sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] ntfs.c.patch

[Hideaki I. <hi...@po...>]

Hi,

On Tue, 18 Feb 2003 12:50:34 -0500
Brian Carrier <ca...@at...> wrote:

> > I hope that TASK supports a Unicode option at the next version.
>
>I can't really do much in this area with out help and testing from 
>non-english users since I don't have access to test images.  And, this 
>is the first request that I have gotten for it.  What happens when you 
>run this on the command line?  Does the shell display the Japanese 
>symbols?   For example:
>
>	fls -f ntfs img.dd

Many thanks for your comment.
There is a result of a command as below.

#fls -f ntfs jp.dd
r/r 34-128-1:
?,?jp.txt r/r 34-128-4:
?,?jp.txt:stream.txt r/- * 0:
?,?jp.txt

http://www.port139.co.jp/task/jp.dd (Size:8M NTFS image)

A shell cannot display Japanese character (Unicode).
Therefore we have to use Autopsy and Web browser.
A general browser supports Unicode(UTF-8). IE, Netscape,Opera...

I asked Mr.Takahashi how to display Japanese using a Shell.
But I could not get a good method from him.
Then he wrote a patch of Unicode for me.
I think it is difficult to display a Japanese file name of NTFS
with TASK.
However, I can read in a Web browser if output in UTF-8 or UTF-16
 as a character code of a file name.
And if we use UTF-8 or UTF-16 for output, I suppose not only 
Japanese but any other language can be displayed.
I am not sure that whether other filing systems use Unicode.

Best regards,

-- 
Hideaki Ihara <hi...@po...>
Port139 URL: http://www.port139.co.jp/
PGP PUBLIC KEY: http://www.port139.co.jp/pgp/

Re: [sleuthkit-users] TASK/Autopsy RPMs

[Brian C. <ca...@at...>]

Thanks Ralf.

I have added a list of the RPMs and ports that I know of to the 
sourceforge page.  Let me know if there are others out there that I do 
not know about and I will add them.

	http://sleuthkit.sourceforge.net/index.html#download
	http://autopsy.sourceforge.net/index.html#download

brian

On Friday, February 14, 2003, at 04:44 AM, Ralf Spenneberg wrote:

> Hi,
>
> if anybody is interested, I have repackaged TASK 1.60 and Autopsy 1.70
> as RedHat 8.0 packages.
> You are welcomed to test them. If you encounter any problems, I will 
> try
> to fix them.

Re: [sleuthkit-users] ntfs.c.patch

[Brian C. <ca...@at...>]

 > I use TASK&Autopsy to analyze NTFS.
 > NTFS disk image includes a Japanese file name.
 > However Autopsy cannot display Japanese file names.

This is true (well, actually TASK has the issues with Unicode).  I will 
begin by stating that I have extremely little knowledge about the 
details of Unicode beyond the ASCII subset of UTF-16.  Which, is why 
that is the only part of Unicode for NTFS that has been implemented 
thus far.

 >
 > Mr.Takahashi wrote the patch which converted file
 > names into Unicode(UTF-8).
 > http://damedame.monyo.com/ntfs.c.patch
 >
 > Using the above patch, it is possible to display Japanese name.
 > Please check the following URL.
 > http://www.port139.co.jp/task/taskjptest.JPG
 >
 > However, it is not a complete patch.
 > If I use a long file name, Buffer over flow occurs.

This is because the bounds on the 'asc' array are not being checked.  
You need to make sure that 'i' is less than 'alen'.  Since it appears 
that you could have three bytes per character, then the size of the 
array should be increased in the functions that call uni2ascii and the 
check when 'l' is set should be modified.

 > I hope that TASK supports a Unicode option at the next version.

I can't really do much in this area with out help and testing from 
non-english users since I don't have access to test images.  And, this 
is the first request that I have gotten for it.  What happens when you 
run this on the command line?  Does the shell display the Japanese 
symbols?   For example:

	fls -f ntfs img.dd

thanks,
brian




--- ntfs.c.org  Mon Jan 13 06:58:16 2003
+++ ntfs.c      Sat Feb 15 21:42:12 2003
@@ -103,7 +103,7 @@
  void
  uni2ascii(char *uni, int ulen, char *asc, int alen)
  {
-       int i, l;
+       int i, l, j;


         /* find the maximum that we can go
@@ -115,15 +115,31 @@
         else
                 l = ulen;

-       for (i = 0; i < l; i++) {
-               /* If this value is NULL, then stop */
-               if (uni[i*2] == 0 && uni[i*2 + 1] == 0)
-                       break;
+       i = 0; j = 0;

-               if (isprint((int)uni[i*2]))
-                       asc[i] = uni[i*2];
-               else
-                       asc[i] = '?';
+       while (i < l) {
+         unsigned short *uni2p = (unsigned short *)uni;
+         /* If this value is NULL, then stop */
+         if (uni2p[j] == 0)
+           break;
+         /* If this value is NULL, then stop */
+
+          if (uni2p[j] <= 0x7f) {
+           asc[i] = uni2p[j] & 0x007f;
+           i++;
+         }
+         else if (uni2p[j] <= 0x7ff) {
+           asc[i] = 0xc0 | ((uni2p[j] & 0x7c0) >> 6);
+           asc[i+1] = 0x80 | (uni2p[j] & 0x003f);
+           i = i + 2;
+         }
+         else if (uni2p[j] > 0x800) {
+           asc[i] = 0xe0 | ((uni2p[j] & 0xf000) >> 12);
+           asc[i+1] = 0x80 | (uni2p[j] & 0xfc0) >> 6;
+           asc[i+2] = 0x80 | (uni2p[j] & 0x003f);
+           i = i + 3;
+         }
+         j++;
         }
         /* NULL Terminate */
         asc[i] = '\0';

[sleuthkit-users] ntfs.c.patch

[Hideaki I. <hi...@po...>]

Hi,

I use TASK&Autopsy to analyze NTFS.
NTFS disk image includes a Japanese file name.
However Autopsy cannot display Japanese file names.

Mr.Takahashi wrote the patch which converted file
 names into Unicode(UTF-8).
http://damedame.monyo.com/ntfs.c.patch

Using the above patch, it is possible to display Japanese name.
Please check the following URL.
http://www.port139.co.jp/task/taskjptest.JPG

However, it is not a complete patch.
If I use a long file name, Buffer over flow occurs.
I hope that TASK supports a Unicode option at the next version.

I am looking forward to feedback.
Best regards,

-- 

Hideaki Ihara <hi...@po...>
Port139 URL: http://www.port139.co.jp/
PGP PUBLIC KEY: http://www.port139.co.jp/pgp/

Re: [sleuthkit-users] Autopsy beginner question

[Brian C. <bca...@at...>]

On Fri, Feb 14, 2003 at 09:17:19AM -0500, Eagle Investigative Services wrote:
> When I specified the Evidence Locker I specified it as the "base"
> directory
> that was in the Autopsy folder. Is this correct? I wasn't sure where
> to put it.

The Evidence Locker is where all of your case data will be saved. 
So, no it should not be the installation folder.  It will work, but
it is not recommended.  You could use something like 
/usr/local/forensics/locker.  

> 
> Also, I have  dual boot machine, Linux and Win2K. My plan is to work
> with TASK/Autopsy to examine the Win2K partition.
> 
> For example, I will do something in Win2K then delete it, and then
> switch to Linux to find it. Is this going to be possible?

Yes.  Make a case and host in Autopsy and make a symlink from
/dev/hda1 (or whichever partition it is)  to the 'images' directory.  

	% ln -s /dev/hda1 /usr/local/forensics/locker/case1/host1/images

Autopsy must be running as root so that it has read permissions on the
device.

brian

[sleuthkit-users] Autopsy beginner question

[Eagle I. S. <in...@ea...>]

When I specified the Evidence Locker I specified it as the "base"
directory
that was in the Autopsy folder. Is this correct? I wasn't sure where
to put it.

Also, I have  dual boot machine, Linux and Win2K. My plan is to work
with TASK/Autopsy to examine the Win2K partition.

For example, I will do something in Win2K then delete it, and then
switch to Linux to find it. Is this going to be possible?

Thank you in advance for reading this one.

Niall.

[sleuthkit-users] TASK/Autopsy RPMs

[Ralf S. <li...@sp...>]

Hi,

if anybody is interested, I have repackaged TASK 1.60 and Autopsy 1.70
as RedHat 8.0 packages.
You are welcomed to test them. If you encounter any problems, I will try
to fix them.

Great work Brian!

Download URL: 
http://www.spenneberg.com/index.php?id=6&subject=%2FForensics%2F

Cheers,

Ralf

-- 
Ralf Spenneberg
RHCE, RHCX

IPsec/PPTP Kernels for Red Hat Linux:  
http://www.spenneberg.com/.net/.org/.de
Honeynet Project Mirror:                http://honeynet.spenneberg.org
Snort Mirror:                           http://snort.spenneberg.org

[sleuthkit-users] Newbie question on installation - SOLVED

[Eagle I. S. <in...@ea...>]

Sorry for the impulsive post. I needed to read up on Linux directory
structures.

Problem solved.


Hello,

I am new to Linux and new to TASK.

I installed Suse Linux 8.1 this evening, and was able to untar both
task-1.60 and autopsy-1.70.  Incidentally, I unpacked these into
a folder on my Desktop (KDE) - not sure if that matters.

Anyway, I navigated to the task folder and ran make (per
instructions).

The log file, pretty much just shows filed being copied across, and
does not
show any errors.

I go to do the same with Autopsy, and it asks for the location of
"TASK"

Here's the stupid question:

Where is TASK? there's no such file on my system. and when I point the
install to the task-1.60 directory it turns its nose up at the
thought.

There's obviously something I'm missing here...

Thank you in advance for any help - I'm excited to start work with
TASK.

NiallC

[sleuthkit-users] Newbie question on installation

[Eagle I. S. <in...@ea...>]

Hello,

I am new to Linux and new to TASK.

I installed Suse Linux 8.1 this evening, and was able to untar both
task-1.60 and autopsy-1.70.  Incidentally, I unpacked these into
a folder on my Desktop (KDE) - not sure if that matters.

Anyway, I navigated to the task folder and ran make (per
instructions).

The log file, pretty much just shows filed being copied across, and
does not
show any errors.

I go to do the same with Autopsy, and it asks for the location of
"TASK"

Here's the stupid question:

Where is TASK? there's no such file on my system. and when I point the
install to the task-1.60 directory it turns its nose up at the
thought.

There's obviously something I'm missing here...

Thank you in advance for any help - I'm excited to start work with
TASK.

NiallC

Re: [sleuthkit-users] A few NTFS questions

[Brian C. <bca...@at...>]

On Mon, Feb 10, 2003 at 03:33:38AM +0000, Chris Barbour wrote:
> I'm a little confused about fls' output regarding ntfs partitions, I get 
> lots of records with duplicate inode numbers with (realloc) appended to 
> the inode number. Where is the (ralloc'ed) meta data comming from? I'd 
> have thought the allocated file's metadata would have replaced the 
> realloc'ed one. Is it safe to ignore the realloc entries?

Yea, this is confusing (and not properly documented).  'fls' processes
the data structures that contain file names in them.  if the structure
has been flagged as deleted, then 'fls' will print "(deleted)" next to
it.  But, since the file name structure is different than the meta data
structure (inode or MFT for example), a file can be deleted and the
meta data structure re-allocated so that the resulting data is no
longer accurate to that file name.  Therefore, (realloc) is displayed
when a deleted file name points to an allocated meta data structure.
Of course, this does not detect when a meta data structure is
reallocated and then deleted again though.

On NTFS though, it gets worse.  NTFS stores the file name structures in
a sorted tree instead of a linear list (like FAT and FFS/EXT2FS do).  So,
when a file is deleted, its structure is not simply flagged.  It is 
removed from the tree and the tree is resorted (i.e. the files at the 
bottom of the tree get moved up).  So, when 'fls' runs on NTFS it
examines the tree to find structures that are not being used.  Quite
often though, the unused structure corresponds to a file that moved up
in the tree (and since the MFT entry is still allocated it comes up as
realloc).

The reason that I do not completely ignore them is because the file
name structure saves MAC times as well.  So, there could be a history
of times in the old structures.  But, the current design does not make
it easy to check for redundant entries.


> 
> On ntfs drives fls generates records that look like:
> /+ r/- * 0:    deletedregularfile/
> Inode 0 is the MFT on a ntfs drive so I assume inode 0 in this case 
> indicates the file has no inode surely this means the inode doesn't have 
> a file either!  Can these entries be ignored also?

These are useful to know that the file existed at one point, but for some
reason the MFT entry pointer was cleared so any dates and times that are
displayed with (-l) are not valid (and should say realloc).

brian

[sleuthkit-users] A few NTFS questions

[Chris B. <ch...@cc...>]

I'm a little confused about fls' output regarding ntfs partitions, I get 
lots of records with duplicate inode numbers with (realloc) appended to 
the inode number. Where is the (ralloc'ed) meta data comming from? I'd 
have thought the allocated file's metadata would have replaced the 
realloc'ed one. Is it safe to ignore the realloc entries?

On ntfs drives fls generates records that look like:
/+ r/- * 0:    deletedregularfile/
Inode 0 is the MFT on a ntfs drive so I assume inode 0 in this case 
indicates the file has no inode surely this means the inode doesn't have 
a file either!  Can these entries be ignored also?

Thanks for a great set of tools!

Chris B

Re: [sleuthkit-users] Task and Autopsy Installation Sob-Story (With Plead for Help)

[Brian C. <bca...@at...>]

On Tue, Feb 04, 2003 at 09:13:40PM +1300, app...@pa... wrote:
        
> The gist is I can't start Autopsy by pasting "./autopsy 8888 localhost" into   
> my browser (Konqueror or Mozilla) as per the Autopsy Readme file. 

The above is supposed to be executed at a command prompt.  It starts
the autopsy program on port 8888 and restricts access to localhost.  
When autopsy starts, it will print a new URL that you cut and paste
into the browser.  It will be something like:

	http://localhost:8888/BIG-NUMBER/autopsy

The wording is a little vague in the README, I'll change that for the
next version.

brian

[sleuthkit-users] Task and Autopsy Installation Sob-Story (With Plead for Help)

[<app...@pa...>]

Hi all, 
    
I am in the process of installing Task and Autopsy (versions 1.60 and 1.70   
respectively) for the first time, using RedHat 7.3 on a stand-alone PC, and   
have met a bit of a brick wall. :-( 
       
The gist is I can't start Autopsy by pasting "./autopsy 8888 localhost" into   
my browser (Konqueror or Mozilla) as per the Autopsy Readme file. 
    
I mucked about and moved Task before it's final install (as newbies like me 
are prone to do).   
 
I followed the advice in the "Install" file and created a generic   
"Task" directory, linked to the directory containing the actual Task files.  
 
To clean up any mess resulting from moving the Task files around, I did a 
"make clean", then a "make tidy" and finally a "make" which seemed to go okay. 
 
Next I installed Autopsy and the process went all the way to the happy 
completion of the conf.pl file.  
 
With great anticipation, I then pasted "./autopsy 8888 localhost" into the 
Konqueror URL bar (without the "") and instead of seeing the Autopsy 
interface, the browser tried to connect to "navigation.realnames.com" to work 
out what the hell I was asking it to do. (The full url it diverts to is below:    
~~~~~~~~~~~~~~~~~~~~~    
http://navigation.realnames.com/resolver.dll?action=navigation&realname=./autopsy%208888%20localhost&charset=iso-8859-1&providerid=180&fallbackuri=http%3A//www.google.com/search%3Fq%3D./autopsy%25208888%2520localhost    
~~~~~~~~~~~~~~~~~~~~~    
In Mozilla, I got "www..could not be found.  Please check the name and try   
again."    
~~~~~~~~~~~~~~~~~~~~~    
Then for fun I tried "http://localhost:8888/autopsy" and got the message:   
"Could not connect to host localhost (port 8888)".    
 
Hmmm. I then looked at netstat to see if there was a port 8888 listening.  No   
there was not - according to my newbie eye.  By then I was thinking "What the   
hell!" I then mucked about with linuxconf network settings and made sure the   
machine knew there was a "locahost" with an IP address of 127.0.0.1- and gave   
my machine the fetching name of "Boris" while I was at it.    
 
If I look at netstat now, in the first section I see: 
    
Active Internet connections (servers and established)    
Proto Recv-Q Send-Q Local Address           Foreign Address         State    
tcp        0      0 *:1024                  *:*                     LISTEN    
tcp        0      0 Boris:1025              *:*                     LISTEN    
tcp        0      0 *:sunrpc                *:*                     LISTEN    
tcp        0      0 *:x11                   *:*                     LISTEN    
tcp        0      0 Boris:smtp              *:*                     LISTEN    
udp        0      0 *:1024                  *:*    
udp        0      0 *:sunrpc                *:*    
    
Still no sign of a port 8888 listening but then I may be looking in the wrong 
place anyway.  
 
Well I am open to any advice you might have for me.  You can probably tell 
that I stopped tinkering with my machine in the nick of time. 
 
I am really excited about what this took set can do!!!   All comments welcome. 
 
If I can provide more information to aid a diagnosis please let me know. 
 
Kind Regards    
Stuart MacKinnon 
App...@Pa...    
Auckland    
New Zealand 

[sleuthkit-users] TASK 1.60 and Autopsy 1.70 Release

[Brian C. <ca...@at...>]

New versions of TASK and Autopsy are available.  TASK has new tools 
including a hash database lookup tool for the NSRL and Autopsy got a 
face lift and new features.


WHAT ARE THEY?
The @stake Sleuth Kit (TASK) contains UNIX-based file system digital 
forensics tools and Autopsy is a graphical interface to the command 
line tools in TASK.


TASK CHANGES
TASK 1.60 has the following changes:
- The 'hfind' tool can be used to perform hash lookups from the NIST 
National Software Reference Library (NSRL) and hash databases created 
by 'md5sum'.

- The 'sorter' tool has been completed.  Sorter organizes files based 
on their file type, while ignoring files that are found in the NSRL and 
other user supplied databases.  It can also generate alerts when 'known 
bad' files are found and when the extension does not match the file 
type.

- The 'ifind' tool will now take a file name and identify the meta data 
structure that it has allocated.

- Bug fixes
   - Casting bug that caused MAGIC errors in fragmented or XP NTFS images
   - Casting bug that caused some inaccurate file times in NTFS images
   - Wrong value for mount status in EXT2FS images in fsstat
   - 'ifind' will not abort when it comes across invalid data in an
     unallocated file.
- See the CHANGES file for more details

   http://sleuthkit.sourceforge.net/index.html
   http://www.atstake.com/research/tools/task/index.html

   MD5 (task-1.60.tar.gz) = e8542e0cd96ea9d6d32913ac9652cd15


AUTOPSY CHANGES
Autopsy 1.70 has the following changes:
- MAJOR interface improvement.  With assistance from Samir Kapuria,  
Autopsy has a more intuitive interface (see the screen shots)

- Case Management:  Cases can contain several hosts, each of which can 
contain one or more images.  All case management is done via the 
interface (so no more hand editing of fsmorgue!!).  Each host can have 
its own time zone and time skew setting.

- Sorter has been integrated into Autopsy to examine images by file 
type.

- Hash databases can be used with Autopsy, including the NSRL.

   http://autopsy.sourceforge.net/index.html
   http://www.atstake.com/research/tools/autopsy/index.html

   MD5 (autopsy-1.70.tar.gz) = 50800683d04762779454a3a8227aeac8


OTHER
I am also going to start a monthly e-mail "newsletter" that will 
contain techniques for using the tools and documents on how the tools 
work.  For example, documenting the design of 'sorter', the     new 
case management directory structure in Autopsy, techniques for using 
the tools for Incident Response and rootkit detection.  The first issue 
will be Feb 15.  You can sign up for the 'sleuthkit-informer' at:

   http://sourceforge.net/mail/?group_id=55685


Lastly, I wrote a paper a few months back on Open Source forensics 
software and the potential legal benefits.  If interested, it can be 
found here:

   Open Source Forensics: The Legal Argument
   
http://www.atstake.com/research/reports/index.html#opensource_forensics


brian

Re: [sleuthkit-users] Question

[Brian C. <ca...@at...>]

Nothing official yet.  I'm always looking for volunteers though ...

There are the Honeynet scan of the month write-ups though which give 
some additional info and techniques.  I have a bunch of slides that I 
have written for conferences that I need to modify and post with the 
tools.  (The next version of Autopsy is much more user friendly though).

brian



On Friday, November 15, 2002, at 09:24  AM, rohail khan wrote:

> I havent been able to find out documents on
> TASK/Autopsy other than which are contained with the
> tools themselves.
> Are there any guides or something where I can start
> Too many errors encountered; the rest of the message
> and get some more input.
>
>  TC
>  aazi
>
>
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Web Hosting - Let the expert host your site
> http://webhosting.yahoo.com
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by: To learn the basics of securing
> your web site with SSL, click here to get a FREE TRIAL of a Thawte
> Server Certificate: http://www.gothawte.com/rd524.html
> _______________________________________________
> sleuthkit-users mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users

[sleuthkit-users] Question

[rohail k. <roh...@ya...>]

I havent been able to find out documents on
TASK/Autopsy other than which are contained with the
tools themselves.
Are there any guides or something where I can start
Too many errors encountered; the rest of the message
and get some more input.
 
 TC
 aazi


__________________________________________________
Do you Yahoo!?
Yahoo! Web Hosting - Let the expert host your site
http://webhosting.yahoo.com

Re: [sleuthkit-users] Help with burning Sleuth-kit/Autopsy on to CD

[Brian C. <bca...@at...>]

Unfortunately, there are no simple instructions yet.  I'm working
on a version of Autopsy that will make it much easier, but it is not
done yet.  

The theory is as follows:
- Make a directory for the CD (/cd)
- Move TASK and autopsy to it
- Compile TASK as normal (/cd/task-1.52) 
- Compile Autopsy as normal (/cd/autopsy-1.62)
- Edit conf.pl in autopsy as follows:
  - $TASKDIR = '../task-1.52'
  - $MORGDIR = '../morgue'
  - $USE_LOG = 0
  - $USE_NOTES = 0
  - $SAVE_COOKIE = 0
- Create a morgue directory /cd/morgue
- Create symlinks from partitions to files in the morgue
  - ln -s /dev/hda1 ./hda1
  - repeat for any device you want
- Create a fsmorgue file that contains all the device entries.  
- Burn to CD

This will have to be done for each platform.  I may have missed a few
steps, so let me know what errors you get.  The new version of Autopsy
will be much easier.

brian



On Sun, Nov 03, 2002 at 12:44:18AM -0500, Gary Pifer wrote:
> Hello.  I was wondering if anyone could give me some SIMPLE-STUPID
> instructions for burning these applications on to a CD for running on a
> live system (both unix and windows 2000)...?  I emphasized
> SIMPLE-STUPID because I am a beginner at this sort of thing.  
> 
> Thanks in advance!!!
> 
> Gary Pifer
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: ApacheCon, November 18-21 in

> Las Vegas (supported by COMDEX), the only Apache event to be
> fully supported by the ASF. http://www.apachecon.com
> _______________________________________________
> sleuthkit-users mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users

[sleuthkit-users] Help with burning Sleuth-kit/Autopsy on to CD

[Gary P. <gx...@it...>]

Hello.  I was wondering if anyone could give me some SIMPLE-STUPID
instructions for burning these applications on to a CD for running on a
live system (both unix and windows 2000)...?  I emphasized
SIMPLE-STUPID because I am a beginner at this sort of thing.  

Thanks in advance!!!

Gary Pifer

[sleuthkit-users] TASK 1.52 & Autopsy 1.62

[Brian C. <ca...@at...>]

TASK 1.52 and Autopsy 1.62 are now available.

What is New?
- Autopsy has new features that make the Honeynet Scan of the Month
   a little easier:
   - Extract or view any number of consecutive data units (fragments,
     sectors, clusters etc.).
   - The file type (output from 'file') is shown when viewing a data
     unit.

- Autopsy has a bug fix that caused problems when key word searching
   a large file (thanks to Michael Stone)

- TASK has a beta version of a new tool: 'sorter'.
   - It runs 'file' on every file in the system and sorts them based
     on type.  It either just writes the name to a file or will
     save the file.  - It also does extension checking to verify
   the type corresponds with
     the extension.


Where do I get them?
http://www.atstake.com/research/tools/task
MD5 (task-1.52.tar.gz) = 475af26bad7492d61490a69ad7f2472e

http://www.atstake.com/research/tools/autopsy
MD5 (autopsy-1.62.tar.gz) = 84f8618c84c1c48db0a1d4591ed22b06


What Are They?
The @stake Sleuth Kit (TASK) is a collection of open source forensic
analysis tools for the analysis of Windows and UNIX file systems.
Autopsy is an HTML-based graphical interface to the command line
tools of TASK.

brian

Re: [sleuthkit-users] NTFS filesystem options ---

[Brian C. <bca...@at...>]

You'll have to either make a new image or just reference the loop back
device that losetup makes.

To make a new image, use:
	# dd if=img.dd skip=32256 count=XYZ of=img2.dd

To use the loop back device, make a symlink from the /dev/ entry to
the morgue directory and then make an entry in fsmorgue for it.

brian


On Wed, Oct 02, 2002 at 12:03:42AM -0400, Jason Mafera wrote:
> Hi,
>  
> Thanks Brian for the help with the large filesystem Perl
> support.Recompiling with the option did the trick.
>  
> Does anyone know a way to set a partition offset in the Autopsy config?
> It isn't recognizing the image file as an NTFS partition.  I had to
> mount the image with an offset of 32256 to get losetup to work.
> Again any help is appreciated.
>  
> Thanks in advance.
>  
> -Jason
>  

[sleuthkit-users] NTFS filesystem options ---

[Jason M. <Ja...@Ma...>]

Hi,
 
Thanks Brian for the help with the large filesystem Perl
support.Recompiling with the option did the trick.
 
Does anyone know a way to set a partition offset in the Autopsy config?
It isn't recognizing the image file as an NTFS partition.  I had to
mount the image with an offset of 32256 to get losetup to work.
Again any help is appreciated.
 
Thanks in advance.
 
-Jason
 

Re: [sleuthkit-users] Perl Problem - Large File support

[Brian C. <bca...@at...>]

Download the source from  cpan.org and compile it.  I don't think 
any RPMs do this.  You will be asked tons of questions and the 
large file option is the default for one of them.
 
brian

On Tue, Oct 01, 2002 at 09:26:01AM -0400, Jason Mafera wrote:
> Hello Everyone,
>  
> Hopefully someone can help me with a problem.  I am getting an error in
> autopsy when I try to open a large image file (9.4 gig), it is telling
> me that I need Perl with Large file support?  I'm not sure what to do at
> this point.  I imagine I need to recompile the RPM with large file
> support enabled, but I am having trouble finding information on how to
> do this.  Any help would be greatly appreciated..
>  
> Thanks in advance.
>  
> -Jason
>  

[sleuthkit-users] Perl Problem - Large File support

[Jason M. <Ja...@Ma...>]

Hello Everyone,
 
Hopefully someone can help me with a problem.  I am getting an error in
autopsy when I try to open a large image file (9.4 gig), it is telling
me that I need Perl with Large file support?  I'm not sure what to do at
this point.  I imagine I need to recompile the RPM with large file
support enabled, but I am having trouble finding information on how to
do this.  Any help would be greatly appreciated..
 
Thanks in advance.
 
-Jason
 

[sleuthkit-users] TASK 1.51 & Autopsy 1.61 Release

[Brian C. <bca...@at...>]

TASK 1.51 and Autopsy 1.61 are now available.  

TASK:  http://www.atstake.com/research/tools/task

Autopsy:  http://www.atstake.com/research/tools/autopsy


Summary of Changes:

TASK:
- fixed 2 bugs with the NTFS code that generated errors.  They had to do
with $MFT and fragmentation (details in CHANGES).
- Updated the version of 'file' that is included
- Added flag to some tools for time skew in seconds.  This makes it easier
to correlate data between multiple sources that do not have NTP.

Autopsy:
- improved error messages and minor updates


Tool Descriptions:
The @stake Sleuth Kit (TASK) is an open source collection of file
system forensic analysis tools for Windows and UNIX file systems.
TASK allows one to view allocated and deleted data from NTFS, FAT,
FFS, and EXT2FS images.

The Autopsy Forensic Browser is a graphical interface to the command
line tools in TASK.  Autopsy allows one to view allocated and deleted
file system content in a "File Manager" style interface and perform
keyword searches.


brian

Re: [sleuthkit-users] FW: TASK with live systems - Readthisfirst

[Brian C. <bca...@at...>]

rmu...@em... (Thu, Sep 19, 2002 at 12:44:53PM -0700):
> 1. how to define live system if I am using Autopsy?

Make a morgue directory and then create symlinks from the device to a file
in that directory:

	ln -s /dev/hda1 /morgue/hda1 

Then in the fsmorgue file just put hda1.

> 2. (same as previous email) If I try to browse the URL from IE, I either
> get 'the page cannot be displayed' or 'you are not authorized to view the
> page' messages.  If it is related to permission, can you tell me which file
> should I change the permission on?

I haven't figured out why IE does that.  I've found that if you use
an IP address instead of a hostname it is sometimes happy (i.e.
127.0.0.1 instead of localhost).  I just use Netscape or Mozilla.  

brian