide
Senior Network Forensics Specialist
NNSA Information Assurance Response Center (IARC)
alt...@nv...



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=3D4721&alloc_id=3D10040&op=3Dclick
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[sleuthkit-users] Fedora Core 2 & strings

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I have had two people in the past couple of days e-mail me about errors 
with getting strings to work on large files with Fedora Core 2.  One 
user had a 6GB image and the other had an 80GB image they were trying 
to run strings on.  Has anyone else experienced this?

brian


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBAJZsOK1gLsdFTIsRAoWqAJ9Epm9T7c+tGHV2W+OHfscduY5BnwCffBwO
DKY0MoCCl/nAi9DHJM4hIxk=
=HwyE
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Fw: dd file size limitations?

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 22, 2004, at 3:53 PM, Fra...@ps... wrote:
> The thing is
>  > that the server is on a raid and the dd file had to be compressed
>  > (gzip'ed) and broken into about 9 separate 1 gig files.
>  >
>  > The problem is hardware resources.
>  >
>  > Currently I'm running Autopsy from cygwin on a Windows 2000 =
desktop.
>  > (Got
>  > it running! - thanks to Charles Lucas for the great directions).=20
> =A0I've
>  > got
>  > cygwin on the root directory which currently only has less than 4=20=

> gig of
>  > hd space left. =A0I've got a "D" partition of about 12 gig free =
space=20
> and
>  > I've just installed a 40 gig hd.
>  >
>  > Here's my question(s)...
>  >
>  > Once I've configured autopsy do I have to re-run 'make' every time=20=

> I want
>  > to restart it or everytime I have to restart windows? =A0If not =
how?

Nope.  'make' compiles the program and configures it.  All you have to=20=

do to run autopsy is to run the 'autopsy' command.

>  > The second question is regarding the "ADD a New Image"...
>  >
>  > The location of the image on the windows 2000 workstation is;
>  >
>  > h:\folder1\folder2\folder3\file.dd
>  >
>  > The evidence folder is located according to the Lucas explaination
>  > (/usr/local/evidence/casename
>  >
>  > How do I make Autopsy point to this file. =A0When add an image it=20=

> doesn't
>  > find the file I point to when I put in something like the =
following;
>  >
>  > /cygdrive/h/folder1/folder2/folder3/file.dd

Is it saying that it can't find the file or that it isn't a valid=20
partition.  Did you merge the 1GB slices back into one big file? =20
Autopsy / TSK do not currently support slices.  They support only a=20
full image.  Is the image of the entire disk or of each partition? =20
Autopsy / TSK currently only support partitions.  Can you see the image=20=

file by typing 'ls /cygwin/h/folder1/....'?

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBAJQUOK1gLsdFTIsRAvokAJ0fFIHZSxL7hDTSYiCE6qaUdY7TZACfZxcn
2b7jzkUBSefH0UK8rEBahY8=3D
=3Dn6jN
-----END PGP SIGNATURE-----

RE: [sleuthkit-users] Problems Recovering EXT3 File Sleuthkit 1.7 /Autopsy 2.0.1

[Altheide, C. B. (IARC) <Alt...@nv...>]

> -----Original Message-----
> When I try to export, I get a zero length JPEG file. Is it 
> possible to recover EXT3 files? Or is this going to be an 
> RTFM post? :)

EXT3 zeroes the block pointers in the inode when a file is deleted, so
logical file recovery is basically impossible.  If it's JPEGs (or anything
else with reliable headers/footers) you can use foremost or SMART to carve
the data out of unallocated space, but you won't have any of the associated
metadata (file name, MAC times, etc).

Cory Altheide
Senior Network Forensics Specialist
NNSA Information Assurance Response Center (IARC)
alt...@nv...

[sleuthkit-users] Problems Recovering EXT3 File Sleuthkit 1.7/Autopsy 2.0.1

[Darren H. <dar...@li...>]

Hello Brian and crowd,

I have been using Sleuth/Autopsy on Solaris for quite some time now. I
just gave a test run on Fedora Core 1. I am aware that it is impossible t=
o
recover  deleted Solaris files. What about ext3? I downloaded a couple of
JPEG's to a FC box, viewed them, deleted them, made a dd image. I can see
the deleted files in the "File Analysis" window in Autopsy. When I click
on the deleted file links, I get "File Type: Empty" and in the bottom
window "Contents Of File: /data/IMG_1237.sized.jpg" (the rest of the
window blank). When I try to export, I get a zero length JPEG file. Is it
possible to recover EXT3 files? Or is this going to be an RTFM post? :)

Thanks,

Darren

*************************
Secure and SPAM Filtered
litemail.org

[sleuthkit-users] Fw: dd file size limitations?

[<Fra...@ps...>]

Frank Kenisky IV, CISSP, CISA, CISM 
Information Technical Security Specialist 
(210) 301-6433 or (210) 887-6985 
----- Forwarded by Frank Kenisky/SAT/AO/USCOURTS on 07/22/2004 03:53 PM 
-----

sle...@sh... 
07/22/2004 03:38 PM

To
Fra...@ps...
cc

Subject
Re: dd file size limitations?






Hi,

I think you meant to send this to sle...@li...

I've only done that to one mailing list so far this week - must be
getting better ;-)

Regards,

Ben


On Thu, 22 Jul 2004 14:17:54 -0500, Fra...@ps... said:
> I'm sort of new to using autopsy so be gentle...
> 
> My goal is to undelte one ftp log file to compare against IDS logs.
> 
> I have an image that was created by a third party of a Windows2000
> server. 
>  The sysadmin is not sure if it was an NTFS or FAT32 (that's not real 
> important since Autopsy can help with determining that).  The thing is 
> that the server is on a raid and the dd file had to be compressed 
> (gzip'ed) and broken into about 9 separate 1 gig files.
> 
> The problem is hardware resources.
> 
> Currently I'm running Autopsy from cygwin on a Windows 2000 desktop. 
> (Got 
> it running! - thanks to Charles Lucas for the great directions).  I've
> got 
> cygwin on the root directory which currently only has less than 4 gig of 

> hd space left.  I've got a "D" partition of about 12 gig free space and 
> I've just installed a 40 gig hd.
> 
> Here's my question(s)...
> 
> Once I've configured autopsy do I have to re-run 'make' every time I 
want 
> to restart it or everytime I have to restart windows?  If not how?
> 
> The second question is regarding the "ADD a New Image"...
> 
> The location of the image on the windows 2000 workstation is;
> 
> h:\folder1\folder2\folder3\file.dd
> 
> The evidence folder is located according to the Lucas explaination 
> (/usr/local/evidence/casename
> 
> How do I make Autopsy point to this file.  When add an image it doesn't 
> find the file I point to when I put in something like the following;
> 
> /cygdrive/h/folder1/folder2/folder3/file.dd
> 
> Even when I re-ran 'make' for autopsy I gave it the 
> /cygdrive/h/folder1/folder2/folder3 as the evidence locker and it 
> apparently ignored it cause when I pointed to the /usr/local/evidence 
> folder it found the file just fine.
> 
> Any clues?
> 
> Frank Kenisky IV, CISSP, CISA, CISM 
> Information Technical Security Specialist 
> (210) 301-6433 or (210) 887-6985 

RE: [sleuthkit-users] Sleuthkit on Cygwin? (make fails: magic.c:192: error: storage size of `utsbuf' isn't known)

[<sle...@sh...>]

On Tue, 20 Jul 2004 00:14:43 -0700, "Charles Lucas" <ch...@lu...>
said:
> You're not the first one to run across this...  I found a fix for this
> error at
> http://archive.netbsd.se/?list=tech-toolchain&a=2004-05&mid=225006.  Ian
> Lance was kind enough to provide a patch.  Aside from that, it was a
> relatively painless installation.
> 
> I recently created a tutorial on the subject:  "Running Sleuthkit and
> Autopsy Under Windows", at
> http://www.memophage.net/Running_Sleuthkit_and_Autopsy_Under_Windows.pdf
> 
> -Charles
> 
> ch...@lu...

Seeing as no one else is reporting trouble I'm sure it's me doing
something silly, but I can't get it to patch. I get:

Ben@mungo /usr/local/sleuthkit-1.70/src/file/src
$ patch --verbose magic.c patch.txt
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|Index: magic.c
|===================================================================
|RCS file: /cvsroot/wasabisrc/src/dist/file/src/magic.c,v
|retrieving revision 1.1.1.5
|diff -p -u -r1.1.1.5 magic.c
|--- magic.c 10 May 2004 04:18:24 -0000 1.1.1.5
|+++ magic.c 21 May 2004 04:36:05 -0000
--------------------------
Patching file magic.c using Plan A...
patch: **** unexpected end of file in patch

My patch.txt file looks like:

Index: magic.c
===================================================================
RCS file: /cvsroot/wasabisrc/src/dist/file/src/magic.c,v
retrieving revision 1.1.1.5
diff -p -u -r1.1.1.5 magic.c
--- magic.c 10 May 2004 04:18:24 -0000 1.1.1.5
+++ magic.c 21 May 2004 04:36:05 -0000
@@ -44,14 +44,14 @@
#include <sys/mman.h>
#endif

-#if defined(HAVE_UTIME)
+#if defined(HAVE_UTIMES)
+# include <sys/time.h>
+#elif defined(HAVE_UTIME)
# if defined(HAVE_SYS_UTIME_H)
# include <sys/utime.h>
# elif defined(HAVE_UTIME_H)
# include <utime.h>
# endif
-#elif defined(HAVE_UTIMES)
-# include <sys/time.h>
#endif

#ifdef HAVE_UNISTD_H


Can you tell me where I'm going wrong?

Thanks,

Ben

Re: [sleuthkit-users] Sleuthkit on Cygwin? (make fails: magic.c:192: error: storage size of `utsbuf' isn't known)

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 20, 2004, at 2:14 AM, Charles Lucas wrote:

> You're not the first one to run across this...  I found a fix for this  
> error at  
> http://archive.netbsd.se/?list=tech-toolchain&a=2004-05&mid=225006.   
> Ian Lance was kind enough to provide a patch.  Aside from that, it was  
> a relatively painless installation.
>
> I recently created a tutorial on the subject:  "Running Sleuthkit and  
> Autopsy Under Windows", at  
> http://www.memophage.net/ 
> Running_Sleuthkit_and_Autopsy_Under_Windows.pdf

Great. I've added a link to this from the documents section of  
sleuthkit.org.

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA/SPoOK1gLsdFTIsRAsZHAJ95NWOFaSNnrsegym3yDAfhWUbnfQCfZO+h
bQK+FCZNOYEsxN6QQ/riOr4=
=Waqh
-----END PGP SIGNATURE-----