sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

[sleuthkit-users] Anyone in or around Atlanta???

[Rich T. <te...@ya...>]

Howdy all,

Anyone in or around Atlanta to make an image for me???
 I've got a very paranoid client who needs an image
made for evidence perservation, but is unwilling to
send me the machine or the drive via FedEx (I'm in
Ohio).  So it has to be made locally.

So anyone in Georgia to make a copy, let me know.

Thx,
Richard C. Thompson
Applied Forensics
www.apfor.com
ri...@ap...
(937) 218 1744

Re: [sleuthkit-users] Sleuthkit & Autopsy on AMD64

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>
> On a sidenote I am willing to donate $100 or a bit more for Brian to
> get amd64 platform to test on
> Brian: can you get a price on a CPU and motherboard for you to play  
> with?

Thank you for the offer, but the wonderful resources at source forge  
include an AMD64 system with SuSe in the compile farm:

http://sourceforge.net/docman/display_doc.php? 
docid=762&group_id=1#platforms

There are a couple of other things I need to change in the code for v2  
with variable sizes before I can focus on doing the 64-bit changes  
correctly.

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAeD6cOK1gLsdFTIsRAmhAAJ0ZxS3i32fLkNY4eAEO0KA4RQiqmwCfY0eR
X4kJXZ0NGwlAS4AY7NrRevw=
=wdtO
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Sleuthkit & Autopsy on AMD64

[<hl...@kr...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On 9/4-2004, at 16.55, Paul Stillwell wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Just as a follow up ...
>
> 	I compiled TSK 1.68 (static) on a suse 9.0 32 bit system and=20
> transferred the
> binaries over to the Mandrake 9.2 AMD64 system, and then ran make for=20=

> Autopsy
> 2.0 on the AMD64 system pointing to the transferred files.  It all=20
> seems to
> work so far without issues.  The logic behind this?  AMD64 systems are
> supposed to be 32bit binary compatible... so are the O/S's that run on
> them... so far, it seems to hold true :-)
>
> If anyone knows of any issues I may introduce by doing this, please=20
> let me
> know.
>

Even though it is nice to have this confirmed you should IMHO
think more about what you DO than just guessing and throwing out
wild speculations, questions and spreading what could be FUD about=20
autopsy
- - people might just remember "sleuthkit & AMD64 =3D problems" the
Internet is a bitch that way ;-)

Please read this the right way and dont take the criticism to hard ...


I recently bought an Athlon64 system to run OpenBSD, knowing that
OpenBSD can run both as amd64 or the GENERIC i386 binaries
- - this works as expected, this IS one of the main reasons to buy this,
so leave out the "supposed to be" it IS compatible



If I decide to experiment with software on amd64 I would RATHER
assume that the operating system is doing "strange stuff" than
thinking that I have discovered problems with the software at hand.

Especially "good stuff" like Autopsy and TASK which REALLY rocks
and works great on multiple platforms.


I for one would EXPECT small problems and quirks compiling software
on amd64 as this is a rather new platform. So I would NOT start
using this for production before I had confirmed that I knew how
to fix small compile problems.

On a sidenote I am willing to donate $100 or a bit more for Brian to
get amd64 platform to test on
Brian: can you get a price on a CPU and motherboard for you to play=20
with?

Best regards

Henrik

PS I haven't actually tried autopsy and sleuthkit on my amd64 yet, but
expect them to behave on my OpenBSD ;-)




- --
Henrik Lund Kramsh=F8j, cand.scient, CISSP
e-mail: hl...@se..., tlf: 2026 6000
www.security6.net - IPv6, sikkerhed, netv=E6rk og UNIX


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAduKLIaZGm9HvuqYRAvXCAJ9aEqEHlH0CIM5BqWHxpkzA07FM6ACfZNn+
scXJjk+OEXTqzq4/6Sux5qY=3D
=3DIH3M
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Sleuthkit & Autopsy on AMD64

[Paul S. <pa...@vn...>]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Just as a follow up ...=20

	I compiled TSK 1.68 (static) on a suse 9.0 32 bit system and transferred t=
he=20
binaries over to the Mandrake 9.2 AMD64 system, and then ran make for Autop=
sy=20
2.0 on the AMD64 system pointing to the transferred files.  It all seems to=
=20
work so far without issues.  The logic behind this?  AMD64 systems are=20
supposed to be 32bit binary compatible... so are the O/S's that run on=20
them... so far, it seems to hold true :-)=20

If anyone knows of any issues I may introduce by doing this, please let me=
=20
know.

Thanks,

Paul

On April 1, 2004 10:30 pm, Paul Stillwell wrote:
> Hello,
>
> 	Just got a brand new shiny amd64 system and I'm trying to compile
> sleuthkit. I also realize that this may not have been done before, but I'm
> hoping it has
>
> :-)  Anyhow, I'm not positive, but I don't think I've had to compile
> : anything
>
> on this system yet so I could simply be missing some libraries, but it
> doesn't look like that to me.
>
> I'm running Mandrake 9.2 for AMD64 (10 is still beta for AMD64)
>
> "uname -a" gives the following output:
> Linux Pluto 2.4.22-24mdk #1 Tue Nov 4 15:08:30 CET 2003 x86_64 unknown
> unknown GNU/Linux
>
> I downloaded (and verified) sleuthkit-1.68, and when I run install, I get
> the following output:
>
> cd src/fstools; make "CC=3Dgcc" MAKELEVEL=3D
> gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE -DVER=3D\"1.6=
8\"
> -I../misc -O -Wall  -g   -c -o fs_buf.o fs_buf.c
> gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE -DVER=3D\"1.6=
8\"
> -I../misc -O -Wall  -g   -c -o fs_inode.o fs_inode.c
> gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE -DVER=3D\"1.6=
8\"
> -I../misc -O -Wall  -g   -c -o fs_io.o fs_io.c
> gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE -DVER=3D\"1.6=
8\"
> -I../misc -O -Wall  -g   -c -o fs_open.o fs_open.c
> gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE -DVER=3D\"1.6=
8\"
> -I../misc -O -Wall  -g   -c -o fs_dent.o fs_dent.c
> gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE -DVER=3D\"1.6=
8\"
> -I../misc -O -Wall  -g   -c -o fs_types.o fs_types.c
> gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE -DVER=3D\"1.6=
8\"
> -I../misc -O -Wall  -g   -c -o fs_data.o fs_data.c
> gcc -DLINUX2 -D_FILE_OFFSET_BITS=3D64 -D_LARGEFILE64_SOURCE -DVER=3D\"1.6=
8\"
> -I../misc -O -Wall  -g   -c -o mylseek.o mylseek.c
> mylseek.c: In function `_llseek':
> mylseek.c:34: error: `__NR__llseek' undeclared (first use in this functio=
n)
> mylseek.c:34: error: (Each undeclared identifier is reported only once
> mylseek.c:34: error: for each function it appears in.)
> make: *** [mylseek.o] Error 1
> make: *** [defs] Error 2
> make: *** [no-perl] Error 2
>
>
> There was some other stuff above this that looked like it worked OK, so I=
'm
> only including what I think is pertinent.
>
> Any help appreciated,
>
> Paul
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: IBM Linux Tutorials
> Free Linux tutorial presented by Daniel Robbins, President and CEO of
> GenToo technologies. Learn everything from fundamentals to system
> administration.http://ads.osdn.com/?ad_id=3D1470&alloc_id=3D3638&op=3Dcli=
ck
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAdrljbu2E+kpEvNgRAgD4AKCcSAn55t5Gsdfvd4q30Di0vvyL9gCffS+8
Y4Axwba+Qh9XI3uhMyY09dE=3D
=3DXli5
=2D----END PGP SIGNATURE-----

[sleuthkit-users] Good Spy-ware/keylogger database

[Paul S. <pa...@vn...>]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

	I'm doing some work that involves searching for keyloggers.  I have found =
a=20
couple of databases out there, but none that I really like so far.  Anyone=
=20
have any favourites they'd like to share?

Thanks,

Paul
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAdrgqbu2E+kpEvNgRAqiDAJ9WoJoUj8I4px7Zz/h1jFOT7SdeBQCfdc8U
y1KfzerZYZGZ60SdYXYkEpc=3D
=3D6cCj
=2D----END PGP SIGNATURE-----

Re: [sleuthkit-users] Restore a damaged partition

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Apr 8, 2004, at 8:13 AM, Linux Tard wrote:

> Hi Eric
> I doubt Sleuthkit does recognize UFS2.  It is new, and
> only support in 2.6 exists.

Nope not yet.  TCT supports it though, but only block and inode level 
access.

> But isnt there a version
> of Sleuthkit for FreeBSD?  If so, that should work for
> you.

Sleuthkit runs on FreeBSD, but it won't help you.  Sleuth Kit doesn't 
use any native file system support.  It just needs to read raw sectors 
from an image or raw device and it processes itself.  So, even if your 
system supports the file system, that doesn't mean that TSK will (and 
vice versa).

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAdgXcOK1gLsdFTIsRAjkiAJ0Tcy2SOzHNwI7OGZkZjZ+g+thtsACeOsd1
fJyVH4s9iZBFk9jeuJSs04Y=
=cq2T
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Restore a damaged partition

[Linux T. <lin...@ya...>]

Hi Eric
I doubt Sleuthkit does recognize UFS2.  It is new, and
only support in 2.6 exists.  But isnt there a version
of Sleuthkit for FreeBSD?  If so, that should work for
you.

-lt
--- Eric Yellin <er...@mi...> wrote:
> I just realized an important fact which I did not
> note.  The OS is FBSD 5.2
> using UFS2 and not UFS1. Does the Sluethkit
> recognize UFS2? It did not
> recognize the partition as being a freebsd
> partition... That is why I could
> only view the raw data.
> 

__________________________________
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/

Re: [sleuthkit-users] Restore a damaged partition

[Eric Y. <er...@mi...>]

I just realized an important fact which I did not note.  The OS is FBSD 5.2
using UFS2 and not UFS1. Does the Sluethkit recognize UFS2? It did not
recognize the partition as being a freebsd partition... That is why I could
only view the raw data.


----- Original Message ----- 
From: "Brian Carrier" <ca...@sl...>
To: "Eric Yellin" <er...@mi...>
Cc: <sle...@li...>
Sent: Sunday, April 04, 2004 11:37 AM
Subject: Re: [sleuthkit-users] Restore a damaged partition


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > I have a feeling that the problem is not finding the partition, though
> > I my
> > be wrong. I can see the partition. It seems to be in place and of the
> > correct size.
>
> What devices did you give to Autopsy to examine during the 'Import
> Image' process?
>
> brian
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.4 (Darwin)
>
> iD8DBQFAcFXSOK1gLsdFTIsRAu/4AJ9iWd8SOlWo9hmGc/JCMrCax1dqugCfQsm5
> nyxm6zppf0rZPkUau3YB9T8=
> =0v+2
> -----END PGP SIGNATURE-----
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: IBM Linux Tutorials
> Free Linux tutorial presented by Daniel Robbins, President and CEO of
> GenToo technologies. Learn everything from fundamentals to system
> administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] AIR Imager

[Linux T. <lin...@ya...>]

Hi Brian,

yes, I experience with AIR.  one 'issue' is /dev/ has
thousands of entries so opening in AIR sometimes takes
long time.  Not like on command line where you type
in.I'm speaking of folder icon, not 'Source' menu nor
Connected Devices buttons.  But that makes sense to
process those files in /dev.

The session log is nice to view what is really
happening behind the GUI clicks.  It's alright.  I
don't know if Steve is updating or not.  I test on
thwo drives and compact flash and verified with dd and
md5sum for matches.  

-lt

--- Brian Carrier <ca...@sl...> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I just came across this today.  It is a Linux GUI
> front-end to 'dd'.  
> Does anyone have any experience with this?
> 
> http://air-imager.sourceforge.net/
> 
> brian

__________________________________
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/

[sleuthkit-users] AIR Imager

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I just came across this today.  It is a Linux GUI front-end to 'dd'.  
Does anyone have any experience with this?

http://air-imager.sourceforge.net/

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAcFlIOK1gLsdFTIsRAmwwAJwPBSfjnYFiRnvPz8ZimRshgD4jtgCdGuUU
bNrPSKEpHw+fF1n0OuMOcgU=
=B1LU
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Restore a damaged partition

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> I have a feeling that the problem is not finding the partition, though 
> I my
> be wrong. I can see the partition. It seems to be in place and of the
> correct size.

What devices did you give to Autopsy to examine during the 'Import 
Image' process?

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAcFXSOK1gLsdFTIsRAu/4AJ9iWd8SOlWo9hmGc/JCMrCax1dqugCfQsm5
nyxm6zppf0rZPkUau3YB9T8=
=0v+2
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Restore a damaged partition

[Eric Y. <er...@mi...>]

Thanks Brian,

>> I run a Feebsd machine. Something happened and the kernel failed to
>> load. I tried restoring but to no avail. I re-installed freebsd and
>> all data from my partitions seemed to have disappeared.

>> Specifically I have one data partition that was not altered at any
>> point, nor during re-install(/web) which I would love to restore...

> What happens when you try to mount it under FreeBSD or Linux?

Well I think that's what I did when I re-installed FreeBSD. The DOS and
FreeBSD partitions did not seem to chgange at all, however after the install
all data was accessible. "/web" was monted on the exact same partition as it
was originally. The partitions did not change.

>>  I installed the Sleuth Kit and Autopsy and was able to view only raw
>> data from the Data Unit option.

> With Autopsy and TSK you will have to identify where the BSD partitions
> are inside of the BSD DOS partition (slice).  If the disk label
> structure inside of the FreeBSD DOS partition was wiped during the
> installation then you will have to figure out where the partition
> actually begins.  The 'gpart' tool may help with this.

I have a feeling that the problem is not finding the partition, though I my
be wrong. I can see the partition. It seems to be in place and of the
correct size.

Eric

Re: [sleuthkit-users] Restore a damaged partition

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Apr 4, 2004, at 3:15 AM, Eric Yellin wrote:

> I run a Feebsd machine. Something happened and the kernel failed to=20
> load. I tried restoring but to no avail. I re-installed freebsd and=20
> all data from my partitions seemed to have disappeared.

> Specifically I have one data partition that was not altered at any=20
> point, nor during re-install(/web) which=A0I would love to restore...

What happens when you try to mount it under FreeBSD or Linux?

>  I installed the Sleuth Kit and Autopsy and was able to view only raw=20=

> data from the Data Unit option.

With Autopsy and TSK you will have to identify where the BSD partitions=20=

are inside of the BSD DOS partition (slice).  If the disk label=20
structure inside of the FreeBSD DOS partition was wiped during the=20
installation then you will have to figure out where the partition=20
actually begins.  The 'gpart' tool may help with this.

It would help if you give command examples of what you have done=20
because it gets confusing with the BSD system and the sub-partitions=20
they have inside of the DOS partition.

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAcDA/OK1gLsdFTIsRAuRJAJ4+I5Vk2u9nCf2MwIZ6PCjCoUdluwCfZ5/j
FEfaIW0VfhJ/yoKlWUyF6/o=3D
=3DS3Pr
-----END PGP SIGNATURE-----

RE: [sleuthkit-users] Restore a damaged partition

[Eagle I. S. I. <in...@ea...>]

I'm not sure of a way to do it with Autopsy, but you can view view and
export the entire file structure hierarchy and files with ASR Data's SMART.
It's not an inexpensive solution, however if the data is valauble to you, it
may be worth the expense. 
 
Niall. 
 
 

  _____  

From: sle...@li...
[mailto:sle...@li...] On Behalf Of Eric
Yellin
Sent: Sunday, April 04, 2004 3:15 AM
To: sle...@li...
Subject: [sleuthkit-users] Restore a damaged partition


I run a Feebsd machine. Something happened and the kernel failed to load. I
tried restoring but to no avail. I re-installed freebsd and all data from my
partitions seemed to have disappeared. Specifically I have one data
partition that was not altered at any point, nor during re-install(/web)
which I would love to restore... 
I installed the Sleuth Kit and Autopsy and was able to view only raw data
from the Data Unit option. From the little random data I checked using the
keyword search option, it appears that all data is physically in tact
however I can't access the directory and file structures in order to restore
the data. 
Is there a way to do this?
Thanks, Eric

[sleuthkit-users] Restore a damaged partition

[Eric Y. <er...@mi...>]

I run a Feebsd machine. Something happened and the kernel failed to =
load. I tried restoring but to no avail. I re-installed freebsd and all =
data from my partitions seemed to have disappeared. Specifically I have =
one data partition that was not altered at any point, nor during =
re-install(/web) which I would love to restore...=20
I installed the Sleuth Kit and Autopsy and was able to view only raw =
data from the Data Unit option. From the little random data I checked =
using the keyword search option, it appears that all data is physically =
in tact however I can't access the directory and file structures in =
order to restore the data.=20
Is there a way to do this?
Thanks, Eric

Re: [sleuthkit-users] Sleuthkit & Autopsy on AMD64

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Apr 1, 2004, at 10:30 PM, Paul Stillwell wrote:

> Hello,
>
> 	Just got a brand new shiny amd64 system and I'm trying to compile 
> sleuthkit.
> I also realize that this may not have been done before, but I'm hoping 
> it has
> :-)  Anyhow, I'm not positive, but I don't think I've had to compile 
> anything
> on this system yet so I could simply be missing some libraries, but it
> doesn't look like that to me.

This is a known issue.  I just added a sourceforge bug for it 
(#928278), which I should have done a few weeks ago. The lseek error is 
fairly easy to fix, but some of the casting warnings / errors are going 
to be more tricky.  I'm not sure if I really want to tackle it until I 
start with v2 of TSK which will get rid of some of the platform 
dependent size issues.

I also don't have a 64-bit machine, so that makes it hard.  I think 
sourceforge has one in their compiler farm though.

brian
  
  
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAbXsgOK1gLsdFTIsRAtOZAJ9+1/JdPCSXM9OT3tct6vi/WgyNpQCeK+QK
Sbu42AyRFuLc+rw6vqD68SU=
=0jpN
-----END PGP SIGNATURE-----

RE: [sleuthkit-users] Extracting partions from dd image

[Eagle I. S. I. <in...@ea...>]

Brian, 

Setting the bs to 512 did the trick. Thanks

Niall.  

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Eagle
Investigative Services, Inc. 
Sent: Wednesday, March 31, 2004 2:20 PM
To: 'Brian Carrier'
Cc: sle...@li...
Subject: RE: [sleuthkit-users] Extracting partions from dd image

Brian, 

I had bs=4096 to help speed things up, so I will retest with bs=512. 

Niall. 

-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...]
Sent: Wednesday, March 31, 2004 2:13 PM
To: Eagle Investigative Services, Inc. 
Cc: sle...@li...
Subject: Re: [sleuthkit-users] Extracting partions from dd image

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Mar 31, 2004, at 12:26 PM, Eagle Investigative Services, Inc. wrote:

> Brian,
>
> The process of dd'ing out the partition worked for only one image 
> file, and not for the three others.  All 4 image files were dd'd the 
> same way.

Which one worked?  The first one or one of the latter ones?

> So what I did was try starting at 63 and 62, and tried ending at one 
> more than the end point and none of these options worked.

It could be that the file system is corrupt.  The first partition of almost
every disk starts at sector 63, so that shouldn't be a problem.  
Make sure you are using the original disk image and not one of the partition
images as input.  Also make sure that the 'bs=' value for 'dd' is set to
512.

Send an 'xxd' output of the first sector of the partition image if nothing
else works:

dd if=part-img.dd count=1 | xxd


brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaxhQOK1gLsdFTIsRAonLAJ9AmeJM39h41j70Tp/d3r+KEDZBXQCgiH1A
7B2rcrJZ4CFtlOkX9uD5uyI=
=Kkb7
-----END PGP SIGNATURE-----




-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials Free Linux tutorial
presented by Daniel Robbins, President and CEO of GenToo technologies. Learn
everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

[sleuthkit-users] Sleuthkit & Autopsy on AMD64

[Paul S. <pa...@vn...>]

Hello,

	Just got a brand new shiny amd64 system and I'm trying to compile sleuthkit.  
I also realize that this may not have been done before, but I'm hoping it has 
:-)  Anyhow, I'm not positive, but I don't think I've had to compile anything 
on this system yet so I could simply be missing some libraries, but it 
doesn't look like that to me.

I'm running Mandrake 9.2 for AMD64 (10 is still beta for AMD64)

"uname -a" gives the following output:  
Linux Pluto 2.4.22-24mdk #1 Tue Nov 4 15:08:30 CET 2003 x86_64 unknown unknown 
GNU/Linux

I downloaded (and verified) sleuthkit-1.68, and when I run install, I get the 
following output:

cd src/fstools; make "CC=gcc" MAKELEVEL=
gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -DVER=\"1.68\" 
-I../misc -O -Wall  -g   -c -o fs_buf.o fs_buf.c
gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -DVER=\"1.68\" 
-I../misc -O -Wall  -g   -c -o fs_inode.o fs_inode.c
gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -DVER=\"1.68\" 
-I../misc -O -Wall  -g   -c -o fs_io.o fs_io.c
gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -DVER=\"1.68\" 
-I../misc -O -Wall  -g   -c -o fs_open.o fs_open.c
gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -DVER=\"1.68\" 
-I../misc -O -Wall  -g   -c -o fs_dent.o fs_dent.c
gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -DVER=\"1.68\" 
-I../misc -O -Wall  -g   -c -o fs_types.o fs_types.c
gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -DVER=\"1.68\" 
-I../misc -O -Wall  -g   -c -o fs_data.o fs_data.c
gcc -DLINUX2 -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE -DVER=\"1.68\" 
-I../misc -O -Wall  -g   -c -o mylseek.o mylseek.c
mylseek.c: In function `_llseek':
mylseek.c:34: error: `__NR__llseek' undeclared (first use in this function)
mylseek.c:34: error: (Each undeclared identifier is reported only once
mylseek.c:34: error: for each function it appears in.)
make: *** [mylseek.o] Error 1
make: *** [defs] Error 2
make: *** [no-perl] Error 2


There was some other stuff above this that looked like it worked OK, so I'm 
only including what I think is pertinent.

Any help appreciated,

Paul

RE: [sleuthkit-users] Extracting partions from dd image

[Eagle I. S. I. <in...@ea...>]

Brian, 

I had bs=4096 to help speed things up, so I will retest with bs=512. 

Niall. 

-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...] 
Sent: Wednesday, March 31, 2004 2:13 PM
To: Eagle Investigative Services, Inc. 
Cc: sle...@li...
Subject: Re: [sleuthkit-users] Extracting partions from dd image

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Mar 31, 2004, at 12:26 PM, Eagle Investigative Services, Inc. wrote:

> Brian,
>
> The process of dd'ing out the partition worked for only one image 
> file, and not for the three others.  All 4 image files were dd'd the 
> same way.

Which one worked?  The first one or one of the latter ones?

> So what I did was try starting at 63 and 62, and tried ending at one 
> more than the end point and none of these options worked.

It could be that the file system is corrupt.  The first partition of almost
every disk starts at sector 63, so that shouldn't be a problem.  
Make sure you are using the original disk image and not one of the partition
images as input.  Also make sure that the 'bs=' value for 'dd' is set to
512.

Send an 'xxd' output of the first sector of the partition image if nothing
else works:

dd if=part-img.dd count=1 | xxd


brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaxhQOK1gLsdFTIsRAonLAJ9AmeJM39h41j70Tp/d3r+KEDZBXQCgiH1A
7B2rcrJZ4CFtlOkX9uD5uyI=
=Kkb7
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Extracting partions from dd image

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Mar 31, 2004, at 12:26 PM, Eagle Investigative Services, Inc. wrote:

> Brian,
>
> The process of dd'ing out the partition worked for only one image 
> file, and
> not for the three others.  All 4 image files were dd'd the same way.

Which one worked?  The first one or one of the latter ones?

> So what I did was try starting at 63 and 62, and tried ending at one 
> more
> than the end point and none of these options worked.

It could be that the file system is corrupt.  The first partition of 
almost every disk starts at sector 63, so that shouldn't be a problem.  
Make sure you are using the original disk image and not one of the 
partition images as input.  Also make sure that the 'bs=' value for 
'dd' is set to 512.

Send an 'xxd' output of the first sector of the partition image if 
nothing else works:

dd if=part-img.dd count=1 | xxd


brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaxhQOK1gLsdFTIsRAonLAJ9AmeJM39h41j70Tp/d3r+KEDZBXQCgiH1A
7B2rcrJZ4CFtlOkX9uD5uyI=
=Kkb7
-----END PGP SIGNATURE-----

RE: [sleuthkit-users] Extracting partions from dd image

[Eagle I. S. I. <in...@ea...>]

Brian, 

The process of dd'ing out the partition worked for only one image file, and
not for the three others.  All 4 image files were dd'd the same way. 

I get the error message that it's not a valid NTFS system. 

I've tried altering the starting point and ending point by one block to no
avail. 

When I do 

fdisk -lu 9g.dd

I get 

9g.dd1 ......(start)63   (end)17789897 HPFS/NTFS

So what I did was try starting at 63 and 62, and tried ending at one more
than the end point and none of these options worked. 

Am I missing something?

Niall. 

Re: [sleuthkit-users] Image searching qurestion

[Enda C. <en...@co...>]

> > You can comment out lines 1854 and 1855 of src/fstools/ntfs.c,
> > recompile, and see how much further it goes  :)
>
>
> I don't know about the rest of you, but the above statement is why I use
> open source forensic tools.
>
> I'll save that email for future reference. ;)

to be honest, I know of commercial tool vendors that would email you the
same fix in the form of a "new dll" / .so etc, but the reason I use open
source tools is because when that didnt work, I could also try commenting
lines 285-290,1071-1075, 1440-1444, 1506-1516 ......

 -Enda.

Re: [sleuthkit-users] Image searching qurestion

[Matthew M. S. <msh...@th...>]

> You can comment out lines 1854 and 1855 of src/fstools/ntfs.c,  
> recompile, and see how much further it goes  :)


I don't know about the rest of you, but the above statement is why I use
open source forensic tools.

I'll save that email for future reference. ;)


-- 
Matthew M. Shannon, CISSP
Principal
Agile Risk Management LLC
www.agilerm.net 
msh...@ag... 
(c)813.732.5076
(o)813.676.5197

Re: [sleuthkit-users] Image searching qurestion

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mar 30, 2004, at 3:54 PM, Enda Cronnolly wrote:
>
> Yeah, the autopsy stdout trace quotes:
> fsstat: Error: /path/sda2.img is not a NTFS file system image
>
> on an NTFS disk partition that fails to mount on the command line with 
> error
> "bad superblock or incorrect filesystem type, or too many filesystems
> mounted".
>
> It would be nice to be able to force the filesystem in autopsy.

You can comment out lines 1854 and 1855 of src/fstools/ntfs.c,  
recompile, and see how much further it goes  :)

>> TSK tools will process a file system image until they encounter an
>> error.  They will not try to fix the error or "guess" what the correct
>> value is.  TSK also ignores the "dirty" status of a file system, as
>> marked in the super block (or equivalent).
>
> Again, would be *nice* to have conv=noerror type operations.

It is a tough line to walk though.  It is simple with 'dd' because each 
block is independent from the next so an error does not get out of 
control.  With TSK, does the force flag remove all sanity checks from 
the code or just some?  My assumption has been that if there is one big 
error, then there are more errors and it is going to fail at some 
point.  If you drop all sanity checks, then invalid data could be used 
and you have to seriously question if the results you are seeing are 
valid.

My advice for this scenario would be to make a copy of the image and 
run 'fsck' with as much verbose logging as possible.  Analyze the clean 
version and then compare how the two are different.

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAaeUEOK1gLsdFTIsRAioRAJ9bWOR5kEz8QmHMk6Rajfq6sxouNACeK29o
0mcFtepivP+S/vOayhr2YC0=
=WL9K
-----END PGP SIGNATURE-----

Re: [sleuthkit-users] Image searching qurestion

[Enda C. <en...@co...>]

Quoting: "Brian Carrier" <carrier@sle


> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Mar 30, 2004, at 2:55 AM, Enda Cronnolly wrote:
> > What happens Brian if you are working with a corrupt filesystem from a
> > system crash, and the parition is not mountable? is it possible to
> > analyse
> > fragments / chunks of a damaged partition using the filesystem rules?
>
> It depends on why the image is corrupt.  TSK doesn't do a full check of
> the FS before it starts to analyze it.  Autopsy checks the image when
> importing into Autopsy by running the 'fsstat' tool on the image to see
> if it can read the superblock and other general file system data.  That
> goal of that is to detect when users enter the wrong file system type.

Yeah, the autopsy stdout trace quotes:
fsstat: Error: /path/sda2.img is not a NTFS file system image

on an NTFS disk partition that fails to mount on the command line with error
"bad superblock or incorrect filesystem type, or too many filesystems
mounted".

It would be nice to be able to force the filesystem in autopsy.

> TSK tools will process a file system image until they encounter an
> error.  They will not try to fix the error or "guess" what the correct
> value is.  TSK also ignores the "dirty" status of a file system, as
> marked in the super block (or equivalent).

Again, would be *nice* to have conv=noerror type operations.

End of wish listing....   ;-)

 -Enda.