sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: Re: [sleuthkit-users] avoiding creating a dd image

[Angus M. <an...@ng...>]

Actually, if you're just using sleuthkit - you don't need symlinks. You can=
 just run the tools directly on the device entry under /dev.

The symlink is useful if you use Autopsy as your interface, but Autopsy wil=
l do the linking for you.

I have to say though, that it doesn't sound like you know quite enough abou=
t the O/S you're working on top of. The device entries and the concept of s=
ymbolic links are fairly basic concepts in any *nix-like OS.

> Message date : Jun 17 2004, 01:31 PM
> From : "Matthew M. Shannon" <msh...@ag...>
> To : "amouri eddy" <edi...@ya...>
> Copy to : "Angus Marshall" <an...@n-...>, sle...@li...ur=
ceforge.net
> Subject : Re: [sleuthkit-users] avoiding creating a dd image
>=20
> ln -s /dev/hdaX(sdaX) /home/path/to/file/file.img=20
>=20
> Of course that could be sdb or hdb... or any other combination..
>=20
> For Example:
>=20
> ln -s /dev/hda1 /home/test/hda1-test.img
>=20
> Good luck!
>=20
> M Shannon
>=20
> On Thu, 2004-06-17 at 05:37, amouri eddy wrote:
> > Thanks for the answer ...
> > But ..symlink command does not exist in linux.=20
> > And how to link for example partition 2 (or 1, or 3)
> > to=20
> > a file ?
> > About the legal reasons, they don't matter in my
> > case...
> >=20
> > --- Angus Marshall <an...@n-...> a =C3=A9crit : > On
> > Thursday 17 June 2004 09:56, amouri eddy wrote:
> > > > Hello,
> > > >
> > > > For analysing a system (booting with a live linux
> > > CD), it is possible to
> > > > mount the disks. But the sleuth kit requires
> > > images, so images of the disks
> > > > must be created. Is it possible to find a way to
> > > directly analyse the disk
> > > > (creating images may takes a long long time and
> > > one need another hd) ?
> > > >
> > > > Thanks
> > >=20
> > > You can symlink the disk device entry (e.g.
> > > /dev/sda1) instead of imaging but=20
> >=20
> > >=20
> > > This SF.Net email is sponsored by The 2004
> > > JavaOne(SM) Conference
> > > Learn from the experts at JavaOne(SM), Sun's
> > > Worldwide Java Developer
> > > Conference, June 28 - July 1 at the Moscone Center
> > > in San Francisco, CA
> > > REGISTER AND SAVE! http://java.sun.com/javaone/sf
> > > Priority Code NWMGYKND
> > > _______________________________________________
> > > sleuthkit-users mailing list
> > >
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> > > =20
> >=20
> >=20
> > =09
> >=20
> > =09
> > =09=09
> > Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout !=
=20
> > Cr=C3=A9ez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/
> >=20
> > Dialoguez en direct avec vos amis gr=C3=A2ce =C3  Yahoo! Messenger !T=
=C3=A9l=C3=A9chargez Yahoo! Messenger sur http://fr.messenger.yahoo.com
> >=20
> >=20
> > -------------------------------------------------------
> > This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
> > Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
> > Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
> > REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKN=
D
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>=20
>=20

--=20

Whatever you Wanadoo:
http://www.wanadoo.co.uk/time/

This email has been checked for most known viruses - find out more at: http=
://www.wanadoo.co.uk/help/id/7098.htm

Re: [sleuthkit-users] avoiding creating a dd image

[Matthew M. S. <msh...@ag...>]

ln -s /dev/hdaX(sdaX) /home/path/to/file/file.img 

Of course that could be sdb or hdb... or any other combination..

For Example:

ln -s /dev/hda1 /home/test/hda1-test.img

Good luck!

M Shannon

On Thu, 2004-06-17 at 05:37, amouri eddy wrote:
> Thanks for the answer ...
> But ..symlink command does not exist in linux. 
> And how to link for example partition 2 (or 1, or 3)
> to 
> a file ?
> About the legal reasons, they don't matter in my
> case...
> 
> --- Angus Marshall <an...@n-...> a écrit : > On
> Thursday 17 June 2004 09:56, amouri eddy wrote:
> > > Hello,
> > >
> > > For analysing a system (booting with a live linux
> > CD), it is possible to
> > > mount the disks. But the sleuth kit requires
> > images, so images of the disks
> > > must be created. Is it possible to find a way to
> > directly analyse the disk
> > > (creating images may takes a long long time and
> > one need another hd) ?
> > >
> > > Thanks
> > 
> > You can symlink the disk device entry (e.g.
> > /dev/sda1) instead of imaging but 
> 
> > 
> > This SF.Net email is sponsored by The 2004
> > JavaOne(SM) Conference
> > Learn from the experts at JavaOne(SM), Sun's
> > Worldwide Java Developer
> > Conference, June 28 - July 1 at the Moscone Center
> > in San Francisco, CA
> > REGISTER AND SAVE! http://java.sun.com/javaone/sf
> > Priority Code NWMGYKND
> > _______________________________________________
> > sleuthkit-users mailing list
> >
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >  
> 
> 
> 	
> 
> 	
> 		
> Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout ! 
> Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/
> 
> Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !Téléchargez Yahoo! Messenger sur http://fr.messenger.yahoo.com
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
> Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
> Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
> REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] avoiding creating a dd image

[<edi...@ya...>]

Thanks for the answer ...
But ..symlink command does not exist in linux. 
And how to link for example partition 2 (or 1, or 3)
to 
a file ?
About the legal reasons, they don't matter in my
case...

--- Angus Marshall <an...@n-...> a écrit : > On
Thursday 17 June 2004 09:56, amouri eddy wrote:
> > Hello,
> >
> > For analysing a system (booting with a live linux
> CD), it is possible to
> > mount the disks. But the sleuth kit requires
> images, so images of the disks
> > must be created. Is it possible to find a way to
> directly analyse the disk
> > (creating images may takes a long long time and
> one need another hd) ?
> >
> > Thanks
> 
> You can symlink the disk device entry (e.g.
> /dev/sda1) instead of imaging but 

> 
> This SF.Net email is sponsored by The 2004
> JavaOne(SM) Conference
> Learn from the experts at JavaOne(SM), Sun's
> Worldwide Java Developer
> Conference, June 28 - July 1 at the Moscone Center
> in San Francisco, CA
> REGISTER AND SAVE! http://java.sun.com/javaone/sf
> Priority Code NWMGYKND
> _______________________________________________
> sleuthkit-users mailing list
>
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>  


	

	
		
Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout ! 
Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/

Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !Téléchargez Yahoo! Messenger sur http://fr.messenger.yahoo.com

Re: [sleuthkit-users] avoiding creating a dd image

[Angus M. <an...@n-...>]

On Thursday 17 June 2004 09:56, amouri eddy wrote:
> Hello,
>
> For analysing a system (booting with a live linux CD), it is possible to
> mount the disks. But the sleuth kit requires images, so images of the disks
> must be created. Is it possible to find a way to directly analyse the disk
> (creating images may takes a long long time and one need another hd) ?
>
> Thanks

You can symlink the disk device entry (e.g. /dev/sda1) instead of imaging but 
this is not recommended practice for legal reasons in most jurisdictions.

> ---------------------------------
> Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout !
> Créez votre Yahoo! Mail
>
> Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !

[sleuthkit-users] avoiding creating a dd image

[<edi...@ya...>]

Hello,
 
For analysing a system (booting with a live linux CD), it is possible to mount the disks. But the sleuth kit requires images, so images of the disks must be created. 
Is it possible to find a way to directly analyse the disk (creating images may takes a long long time and one need another hd) ?
 
Thanks

		
---------------------------------
Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout !
Créez votre Yahoo! Mail

Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !

RE: [sleuthkit-users] Autopsy 2.01 - LiveAnalysis Questions

[Surago J. <su...@sj...>]

Excellent,

I was reasonably sure I was on the right track with my thinking, just
needed someone else to confirm it. :)

Thanks for the quick response, much appreciated.

Cheers

Surago=20

-----Original Message-----
From: Brian Carrier
Sent: Thursday, 17 June 2004 3:12 a.m.
To: Surago Jones
Cc: Brian Carrier; <sle...@li...>
Subject: Re: [sleuthkit-users] Autopsy 2.01 - LiveAnalysis Questions

[The sourceforge server was black listed on the SPAM list that
sleuthkit.org uses and I can't send e-mail from there ...]

On Jun 16, 2004, at 2:26 AM, Surago Jones wrote:

> Fristly, it is my understanding, that during a live analysis, autopsy
> v2.01 does not offer any extra functionality that can be found in=20
> autopsy when performing a so called dead analysis on a hdd image=20
> (however during a dead analysis autopsy does have extra functionality=20
> not available during a live analysis).  Can someone confirm this for=20
> me please, just so I know I'm on the right track.

Yes, this is true.  The first phase was to provide the basic
functionality.  Features that require files to be created on the local
system were disabled because there is no where to write them to.

> I have created some shell scripts to help automate the incident=20
> verification process, by returning information from volatile sources=20
> (ps, netstat, arp, ifconfig) using trusted binaries, and it might be=20
> useful if autopsy had an interface for these sources of information=20
> during a liveanalysis.  Currently I simply pipe the output from these=20
> sources thru netcat, and save the datafile on the evidence server.

This is part of the second phase of the autopsy live-analysis support. =20
I want to be able to make scripts and let users make scripts that can be
placed on the CD and that will show up in a menu in Autopsy.

> Secondly, I understand that a liveanalysis is not the preferred method

> of performing an analysis, and depending on circumstances (every case=20
> is different), should be avoided where possible.  However, if one was=20
> to utilise autopsy for browsing the filesystem, the underlying=20
> functionality of autopsy (tools from sleuthkit) does not modify the=20
> MAC times on directories and files browsed.  If someone can confirm,=20
> or comment on this, it would be much appreciated also.

Yes, this is true. TSK reads from the raw device and does not use any of
the kernel's file system support.  Therefore, MAC times are not updated
and any files that are hidden by kernel-based rootkits are shown.

brian

Re: [sleuthkit-users] File too large, Fat32

[Brian C. <ca...@ce...>]

[I sent this last week, but it was never posted because of the SPAM 
list issue.  Here it is again.]


On Jun 10, 2004, at 11:23 AM, Brian Carrier wrote:

> To finish this thread, the issue has been resolved (BUG 966839).  If 
> your system is showing the same behavior for large FAT files, let me 
> know and I'll send you the fix.  Otherwise, it will be in the next 
> version.
>
> Thanks to Fuerst for helping to debug this.
>
> brian
>
>
>
>
> On Jun 7, 2004, at 2:29 AM, fu...@gm... wrote:
>
>>>> Hi list members
>>>>
>>>> I got a problem with an image of a Fat32-Image.
>>>
>>> ...
>>>
>>>> Size:
>>>> 18446744073709546496
>>>>
>>>> Obviously, the file size is wrong here.
>

Re: [sleuthkit-users] Autopsy 2.01 - LiveAnalysis Questions

[Brian C. <ca...@ce...>]

[The sourceforge server was black listed on the SPAM list that 
sleuthkit.org uses and I can't send e-mail from there ...]

On Jun 16, 2004, at 2:26 AM, Surago Jones wrote:

> Fristly, it is my understanding, that during a live analysis, autopsy
> v2.01 does not offer any extra functionality that can be found in
> autopsy when performing a so called dead analysis on a hdd image
> (however during a dead analysis autopsy does have extra functionality
> not available during a live analysis).  Can someone confirm this for me
> please, just so I know I'm on the right track.

Yes, this is true.  The first phase was to provide the basic 
functionality.  Features that require files to be created on the local 
system were disabled because there is no where to write them to.

> I have created some shell scripts to help automate the incident
> verification process, by returning information from volatile sources
> (ps, netstat, arp, ifconfig) using trusted binaries, and it might be
> useful if autopsy had an interface for these sources of information
> during a liveanalysis.  Currently I simply pipe the output from these
> sources thru netcat, and save the datafile on the evidence server.

This is part of the second phase of the autopsy live-analysis support.  
I want to be able to make scripts and let users make scripts that can 
be placed on the CD and that will show up in a menu in Autopsy.

> Secondly, I understand that a liveanalysis is not the preferred method
> of performing an analysis, and depending on circumstances (every case 
> is
> different), should be avoided where possible.  However, if one was to
> utilise autopsy for browsing the filesystem, the underlying
> functionality of autopsy (tools from sleuthkit) does not modify the MAC
> times on directories and files browsed.  If someone can confirm, or
> comment on this, it would be much appreciated also.

Yes, this is true. TSK reads from the raw device and does not use any 
of the kernel's file system support.  Therefore, MAC times are not 
updated and any files that are hidden by kernel-based rootkits are 
shown.

brian

[sleuthkit-users] Autopsy 2.01 - LiveAnalysis Questions

[Surago J. <su...@sj...>]

Hi All,

So now that I have managed to get autopsy to run fine for a live
analysis (Using Perl and libraries from a trusted cd), there are a few
things I was wondering, and was hoping someone could confirm or deny for
me.

Fristly, it is my understanding, that during a live analysis, autopsy
v2.01 does not offer any extra functionality that can be found in
autopsy when performing a so called dead analysis on a hdd image
(however during a dead analysis autopsy does have extra functionality
not available during a live analysis).  Can someone confirm this for me
please, just so I know I'm on the right track.

I have created some shell scripts to help automate the incident
verification process, by returning information from volatile sources
(ps, netstat, arp, ifconfig) using trusted binaries, and it might be
useful if autopsy had an interface for these sources of information
during a liveanalysis.  Currently I simply pipe the output from these
sources thru netcat, and save the datafile on the evidence server.

Obviously access to these information sources would vary from platform
to platform, and architecture to architecture, and having not had
experience but with more than a few differing platforms I can't comment
on how much of an issue/hassle this could be.  My current research is
limited to the Linux platform, on i?86 architecture due to resource
constraints.

Secondly, I understand that a liveanalysis is not the preferred method
of performing an analysis, and depending on circumstances (every case is
different), should be avoided where possible.  However, if one was to
utilise autopsy for browsing the filesystem, the underlying
functionality of autopsy (tools from sleuthkit) does not modify the MAC
times on directories and files browsed.  If someone can confirm, or
comment on this, it would be much appreciated also.

Any comments, suggestions, ideas, would all be much appreciated, and
thank you for you time.

Cheers

Surago Jones.

Re: [sleuthkit-users] NetBSD support?

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Jun 8, 2004, at 7:43 PM, Scott Ellis wrote:

> In an attempt to recover some data accidentally deleted by one of my  
> users,
> I've been trying to get either Sleuthkit or TCT working on a UFS1
> filesystem, to no avail.

Just because a tool does not do what you want it to does not mean that  
it doesn't work. File deletion procedures are OS specific and not file  
system specific.  UFS1 defines only the data structures and does not  
define when or how they will be updated or wiped.

Many of the UFS file systems wipe the block pointers, but do not wipe  
the inode pointer in the directory entry when a file is deleted.   
Solaris wipes both pointers as does Linux in the past couple of years  
with EXT3FS and EXT2FS.  I documented this back in 2001 for a SANSFIRE  
paper and I think it is documented elsewhere in the TSK docs.

http://www.cerias.purdue.edu/homes/carrier/forensics/docs/ 
autopsy_sansfire2001.pdf


> Unfortunately, the tools from SleuthKit and TCT don't seem to operate  
> as
> expected, and my gut tells me it's due to a divergence of NetBSD's  
> on-disk
> format from that of the other BSD's.

> Note that st_block is zero, when it should contain the disk block that  
> is
> referenced by that inode.  Indeed, trying to just cat the contents of  
> that
> inode returns nothing as well:

I will admit that I haven't looked at a NetBSD image in a while, but I  
wouldn't expect it to have the block pointers (based on how FreeBSD and  
OpenBSD operate).  Do you have a reference for what lead you to believe  
that the block pointers should exist?

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAxrvqOK1gLsdFTIsRArQ3AJ0XCLNLTNZ2UqcBNdJE5Pps9iZiQQCeLnwy
eW3JboCwHbPTD+oAtub5VEM=
=7maZ
-----END PGP SIGNATURE-----

[sleuthkit-users] NetBSD support?

[Scott E. <sc...@wa...>]

In an attempt to recover some data accidentally deleted by one of my users,
I've been trying to get either Sleuthkit or TCT working on a UFS1
filesystem, to no avail.

Using a relatively current NetBSD/i386 machine (2.0F) I created a small
directory tree for testing:

intrepid: {222} ls -lR SEDir.source
total 16
drwxr-xr-x  2 scotte  wheel  512 Jun  8 17:20 DelDir
-rw-r--r--  1 scotte  wheel   29 Jun  8 17:19 DelFile
drwxr-xr-x  2 scotte  wheel  512 Jun  8 17:19 KeepDir
-rw-r--r--  1 scotte  wheel   33 Jun  8 17:19 KeepFile

SEDir.source/DelDir:
total 4
-rw-r--r--  1 scotte  wheel  71 Jun  8 17:20 KeepFile

SEDir.source/KeepDir:
total 4
-rw-r--r--  1 scotte  wheel  50 Jun  8 17:19 KeepFile2


...and then proceeded to make an image of it using makefs, mount it to a
vnd, delete the "DelDir" and "DelFile" parts, then unmount/unvnconfig the
file so I could practice file recovery.

Unfortunately, the tools from SleuthKit and TCT don't seem to operate as
expected, and my gut tells me it's due to a divergence of NetBSD's on-disk
format from that of the other BSD's.

The "fls" command starts at the root inode (2), and looks at the dinode:

intrepid: {212} /misc/sleuthkit-1.70/bin/fls sedir.img
r/r 3:  KeepFile
r/- * 4:        DelFile
d/d 5:  KeepDir
d/- * 6:        DelDir

So far, so good.  We can see that inode 4 is where the deleted "DelFile"
should live.  So, we use the "ils" command to look at properties of that
inode:

intrepid: {213} /misc/sleuthkit-1.70/bin/ils sedir.img 4
class|host|device|start_time
ils|intrepid|sedir.img|1086740772
st_ino|st_alloc|st_uid|st_gid|st_mtime|st_atime|st_ctime|st_mode|st_nlink|st
_size|st_block0|st_block1
4|f|100|0|1086740653|1086740502|1086740653|0|0|0|0|0

Note that st_block is zero, when it should contain the disk block that is
referenced by that inode.  Indeed, trying to just cat the contents of that
inode returns nothing as well:

intrepid: {214} /misc/sleuthkit-1.70/bin/icat sedir.img 4
intrepid: {215}

Am I missing something fundamental here, or is NetBSD significantly
different enough from the other BSD's that these tools just aren't working?
I tried examining the dirent and inode structs that SleuthKit thought it
should use, and comparing those to what NetBSD has in dirent.h and fs.h, but
nothing jumped out at me.

Clues?

	ScottE

RE: [sleuthkit-users] Perl Binary that Autopsy should use in Live Analysis?

[Surago J. <su...@sj...>]

I must say that it does please me that I am not the only person whom has
had problems with compiling Perl so that it is statically linked, as I
have spent a few days on it without any success.

But, I have just had some luck getting Perl to compile statically, at
this stage I haven't had a chance to test it out, basically I just know
that it is linked statically thru what the 'file' command tells me (Not
100% sure how reliable this is however)

So it is basically a case of testing my collection of tools I have put
together for a Forensics CD, in a suspect system (I'm just using the
Scan of the Month from the suspended Linux machine released a couple
months ago.)

If I have any success, I'll post my findings.  However I must note, that
currently I am only working with one particular vendor (Red Hat), and
only one specific platform i386 systems, so I would really have no idea
about other platforms and systems.

Granted, it may turn out that use of Autopsy for a live system analysis
is not the best method/tool to use, however this is part of some
research I am doing, and I can document these findings if this happens
to be the case.

Cheers

Surago


-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...]=20
Sent: Tuesday, 8 June 2004 2:55 a.m.
To: Surago Jones
Cc: <sle...@li...>
<sle...@li...>
Subject: Re: [sleuthkit-users] Perl Binary that Autopsy should use in
Live Analysis?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Jun 7, 2004, at 5:55 AM, Surago Jones wrote:

> When using the Autopsy browser on a Live Analysis, my understanding is

> that Autopsy requires Perl, however I am unable to provide a=20
> statically linked Perl binary (I just can't get the *^#$&^#$ to=20
> compile statically), and when using a Dynamically linked file, does=20
> this not require library files on the live system to be accessed?

Yea it does.  I entered this as bug 919831 when it was released.  I
don't know the best way around this and it is an open problem. In
reality, there is a risk of running any program (even if it is static),
so it will never be 100% safe, but I agree that there must be a better
way than what autopsy currently does.  I have tried playing with getting
Perl to compile statically and, like you, did not have much luck.  Some
OSes, such as OS X, refuse to make any static executables. =20
I also want to look into placing more of the Perl libraries on the CD so
that it uses its local copies instead of the ones from the suspect
system.

I have had luck with the trial version of perl2exe, but I do not own a
full version.


brian



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAxIG6OK1gLsdFTIsRAuhtAJ4lUsjVXI56KUHyoTvVWOBNz4yEXQCeOEWd
+HEG6SO7sN+t9qwNAenkbRk=3D
=3D7iIf
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Perl Binary that Autopsy should use in Live Analysis?

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Jun 7, 2004, at 5:55 AM, Surago Jones wrote:

> When using the Autopsy browser on a Live Analysis, my understanding is
> that Autopsy requires Perl, however I am unable to provide a statically
> linked Perl binary (I just can't get the *^#$&^#$ to compile
> statically), and when using a Dynamically linked file, does this not
> require library files on the live system to be accessed?

Yea it does.  I entered this as bug 919831 when it was released.  I 
don't know the best way around this and it is an open problem. In 
reality, there is a risk of running any program (even if it is static), 
so it will never be 100% safe, but I agree that there must be a better 
way than what autopsy currently does.  I have tried playing with 
getting Perl to compile statically and, like you, did not have much 
luck.  Some OSes, such as OS X, refuse to make any static executables.  
I also want to look into placing more of the Perl libraries on the CD 
so that it uses its local copies instead of the ones from the suspect 
system.

I have had luck with the trial version of perl2exe, but I do not own a 
full version.


brian



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAxIG6OK1gLsdFTIsRAuhtAJ4lUsjVXI56KUHyoTvVWOBNz4yEXQCeOEWd
+HEG6SO7sN+t9qwNAenkbRk=
=7iIf
-----END PGP SIGNATURE-----

[sleuthkit-users] Perl Binary that Autopsy should use in Live Analysis?

[Surago J. <su...@sj...>]

Hi All,

When using the Autopsy browser on a Live Analysis, my understanding is
that Autopsy requires Perl, however I am unable to provide a statically
linked Perl binary (I just can't get the *^#$&^#$ to compile
statically), and when using a Dynamically linked file, does this not
require library files on the live system to be accessed?

Any hints tips or tricks with regards to how I should configure/compile
Perl (To be run from the CD that Autopsy would be run from) would be
much appreciated.

Regards,

Surago.

Re: [sleuthkit-users] File too large, Fat32

[<fu...@gm...>]

> > Hi list members
> >
> > I got a problem with an image of a Fat32-Image.
> 
> ...
> 
> > Size:
> > 18446744073709546496
> >
> > Obviously, the file size is wrong here.
> 
> Hmmm.  There is a casting problem going on between internal storage 
> sizes.  What OS are you using?  The current version of TSK uses some 
> platform-dependent variable sizes, which leads these problems.
> 

Autopsy and sleuthkit are running on a Debian Linux Woody System with kernel
2.4.19, gcc 2.95.4.

Can I provide you with any other usefull information?

regards

Fuerst

-- 
"Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
Jetzt aktivieren unter http://www.gmx.net/info

Re: [sleuthkit-users] File too large, Fat32

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Jun 4, 2004, at 10:42 AM, fu...@gm... wrote:

> Hi list members
>
> I got a problem with an image of a Fat32-Image.

...

> Size:
> 18446744073709546496
>
> Obviously, the file size is wrong here.

Hmmm.  There is a casting problem going on between internal storage 
sizes.  What OS are you using?  The current version of TSK uses some 
platform-dependent variable sizes, which leads these problems.

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAwPajOK1gLsdFTIsRAiB6AJ4tmECT4RxSc/apTf/8bGSafKTJhwCeJnaF
9prvLJAXlGYlW+35aEl9nLA=
=7wQp
-----END PGP SIGNATURE-----

[sleuthkit-users] File too large, Fat32

[<fu...@gm...>]

Hi list members

I got a problem with an image of a Fat32-Image.

The situation:
An image of an external usb harddrive, formated with FAT (mounted as a
loopback, mount shows vfat). On the disk are some backup-files from MyBackup
PC from Stomp. 

The problem:
3 of the 4 Backup files are broken, but one is still complete (hope so). Is
has a size of 4 gigabyte when I take a look at it via Windows or via mounted
loopback device. But if load the image to autopsy (2.0.0), the file looks
like this:

Name:
120404.qic	  	

Written:
2004.04.12 16:42:18 (CEST)

Modified:
2004.05.27 00:00:00 (CEST)

Created:
2004.04.12 16:42:18 (CEST)

Size:
18446744073709546496

Meta:
164

Obviously, the file size is wrong here. I don't know any USB drive with such
size. when I take a look at the file content I see nothing also got File
Type: empty. Exporting also does not work. I'm now wondering what happens
here?

I mounted the image as FAT32. With the other FAT's I had no access. 

There are also two other huge files which are NOT allocated. There happens
the same. Of course I'm interested in their content. The size of these files
are 
ackup.bkf (_ACKUP.BKF): 18446744073709523968
_Za03576 (_ZA03576): 18446744073709155022
Also both impossible size.

I read assuming the real size of a file under FAT is very hard, is this the
case here? Any hope to get the deleted files (other tools e.g.)?

thank you 

Fuerst


-- 
"Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
Jetzt aktivieren unter http://www.gmx.net/info

[sleuthkit-users] Release of TSK 1.70 and Autopsy 2.01

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

New versions are available.

http://www.sleuthkit.org/sleuthkit/download.php
MD5: 3e06290fb633fefef443e343b97e56db

http://www.sleuthkit.org/autopsy/download.php
MD5: a754189ea0804efbc9709f26cd9f58cf


TSK has a couple of bug fixes (allocation status of deleted FAT files 
and compiling under Fedora Core 2) and many updates. Updates are for 
improved FAT support, FAT file recovery, new 'icat' syntax, and new 
'dcat' syntax.

Autopsy also has a couple of bug fixes, mainly that the wrong data unit 
was being displayed when a keyword search was done on unallocated space 
(this was introduced in the last version).  New features include the 
ability to search for a specific file name and support for new TSK 
features.

brian



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAvljxOK1gLsdFTIsRAnoiAJ4imqZJRSwaeYjAMar5UPqtG7CpXgCeKnPC
Dq174ZjAzW69INWZwe/ZDh0=
=Qh57
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Manual

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On May 27, 2004, at 10:03 PM, Rick Mayberry wrote:

> can someone please point me in the direction of any
> kind of a user manual or a tips and tricks page for the
> Sleuth kit.

Check out sleuthkit.org or the reading room area of SANS.  The 2nd 
edition of the Honeynet Know Your Enemy book (which just came out this 
week) uses Autopsy and TSK for the UNIX and Windows forensics chapters 
(Rob Lee wrote the Windows chapter and I wrote the UNIX chapter).  
There is also Barry Grundy's guide 
(ftp://ftp.hq.nasa.gov/pub/ig/ccd/linuxintro/).

brian


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAtr+fOK1gLsdFTIsRAh0NAJ0aKaJ2sSMl4vHSR6Sxoa4HRmhxQACdF3TL
TWiCFFH4IjDuSW2pQxqgV+o=
=vdJi
-----END PGP SIGNATURE-----

[sleuthkit-users] Manual

[Rick M. <sch...@ya...>]

can someone please point me in the direction of any
kind of a user manual or a tips and tricks page for the
Sleuth kit.
Thanx.
Richard-

		
---------------------------------
Do you Yahoo!?
Friends.  Fun. Try the all-new Yahoo! Messenger

Re: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit install problem)

[Angus M. <an...@n-...>]

On Thursday 27 May 2004 21:44, Chris Poldervaart wrote:
> So what it boils back down to is that you have to be comfortable with your
> own techniques, methodology, and equipment (through personal validation,
> experience, and overall knowledge of the tools you use).  When you get on
> the stand...and you will...you will have the appropriate information to
> convince a judge or jury that 1) you are capable and credible 2) your
> equipment is capable 3) your methods are sound 4) and because of all of
> that, the evidence presented on your behalf is credible, accurate,
> unbiased, and in its true form.
>
> Unfortunately I see law enforcement officers buy a one-stop forensic tool
> such as encase (and that is NOT a problem by any means) and with very
> little to no knowledge of what they are doing, put together a case and
> present it for prosecution.  They don't know how the program works (not
> that they necessarily should know EVERYTHING) and if challenged...only pray
> that the judge, jury, and defense know less than they do so they dazzle
> them with big words.  

Absolutely - and that's what makes working as a defence expert so interesting. 
I learn a lot about what I should doing in my prosectuion work from the holes 
I find in other people's prosecution work when I act as a defence expert.

> I don't know everything by far...but I practice
> self-validation, and I try and learn everything I can about the methods I
> use.  I am not new to forensics...but I am new to Linux forensics, hence my
> recent experience with TSK.  I see alot of potential in this area.  Knowing
> what others have already validated and tested helps shorten the learning
> curve.  Knowing what others have been called on the carpet with (where
> their methods have failed the reliability and credibility test--whatever
> that is) also helps.

Who said "the wise man knows that he does not know" ?

>
> --
> Regards,
>
> Chris Poldervaart, Investigator
> Natrona County Sheriff's Office
> 201 N David St Casper, WY 82601
> 307-235-9282    po...@na... <mailto:po...@na...>
>
> CONFIDENTIALITY NOTICE: This e-mail message including attachments, if any,
> is intended only for the person or entity to which it is addressed and may
> contain confidential and/or privileged material. Any unauthorized review,
> use, disclosure or distribution is prohibited. If you are not the intended
> recipient, please contact the sender by reply e-mail and destroy all copies
> of the original message. If you are the intended recipient but do not wish
> to receive communications through this medium, please so advise the sender
> immediately.
>
>
> -----Original Message-----
> From: sle...@li...
> [mailto:sle...@li...]On Behalf Of Angus
> Marshall
> Sent: Thursday, May 27, 2004 2:17 PM
> To: Brian Carrier
> Cc: <sle...@li...>
> <sle...@li...>
> Subject: Re: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit
> install problem)
>
> On Thursday 27 May 2004 15:05, Brian Carrier wrote:
> > On May 27, 2004, at 3:52 AM, Angus Marshall wrote:
> > > As for acceptance - in English and Scots law (two different legal
> > > systems over
> > > here), the basic principle is that once a technique has been accepted
> > > by one
> > > court in either legal system, it is accepted by all courts within the
> > > same
> > > legal system of an equivalent or lower level (rulings in England have
> > > no
> > > effect in Scotland and vice-versa). Thus acceptance in Crown Court
> > > implies
> > > acceptance in Magistrates court too. It doesn't mean that the results
> > > or the
> > > technique were correct, but that the court accepts them as valid.
> >
> > But how does one show that the results are valid when there are no
> > standards to compare it with?  You can show that the same result can be
> > found with tool X, which is already accepted, but on what basis was the
> > first tool accepted?  Take NTFS for example.  There is no official
> > specification for it and every tool may be using a different technique.
> >   Does that matter when it comes to court acceptance?
>
> That's my whole point - in an adversarial system there is no concept of
> absolute proof or correctness. Ultimately, it comes down to which side has
> the more believable witness, therefore most of the work, in court, for an
> expert witness is about proving their expertise before going on to discuss
> the evidence itself. By accepting the expert, the court accepts his/her
> opinions and practices as used in the case. Law in a courtroom is all about
> precedents and interpretations of legislation.
>
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: Oracle 10g
> Get certified on the hottest thing ever to hit the market... Oracle 10g.
> Take an Oracle 10g class now, and we'll give you the exam FREE.
> http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
> __________________________________________________________________
> << ella for Spam Control >> has removed Spam messages and set aside
> Newsletters for me You can use it too - and it's FREE! 
> http://www.ellaforspam.com

RE: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit install problem)

[Chris P. <po...@na...>]

So what it boils back down to is that you have to be comfortable with =
your own techniques, methodology, and equipment (through personal =
validation, experience, and overall knowledge of the tools you use).  =
When you get on the stand...and you will...you will have the appropriate =
information to convince a judge or jury that 1) you are capable and =
credible 2) your equipment is capable 3) your methods are sound 4) and =
because of all of that, the evidence presented on your behalf is =
credible, accurate, unbiased, and in its true form.

Unfortunately I see law enforcement officers buy a one-stop forensic =
tool such as encase (and that is NOT a problem by any means) and with =
very little to no knowledge of what they are doing, put together a case =
and present it for prosecution.  They don't know how the program works =
(not that they necessarily should know EVERYTHING) and if =
challenged...only pray that the judge, jury, and defense know less than =
they do so they dazzle them with big words.  I don't know everything by =
far...but I practice self-validation, and I try and learn everything I =
can about the methods I use.  I am not new to forensics...but I am new =
to Linux forensics, hence my recent experience with TSK.  I see alot of =
potential in this area.  Knowing what others have already validated and =
tested helps shorten the learning curve.  Knowing what others have been =
called on the carpet with (where their methods have failed the =
reliability and credibility test--whatever that is) also helps.=20


--
Regards,=20

Chris Poldervaart, Investigator
Natrona County Sheriff's Office
201 N David St Casper, WY 82601
307-235-9282    po...@na... <mailto:po...@na...> =20

CONFIDENTIALITY NOTICE: This e-mail message including attachments, if =
any, is intended only for the person or entity to which it is addressed =
and may contain confidential and/or privileged material. Any =
unauthorized review, use, disclosure or distribution is prohibited. If =
you are not the intended recipient, please contact the sender by reply =
e-mail and destroy all copies of the original message. If you are the =
intended recipient but do not wish to receive communications through =
this medium, please so advise the sender immediately.=20


-----Original Message-----
From: sle...@li...
[mailto:sle...@li...]On Behalf Of Angus
Marshall
Sent: Thursday, May 27, 2004 2:17 PM
To: Brian Carrier
Cc: <sle...@li...>
<sle...@li...>
Subject: Re: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit
install problem)


On Thursday 27 May 2004 15:05, Brian Carrier wrote:
> On May 27, 2004, at 3:52 AM, Angus Marshall wrote:
> > As for acceptance - in English and Scots law (two different legal
> > systems over
> > here), the basic principle is that once a technique has been =
accepted
> > by one
> > court in either legal system, it is accepted by all courts within =
the
> > same
> > legal system of an equivalent or lower level (rulings in England =
have
> > no
> > effect in Scotland and vice-versa). Thus acceptance in Crown Court
> > implies
> > acceptance in Magistrates court too. It doesn't mean that the =
results
> > or the
> > technique were correct, but that the court accepts them as valid.
>
> But how does one show that the results are valid when there are no
> standards to compare it with?  You can show that the same result can =
be
> found with tool X, which is already accepted, but on what basis was =
the
> first tool accepted?  Take NTFS for example.  There is no official
> specification for it and every tool may be using a different =
technique.
>   Does that matter when it comes to court acceptance?
>

That's my whole point - in an adversarial system there is no concept of=20
absolute proof or correctness. Ultimately, it comes down to which side =
has=20
the more believable witness, therefore most of the work, in court, for =
an=20
expert witness is about proving their expertise before going on to =
discuss=20
the evidence itself. By accepting the expert, the court accepts his/her=20
opinions and practices as used in the case. Law in a courtroom is all =
about=20
precedents and interpretations of legislation.




-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. =

Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3D3149&alloc_id=3D8166&op=3Dclick
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


__________________________________________________________________
<< ella for Spam Control >> has removed Spam messages and set aside =
Newsletters for me
You can use it too - and it's FREE!  http://www.ellaforspam.com

Re: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit install problem)

[Angus M. <an...@n-...>]

On Thursday 27 May 2004 15:05, Brian Carrier wrote:
> On May 27, 2004, at 3:52 AM, Angus Marshall wrote:
> > As for acceptance - in English and Scots law (two different legal
> > systems over
> > here), the basic principle is that once a technique has been accepted
> > by one
> > court in either legal system, it is accepted by all courts within the
> > same
> > legal system of an equivalent or lower level (rulings in England have
> > no
> > effect in Scotland and vice-versa). Thus acceptance in Crown Court
> > implies
> > acceptance in Magistrates court too. It doesn't mean that the results
> > or the
> > technique were correct, but that the court accepts them as valid.
>
> But how does one show that the results are valid when there are no
> standards to compare it with?  You can show that the same result can be
> found with tool X, which is already accepted, but on what basis was the
> first tool accepted?  Take NTFS for example.  There is no official
> specification for it and every tool may be using a different technique.
>   Does that matter when it comes to court acceptance?
>

That's my whole point - in an adversarial system there is no concept of 
absolute proof or correctness. Ultimately, it comes down to which side has 
the more believable witness, therefore most of the work, in court, for an 
expert witness is about proving their expertise before going on to discuss 
the evidence itself. By accepting the expert, the court accepts his/her 
opinions and practices as used in the case. Law in a courtroom is all about 
precedents and interpretations of legislation.

Re: [sleuthkit-users] RE: Sleuthkit install problem

[Angus M. <an...@n-...>]

On Thursday 27 May 2004 06:16, Brian Carrier wrote:
> So, to confirm.  You are using the original makedefs and fs_tools.h
> file.  All you did was add linux/unistd.h to mylseek.c?
>
> brian

That is correct.

Re: [sleuthkit-users] Tool acceptance (was RE: Sleuthkit install problem)

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On May 27, 2004, at 3:52 AM, Angus Marshall wrote:
> As for acceptance - in English and Scots law (two different legal 
> systems over
> here), the basic principle is that once a technique has been accepted 
> by one
> court in either legal system, it is accepted by all courts within the 
> same
> legal system of an equivalent or lower level (rulings in England have 
> no
> effect in Scotland and vice-versa). Thus acceptance in Crown Court 
> implies
> acceptance in Magistrates court too. It doesn't mean that the results 
> or the
> technique were correct, but that the court accepts them as valid.

But how does one show that the results are valid when there are no 
standards to compare it with?  You can show that the same result can be 
found with tool X, which is already accepted, but on what basis was the 
first tool accepted?  Take NTFS for example.  There is no official 
specification for it and every tool may be using a different technique. 
  Does that matter when it comes to court acceptance?

thanks,
brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAtfWmOK1gLsdFTIsRAt81AJwNtd1Cfq4ivUySu9tScU+60Md/VACePwxp
t96DXuqjgy5dqCjcFKUbFio=
=1+iq
-----END PGP SIGNATURE-----