sleuthkit-users Mailing List for The Sleuth Kit (Page 22)
Brought to you by:
carrier
Menu
▾
▴
sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.
You can subscribe to this list here.
| 2002 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(6) |
Aug
|
Sep
(11) |
Oct
(5) |
Nov
(4) |
Dec
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 |
Jan
(1) |
Feb
(20) |
Mar
(60) |
Apr
(40) |
May
(24) |
Jun
(28) |
Jul
(18) |
Aug
(27) |
Sep
(6) |
Oct
(14) |
Nov
(15) |
Dec
(22) |
| 2004 |
Jan
(34) |
Feb
(13) |
Mar
(28) |
Apr
(23) |
May
(27) |
Jun
(26) |
Jul
(37) |
Aug
(19) |
Sep
(20) |
Oct
(39) |
Nov
(17) |
Dec
(9) |
| 2005 |
Jan
(45) |
Feb
(43) |
Mar
(66) |
Apr
(36) |
May
(19) |
Jun
(64) |
Jul
(10) |
Aug
(11) |
Sep
(35) |
Oct
(6) |
Nov
(4) |
Dec
(13) |
| 2006 |
Jan
(52) |
Feb
(34) |
Mar
(39) |
Apr
(39) |
May
(37) |
Jun
(15) |
Jul
(13) |
Aug
(48) |
Sep
(9) |
Oct
(10) |
Nov
(47) |
Dec
(13) |
| 2007 |
Jan
(25) |
Feb
(4) |
Mar
(2) |
Apr
(29) |
May
(11) |
Jun
(19) |
Jul
(13) |
Aug
(15) |
Sep
(30) |
Oct
(12) |
Nov
(10) |
Dec
(13) |
| 2008 |
Jan
(2) |
Feb
(54) |
Mar
(58) |
Apr
(43) |
May
(10) |
Jun
(27) |
Jul
(25) |
Aug
(27) |
Sep
(48) |
Oct
(69) |
Nov
(55) |
Dec
(43) |
| 2009 |
Jan
(26) |
Feb
(36) |
Mar
(28) |
Apr
(27) |
May
(55) |
Jun
(9) |
Jul
(19) |
Aug
(16) |
Sep
(15) |
Oct
(17) |
Nov
(70) |
Dec
(21) |
| 2010 |
Jan
(56) |
Feb
(59) |
Mar
(53) |
Apr
(32) |
May
(25) |
Jun
(31) |
Jul
(36) |
Aug
(11) |
Sep
(37) |
Oct
(19) |
Nov
(23) |
Dec
(6) |
| 2011 |
Jan
(21) |
Feb
(20) |
Mar
(30) |
Apr
(30) |
May
(74) |
Jun
(50) |
Jul
(34) |
Aug
(34) |
Sep
(12) |
Oct
(33) |
Nov
(10) |
Dec
(8) |
| 2012 |
Jan
(23) |
Feb
(57) |
Mar
(26) |
Apr
(14) |
May
(27) |
Jun
(27) |
Jul
(60) |
Aug
(88) |
Sep
(13) |
Oct
(36) |
Nov
(97) |
Dec
(85) |
| 2013 |
Jan
(60) |
Feb
(24) |
Mar
(43) |
Apr
(32) |
May
(22) |
Jun
(38) |
Jul
(51) |
Aug
(50) |
Sep
(76) |
Oct
(65) |
Nov
(25) |
Dec
(30) |
| 2014 |
Jan
(19) |
Feb
(41) |
Mar
(43) |
Apr
(28) |
May
(61) |
Jun
(12) |
Jul
(10) |
Aug
(37) |
Sep
(76) |
Oct
(31) |
Nov
(41) |
Dec
(12) |
| 2015 |
Jan
(33) |
Feb
(28) |
Mar
(53) |
Apr
(22) |
May
(29) |
Jun
(20) |
Jul
(15) |
Aug
(17) |
Sep
(52) |
Oct
(3) |
Nov
(18) |
Dec
(21) |
| 2016 |
Jan
(20) |
Feb
(8) |
Mar
(21) |
Apr
(7) |
May
(13) |
Jun
(35) |
Jul
(34) |
Aug
(11) |
Sep
(14) |
Oct
(22) |
Nov
(31) |
Dec
(23) |
| 2017 |
Jan
(20) |
Feb
(7) |
Mar
(5) |
Apr
(6) |
May
(6) |
Jun
(22) |
Jul
(11) |
Aug
(16) |
Sep
(8) |
Oct
(1) |
Nov
(1) |
Dec
(1) |
| 2018 |
Jan
|
Feb
|
Mar
(16) |
Apr
(2) |
May
(6) |
Jun
(5) |
Jul
|
Aug
(2) |
Sep
(4) |
Oct
|
Nov
(16) |
Dec
(13) |
| 2019 |
Jan
|
Feb
(1) |
Mar
(25) |
Apr
(9) |
May
(2) |
Jun
(1) |
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2020 |
Jan
(2) |
Feb
|
Mar
(1) |
Apr
|
May
(1) |
Jun
(3) |
Jul
(2) |
Aug
|
Sep
|
Oct
(5) |
Nov
|
Dec
|
| 2021 |
Jan
|
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
(4) |
Jul
(1) |
Aug
|
Sep
(1) |
Oct
|
Nov
(1) |
Dec
|
| 2022 |
Jan
|
Feb
(2) |
Mar
|
Apr
|
May
(2) |
Jun
|
Jul
(3) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2023 |
Jan
(2) |
Feb
|
Mar
(1) |
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
(1) |
Nov
|
Dec
|
| 2024 |
Jan
|
Feb
(3) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
| 2025 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Ketil F. <ke...@fr...> - 2015-09-29 06:47:59
|
On 29 Sep 2015 04:45, "Brian Carrier" <ca...@sl...> wrote: > They are both equivalent. Any strong opinions? Not really. > Is this task tracking of interest? For me again, not really. I work in an environment where we use several different tools, and I find it unlikely that we'd use tracking of this sort in one of the tools. Regards, Ketil |
|
From: Simson G. <si...@ac...> - 2015-09-29 03:05:21
|
Brian, Interesting files seems like a fine approach. If you are going to add task management, then are you going to allow it to host on MySQL and have multi-user support? Pretty soon, you will have re-implemented PyFlag... > On Sep 28, 2015, at 10:44 PM, Brian Carrier <ca...@sl...> wrote: > > Flagging the file so that it is in the tree for easy follow on analysis seems to be a common theme with the suggestions. > > We could do a few things: > 1) Make a new artifact, such as “TSK_FILE_CANNOT_OPEN” that could have a description that says why. > > 2) Use the generic “TSK_INTERESTING_FILES” artifact with a set name that is why it could not be opened. > — For those who have not used the Interesting Files module yet, it exists to flag files that meet certain criteria and there is a special section in the tree for them. > > They are both equivalent. Any strong opinions? > > This is also making me think about adding “task management” to Autopsy to help people track what needs to be done because it occurred to me that we could also make “tasks” to help you track which of the unsupported files that you have looked at yet or not. We could do this either with specially named tags (that can be deleted or moved to different “priorities”) or a new data type. > > Is this task tracking of interest? > > > > > > > > > >> On Sep 24, 2015, at 4:14 PM, Derrick Karpo <dk...@gm...> wrote: >> >> I don't mind the log message with an additional pop up in the lower >> right. That works for me. I don't recall but, are those problematic >> files marked somehow so that we can manually examine them after >> without digging through the log to identify them? >> >> Derrick >> >> >> On Thu, Sep 24, 2015 at 1:57 PM, Simson Garfinkel <si...@ac...> wrote: >>> I think that there should be a general "alert" framework where any scanner can post processing alerts, and have them show up in the results like other results. >>> >>>> On Sep 24, 2015, at 3:50 PM, Brian Carrier <ca...@sl...> wrote: >>>> >>>> Autopsy will sometimes encounter allocated ZIP files that cannot be opened by 7Zip (or other tools). We’re currently creating a log message, but no one probably sees though. Would you rather that we pop up an error message in the lower right? I’d suggest this only be done for allocated files rather than deleted files (that could be corrupt). >>>> >>>> Opinions? >>>> >>>> >>>> >>>> ------------------------------------------------------------------------------ >>>> _______________________________________________ >>>> sleuthkit-users mailing list >>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >>>> http://www.sleuthkit.org >>> >>> >>> ------------------------------------------------------------------------------ >>> _______________________________________________ >>> sleuthkit-users mailing list >>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >>> http://www.sleuthkit.org >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org > > > ------------------------------------------------------------------------------ > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Brian C. <ca...@sl...> - 2015-09-29 02:44:24
|
Flagging the file so that it is in the tree for easy follow on analysis seems to be a common theme with the suggestions. We could do a few things: 1) Make a new artifact, such as “TSK_FILE_CANNOT_OPEN” that could have a description that says why. 2) Use the generic “TSK_INTERESTING_FILES” artifact with a set name that is why it could not be opened. — For those who have not used the Interesting Files module yet, it exists to flag files that meet certain criteria and there is a special section in the tree for them. They are both equivalent. Any strong opinions? This is also making me think about adding “task management” to Autopsy to help people track what needs to be done because it occurred to me that we could also make “tasks” to help you track which of the unsupported files that you have looked at yet or not. We could do this either with specially named tags (that can be deleted or moved to different “priorities”) or a new data type. Is this task tracking of interest? > On Sep 24, 2015, at 4:14 PM, Derrick Karpo <dk...@gm...> wrote: > > I don't mind the log message with an additional pop up in the lower > right. That works for me. I don't recall but, are those problematic > files marked somehow so that we can manually examine them after > without digging through the log to identify them? > > Derrick > > > On Thu, Sep 24, 2015 at 1:57 PM, Simson Garfinkel <si...@ac...> wrote: >> I think that there should be a general "alert" framework where any scanner can post processing alerts, and have them show up in the results like other results. >> >>> On Sep 24, 2015, at 3:50 PM, Brian Carrier <ca...@sl...> wrote: >>> >>> Autopsy will sometimes encounter allocated ZIP files that cannot be opened by 7Zip (or other tools). We’re currently creating a log message, but no one probably sees though. Would you rather that we pop up an error message in the lower right? I’d suggest this only be done for allocated files rather than deleted files (that could be corrupt). >>> >>> Opinions? >>> >>> >>> >>> ------------------------------------------------------------------------------ >>> _______________________________________________ >>> sleuthkit-users mailing list >>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >>> http://www.sleuthkit.org >> >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org > > ------------------------------------------------------------------------------ > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Simson G. <si...@ac...> - 2015-09-25 02:00:50
|
Yes, the alerts would go in the tree. That way they could be reviewed as a set, and any technology for annotating or selecting tree leafs could be used for alerts as well. > On Sep 24, 2015, at 5:13 PM, Brian Carrier <ca...@sl...> wrote: > > Do you mean the alert would be in the tree (at the same level as say Web Bookmarks)? > > > >> On Sep 24, 2015, at 3:57 PM, Simson Garfinkel <si...@ac...> wrote: >> >> I think that there should be a general "alert" framework where any scanner can post processing alerts, and have them show up in the results like other results. >> >>> On Sep 24, 2015, at 3:50 PM, Brian Carrier <ca...@sl...> wrote: >>> >>> Autopsy will sometimes encounter allocated ZIP files that cannot be opened by 7Zip (or other tools). We’re currently creating a log message, but no one probably sees though. Would you rather that we pop up an error message in the lower right? I’d suggest this only be done for allocated files rather than deleted files (that could be corrupt). >>> >>> Opinions? >>> >>> >>> >>> ------------------------------------------------------------------------------ >>> _______________________________________________ >>> sleuthkit-users mailing list >>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >>> http://www.sleuthkit.org >> >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org > |
|
From: Brian C. <ca...@sl...> - 2015-09-24 21:13:09
|
Do you mean the alert would be in the tree (at the same level as say Web Bookmarks)? > On Sep 24, 2015, at 3:57 PM, Simson Garfinkel <si...@ac...> wrote: > > I think that there should be a general "alert" framework where any scanner can post processing alerts, and have them show up in the results like other results. > >> On Sep 24, 2015, at 3:50 PM, Brian Carrier <ca...@sl...> wrote: >> >> Autopsy will sometimes encounter allocated ZIP files that cannot be opened by 7Zip (or other tools). We’re currently creating a log message, but no one probably sees though. Would you rather that we pop up an error message in the lower right? I’d suggest this only be done for allocated files rather than deleted files (that could be corrupt). >> >> Opinions? >> >> >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org > > > ------------------------------------------------------------------------------ > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Ketil F. <ke...@fr...> - 2015-09-24 20:33:59
|
How about adding an artifact group for files that can't be opened, and adding them there in addition to logging the reason? That would make it easier to automate reruns with tools to repair broken zip-files or try to decrypt encrypted files, and it'd still be possible to look in the log to find the reason it didn't open initially. Regards, Ketil On 24 Sep 2015 21:51, "Brian Carrier" <ca...@sl...> wrote: > Autopsy will sometimes encounter allocated ZIP files that cannot be opened > by 7Zip (or other tools). We’re currently creating a log message, but no > one probably sees though. Would you rather that we pop up an error > message in the lower right? I’d suggest this only be done for allocated > files rather than deleted files (that could be corrupt). > > Opinions? > > > > > ------------------------------------------------------------------------------ > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > |
|
From: Derrick K. <dk...@gm...> - 2015-09-24 20:14:32
|
I don't mind the log message with an additional pop up in the lower right. That works for me. I don't recall but, are those problematic files marked somehow so that we can manually examine them after without digging through the log to identify them? Derrick On Thu, Sep 24, 2015 at 1:57 PM, Simson Garfinkel <si...@ac...> wrote: > I think that there should be a general "alert" framework where any scanner can post processing alerts, and have them show up in the results like other results. > >> On Sep 24, 2015, at 3:50 PM, Brian Carrier <ca...@sl...> wrote: >> >> Autopsy will sometimes encounter allocated ZIP files that cannot be opened by 7Zip (or other tools). We’re currently creating a log message, but no one probably sees though. Would you rather that we pop up an error message in the lower right? I’d suggest this only be done for allocated files rather than deleted files (that could be corrupt). >> >> Opinions? >> >> >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users >> http://www.sleuthkit.org > > > ------------------------------------------------------------------------------ > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Simson G. <si...@ac...> - 2015-09-24 19:57:17
|
I think that there should be a general "alert" framework where any scanner can post processing alerts, and have them show up in the results like other results. > On Sep 24, 2015, at 3:50 PM, Brian Carrier <ca...@sl...> wrote: > > Autopsy will sometimes encounter allocated ZIP files that cannot be opened by 7Zip (or other tools). We’re currently creating a log message, but no one probably sees though. Would you rather that we pop up an error message in the lower right? I’d suggest this only be done for allocated files rather than deleted files (that could be corrupt). > > Opinions? > > > > ------------------------------------------------------------------------------ > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
|
From: Brian C. <ca...@sl...> - 2015-09-24 19:50:28
|
Autopsy will sometimes encounter allocated ZIP files that cannot be opened by 7Zip (or other tools). We’re currently creating a log message, but no one probably sees though. Would you rather that we pop up an error message in the lower right? I’d suggest this only be done for allocated files rather than deleted files (that could be corrupt). Opinions? |
|
From: Brian C. <ca...@sl...> - 2015-09-24 14:55:31
|
Hi John,
At one point it compiled on Linux. To be honest though, we don’t use the framework anymore in active development. We’re using Autopsy for all of those projects.
thanks,
brian
> On Sep 23, 2015, at 4:58 PM, slo...@gm... wrote:
>
> Please disregard the Poco error from make. I failed to notice that the Ubuntu package was poco version 1.3.8. I installed poco 1.6 from source and compiled the framework successfully.
>
> On Wed, Sep 23, 2015 at 1:11 PM, slo...@gm... <slo...@gm...> wrote:
> I have never installed the framework under linux, but it appears it is possible. However, I get the following error on ./configure
>
> ****************************
> Modules missing dependencies:
> cat: ../*/missing_libs.txt: No such file or directory
> ****************************
>
> I searched the parent directory and subdirectories, and missing_libs.txt is not present. Is the missing file critical? I'm guessing it is not based on it's name...
>
> Proceeding with the compilation, the make command results in this error:
>
> In file included from TskServices.cpp:15:0:
> ../../../tsk/framework/services/TskSystemPropertiesImpl.h:87:11: error: 'AutoPtr' in namespace 'Poco' does not name a template type
> Poco::AutoPtr<Poco::Util::AbstractConfiguration> m_abstractConfig;
> ^
> ../../../tsk/framework/services/TskSystemPropertiesImpl.h: In constructor 'TskSystemPropertiesImpl::TskSystemPropertiesImpl()':
> ../../../tsk/framework/services/TskSystemPropertiesImpl.h:52:33: error: class 'TskSystemPropertiesImpl' does not have any field named 'm_abstractConfig'
> TskSystemPropertiesImpl() : m_abstractConfig(static_cast<Poco::Util::AbstractConfiguration*>(NULL)) {}
> ^
> Makefile:425: recipe for target 'TskServices.lo' failed
>
> I will install poco from source to try to correct the make error, rather than using the Ubuntu 15.04 libpoco-dev package. However, this doesn't look like a package error.
>
> Any guidance/installation experience appreciated.
>
> John
>
> ------------------------------------------------------------------------------
> Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
> Get real-time metrics from all of your servers, apps and tools
> in one place.
> SourceForge users - Click here to start your Free Trial of Datadog now!
> http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
|
|
From: <slo...@gm...> - 2015-09-23 20:58:35
|
Please disregard the Poco error from make. I failed to notice that the
Ubuntu package was poco version 1.3.8. I installed poco 1.6 from source
and compiled the framework successfully.
On Wed, Sep 23, 2015 at 1:11 PM, slo...@gm... <slo...@gm...>
wrote:
> I have never installed the framework under linux, but it appears it is
> possible. However, I get the following error on ./configure
>
> ****************************
> Modules missing dependencies:
> cat: ../*/missing_libs.txt: No such file or directory
> ****************************
>
> I searched the parent directory and subdirectories, and missing_libs.txt
> is not present. Is the missing file critical? I'm guessing it is not
> based on it's name...
>
> Proceeding with the compilation, the make command results in this error:
>
> In file included from TskServices.cpp:15:0:
> ../../../tsk/framework/services/TskSystemPropertiesImpl.h:87:11: error:
> 'AutoPtr' in namespace 'Poco' does not name a template type
> Poco::AutoPtr<Poco::Util::AbstractConfiguration> m_abstractConfig;
> ^
> ../../../tsk/framework/services/TskSystemPropertiesImpl.h: In constructor
> 'TskSystemPropertiesImpl::TskSystemPropertiesImpl()':
> ../../../tsk/framework/services/TskSystemPropertiesImpl.h:52:33: error:
> class 'TskSystemPropertiesImpl' does not have any field named
> 'm_abstractConfig'
> TskSystemPropertiesImpl() :
> m_abstractConfig(static_cast<Poco::Util::AbstractConfiguration*>(NULL)) {}
> ^
> Makefile:425: recipe for target 'TskServices.lo' failed
>
> I will install poco from source to try to correct the make error, rather
> than using the Ubuntu 15.04 libpoco-dev package. However, this doesn't
> look like a package error.
>
> Any guidance/installation experience appreciated.
>
> John
>
|
|
From: <slo...@gm...> - 2015-09-23 20:11:35
|
I have never installed the framework under linux, but it appears it is
possible. However, I get the following error on ./configure
****************************
Modules missing dependencies:
cat: ../*/missing_libs.txt: No such file or directory
****************************
I searched the parent directory and subdirectories, and missing_libs.txt is
not present. Is the missing file critical? I'm guessing it is not based
on it's name...
Proceeding with the compilation, the make command results in this error:
In file included from TskServices.cpp:15:0:
../../../tsk/framework/services/TskSystemPropertiesImpl.h:87:11: error:
'AutoPtr' in namespace 'Poco' does not name a template type
Poco::AutoPtr<Poco::Util::AbstractConfiguration> m_abstractConfig;
^
../../../tsk/framework/services/TskSystemPropertiesImpl.h: In constructor
'TskSystemPropertiesImpl::TskSystemPropertiesImpl()':
../../../tsk/framework/services/TskSystemPropertiesImpl.h:52:33: error:
class 'TskSystemPropertiesImpl' does not have any field named
'm_abstractConfig'
TskSystemPropertiesImpl() :
m_abstractConfig(static_cast<Poco::Util::AbstractConfiguration*>(NULL)) {}
^
Makefile:425: recipe for target 'TskServices.lo' failed
I will install poco from source to try to correct the make error, rather
than using the Ubuntu 15.04 libpoco-dev package. However, this doesn't
look like a package error.
Any guidance/installation experience appreciated.
John
|
|
From: Richer, M. (CIV) <mhr...@np...> - 2015-09-20 22:10:36
|
While folks might usually want hashes, it's an expensive operation to perform on every file on a large source. I assume that's why it's an option. I suppose -m could be for md5, -s for sha1 etc so as not to be confused with help. My 2 cents (likely worth as much), Mark On Sep 20, 2015, at 17:33, Rolf Inator <rol...@gm...<mailto:rol...@gm...>> wrote: This happens when you expect something else... I thought the hashes are automatically calculated and didn't expect the "-h" switch to be the hash switch (expected "help" when using "h" ^^). However, thanks guys, this works great on a running Windows! --Rolf Gesendet: Sonntag, 20. September 2015 um 20:09 Uhr Von: "Ketil Froyn" <ke...@fr...<mailto:ke...@fr...>> An: "Rolf Inator" <rol...@gm...<mailto:rol...@gm...>> Cc: sleuthkit-users <sle...@li...<mailto:sle...@li...>>, "Derrick Karpo" <dk...@gm...<mailto:dk...@gm...>> Betreff: Re: [sleuthkit-users] Fiwalk on running system You have to specify the -h option to calculate md5sums. http://www.sleuthkit.org/sleuthkit/man/tsk_loaddb.html Ketil On 20 Sep 2015 18:38, "Rolf Inator" <rol...@gm...> wrote: Thanks a lot to both of you! So far I tried tsk_loaddb, since it was included in the sleuthkit 4.2.0 on sourceforge. However, I will give fiwalk another try as soon as I tried out tsk_loaddb! So, tsk_loaddb is very promising! I tried your suggestion on a Windows 8.1 machine and it worked out pretty good! The sqlite DB was written do disk- the only thing I noticed (and what is a little bit weird), is that the column "md5" in tsk_files is null for every row. Do you have any idea why this is happening? (I started the cmd as Administrator for C:, so the rights should be fine ;) ). Thanks again! --Rolf > Gesendet: Freitag, 18. September 2015 um 17:14 Uhr > Von: "Derrick Karpo" <dk...@gm...> > An: "Rolf Inator" <rol...@gm...>, "sleuthkit-users users" <sle...@li...> > Betreff: Re: [sleuthkit-users] Fiwalk on running system > > Hi Rolf. > > I'm not sure if Michael's suggestion works with the latest fiwalk or > not but if it doesn't, have you looked at tsk_loaddb as an alternative > to fiwalk? fiwalk hasn't been getting as much development lately but > tsk_loaddb is actively developed and outputs all the results into a > SQLite database. Something like this would work with tsk_loaddb: > > tsk_loaddb -d myimage.db \\.\c: > > Alternatively, for physical disks: > > wmic diskdrive list > tsk_loaddb -d myimage.db \\.\PhysicalDrive0 > > Derrick > > > On Fri, Sep 18, 2015 at 8:05 AM, Michael Cohen <scu...@gm...> wrote: > > Does it work if you give it the volume name? fiwalk \\.\C: > > > > On 18 September 2015 at 14:50, Rolf Inator <rol...@gm...> wrote: > >> Hi list, > >> > >> I wonder if it's possible to run fiwalk on a live system? The documentation says > >> user@forensicbox:~$ fiwalk > >> usage: fiwalk [options] iso-name > >> > >> The problem I am facing is, that if I want to run fiwalk over a bitlocker encrypted dd image, I have to install Dislocker (a new driver) on my Linux system. It would be more decent if I could just run the fiwalk Windows executable while the suspects system is still running. > >> > >> I hope that was clear :) > >> > >> Kind regards, > >> Rolf > >> > >> ------------------------------------------------------------------------------ > >> _______________________________________________ > >> sleuthkit-users mailing list > >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > >> http://www.sleuthkit.org > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > > sleuthkit-users mailing list > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > > http://www.sleuthkit.org > ------------------------------------------------------------------------------ _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org ------------------------------------------------------------------------------ _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org |
|
From: Rolf I. <rol...@gm...> - 2015-09-20 21:33:04
|
<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div> <div>This happens when you expect something else...</div> <div>I thought the hashes are automatically calculated and didn't expect the "-h" switch to be the hash switch (expected "help" when using "h" ^^).</div> <div> </div> <div>However, thanks guys, this works great on a running Windows!</div> <div>--Rolf</div> <div> <div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"> <div style="margin:0 0 10px 0;"><b>Gesendet:</b> Sonntag, 20. September 2015 um 20:09 Uhr<br/> <b>Von:</b> "Ketil Froyn" <ke...@fr...><br/> <b>An:</b> "Rolf Inator" <rol...@gm...><br/> <b>Cc:</b> sleuthkit-users <sle...@li...>, "Derrick Karpo" <dk...@gm...><br/> <b>Betreff:</b> Re: [sleuthkit-users] Fiwalk on running system</div> <div name="quoted-content"> <p>You have to specify the -h option to calculate md5sums.</p> <p><a href="http://www.sleuthkit.org/sleuthkit/man/tsk_loaddb.html" target="_blank">http://www.sleuthkit.org/sleuthkit/man/tsk_loaddb.html</a></p> <p>Ketil</p> <div class="gmail_quote">On 20 Sep 2015 18:38, "Rolf Inator" <<a href="rol...@gm..." target="_parent">rol...@gm...</a>> wrote: <blockquote class="gmail_quote" style="margin: 0 0 0 0.8ex;border-left: 1.0px rgb(204,204,204) solid;padding-left: 1.0ex;">Thanks a lot to both of you! So far I tried tsk_loaddb, since it was included in the sleuthkit 4.2.0 on sourceforge. However, I will give fiwalk another try as soon as I tried out tsk_loaddb!<br/> <br/> So, tsk_loaddb is very promising! I tried your suggestion on a Windows 8.1 machine and it worked out pretty good! The sqlite DB was written do disk- the only thing I noticed (and what is a little bit weird), is that the column "md5" in tsk_files is null for every row.<br/> Do you have any idea why this is happening? (I started the cmd as Administrator for C:, so the rights should be fine ;) ).<br/> <br/> Thanks again!<br/> --Rolf<br/> <br/> <br/> > Gesendet: Freitag, 18. September 2015 um 17:14 Uhr<br/> > Von: "Derrick Karpo" <<a href="dk...@gm..." target="_parent">dk...@gm...</a>><br/> > An: "Rolf Inator" <<a href="rol...@gm..." target="_parent">rol...@gm...</a>>, "sleuthkit-users users" <<a href="sle...@li..." target="_parent">sle...@li...</a>><br/> > Betreff: Re: [sleuthkit-users] Fiwalk on running system<br/> ><br/> > Hi Rolf.<br/> ><br/> > I'm not sure if Michael's suggestion works with the latest fiwalk or<br/> > not but if it doesn't, have you looked at tsk_loaddb as an alternative<br/> > to fiwalk? fiwalk hasn't been getting as much development lately but<br/> > tsk_loaddb is actively developed and outputs all the results into a<br/> > SQLite database. Something like this would work with tsk_loaddb:<br/> ><br/> > tsk_loaddb -d myimage.db \\.\c:<br/> ><br/> > Alternatively, for physical disks:<br/> ><br/> > wmic diskdrive list<br/> > tsk_loaddb -d myimage.db \\.\PhysicalDrive0<br/> ><br/> > Derrick<br/> ><br/> ><br/> > On Fri, Sep 18, 2015 at 8:05 AM, Michael Cohen <<a href="scu...@gm..." target="_parent">scu...@gm...</a>> wrote:<br/> > > Does it work if you give it the volume name? fiwalk \\.\C:<br/> > ><br/> > > On 18 September 2015 at 14:50, Rolf Inator <<a href="rol...@gm..." target="_parent">rol...@gm...</a>> wrote:<br/> > >> Hi list,<br/> > >><br/> > >> I wonder if it's possible to run fiwalk on a live system? The documentation says<br/> > >> user@forensicbox:~$ fiwalk<br/> > >> usage: fiwalk [options] iso-name<br/> > >><br/> > >> The problem I am facing is, that if I want to run fiwalk over a bitlocker encrypted dd image, I have to install Dislocker (a new driver) on my Linux system. It would be more decent if I could just run the fiwalk Windows executable while the suspects system is still running.<br/> > >><br/> > >> I hope that was clear :)<br/> > >><br/> > >> Kind regards,<br/> > >> Rolf<br/> > >><br/> > >> ------------------------------------------------------------------------------<br/> > >> _______________________________________________<br/> > >> sleuthkit-users mailing list<br/> > >> <a href="https://lists.sourceforge.net/lists/listinfo/sleuthkit-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/sleuthkit-users</a><br/> > >> <a href="http://www.sleuthkit.org" target="_blank">http://www.sleuthkit.org</a><br/> > ><br/> > > ------------------------------------------------------------------------------<br/> > > _______________________________________________<br/> > > sleuthkit-users mailing list<br/> > > <a href="https://lists.sourceforge.net/lists/listinfo/sleuthkit-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/sleuthkit-users</a><br/> > > <a href="http://www.sleuthkit.org" target="_blank">http://www.sleuthkit.org</a><br/> ><br/> <br/> ------------------------------------------------------------------------------<br/> _______________________________________________<br/> sleuthkit-users mailing list<br/> <a href="https://lists.sourceforge.net/lists/listinfo/sleuthkit-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/sleuthkit-users</a><br/> <a href="http://www.sleuthkit.org" target="_blank">http://www.sleuthkit.org</a></blockquote> </div> </div> </div> </div> </div></div></body></html> |
|
From: Ketil F. <ke...@fr...> - 2015-09-20 18:36:41
|
You have to specify the -h option to calculate md5sums. http://www.sleuthkit.org/sleuthkit/man/tsk_loaddb.html Ketil On 20 Sep 2015 18:38, "Rolf Inator" <rol...@gm...> wrote: > Thanks a lot to both of you! So far I tried tsk_loaddb, since it was > included in the sleuthkit 4.2.0 on sourceforge. However, I will give fiwalk > another try as soon as I tried out tsk_loaddb! > > So, tsk_loaddb is very promising! I tried your suggestion on a Windows 8.1 > machine and it worked out pretty good! The sqlite DB was written do disk- > the only thing I noticed (and what is a little bit weird), is that the > column "md5" in tsk_files is null for every row. > Do you have any idea why this is happening? (I started the cmd as > Administrator for C:, so the rights should be fine ;) ). > > Thanks again! > --Rolf > > > > Gesendet: Freitag, 18. September 2015 um 17:14 Uhr > > Von: "Derrick Karpo" <dk...@gm...> > > An: "Rolf Inator" <rol...@gm...>, "sleuthkit-users users" < > sle...@li...> > > Betreff: Re: [sleuthkit-users] Fiwalk on running system > > > > Hi Rolf. > > > > I'm not sure if Michael's suggestion works with the latest fiwalk or > > not but if it doesn't, have you looked at tsk_loaddb as an alternative > > to fiwalk? fiwalk hasn't been getting as much development lately but > > tsk_loaddb is actively developed and outputs all the results into a > > SQLite database. Something like this would work with tsk_loaddb: > > > > tsk_loaddb -d myimage.db \\.\c: > > > > Alternatively, for physical disks: > > > > wmic diskdrive list > > tsk_loaddb -d myimage.db \\.\PhysicalDrive0 > > > > Derrick > > > > > > On Fri, Sep 18, 2015 at 8:05 AM, Michael Cohen <scu...@gm...> > wrote: > > > Does it work if you give it the volume name? fiwalk \\.\C: > > > > > > On 18 September 2015 at 14:50, Rolf Inator <rol...@gm...> > wrote: > > >> Hi list, > > >> > > >> I wonder if it's possible to run fiwalk on a live system? The > documentation says > > >> user@forensicbox:~$ fiwalk > > >> usage: fiwalk [options] iso-name > > >> > > >> The problem I am facing is, that if I want to run fiwalk over a > bitlocker encrypted dd image, I have to install Dislocker (a new driver) on > my Linux system. It would be more decent if I could just run the fiwalk > Windows executable while the suspects system is still running. > > >> > > >> I hope that was clear :) > > >> > > >> Kind regards, > > >> Rolf > > >> > > >> > ------------------------------------------------------------------------------ > > >> _______________________________________________ > > >> sleuthkit-users mailing list > > >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > > >> http://www.sleuthkit.org > > > > > > > ------------------------------------------------------------------------------ > > > _______________________________________________ > > > sleuthkit-users mailing list > > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > > > http://www.sleuthkit.org > > > > > ------------------------------------------------------------------------------ > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > |
|
From: Rolf I. <rol...@gm...> - 2015-09-20 16:37:06
|
Thanks a lot to both of you! So far I tried tsk_loaddb, since it was included in the sleuthkit 4.2.0 on sourceforge. However, I will give fiwalk another try as soon as I tried out tsk_loaddb! So, tsk_loaddb is very promising! I tried your suggestion on a Windows 8.1 machine and it worked out pretty good! The sqlite DB was written do disk- the only thing I noticed (and what is a little bit weird), is that the column "md5" in tsk_files is null for every row. Do you have any idea why this is happening? (I started the cmd as Administrator for C:, so the rights should be fine ;) ). Thanks again! --Rolf > Gesendet: Freitag, 18. September 2015 um 17:14 Uhr > Von: "Derrick Karpo" <dk...@gm...> > An: "Rolf Inator" <rol...@gm...>, "sleuthkit-users users" <sle...@li...> > Betreff: Re: [sleuthkit-users] Fiwalk on running system > > Hi Rolf. > > I'm not sure if Michael's suggestion works with the latest fiwalk or > not but if it doesn't, have you looked at tsk_loaddb as an alternative > to fiwalk? fiwalk hasn't been getting as much development lately but > tsk_loaddb is actively developed and outputs all the results into a > SQLite database. Something like this would work with tsk_loaddb: > > tsk_loaddb -d myimage.db \\.\c: > > Alternatively, for physical disks: > > wmic diskdrive list > tsk_loaddb -d myimage.db \\.\PhysicalDrive0 > > Derrick > > > On Fri, Sep 18, 2015 at 8:05 AM, Michael Cohen <scu...@gm...> wrote: > > Does it work if you give it the volume name? fiwalk \\.\C: > > > > On 18 September 2015 at 14:50, Rolf Inator <rol...@gm...> wrote: > >> Hi list, > >> > >> I wonder if it's possible to run fiwalk on a live system? The documentation says > >> user@forensicbox:~$ fiwalk > >> usage: fiwalk [options] iso-name > >> > >> The problem I am facing is, that if I want to run fiwalk over a bitlocker encrypted dd image, I have to install Dislocker (a new driver) on my Linux system. It would be more decent if I could just run the fiwalk Windows executable while the suspects system is still running. > >> > >> I hope that was clear :) > >> > >> Kind regards, > >> Rolf > >> > >> ------------------------------------------------------------------------------ > >> _______________________________________________ > >> sleuthkit-users mailing list > >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > >> http://www.sleuthkit.org > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > > sleuthkit-users mailing list > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > > http://www.sleuthkit.org > |
|
From: Michael H. <mi...@ac...> - 2015-09-20 13:38:34
|
Hi, I have an application that sub-classes TskAuto to run through all the files in an image. I've run into an issue where the file meta-data in the TSK_FS_FILE structure passed to TskAuto::processFile represents a different inode than is returned by opening the same file by path/filename using tsk_fs_file_open. The inode address is different and the file content is different. If I look up the inode address passed to TskAuto::process file using ffind, it indicates that it belongs to a different file. Can someone please explain this behavior? Thanks, Mike |
|
From: brads <br...@ny...> - 2015-09-20 01:25:06
|
Thank you very much for clarifying that. I gotta go brush up on my sed and awk skillz o.0 From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 8:54 PM To: brads <br...@ny...> Cc: sle...@li... Subject: Re: [sleuthkit-users] how do I get the file location without a scan? tsk_recover relies on metadata to recover files. photorec is a carver. It recovers files based on patterns in the data. They use completely different approaches. As such, they will recover different content. If you got back the files, and there are only 400 of them, then be grateful and rename them manually. Either that, or restore from your backups. On Sep 19, 2015, at 7:37 PM, brads <br...@ny... <mailto:br...@ny...> > wrote: I think you are correct in your first assessment of how it is created. I was a little off. tsk_recover failed to retrieve unallocated files that photorec was able to retrieve. I don’t understand why one would fail and the other would not. Brad From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 4:03 PM To: brads <br...@ny... <mailto:br...@ny...> > Cc: sle...@li... <mailto:sle...@li...> Subject: Re: [sleuthkit-users] how do I get the file location without a scan? Hi Brad. It sounds like you are trying to recover the data from a drive that has been hit by Cryptowall. Are you sure that it first deletes the file, then make a copy of the file, and encrypt the resulting file. If it does that, then how would it get the data for the deleted file? More likely, the program encrypts the file to a new, temporary name, deletes the file, and then renames the encrypted file to the new file. Or, alternatively, it could simply encrypt in place. (That's what I would do, if I was writing such a program, as it wouldn't require additional file space.) In any event, you can use tsk_recover to recover all of the unallocated files that can be "undeleted". If you are going to go after this with file carving it's unlikely that you'll like the results, as most file carvers can only recover contiguous files. The except is JPEGs, which isn't what you are trying to recover. Is this your system or a clients? Faced with Cryptowall, your best bet is to go to the backups. Simson On Sep 19, 2015, at 2:34 PM, brads <br...@ny... <mailto:br...@ny...> > wrote: Yes, the string in question is the filename. The data in question fell victim to Cryptowall 3.0 >From what I read and can tell, Cryptowall 3.0 first deletes the file and then makes a copy of the file and encrypts that. Extundelete fails to undelete the original file. Photorec recovers the original file but blows out the file name with is not acceptable for the 4000 files in question. All corrupted files are .docx and .pdf formats. My thought is to create a python script that searches the string, then calculates the offset and then use dd to carve out the file and name that file to the proper name. The image is 189GB and is mounted ro from and EXT4 file system Thank you sincerely for any guidance you can provide. Brad From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 1:43 PM To: brads <br...@ny... <mailto:br...@ny...> > Cc: sle...@li... <mailto:sle...@li...> Subject: Re: [sleuthkit-users] how do I get the file location without a scan? Hi Brad. Is the string in the file name, in the file contents, or in unallocated space? How big are your disk images? Are you trying to probe for the existence of the string, do you need to learn its block number, or are you trying to learn the actual file in which the string resides? Do you know anything else about the files? Such as their file type? Do you need to analyze every file, or just files of a particular type? Simson On Sep 19, 2015, at 1:15 PM, brads <br...@ny... <mailto:br...@ny...> > wrote: I followed the instruction from http://wiki.sleuthkit.org/index.php?title=FS_Analysis but following the process, I am unable to find a given string http://i.imgur.com/kYuEatn.png I know the string is there because I can locate it using the string command http://i.imgur.com/alQCRfM.png but, this is not an acceptable solution because the scan takes 3 hrs against the image, I have 400 to do. How do I get blkfs to work correctly or an alternative to getting a string location at the disk layer like string but more robust? Brad ------------------------------------------------------------------------------ _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org <http://www.sleuthkit.org/> |
|
From: Simson G. <si...@ac...> - 2015-09-20 00:54:11
|
tsk_recover relies on metadata to recover files. photorec is a carver. It recovers files based on patterns in the data. They use completely different approaches. As such, they will recover different content. If you got back the files, and there are only 400 of them, then be grateful and rename them manually. Either that, or restore from your backups. > On Sep 19, 2015, at 7:37 PM, brads <br...@ny...> wrote: > > I think you are correct in your first assessment of how it is created. I was a little off. > > tsk_recover failed to retrieve unallocated files that photorec was able to retrieve. > I don’t understand why one would fail and the other would not. > > Brad > <> > From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel > Sent: Saturday, September 19, 2015 4:03 PM > To: brads <br...@ny...> > Cc: sle...@li... > Subject: Re: [sleuthkit-users] how do I get the file location without a scan? > > Hi Brad. > > It sounds like you are trying to recover the data from a drive that has been hit by Cryptowall. > > Are you sure that it first deletes the file, then make a copy of the file, and encrypt the resulting file. If it does that, then how would it get the data for the deleted file? More likely, the program encrypts the file to a new, temporary name, deletes the file, and then renames the encrypted file to the new file. Or, alternatively, it could simply encrypt in place. (That's what I would do, if I was writing such a program, as it wouldn't require additional file space.) > > In any event, you can use tsk_recover to recover all of the unallocated files that can be "undeleted". If you are going to go after this with file carving it's unlikely that you'll like the results, as most file carvers can only recover contiguous files. The except is JPEGs, which isn't what you are trying to recover. > > Is this your system or a clients? Faced with Cryptowall, your best bet is to go to the backups. > > Simson > > >> On Sep 19, 2015, at 2:34 PM, brads <br...@ny... <mailto:br...@ny...>> wrote: >> >> Yes, the string in question is the filename. >> The data in question fell victim to Cryptowall 3.0 >> From what I read and can tell, Cryptowall 3.0 first deletes the file and then makes a copy of the file and encrypts that. >> Extundelete fails to undelete the original file. Photorec recovers the original file but blows out the file name with is not acceptable for the 4000 files in question. >> All corrupted files are .docx and .pdf formats. >> >> My thought is to create a python script that searches the string, then calculates the offset and then use dd to carve out the file and name that file to the proper name. >> The image is 189GB and is mounted ro from and EXT4 file system >> >> Thank you sincerely for any guidance you can provide. >> >> Brad >> >> From: Simson Garfinkel [mailto:si...@gm... <mailto:si...@gm...>] On Behalf Of Simson Garfinkel >> Sent: Saturday, September 19, 2015 1:43 PM >> To: brads <br...@ny... <mailto:br...@ny...>> >> Cc: sle...@li... <mailto:sle...@li...> >> Subject: Re: [sleuthkit-users] how do I get the file location without a scan? >> >> Hi Brad. >> >> Is the string in the file name, in the file contents, or in unallocated space? How big are your disk images? >> >> Are you trying to probe for the existence of the string, do you need to learn its block number, or are you trying to learn the actual file in which the string resides? >> >> Do you know anything else about the files? Such as their file type? Do you need to analyze every file, or just files of a particular type? >> >> Simson >> >> >> >> >>> On Sep 19, 2015, at 1:15 PM, brads <br...@ny... <mailto:br...@ny...>> wrote: >>> >>> I followed the instruction from http://wiki.sleuthkit.org/index.php?title=FS_Analysis <http://wiki.sleuthkit.org/index.php?title=FS_Analysis> but following the process, I am unable to find a given string http://i.imgur.com/kYuEatn.png <http://i.imgur.com/kYuEatn.png> >>> I know the string is there because I can locate it using the string command http://i.imgur.com/alQCRfM.png <http://i.imgur.com/alQCRfM.png> but, this is not an acceptable solution because the scan takes 3 hrs against the image, I have 400 to do. >>> How do I get blkfs to work correctly or an alternative to getting a string location at the disk layer like string but more robust? >>> >>> Brad >>> ------------------------------------------------------------------------------ >>> _______________________________________________ >>> sleuthkit-users mailing list >>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users> >>> http://www.sleuthkit.org <http://www.sleuthkit.org/> >> > > |
|
From: brads <br...@ny...> - 2015-09-19 23:37:51
|
I think you are correct in your first assessment of how it is created. I was a little off. tsk_recover failed to retrieve unallocated files that photorec was able to retrieve. I don't understand why one would fail and the other would not. Brad From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 4:03 PM To: brads <br...@ny...> Cc: sle...@li... Subject: Re: [sleuthkit-users] how do I get the file location without a scan? Hi Brad. It sounds like you are trying to recover the data from a drive that has been hit by Cryptowall. Are you sure that it first deletes the file, then make a copy of the file, and encrypt the resulting file. If it does that, then how would it get the data for the deleted file? More likely, the program encrypts the file to a new, temporary name, deletes the file, and then renames the encrypted file to the new file. Or, alternatively, it could simply encrypt in place. (That's what I would do, if I was writing such a program, as it wouldn't require additional file space.) In any event, you can use tsk_recover to recover all of the unallocated files that can be "undeleted". If you are going to go after this with file carving it's unlikely that you'll like the results, as most file carvers can only recover contiguous files. The except is JPEGs, which isn't what you are trying to recover. Is this your system or a clients? Faced with Cryptowall, your best bet is to go to the backups. Simson On Sep 19, 2015, at 2:34 PM, brads <br...@ny... <mailto:br...@ny...> > wrote: Yes, the string in question is the filename. The data in question fell victim to Cryptowall 3.0 >From what I read and can tell, Cryptowall 3.0 first deletes the file and then makes a copy of the file and encrypts that. Extundelete fails to undelete the original file. Photorec recovers the original file but blows out the file name with is not acceptable for the 4000 files in question. All corrupted files are .docx and .pdf formats. My thought is to create a python script that searches the string, then calculates the offset and then use dd to carve out the file and name that file to the proper name. The image is 189GB and is mounted ro from and EXT4 file system Thank you sincerely for any guidance you can provide. Brad From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 1:43 PM To: brads <br...@ny... <mailto:br...@ny...> > Cc: sle...@li... <mailto:sle...@li...> Subject: Re: [sleuthkit-users] how do I get the file location without a scan? Hi Brad. Is the string in the file name, in the file contents, or in unallocated space? How big are your disk images? Are you trying to probe for the existence of the string, do you need to learn its block number, or are you trying to learn the actual file in which the string resides? Do you know anything else about the files? Such as their file type? Do you need to analyze every file, or just files of a particular type? Simson On Sep 19, 2015, at 1:15 PM, brads <br...@ny... <mailto:br...@ny...> > wrote: I followed the instruction from http://wiki.sleuthkit.org/index.php?title=FS_Analysis but following the process, I am unable to find a given string http://i.imgur.com/kYuEatn.png I know the string is there because I can locate it using the string command http://i.imgur.com/alQCRfM.png but, this is not an acceptable solution because the scan takes 3 hrs against the image, I have 400 to do. How do I get blkfs to work correctly or an alternative to getting a string location at the disk layer like string but more robust? Brad ---------------------------------------------------------------------------- -- _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org <http://www.sleuthkit.org/> |
|
From: brads <br...@ny...> - 2015-09-19 22:39:50
|
As stated before. I can recover the files/data. But Photorec blows out the file names. How does extundelete recover the file name for files it undeletes? It there any reason I cannot manually look for the same data segment with hexdump the extundelete uses? That's what I am really looking for. Brad From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 4:03 PM To: brads <br...@ny...> Cc: sle...@li... Subject: Re: [sleuthkit-users] how do I get the file location without a scan? Hi Brad. It sounds like you are trying to recover the data from a drive that has been hit by Cryptowall. Are you sure that it first deletes the file, then make a copy of the file, and encrypt the resulting file. If it does that, then how would it get the data for the deleted file? More likely, the program encrypts the file to a new, temporary name, deletes the file, and then renames the encrypted file to the new file. Or, alternatively, it could simply encrypt in place. (That's what I would do, if I was writing such a program, as it wouldn't require additional file space.) In any event, you can use tsk_recover to recover all of the unallocated files that can be "undeleted". If you are going to go after this with file carving it's unlikely that you'll like the results, as most file carvers can only recover contiguous files. The except is JPEGs, which isn't what you are trying to recover. Is this your system or a clients? Faced with Cryptowall, your best bet is to go to the backups. Simson On Sep 19, 2015, at 2:34 PM, brads <br...@ny... <mailto:br...@ny...> > wrote: Yes, the string in question is the filename. The data in question fell victim to Cryptowall 3.0 >From what I read and can tell, Cryptowall 3.0 first deletes the file and then makes a copy of the file and encrypts that. Extundelete fails to undelete the original file. Photorec recovers the original file but blows out the file name with is not acceptable for the 4000 files in question. All corrupted files are .docx and .pdf formats. My thought is to create a python script that searches the string, then calculates the offset and then use dd to carve out the file and name that file to the proper name. The image is 189GB and is mounted ro from and EXT4 file system Thank you sincerely for any guidance you can provide. Brad From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 1:43 PM To: brads <br...@ny... <mailto:br...@ny...> > Cc: sle...@li... <mailto:sle...@li...> Subject: Re: [sleuthkit-users] how do I get the file location without a scan? Hi Brad. Is the string in the file name, in the file contents, or in unallocated space? How big are your disk images? Are you trying to probe for the existence of the string, do you need to learn its block number, or are you trying to learn the actual file in which the string resides? Do you know anything else about the files? Such as their file type? Do you need to analyze every file, or just files of a particular type? Simson On Sep 19, 2015, at 1:15 PM, brads <br...@ny... <mailto:br...@ny...> > wrote: I followed the instruction from http://wiki.sleuthkit.org/index.php?title=FS_Analysis but following the process, I am unable to find a given string http://i.imgur.com/kYuEatn.png I know the string is there because I can locate it using the string command http://i.imgur.com/alQCRfM.png but, this is not an acceptable solution because the scan takes 3 hrs against the image, I have 400 to do. How do I get blkfs to work correctly or an alternative to getting a string location at the disk layer like string but more robust? Brad ---------------------------------------------------------------------------- -- _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org <http://www.sleuthkit.org/> |
|
From: Simson G. <si...@ac...> - 2015-09-19 20:03:34
|
Hi Brad. It sounds like you are trying to recover the data from a drive that has been hit by Cryptowall. Are you sure that it first deletes the file, then make a copy of the file, and encrypt the resulting file. If it does that, then how would it get the data for the deleted file? More likely, the program encrypts the file to a new, temporary name, deletes the file, and then renames the encrypted file to the new file. Or, alternatively, it could simply encrypt in place. (That's what I would do, if I was writing such a program, as it wouldn't require additional file space.) In any event, you can use tsk_recover to recover all of the unallocated files that can be "undeleted". If you are going to go after this with file carving it's unlikely that you'll like the results, as most file carvers can only recover contiguous files. The except is JPEGs, which isn't what you are trying to recover. Is this your system or a clients? Faced with Cryptowall, your best bet is to go to the backups. Simson > On Sep 19, 2015, at 2:34 PM, brads <br...@ny...> wrote: > > Yes, the string in question is the filename. > The data in question fell victim to Cryptowall 3.0 > From what I read and can tell, Cryptowall 3.0 first deletes the file and then makes a copy of the file and encrypts that. > Extundelete fails to undelete the original file. Photorec recovers the original file but blows out the file name with is not acceptable for the 4000 files in question. > All corrupted files are .docx and .pdf formats. > > My thought is to create a python script that searches the string, then calculates the offset and then use dd to carve out the file and name that file to the proper name. > The image is 189GB and is mounted ro from and EXT4 file system > > Thank you sincerely for any guidance you can provide. > > Brad > <> > From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel > Sent: Saturday, September 19, 2015 1:43 PM > To: brads <br...@ny...> > Cc: sle...@li... > Subject: Re: [sleuthkit-users] how do I get the file location without a scan? > > Hi Brad. > > Is the string in the file name, in the file contents, or in unallocated space? How big are your disk images? > > Are you trying to probe for the existence of the string, do you need to learn its block number, or are you trying to learn the actual file in which the string resides? > > Do you know anything else about the files? Such as their file type? Do you need to analyze every file, or just files of a particular type? > > Simson > > > > >> On Sep 19, 2015, at 1:15 PM, brads <br...@ny... <mailto:br...@ny...>> wrote: >> >> I followed the instruction from http://wiki.sleuthkit.org/index.php?title=FS_Analysis <http://wiki.sleuthkit.org/index.php?title=FS_Analysis> but following the process, I am unable to find a given string http://i.imgur.com/kYuEatn.png <http://i.imgur.com/kYuEatn.png> >> I know the string is there because I can locate it using the string command http://i.imgur.com/alQCRfM.png <http://i.imgur.com/alQCRfM.png> but, this is not an acceptable solution because the scan takes 3 hrs against the image, I have 400 to do. >> How do I get blkfs to work correctly or an alternative to getting a string location at the disk layer like string but more robust? >> >> Brad >> ------------------------------------------------------------------------------ >> _______________________________________________ >> sleuthkit-users mailing list >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users> >> http://www.sleuthkit.org <http://www.sleuthkit.org/> > |
|
From: Jon S. <JSt...@St...> - 2015-09-19 20:01:14
|
I am not sure I understand--you have 4000 filenames and you want to search for all of these and find where they occur (the disk offset)? And then once you find them... you are going to rename some files you've carved with photorec? What I don't understand is how finding the filenames will help you rename the carved files. Can you elaborate on that? Note that the location of the filename on disk likely is nowhere near the file contents. There are good ways* of searching for multiple strings within disk images, but it would be helpful if you could elaborate a bit more on what you're trying to accomplish so that we don't give you irrelevant/confusing/harmful advice. Cheers, Jon *well, maybe only one Sent from my iPhone On Sep 19, 2015, at 2:35 PM, brads <br...@ny...<mailto:br...@ny...>> wrote: Yes, the string in question is the filename. The data in question fell victim to Cryptowall 3.0 From what I read and can tell, Cryptowall 3.0 first deletes the file and then makes a copy of the file and encrypts that. Extundelete fails to undelete the original file. Photorec recovers the original file but blows out the file name with is not acceptable for the 4000 files in question. All corrupted files are .docx and .pdf formats. My thought is to create a python script that searches the string, then calculates the offset and then use dd to carve out the file and name that file to the proper name. The image is 189GB and is mounted ro from and EXT4 file system Thank you sincerely for any guidance you can provide. Brad From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 1:43 PM To: brads <br...@ny...<mailto:br...@ny...>> Cc: sle...@li...<mailto:sle...@li...> Subject: Re: [sleuthkit-users] how do I get the file location without a scan? Hi Brad. Is the string in the file name, in the file contents, or in unallocated space? How big are your disk images? Are you trying to probe for the existence of the string, do you need to learn its block number, or are you trying to learn the actual file in which the string resides? Do you know anything else about the files? Such as their file type? Do you need to analyze every file, or just files of a particular type? Simson On Sep 19, 2015, at 1:15 PM, brads <br...@ny...<mailto:br...@ny...>> wrote: I followed the instruction from http://wiki.sleuthkit.org/index.php?title=FS_Analysis but following the process, I am unable to find a given string http://i.imgur.com/kYuEatn.png I know the string is there because I can locate it using the string command http://i.imgur.com/alQCRfM.png but, this is not an acceptable solution because the scan takes 3 hrs against the image, I have 400 to do. How do I get blkfs to work correctly or an alternative to getting a string location at the disk layer like string but more robust? Brad ------------------------------------------------------------------------------ _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org ------------------------------------------------------------------------------ _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org |
|
From: brads <br...@ny...> - 2015-09-19 18:34:53
|
Yes, the string in question is the filename. The data in question fell victim to Cryptowall 3.0 >From what I read and can tell, Cryptowall 3.0 first deletes the file and then makes a copy of the file and encrypts that. Extundelete fails to undelete the original file. Photorec recovers the original file but blows out the file name with is not acceptable for the 4000 files in question. All corrupted files are .docx and .pdf formats. My thought is to create a python script that searches the string, then calculates the offset and then use dd to carve out the file and name that file to the proper name. The image is 189GB and is mounted ro from and EXT4 file system Thank you sincerely for any guidance you can provide. Brad From: Simson Garfinkel [mailto:si...@gm...] On Behalf Of Simson Garfinkel Sent: Saturday, September 19, 2015 1:43 PM To: brads <br...@ny...> Cc: sle...@li... Subject: Re: [sleuthkit-users] how do I get the file location without a scan? Hi Brad. Is the string in the file name, in the file contents, or in unallocated space? How big are your disk images? Are you trying to probe for the existence of the string, do you need to learn its block number, or are you trying to learn the actual file in which the string resides? Do you know anything else about the files? Such as their file type? Do you need to analyze every file, or just files of a particular type? Simson On Sep 19, 2015, at 1:15 PM, brads <br...@ny... <mailto:br...@ny...> > wrote: I followed the instruction from http://wiki.sleuthkit.org/index.php?title=FS_Analysis but following the process, I am unable to find a given string http://i.imgur.com/kYuEatn.png I know the string is there because I can locate it using the string command http://i.imgur.com/alQCRfM.png but, this is not an acceptable solution because the scan takes 3 hrs against the image, I have 400 to do. How do I get blkfs to work correctly or an alternative to getting a string location at the disk layer like string but more robust? Brad ---------------------------------------------------------------------------- -- _______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org |
|
From: Simson G. <si...@ac...> - 2015-09-19 17:42:56
|
Hi Brad. Is the string in the file name, in the file contents, or in unallocated space? How big are your disk images? Are you trying to probe for the existence of the string, do you need to learn its block number, or are you trying to learn the actual file in which the string resides? Do you know anything else about the files? Such as their file type? Do you need to analyze every file, or just files of a particular type? Simson > On Sep 19, 2015, at 1:15 PM, brads <br...@ny...> wrote: > > I followed the instruction from http://wiki.sleuthkit.org/index.php?title=FS_Analysis <http://wiki.sleuthkit.org/index.php?title=FS_Analysis> but following the process, I am unable to find a given string http://i.imgur.com/kYuEatn.png <http://i.imgur.com/kYuEatn.png> > I know the string is there because I can locate it using the string command http://i.imgur.com/alQCRfM.png <http://i.imgur.com/alQCRfM.png> but, this is not an acceptable solution because the scan takes 3 hrs against the image, I have 400 to do. > How do I get blkfs to work correctly or an alternative to getting a string location at the disk layer like string but more robust? > > Brad > ------------------------------------------------------------------------------ > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |
38 messages has been excluded from this view by a project administrator.
