sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

RE: [sleuthkit-users] Sleuthkit on Cygwin? (make fails: magic.c:192: error: storage size of `utsbuf' isn't known)

[Charles L. <ch...@lu...>]

You're not the first one to run across this...  I found a fix for this =
error at =
http://archive.netbsd.se/?list=3Dtech-toolchain&a=3D2004-05&mid=3D225006.=
  Ian Lance was kind enough to provide a patch.  Aside from that, it was =
a relatively painless installation.

I recently created a tutorial on the subject:  "Running Sleuthkit and =
Autopsy Under Windows", at =
http://www.memophage.net/Running_Sleuthkit_and_Autopsy_Under_Windows.pdf

-Charles

ch...@lu...



-----Original Message-----
From: sle...@li... =
[mailto:sle...@li...] On Behalf Of Joseph =
J. Farino
Sent: Monday, July 19, 2004 2:19 AM
To: sle...@li...
Subject: [sleuthkit-users] Sleuthkit on Cygwin? (make fails: =
magic.c:192: error: storage size of `utsbuf' isn't known)


I am running the latest available version of cygwin and I am trying to =
compile and install sleuthkit for cygwin.  After running make, I get the =
following error:
=20
magic.c: In function `close_and_restore':
magic.c:192: error: storage size of `utsbuf' isn't known
make[2]: *** [magic.lo] Error 1
make[2]: Leaving directory `/usr/local/sleuthkit-1.70/src/file/src'
make[1]: *** [install-recursive] Error 1
make[1]: Leaving directory `/usr/local/sleuthkit-1.70/src/file'
make: *** [file] Error 2
=20
Any ideas?
=20
Thanks,
=20
Joe
=20
N=18HSX=E9=8A=B2u=10=05nZ=C5=AEK=10B+'au =DA=96w*y =
=CA=87=10=05l=C5=AEK=1B=CA=A7v vw

Re: [sleuthkit-users] Sleuthkit on Cygwin? (make fails: magic.c:192: error: storage size of `utsbuf' isn't known)

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 19, 2004, at 4:19 AM, Joseph J. Farino wrote:

> I am running the latest available version of cygwin and I am trying to 
> compile and install sleuthkit for cygwin.  After running make, I get 
> the following error:
>
> magic.c: In function `close_and_restore':
> magic.c:192: error: storage size of `utsbuf' isn't known
>

This error is coming from 'file', which I only include and do not 
maintain.  I'll send the maintainer an e-mail about it.  To get around 
this, make a symlink between '/bin/file' on your local system to the 
sleuthkit bin.

# ln -s /bin/file sleuthkit-1.70/bin/file


brian


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA+8N9OK1gLsdFTIsRAkj7AJ9YaeVUQ4lDFGnNhMjQQldESpcCRgCdF0Qd
YHt+6oFtXu/Ev7aO/znHoR8=
=yUo5
-----END PGP SIGNATURE-----

[sleuthkit-users] Sleuthkit on Cygwin? (make fails: magic.c:192: error: storage size of `utsbuf' isn't known)

[Joseph J. F. <jj...@ic...>]

SSBhbSBydW5uaW5nIHRoZSBsYXRlc3QgYXZhaWxhYmxlIHZlcnNpb24gb2YgY3lnd2luIGFuZCBJ
IGFtIHRyeWluZyB0byBjb21waWxlIGFuZCBpbnN0YWxsIHNsZXV0aGtpdCBmb3IgY3lnd2luLiAg
QWZ0ZXIgcnVubmluZyBtYWtlLCBJIGdldCB0aGUgZm9sbG93aW5nIGVycm9yOg0KIA0KbWFnaWMu
YzogSW4gZnVuY3Rpb24gYGNsb3NlX2FuZF9yZXN0b3JlJzoNCm1hZ2ljLmM6MTkyOiBlcnJvcjog
c3RvcmFnZSBzaXplIG9mIGB1dHNidWYnIGlzbid0IGtub3duDQptYWtlWzJdOiAqKiogW21hZ2lj
LmxvXSBFcnJvciAxDQptYWtlWzJdOiBMZWF2aW5nIGRpcmVjdG9yeSBgL3Vzci9sb2NhbC9zbGV1
dGhraXQtMS43MC9zcmMvZmlsZS9zcmMnDQptYWtlWzFdOiAqKiogW2luc3RhbGwtcmVjdXJzaXZl
XSBFcnJvciAxDQptYWtlWzFdOiBMZWF2aW5nIGRpcmVjdG9yeSBgL3Vzci9sb2NhbC9zbGV1dGhr
aXQtMS43MC9zcmMvZmlsZScNCm1ha2U6ICoqKiBbZmlsZV0gRXJyb3IgMg0KIA0KQW55IGlkZWFz
Pw0KIA0KVGhhbmtzLA0KIA0KSm9lDQogDQo=

Re: [sleuthkit-users] Errors starting Autopsy on FreeBSD

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 18, 2004, at 4:02 PM, sle...@sh... wrote:

> Hi,
>
> I've installed Sleuthkit and Autopsy 1.73 on FreeBSD 4.9 using ports,
> but when I try to start it I get
>
> exists operator argument is not a HASH element at
> /usr/ports/sysutils/autopsy/work/autopsy-1.73/autopsyfunc.pm line 6829.
> BEGIN failed--compilation aborted at /usr/local/bin/autopsy line 64.
>
> Anyone know how to fix this?

Install that latest versions (from src if needed). The ones you have 
are over a year old. Some versions of Perl complained about that line.  
It is different in the new 2.0 design.

brian


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA+wAnOK1gLsdFTIsRAnNUAJ9E0v0w9tVXMnyErDAh5VIqfGm9oACfS6FN
UR/44PHZ6/lEXP4Qh+sOoRw=
=y/QK
-----END PGP SIGNATURE-----

[sleuthkit-users] Errors starting Autopsy on FreeBSD

[<sle...@sh...>]

Hi,

I've installed Sleuthkit and Autopsy 1.73 on FreeBSD 4.9 using ports,
but when I try to start it I get 

exists operator argument is not a HASH element at
/usr/ports/sysutils/autopsy/work/autopsy-1.73/autopsyfunc.pm line 6829.
BEGIN failed--compilation aborted at /usr/local/bin/autopsy line 64.

Anyone know how to fix this?

Thanks,

Ben

Re: [sleuthkit-users] Recovering deleted file from fat32

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 7, 2004, at 12:26 PM, Anne Wilson wrote:

> On Wednesday 07 Jul 2004 17:49, Brian Carrier wrote:
>>
>> If the file can be recovered, then you can 'export' the file and then
>> copy it back to its original location.  Use the latest autopsy and TSK
>> because they have FAT file recovery.  They do not do file recovery in
>> the classical sense because their primary focus is to examine a raw
>> image of the disk and they have no write support in them at all.
>>
> Thanks for the reply, Brian.  I think my copy (with Mandrake 10) 
> mustn't be
> the latest, then.  In the end I used fatback to recover them.  
> However, for
> future reference -
>
> I could see the files in autopsy, but attempting to export them 
> resulted in,
> for instance, bankrec.xls which appears to be a raw file and cannot be 
> read
> by any of the spreadsheet programs I have.  Could I have sorted this?

If you don't have the latest version (TSK v1.70), then exporting a 
deleted FAT file will give you only the first cluster.  Using 1.70 will 
export the entire file if it can be recovered.

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA7MNrOK1gLsdFTIsRAiOlAJ94sVA2yf+nXdm7kAKG5F3nE2drDwCdHiGC
9V1SG8hbjMXdZhC3FVOjRC0=
=QkXv
-----END PGP SIGNATURE-----

[sleuthkit-users] ECCE conference - correction

[Angus M. <an...@n-...>]

There was a typo. in the CFP issued yesterday. Mea maxima culpa.

The correct URL for the Monaco conference is http://www.ecce-conference.com/

Re: [sleuthkit-users] Overwritten parition and filesystem and some Autopsy trouble

[<spa...@gi...>]

Oh dear. Unfortunately I can't use any application level techniques as
the file in question is a raw 2GB MPEG TransportStream which does not
carry any header or so :( The disk was built into a digital set-top box
and the file is an important evidence in a case... Seems I am out of
luck today...
Any other idea?
Hmm, after thinking about it


On the other problem: I copied the URL properly but it didn't work.
Neither with IE6 nor Firefox 0.91. Anyway I finally got it working with
the -C option.

Ciao,
Christof

----- Original Message -----=20
From: "Brian Carrier" <ca...@sl...>
To: "Christof Baumg=E4rtner" <spa...@gi...>
Cc: <sle...@li...>
Sent: Wednesday, July 07, 2004 6:57 PM
Subject: Re: [sleuthkit-users] Overwritten parition and filesystem and
some Autopsy trouble


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 6, 2004, at 6:06 PM, Christof Baumg=E4rtner wrote:

> Hello,
> I have a harddisk which has two partitions on it (one of type 0x41,
one
> of type 0x83 which is Linux ext2). By accident I started a script
which
> recreated the two partitions, recreated the two filesystems and
> recreated the directory structure the same way as it was before. So I
> can still mount the ext2 partition and have access to all my previous
> directories. But now they are empty :(
> I tried to search for the inodes of the missing files without
success.
> How do I actually have to proceed?

If the file system data is gone (which probably occured when your
recreated the file systems), then your only bet is to use the
"application-level" techniques for recovery and use a tool like
foremost or another tool that looks at file headers.

> My second question concerns autopsy. I start autopsy with "./autopsy
> 9999 192.168.1.109" (192.168.1.109 is the IP address of another
> machine). I enter the long URL into a browser on the other machine
but
> get HTTP 403 denied. Am I missing something?

<later>

> Anyway: I just receive "document contains no data" with this
> modification :(

If using '-C' helped, then you were probably copying the cookie value
incorrectly.  Are you using IE as a client?  I have had bad luck with
IE giving the document contains no data errors and use Mozilla. I
thought I fixed most of the problems a long time ago though.  I also
seen those errors from running autopsy from within some versions of
Cygwin.

Check the autopsy log  in the evidence locker for more information on
why the original connection was being denied.

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA7CuGOK1gLsdFTIsRAi8PAJ9iKte0sRi6iJEBxQa1pSamrxejRQCdHK5x
ad8Wza3uoLN2othykM15Jw8=3D
=3DrxqN
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Recovering deleted file from fat32

[Anne W. <can...@ti...>]

On Wednesday 07 Jul 2004 17:49, Brian Carrier wrote:
>
> If the file can be recovered, then you can 'export' the file and then
> copy it back to its original location.  Use the latest autopsy and TSK
> because they have FAT file recovery.  They do not do file recovery in
> the classical sense because their primary focus is to examine a raw
> image of the disk and they have no write support in them at all.
>
Thanks for the reply, Brian.  I think my copy (with Mandrake 10) mustn't be 
the latest, then.  In the end I used fatback to recover them.  However, for 
future reference -

I could see the files in autopsy, but attempting to export them resulted in, 
for instance, bankrec.xls which appears to be a raw file and cannot be read 
by any of the spreadsheet programs I have.  Could I have sorted this?

Anne
-- 
Registered Linux User No.293302
Have you visited http://twiki.mdklinuxfaq.org yet?

Re: [sleuthkit-users] Overwritten parition and filesystem and some Autopsy trouble

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 6, 2004, at 6:06 PM, Christof Baumg=E4rtner wrote:

> Hello,
> I have a harddisk which has two partitions on it (one of type 0x41, =
one
> of type 0x83 which is Linux ext2). By accident I started a script =
which
> recreated the two partitions, recreated the two filesystems and
> recreated the directory structure the same way as it was before. So I
> can still mount the ext2 partition and have access to all my previous
> directories. But now they are empty :(
> I tried to search for the inodes of the missing files without success.
> How do I actually have to proceed?

If the file system data is gone (which probably occured when your=20
recreated the file systems), then your only bet is to use the=20
"application-level" techniques for recovery and use a tool like=20
foremost or another tool that looks at file headers.

> My second question concerns autopsy. I start autopsy with "./autopsy
> 9999 192.168.1.109" (192.168.1.109 is the IP address of another
> machine). I enter the long URL into a browser on the other machine but
> get HTTP 403 denied. Am I missing something?

<later>

> Anyway: I just receive "document contains no data" with this
> modification :(

If using '-C' helped, then you were probably copying the cookie value=20
incorrectly.  Are you using IE as a client?  I have had bad luck with=20
IE giving the document contains no data errors and use Mozilla. I=20
thought I fixed most of the problems a long time ago though.  I also=20
seen those errors from running autopsy from within some versions of=20
Cygwin.

Check the autopsy log  in the evidence locker for more information on=20
why the original connection was being denied.

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA7CuGOK1gLsdFTIsRAi8PAJ9iKte0sRi6iJEBxQa1pSamrxejRQCdHK5x
ad8Wza3uoLN2othykM15Jw8=3D
=3DrxqN
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Recovering deleted file from fat32

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 4, 2004, at 7:20 AM, Anne Wilson wrote:

> After an accident involving a fan failure I am left with whole 
> directories
> apparently lost.  Using Autopsy, however, I have confirmed that the 
> files are
> still there and intact.  I can see the files I need, with just the 
> first
> letter missing.  However, I can't see how I can recover them.  I 
> presume that
> there is some way in which I can rename these to the original name and 
> save
> them - maybe to a different directory?

If the file can be recovered, then you can 'export' the file and then 
copy it back to its original location.  Use the latest autopsy and TSK 
because they have FAT file recovery.  They do not do file recovery in 
the classical sense because their primary focus is to examine a raw 
image of the disk and they have no write support in them at all.

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA7CmcOK1gLsdFTIsRAvemAJ9Y5ph+qi5jJ80vDx2IJTC4INe4/gCdFEDJ
JfV5ovZQj/mk5NbMS8pLvys=
=5v2Q
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Overwritten parition and filesystem andsomeAutopsy trouble

[<spa...@gi...>]

OK. I was thinking of standard cookies (i.e. embedded into the HTTP
request body itself).
Anyway: I just receive "document contains no data" with this
modification :(

Ciao,
Christof

----- Original Message -----=20
From: "Matthew M. Shannon" <msh...@th...>
To: "Christof Baumg=E4rtner" <spa...@gi...>
Sent: Wednesday, July 07, 2004 5:13 PM
Subject: Re: [sleuthkit-users] Overwritten parition and filesystem
andsomeAutopsy trouble


Unless required by policy, don't use the cookie restrictions.

What version of Autopsy are you using?

./autopsy -C 9090 [IP Address]

The -C will force the URL to not use the "long number" cookie
restriction.


M

On Wed, 2004-07-07 at 10:48, Christof Baumg=C3=A4rtner wrote:
> I did.
> Actually the URL looks like
> http://192.168.1.150:9999/verylongnumericalstuff/autopsy
>
> Ciao,
> Christof
>
> ----- Original Message -----=20
> From: "Matthew M. Shannon" <msh...@th...>
> To: "Christof Baumg=C3=A4rtner" <spa...@gi...>
> Sent: Wednesday, July 07, 2004 2:18 PM
> Subject: Re: [sleuthkit-users] Overwritten parition and filesystem
and
> someAutopsy trouble
>
>
> Unless I'm not following you correctly, you need to add autopsy to
the
> address line.
>
>
> http://XX.XXX.XX.XXX:8080/autopsy
>
>
> M Shannon
>
>
>
> On Tue, 2004-07-06 at 19:12, Christof Baumg=C3f=C2=A4rtner wrote:
> > Actually it is not a HTTP 403, but a HTTP 200 just saying "Access
> > denied" ;)
> >
> > ----- Original Message -----=20
> > From: "Christof Baumg=C3f=C2=A4rtner" <spa...@gi...>
> > To: <sle...@li...>
> > Sent: Wednesday, July 07, 2004 1:06 AM
> > Subject: [sleuthkit-users] Overwritten parition and filesystem and
> some
> > Autopsy trouble
> >
> >
> > > Hello,
> > > I have a harddisk which has two partitions on it (one of type
0x41,
> > one
> > > of type 0x83 which is Linux ext2). By accident I started a script
> > which
> > > recreated the two partitions, recreated the two filesystems and
> > > recreated the directory structure the same way as it was before.
So
> I
> > > can still mount the ext2 partition and have access to all my
> previous
> > > directories. But now they are empty :(
> > > I tried to search for the inodes of the missing files without
> > success.
> > > How do I actually have to proceed?
> > >
> > > My second question concerns autopsy. I start autopsy with
> "./autopsy
> > > 9999 192.168.1.109" (192.168.1.109 is the IP address of another
> > > machine). I enter the long URL into a browser on the other
machine
> > but
> > > get HTTP 403 denied. Am I missing something?
> > >
> > > Ciao,
> > > Christof
> > >
> > >
> > >
> > > -------------------------------------------------------
> > > This SF.Net email sponsored by Black Hat Briefings & Training.
> > > Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> > > digital self defense, top technical experts, no vendor pitches,
> > > unmatched networking opportunities. Visit www.blackhat.com
> > > _______________________________________________
> > > sleuthkit-users mailing list
> > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> > >
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by Black Hat Briefings & Training.
> > Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> > digital self defense, top technical experts, no vendor pitches,
> > unmatched networking opportunities. Visit www.blackhat.com
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> digital self defense, top technical experts, no vendor pitches,
> unmatched networking opportunities. Visit www.blackhat.com
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Overwritten parition and filesystem and someAutopsy trouble

[<spa...@gi...>]

I did.
Actually the URL looks like
http://192.168.1.150:9999/verylongnumericalstuff/autopsy

Ciao,
Christof

----- Original Message -----=20
From: "Matthew M. Shannon" <msh...@th...>
To: "Christof Baumg=E4rtner" <spa...@gi...>
Sent: Wednesday, July 07, 2004 2:18 PM
Subject: Re: [sleuthkit-users] Overwritten parition and filesystem and
someAutopsy trouble


Unless I'm not following you correctly, you need to add autopsy to the
address line.


http://XX.XXX.XX.XXX:8080/autopsy


M Shannon



On Tue, 2004-07-06 at 19:12, Christof Baumg=C3=A4rtner wrote:
> Actually it is not a HTTP 403, but a HTTP 200 just saying "Access
> denied" ;)
>
> ----- Original Message -----=20
> From: "Christof Baumg=C3=A4rtner" <spa...@gi...>
> To: <sle...@li...>
> Sent: Wednesday, July 07, 2004 1:06 AM
> Subject: [sleuthkit-users] Overwritten parition and filesystem and
some
> Autopsy trouble
>
>
> > Hello,
> > I have a harddisk which has two partitions on it (one of type 0x41,
> one
> > of type 0x83 which is Linux ext2). By accident I started a script
> which
> > recreated the two partitions, recreated the two filesystems and
> > recreated the directory structure the same way as it was before. So
I
> > can still mount the ext2 partition and have access to all my
previous
> > directories. But now they are empty :(
> > I tried to search for the inodes of the missing files without
> success.
> > How do I actually have to proceed?
> >
> > My second question concerns autopsy. I start autopsy with
"./autopsy
> > 9999 192.168.1.109" (192.168.1.109 is the IP address of another
> > machine). I enter the long URL into a browser on the other machine
> but
> > get HTTP 403 denied. Am I missing something?
> >
> > Ciao,
> > Christof
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by Black Hat Briefings & Training.
> > Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> > digital self defense, top technical experts, no vendor pitches,
> > unmatched networking opportunities. Visit www.blackhat.com
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> digital self defense, top technical experts, no vendor pitches,
> unmatched networking opportunities. Visit www.blackhat.com
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Overwritten parition and filesystem and some Autopsy trouble

[<spa...@gi...>]

Actually it is not a HTTP 403, but a HTTP 200 just saying "Access
denied" ;)

----- Original Message -----=20
From: "Christof Baumg=E4rtner" <spa...@gi...>
To: <sle...@li...>
Sent: Wednesday, July 07, 2004 1:06 AM
Subject: [sleuthkit-users] Overwritten parition and filesystem and some
Autopsy trouble


> Hello,
> I have a harddisk which has two partitions on it (one of type 0x41,
one
> of type 0x83 which is Linux ext2). By accident I started a script
which
> recreated the two partitions, recreated the two filesystems and
> recreated the directory structure the same way as it was before. So I
> can still mount the ext2 partition and have access to all my previous
> directories. But now they are empty :(
> I tried to search for the inodes of the missing files without
success.
> How do I actually have to proceed?
>
> My second question concerns autopsy. I start autopsy with "./autopsy
> 9999 192.168.1.109" (192.168.1.109 is the IP address of another
> machine). I enter the long URL into a browser on the other machine
but
> get HTTP 403 denied. Am I missing something?
>
> Ciao,
> Christof
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> digital self defense, top technical experts, no vendor pitches,
> unmatched networking opportunities. Visit www.blackhat.com
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] Overwritten parition and filesystem and some Autopsy trouble

[<spa...@gi...>]

Hello,
I have a harddisk which has two partitions on it (one of type 0x41, one
of type 0x83 which is Linux ext2). By accident I started a script which
recreated the two partitions, recreated the two filesystems and
recreated the directory structure the same way as it was before. So I
can still mount the ext2 partition and have access to all my previous
directories. But now they are empty :(
I tried to search for the inodes of the missing files without success.
How do I actually have to proceed?

My second question concerns autopsy. I start autopsy with "./autopsy
9999 192.168.1.109" (192.168.1.109 is the IP address of another
machine). I enter the long URL into a browser on the other machine but
get HTTP 403 denied. Am I missing something?

Ciao,
Christof

[sleuthkit-users] e-crime and computer evidence Call for Papers

[Angus M. <an...@n-...>]

I am pleased to announce that the CFP for the 2005 e-crime and computer
evidence conference is now out.

The conference will be held on 29th & 30th March in the Columbus Hotel,
Monaco and we hope to attract papers from internationally renowned speakers.

Full details of the CFP are now available at
http://www.-ecce-conference.com/ and registration information will appear
there early next week. All accepted speakers will qualify for a 50% discount
on accomodation and registration for the 2-day conference.

Angus M. Marshall.

[sleuthkit-users] Recovering deleted file from fat32

[Anne W. <can...@ti...>]

After an accident involving a fan failure I am left with whole directories 
apparently lost.  Using Autopsy, however, I have confirmed that the files are 
still there and intact.  I can see the files I need, with just the first 
letter missing.  However, I can't see how I can recover them.  I presume that 
there is some way in which I can rename these to the original name and save 
them - maybe to a different directory?

Anne
-- 
Registered Linux User No.293302
Have you visited http://twiki.mdklinuxfaq.org yet?

[sleuthkit-users] RE: sleuthkit-users digest, Vol 1 #175 - 1 msg

[SecMan <se...@ta...>]

I had a disk with the same weirdness - it turned out to be a win2k ntfs disk
that someone had mounted wrong and written as win98 fat32 - I was able to
salvage a little of teh original but
not much good - If you can get some of the early history - maybe you can
rebuild the orig
layout. Sorry - i know that this is not much help. tc.

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...]On Behalf Of
sle...@li...
Sent: Thursday, June 17, 2004 11:26 PM
To: sle...@li...
Subject: sleuthkit-users digest, Vol 1 #175 - 1 msg


Send sleuthkit-users mailing list submissions to
	sle...@li...

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
or, via email, send a message with subject or body 'help' to
	sle...@li...

You can reach the person managing the list at
	sle...@li...

When replying, please edit your Subject line so it is more specific
than "Re: Contents of sleuthkit-users digest..."


Today's Topics:

   1. Problems Aquiring a Bad Drive (Jason Fuller)

--__--__--

Message: 1
From: "Jason Fuller" <efo...@ho...>
To: sle...@li...
Date: Thu, 17 Jun 2004 13:33:27 -0500
Subject: [sleuthkit-users] Problems Aquiring a Bad Drive

To All:

I am using RH9 with Sleuthkit  1.7 & Autopsy 2.01. I am experiencing
problems processig an image. I am imaging a "bad" 30gig drive. (i.e. it will
no longer boot into Win98).

Below is the partition that I copied:
----------------------------------------------------------------------------
-----------------------------
[root@localhost levan]# fdisk -l

Disk /dev/hdb: 30.0 GB, 30020272128 bytes
255 heads, 63 sectors/track, 3649 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot    Start       End    Blocks   Id  System
/dev/hdb1   *         1      3649  29310561    c  Win95 FAT32 (LBA)

[root@localhost levan]# clock ; dcfldd if=/dev/hdb1 of=30gig1.img
conv=noerror,sync ; clock
Thu 17 Jun 2004 11:35:44 AM CDT  -0.214746 seconds
dcfldd: reading `/dev/hdb1': Input/output error
0+0 records in
0+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+1 records in
1+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+2 records in
2+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+3 records in
3+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+4 records in
4+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+5 records in
5+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+6 records in
6+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+7 records in
7+0 records out
58620928 blocks (28639Mb) written.
58621114+8 records in
58621122+0 records out
Thu 17 Jun 2004 11:58:23 AM CDT  -0.134078 seconds
----------------------------------------------------------------------------
-------------------------------------
When I try to add the image to Autopsy, I receive an error stating that the
image is not fat32. This image is win98 fat32.  How can I get Autopsy to add
the correct image under Fat32, apparently the bad blocks are preventing
Autopsy to view the partition properly.

I also receive errors when dd'ing the whole /dev/hdb.

What do I need to do to correct this problem?

Thank you,

Jason Fuller

_________________________________________________________________
Getting married? Find great tips, tools and the latest trends at MSN Life
Events. http://lifeevents.msn.com/category.aspx?cid=married




--__--__--

_______________________________________________
sleuthkit-users mailing list
sle...@li...
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users


End of sleuthkit-users Digest

Re: [sleuthkit-users] NSRL hash usage in Autopsy

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Jun 30, 2004, at 12:03 PM, Baskin, Brian wrote:

> My first question is what is the status of using NSRL in Autopsy for=20=

> hash analysis?
>
> In Informer #8, Aug 28, 2003, it was mentioned that the sorter no=20
> longer uses NSRL because of the issues between known good and known=20
> bad hashes.
>
> I haven't found any sort of update on this, so I was wondering if the=20=

> sorter has been updated?=A0 I saw that the Hashapalooza was yesterday =
at=20
> NIST
>
>  (unfortunately I couldn't attend), and was hoping to ask in person.=A0=20=

> I hope it was a good event for all involved.

The hashapalooza was delayed and it will now be on the third day of=20
DFRWS in August.

The plan is to develop a small number of application categories that a=20=

user can choose if they are "good" or "bad" for that case.  Those exact=20=

categories are still being worked out, but should be done for August.

> A second, very minor question, deals with nomenclature with the TASK=20=

> utils.=A0 fls/mactime mention the use of the 'body' file.=A0 Autopsy=20=

> refers to it as the 'data' file.=A0 Is one term preferred above the=20
> other in describing this file?

'body' came from the original TCT documentation.  I prefer something=20
more generic like 'data'.  Maybe when v2 is done and the output of each=20=

tool is reconsidered then a more accurate name can be given.

brian


 =20
 =20
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA4xb3OK1gLsdFTIsRAtxwAJ9EybDPiBaUQuLqnNHtFHDl1aXmewCdGvq/
gqQnRZ4FfyUyl4jZuednuUw=3D
=3Dp8OY
-----END PGP SIGNATURE-----

[sleuthkit-users] NSRL hash usage in Autopsy

[Baskin, B. <ba...@dc...>]

My first question is what is the status of using NSRL in Autopsy for hash
analysis?

In Informer #8, Aug 28, 2003, it was mentioned that the sorter no longer
uses NSRL because of the issues between known good and known bad hashes.
I haven't found any sort of update on this, so I was wondering if the sorter
has been updated?  I saw that the Hashapalooza was yesterday at NIST 
(unfortunately I couldn't attend), and was hoping to ask in person.  I hope
it was a good event for all involved.


A second, very minor question, deals with nomenclature with the TASK utils.
fls/mactime mention the use of the 'body' file.  Autopsy refers to it as the
'data' file.  Is one term preferred above the other in describing this file?



Brian Baskin
DoD Computer Investigations Training Program
ba...@dc...
410-981-1655

Re: [sleuthkit-users] Problems Aquiring a Bad Drive

[Linux T. <lin...@ya...>]

haven't you tried dd_rhelp and gpart to go further?

-lt


--- Jason Fuller <efo...@ho...> wrote:
> To All:
> 
> I am using RH9 with Sleuthkit  1.7 & Autopsy 2.01. I
> am experiencing 
> problems processig an image. I am imaging a "bad"
> 30gig drive. (i.e. it will 
> no longer boot into Win98).
> 
> Below is the partition that I copied:
> 


	
		
__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail 

Re: [sleuthkit-users] Problems Aquiring a Bad Drive

[Brian C. <ca...@sl...>]

On Jun 17, 2004, at 1:33 PM, Jason Fuller wrote:

> To All:
>
> I am using RH9 with Sleuthkit  1.7 & Autopsy 2.01. I am experiencing 
> problems processig an image. I am imaging a "bad" 30gig drive. (i.e. 
> it will no longer boot into Win98).


> When I try to add the image to Autopsy, I receive an error stating 
> that the image is not fat32. This image is win98 fat32.  How can I get 
> Autopsy to add the correct image under Fat32, apparently the bad 
> blocks are preventing Autopsy to view the partition properly.

Autopsy is complaining because you don't have a boot sector.  The first 
eight sectors of the file system have errors, so dd is writing zeros in 
those locations.  Without the boot sector,  TSK doesn't know how big a 
cluster is, where the FAT is, how big the FAT is etc.  FAT32 has a 
backup copy in sector 6, but that is damaged as well.  So, unless you 
can find a tool that will try and recreate the boot sector, then 
Autopsy or TSK won't help.

brian


> [root@localhost levan]# clock ; dcfldd if=/dev/hdb1 of=30gig1.img 
> conv=noerror,sync ; clock
> Thu 17 Jun 2004 11:35:44 AM CDT  -0.214746 seconds
> dcfldd: reading `/dev/hdb1': Input/output error
> 0+0 records in
> 0+0 records out
> dcfldd: reading `/dev/hdb1': Input/output error
> 0+1 records in
> 1+0 records out
> dcfldd: reading `/dev/hdb1': Input/output error
> 0+2 records in
> 2+0 records out
> dcfldd: reading `/dev/hdb1': Input/output error
> 0+3 records in
> 3+0 records out
> dcfldd: reading `/dev/hdb1': Input/output error
> 0+4 records in
> 4+0 records out
> dcfldd: reading `/dev/hdb1': Input/output error
> 0+5 records in
> 5+0 records out
> dcfldd: reading `/dev/hdb1': Input/output error
> 0+6 records in
> 6+0 records out
> dcfldd: reading `/dev/hdb1': Input/output error
> 0+7 records in
> 7+0 records out
> 58620928 blocks (28639Mb) written.
> 58621114+8 records in
> 58621122+0 records out
> Thu 17 Jun 2004 11:58:23 AM CDT  -0.134078 seconds
>

[sleuthkit-users] Problems Aquiring a Bad Drive

[Jason F. <efo...@ho...>]

To All:

I am using RH9 with Sleuthkit  1.7 & Autopsy 2.01. I am experiencing 
problems processig an image. I am imaging a "bad" 30gig drive. (i.e. it will 
no longer boot into Win98).

Below is the partition that I copied:
---------------------------------------------------------------------------------------------------------
[root@localhost levan]# fdisk -l

Disk /dev/hdb: 30.0 GB, 30020272128 bytes
255 heads, 63 sectors/track, 3649 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot    Start       End    Blocks   Id  System
/dev/hdb1   *         1      3649  29310561    c  Win95 FAT32 (LBA)

[root@localhost levan]# clock ; dcfldd if=/dev/hdb1 of=30gig1.img 
conv=noerror,sync ; clock
Thu 17 Jun 2004 11:35:44 AM CDT  -0.214746 seconds
dcfldd: reading `/dev/hdb1': Input/output error
0+0 records in
0+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+1 records in
1+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+2 records in
2+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+3 records in
3+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+4 records in
4+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+5 records in
5+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+6 records in
6+0 records out
dcfldd: reading `/dev/hdb1': Input/output error
0+7 records in
7+0 records out
58620928 blocks (28639Mb) written.
58621114+8 records in
58621122+0 records out
Thu 17 Jun 2004 11:58:23 AM CDT  -0.134078 seconds
-----------------------------------------------------------------------------------------------------------------
When I try to add the image to Autopsy, I receive an error stating that the 
image is not fat32. This image is win98 fat32.  How can I get Autopsy to add 
the correct image under Fat32, apparently the bad blocks are preventing 
Autopsy to view the partition properly.

I also receive errors when dd'ing the whole /dev/hdb.

What do I need to do to correct this problem?

Thank you,

Jason Fuller

_________________________________________________________________
Getting married? Find great tips, tools and the latest trends at MSN Life 
Events. http://lifeevents.msn.com/category.aspx?cid=married

Re: Re: [sleuthkit-users] avoiding creating a dd image

[<edi...@ya...>]

Thanks for all !
Well, my knowledge of unix systems is actually basic (as my english is) as you noticed, but with the help of autopsy that should be enough.
Autopsy is the only one solution that avoid creating images of the system. 
I need that because my first task is to  analyse a system and to find information without copying,printing or burning anything else than authorized by the judge; thus a disk image for further analysis is forbidden (and expensive :-(  ). Of course, the best tool (well, the more ergonomic) would be iLook, but this one need disk images ... 

Angus Marshall <an...@ng...> wrote:
Actually, if you're just using sleuthkit - you don't need symlinks. You can just run the tools directly on the device entry under /dev.

The symlink is useful if you use Autopsy as your interface, but Autopsy will do the linking for you.

I have to say though, that it doesn't sound like you know quite enough about the O/S you're working on top of. The device entries and the concept of symbolic links are fairly basic concepts in any *nix-like OS.

> Message date : Jun 17 2004, 01:31 PM
> From : "Matthew M. Shannon" 
> To : "amouri eddy" 
> Copy to : "Angus Marshall" , sle...@li...
> Subject : Re: [sleuthkit-users] avoiding creating a dd image
> 
> ln -s /dev/hdaX(sdaX) /home/path/to/file/file.img 
> 
> Of course that could be sdb or hdb... or any other combination..
> 
> For Example:
> 
> ln -s /dev/hda1 /home/test/hda1-test.img
> 
> Good luck!
> 
> M Shannon
> 
> On Thu, 2004-06-17 at 05:37, amouri eddy wrote:
> > Thanks for the answer ...
> > But ..symlink command does not exist in linux. 
> > And how to link for example partition 2 (or 1, or 3)
> > to 
> > a file ?
> > About the legal reasons, they don't matter in my
> > case...
> > 
> > --- Angus Marshall a écrit : > On
> > Thursday 17 June 2004 09:56, amouri eddy wrote:
> > > > Hello,
> > > >
> > > > For analysing a system (booting with a live linux
> > > CD), it is possible to
> > > > mount the disks. But the sleuth kit requires
> > > images, so images of the disks
> > > > must be created. Is it possible to find a way to
> > > directly analyse the disk
> > > > (creating images may takes a long long time and
> > > one need another hd) ?
> > > >
> > > > Thanks
> > > 
> > > You can symlink the disk device entry (e.g.
> > > /dev/sda1) instead of imaging but 
> > 
> > > 
> > > This SF.Net email is sponsored by The 2004
> > > JavaOne(SM) Conference
> > > Learn from the experts at JavaOne(SM), Sun's
> > > Worldwide Java Developer
> > > Conference, June 28 - July 1 at the Moscone Center
> > > in San Francisco, CA
> > > REGISTER AND SAVE! http://java.sun.com/javaone/sf
> > > Priority Code NWMGYKND
> > > _______________________________________________
> > > sleuthkit-users mailing list
> > >
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> > > 
> > 
> > 
> > 
> > 
> > 
> > 
> > Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout ! 
> > Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/
> > 
> > Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !Téléchargez Yahoo! Messenger sur http://fr.messenger.yahoo.com
> > 
> > 
> > -------------------------------------------------------
> > This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
> > Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
> > Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
> > REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> 
> 

-- 

Whatever you Wanadoo:
http://www.wanadoo.co.uk/time/

This email has been checked for most known viruses - find out more at: http://www.wanadoo.co.uk/help/id/7098.htm


-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

		
---------------------------------
Créez gratuitement votre Yahoo! Mail avec 100 Mo de stockage !
Créez votre Yahoo! Mail

Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !

Re: [sleuthkit-users] avoiding creating a dd image

[Paul S. <pa...@vn...>]

The command you want is not "symlink" but "ln", check the man page and
use the -s switch.  Devices under Linux for IDE are /dev/hda, hdb, hdc,
hdd etc. for the 1st, 2nd, 3rd, 4th IDE disks.  For SCSI it's /dev/sda,
sdb, sdc etc.  Following that would be the partition number, for example
- using fdisk -l the partition table for the laptop I'm working on now
reads:
pauls:~ # fdisk -l /dev/hda

Disk /dev/hda: 40.0 GB, 40007761920 bytes
255 heads, 63 sectors/track, 4864 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot    Start       End    Blocks   Id  System
/dev/hda1             1         4     32098+  de  Dell Utility
/dev/hda2   *         5        17    104422+  83  Linux
/dev/hda3            18      1949  15518790    7  HPFS/NTFS
/dev/hda4          1950      4864  23414737+   f  Win95 Ext'd (LBA)
/dev/hda5          1950      2050    811251   82  Linux swap
/dev/hda6          2051      2181   1052226    c  Win95 FAT32 (LBA)
/dev/hda7          2182      2834   5245191   83  Linux
/dev/hda8          2835      4864  16305943+  83  Linux


It's dual boot Dell Inspiron hence all the different partition types.  I
could link /dev/hda6 to a file and access it as if it were a dd image
like so:

pauls:~ # ln -s /dev/hda6 ./hda6.dd
pauls:~ # ls -l hda6.dd
lrwxrwxrwx    1 root     root            9 Jun 17 08:21 hda6.dd ->
/dev/hda6

One must be careful though, because the device has not been marked
read-only and there is a chance that you could contaminate your
evidence.

If you simply need to examine the file system and search for files, you
could mount it read-only and do so safely like so:

pauls:~ # mkdir hda6
pauls:~ # mount /dev/hda6 -t vfat -o ro hda6

To verify that it has been mounted read only, issue the mount command
and in the resulted listing you will find a line like the following:

pauls:~ # mount
/dev/hda6 on /root/hda6 type vfat (ro)

The (ro) means read only.

Hope this helps.  Keep in mind the legalities of what you are trying to
do.

Paul


On Thu, 2004-06-17 at 05:37, amouri eddy wrote:

> Thanks for the answer ...
> But ..symlink command does not exist in linux. 
> And how to link for example partition 2 (or 1, or 3)
> to 
> a file ?
> About the legal reasons, they don't matter in my
> case...
> 
> --- Angus Marshall <an...@n-...> a écrit : > On
> Thursday 17 June 2004 09:56, amouri eddy wrote:
> > > Hello,
> > >
> > > For analysing a system (booting with a live linux
> > CD), it is possible to
> > > mount the disks. But the sleuth kit requires
> > images, so images of the disks
> > > must be created. Is it possible to find a way to
> > directly analyse the disk
> > > (creating images may takes a long long time and
> > one need another hd) ?
> > >
> > > Thanks
> > 
> > You can symlink the disk device entry (e.g.
> > /dev/sda1) instead of imaging but 
> 
> > 
> > This SF.Net email is sponsored by The 2004
> > JavaOne(SM) Conference
> > Learn from the experts at JavaOne(SM), Sun's
> > Worldwide Java Developer
> > Conference, June 28 - July 1 at the Moscone Center
> > in San Francisco, CA
> > REGISTER AND SAVE! http://java.sun.com/javaone/sf
> > Priority Code NWMGYKND
> > _______________________________________________
> > sleuthkit-users mailing list
> >
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >  
> 
> 
> 	
> 
> 	
> 		
> Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout ! 
> Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/
> 
> Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !Téléchargez Yahoo! Messenger sur http://fr.messenger.yahoo.com
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
> Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
> Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
> REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org