sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

[sleuthkit-users] XFS support?

[Jesse B. <jes...@gm...>]

Hi all,

Looking through my email I see that almost exactly 2 years ago the question was posed for support of XFS filesystems by sleuthkit, and the answer at the time was “no”. Looking through the TSK website today, it appears that is still the case. Am I missing something somewhere?

RHEL 7 (and others I’m sure) are starting to automatically use XFS in some cases, so I expect to run into more and more instances and am looking for a tool (preferably TSK!) to support analysis. I’m no programmer (as my CS professors could attest to) but I’m willing to help if I can.

Cheers,

Jesse 

Re: [sleuthkit-users] Fiwalk clam scripts miss boot sector virus

[Alex N. <ajn...@cs...>]

Hello all,

Wrapping up this thread: Christie and I carried out testing off-list.  With a pull request being merged yesterday, Fiwalk now runs plugins on the boot sector.

https://github.com/sleuthkit/sleuthkit/pull/358

--Alex


On Aug 21, 2014, at 16:06 , Alex Nelson <ajn...@cs...> wrote:

> Hi Christie,
> 
> I've developed a patch that compiles, and I think will do what you want, but I haven't tested it yet.  Could you test it and see if running this modified Fiwalk, clamscan on your disk, and clamscan on your disk's dd'd boot sector report what you're looking for?
> 
> https://github.com/ajnelson/sleuthkit/tree/testing/fiwalk_plugins_on_virtuals
> 
> (Feel free to email me off-list for any testing logistics.)
> 
> --Alex
> 
> 
> On Wed, Aug 20, 2014 at 4:59 PM, Christie Peterson <cpe...@jh...> wrote:
> My goal is to use fiwalk to automate a number of functions (including virus scan) over a collection of disk images, building off of the python scripts that can be found at https://github.com/anarchivist/fiwalk-dgi
> 
>  
> 
> As I was testing pyclam, though, I realized it was not catching a known BSV, which led to this thread.
> 
>  
> 
> Thanks,
> 
>  
> 
> Christie
> 
>  
> 
> From: Simson Garfinkel [mailto:si...@ac...] 
> Sent: Wednesday, August 20, 2014 4:44 PM
> To: Alex Nelson
> Cc: Christie Peterson; sle...@li...
> 
> 
> Subject: Re: [sleuthkit-users] Fiwalk clam scripts miss boot sector virus
> 
>  
> 
> Christie,
> 
>  
> 
> It seems like you're going through a huge amount of work to get this to work. WHy don't you just use 'dd' and copy out the MBR into a file, and then run clamav on the resulting file? Is there some reason you need to do this within fiwalk?
> 
>  
> 
> On Aug 20, 2014, at 4:41 PM, Alex Nelson <ajn...@cs...> wrote:
> 
> 
> 
> 
> Ah, ok.  I can make that adjustment, but I have a few things on my queue to get to first.
> 
>  
> 
> --Alex
> 
>  
> 
> On Wed, Aug 20, 2014 at 4:29 PM, Christie Peterson <cpe...@jh...> wrote:
> 
> Actually, I take that back – the adjustment part, not the thanks part.
> 
>  
> 
> I realized after clicking send that you were pointing to an adjustment to be made in Fiwalk, not in the plugin. I’m afraid C++ is beyond both my skills and my ambition at this point.
> 
>  
> 
> Best,
> 
>  
> 
> Christie
> 
>  
> 
> From: Christie Peterson 
> Sent: Wednesday, August 20, 2014 4:13 PM
> To: 'Alex Nelson'
> Cc: sle...@li...
> Subject: RE: [sleuthkit-users] Fiwalk clam scripts miss boot sector virus
> 
>  
> 
> Thanks for catching that, Alex! Going to the script was my next step, once I got a better handle on how Fiwalk was actually running.
> 
>  
> 
> I will definitely submit the adjustment, though it could be a while before I manage to do it.
> 
>  
> 
> Best,
> 
>  
> 
> Christie
> 
>  
> 
>  
> 
> From: Alex Nelson [mailto:ajn...@cs...]
> 
> Sent: Wednesday, August 20, 2014 4:10 PM
> 
> To: Christie Peterson
> Cc: sle...@li...
> Subject: Re: [sleuthkit-users] Fiwalk clam scripts miss boot sector virus
> 
>  
> 
>  
> 
> That file object looks fine (though I could be highly pedantic and argue that $MBR semantically has neither parent nor fs_offset).
> 
>  
> 
> I did find why the plugin didn't run, though.  Note that <name_type> is v, which TSK uses for virtual files.  There is a specific check in place to only run plugins on "Regular" files:
> 
>  
> 
> https://github.com/sleuthkit/sleuthkit/blob/develop/tools/fiwalk/src/fiwalk_tsk.cpp#L345
> 
>  
> 
> The correct revision for scanning the MBR would be to add a third boolean into L347 based on the file's type and name, tweaking the test at L345 to set the boolean based on matching name.
> 
>  
> 
> Would you like to submit that adjustment?
> 
>  
> 
> --Alex
> 
>  
> 
> On Wed, Aug 20, 2014 at 3:40 PM, Christie Peterson <cpe...@jh...> wrote:
> 
> Here is the full <fileobject> for $MBR:
> 
>  
> 
> <fileobject>
> 
> <parent_object>
> 
> <inode>2</inode>
> 
> </parent_object>
> 
> <filename>$MBR</filename>
> 
> <partition>1</partition>
> 
> <id>36</id>
> 
> <name_type>v</name_type>
> 
> <filesize>512</filesize>
> 
> <alloc>1</alloc>
> 
> <used>1</used>
> 
> <inode>11443</inode>
> 
> <meta_type>10</meta_type>
> 
> <mode>0</mode>
> 
> <nlink>1</nlink>
> 
> <uid>0</uid>
> 
> <gid>0</gid>
> 
> <byte_runs>
> 
> <byte_run file_offset="0" fs_offset="0" img_offset="0" len="512"/>
> 
> </byte_runs>
> 
> <hashdigest type="md5">2094c4ac8d687f7c1476a5ce675229e4</hashdigest>
> 
> <hashdigest type="sha1">ad3220057082bae3090202d8b1675406304d5d91</hashdigest>
> 
> </fileobject>
> 
>  
> 
> If the plugin had run, there would be an entry after the <hashdigest> entries.
> 
>  
> 
> Christie
> 
>  
> 
>  
> 
>  
> 
>  
> 
> ------------------------------------------------------------------------------
> Slashdot TV.  
> Video for Nerds.  Stuff that matters.
> http://tv.slashdot.org/_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 
>  
> 
> 

[sleuthkit-users] Forum Moderators Needed

[Brian C. <ca...@sl...>]

As you may have heard, we setup forum.sleuthkit.org a while back.   We have it configured so that when a new account is created, its first posts require approval to reduce SPAM on the board.  We've been doing the moderation ourselves initially to get a feel for it and are now ready to open it up to more folks who want to get involved. If you are interested in becoming a moderator of the board, let me know.

thanks,
brian

Re: [sleuthkit-users] iMAC file extraction

[Ketil F. <ke...@fr...>]

I've reported the same issue on the Autopsy issue tracker:

https://github.com/sleuthkit/autopsy/issues/903

and I have reported and linked an isssue on the sleuthkit issue
tracker that I believe is related:

https://github.com/sleuthkit/sleuthkit/issues/376

I'm not aware of any workaround in Autopsy, so as far as I know it's
not really usable for working with Mac images.

Regards, Ketil

On 9 December 2014 at 09:44, jack tiger <jac...@ne...> wrote:
> Hi all, I am Jack and I am new in the list.
> I have got a little trouble. This happenes when I work on Macintosh computers.
> I have got a E01 files that are the image of the drive. I used FTK imager. Using Autopsy I see folders and files. I can see correctly the preview of Jpg images, for example, But when I extract them the file is empty. This troble happens with every kind of file: doc, docx, xls, xlsx etc
> How I can fix it?
> thanks in advance
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
> http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org



-- 
-Ketil

[sleuthkit-users] iMAC file extraction

[jack t. <jac...@ne...>]

Hi all, I am Jack and I am new in the list.
I have got a little trouble. This happenes when I work on Macintosh computers. 
I have got a E01 files that are the image of the drive. I used FTK imager. Using Autopsy I see folders and files. I can see correctly the preview of Jpg images, for example, But when I extract them the file is empty. This troble happens with every kind of file: doc, docx, xls, xlsx etc
How I can fix it?
thanks in advance

Re: [sleuthkit-users] byte_start in tsk_file_layout created by tsk_load_db

[Alex N. <ajn...@cs...>]

I confirm seeing the same as Simson:  When I was checking the resident byte
run thing from the other day, the byte runs I saw in the SQLite database
started at the partition, not the image.

--Alex

On Wed, Nov 26, 2014 at 5:49 PM, Simson Garfinkel <si...@ac...> wrote:

> The documentation [1] for the SQLite Database v3 Schema states that
> byte_start in tsk_file_layout is from the beginning of the image.
>
> Is this true? In some of my tests, it appears to be from the start of the
> partition, not from the start of the image.
>
> Thanks,
>
> Simson
>
>
>
>
>
>
>
>
>
> [1] http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

[sleuthkit-users] byte_start in tsk_file_layout created by tsk_load_db

[Simson G. <si...@ac...>]

The documentation [1] for the SQLite Database v3 Schema states that byte_start in tsk_file_layout is from the beginning of the image. 

Is this true? In some of my tests, it appears to be from the start of the partition, not from the start of the image.

Thanks,

Simson









[1] http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema <http://wiki.sleuthkit.org/index.php?title=SQLite_Database_v3_Schema>

Re: [sleuthkit-users] Autopsy Users / Version

[Ketil F. <ke...@fr...>]

I like keyboard shortcuts. What about ctrl-t (or something) popping up a
small window, where you can click on the tag you want if it's visible, or
use a keyboard shortcut to select the tag you want. If you have lots of
tags, simply typing could do a (sub)string search to filter matching tags
and display those, and the user can type until there's only one tag left
and just hit enter, or use mouse click or keyboard shortcut when they see
the wanted tag. This could tag all selected files, or the current file
only, or a complete tree structure.

Just my 2 cents. If at all possible, I usually prefer the keyboard-only
option.

Cheers, Ketil
On 19 Nov 2014 17:58, "Karl Mortensen" <kmo...@ba...> wrote:

> Would keyboard shortcuts help? Control-1 assigns Tag1 to the currently
> selected item (or items), Control-2 for Tag2, etc?
>
> Tag names would be configurable.
>
> Karl
>
> On Wed, Nov 19, 2014 at 10:24 AM, Billy Pronovost <bg...@gm...>
> wrote:
>
>> Richard,
>>
>> I think a generic bookmark/tag checkbox is fine to start. When the item
>> is checked, it goes into a tree location for "bookmarks' that you can go
>> look at all your bookmarked items. From here if you wanted to classify a
>> category "Needs further review" or "Fraud Evidence" (etc) you could do
>> that.
>>
>> I find the multiple section to be non-user friendly. This would mean that
>> I would need to mentally keep track of the files I want to tag and then go
>> back and select them all. If I am looking at pictures and there is 1000
>> clip art or pointless pictures and 5 non-similarly named evidence pictures,
>> I would have to wade through the pics to find my 5 important pictures.
>>
>> I am not looking for a new version tomorrow, I am looking to try and help
>> make Autopsy the best it can be and this to me is something that users
>> would enjoy as it would make their lives easier.
>>
>> Billy
>>
>> On Wed, Nov 19, 2014 at 6:57 AM, Richard Cordovano <
>> rco...@ba...> wrote:
>>
>>> Simson, not being a Mac user, I was not aware of the tagging feature of
>>> the OSX UI. Thanks for the idea. I will add it to the notes for this issue
>>> in our issue tracking system. I can also imagine adding menu items for the
>>> existing tags to the first level of the context (right-click) menu. This
>>> could be the new implementation of the "quick tag" feature, while still
>>> allowing for the "tag and comment" feature. Of course, this would get
>>> unwieldy if someone defined a large number of tags.
>>>
>>> As an alternative to popping up tag definition dialogs from the context
>>> menu, I'm wondering if having a separate UI, perhaps an options panel, for
>>> defining tags might fit in well with the NetBean RCP (rich client platform)
>>> framework with which Autopsy is built, while also being less cumbersome.
>>>
>>> Billy, I'm not sure I fully understand your suggestion. Thinking about
>>> your use case, something that we can consider is adding a column to the
>>> table results viewer with a check box just for the predefined "Bookmark"
>>> tag. This could be a way to make for a sort of quick tagging capability.
>>> You could then select the Bookmark tagged items in the tree view and sort
>>> them further with additional tags.
>>>
>>> Tagging can still be fairly quick with the current implementation,
>>> though. Is everyone aware of the ability to do multiple selection in the
>>> table view, a feature I added about a year ago? Billy, you might feel less
>>> pain if you select everything you want to bookmark, then tag them all in
>>> one go.
>>>
>>> I should also mention that the digital forensics team at Basis is pretty
>>> busy with customer paid work right now, so changes to the tagging feature
>>> by Basis staff are not on the horizon yet.
>>>
>>>
>>>
>>>
>>> On Mon, Nov 17, 2014 at 12:34 PM, Billy Pronovost <bg...@gm...>
>>> wrote:
>>>
>>>> Simson,
>>>>
>>>> This is an interesting concept. I am a Mac user, I do understand, but I
>>>> still don't use it. Mostly because I filter my stuff in folders already so
>>>> the Tag seems redundant.
>>>>
>>>> I guess the only difference I would want to point out for Autopsy is
>>>> that I am looking for a quick way to "tag" an item and move on and that is
>>>> why a check box would be beneficial (because I can hit the space bar and
>>>> tag the item and move on with the arrow keys).
>>>>
>>>> This method you described might be good for the next step of going back
>>>> to my tagged items section, and filtering the items by putting them into
>>>> categories. Your method would allow me to select multiple files at one time
>>>> and categorize them from an easy dropdown menu.  Also, having this dropdown
>>>> available in the evidence window would allow someone that didn't just want
>>>> to tag an item (like me) to select a file and tag/categorize it from here.
>>>> If someone does this, then the Checkbox should automatically be checked by
>>>> the system when a category is attached to a file.
>>>>
>>>> Make sense?
>>>>
>>>> Billy
>>>>
>>>> On Mon, Nov 17, 2014 at 8:17 AM, Simson Garfinkel <si...@gm...>
>>>> wrote:
>>>>
>>>>> Richard,
>>>>>
>>>>> For a tag UI, you might look at how tags are implemented in MacOS
>>>>> 10.10. There's a "tag" button that brings up an interface that allows
>>>>> people to specify new tags or choose from an existing one:
>>>>>
>>>>>
>>>>> New tags are created by simply typing their names:
>>>>>
>>>>>
>>>>> Tags can then be listed whenever file names are shown:
>>>>>
>>>>>
>>>>> However, it is worth pointing out that the vast majority of OSX users
>>>>> do not understand about the tag feature and do not use it.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Nov 17, 2014, at 7:14 AM, Richard Cordovano <
>>>>> rco...@ba...> wrote:
>>>>>
>>>>> Tags in general are intended to allow a user to flag files or results
>>>>> of interest. Tags have names (e.g., Bookmark) so that  files or results can
>>>>> be classified into different categories. Bookmark is actually just a
>>>>> predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.
>>>>>
>>>>> In addition to the ability to only include items with particular tags
>>>>> in reports, you can also see what items fall under what tags in the tree
>>>>> view on the left hand side of the main Autopsy window. This allows you to
>>>>> select a group of items with the same tag and view them in the table and
>>>>> thumbnail views to the right of the tree view.
>>>>>
>>>>> The UI for tags is definitely cumbersome. We already have a "story" in
>>>>> our internal issue tracking system at Basis Technology about making tagging
>>>>> more streamlined.
>>>>>
>>>>> The idea of having columns with check boxes in the table view is
>>>>> interesting. I think we would have difficulty scaling this up though. Let's
>>>>> say a user defines ten tags. A column for each tag would crowd out the
>>>>> actual data being displayed. This is not purely hypothetical; I know of at
>>>>> least one use case which requires five tags to do what the user needs to do
>>>>> with tagging.
>>>>>
>>>>> Richard Cordovano
>>>>> Basis Technology
>>>>>
>>>>>
>>>>>
>>>>> On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...>
>>>>> wrote:
>>>>>
>>>>>> Hello TSK users... I had a question and a comment/suggestion.
>>>>>>
>>>>>> What is the intended purpose of Bookmark and Tag (or versus)?
>>>>>>
>>>>>> I get that Bookmarking is putting the item into the Report, but what
>>>>>> about
>>>>>> Tag?
>>>>>>
>>>>>> For me, it seems like it should be just "tagging" and item, but I
>>>>>> know that
>>>>>> Bookmarking is a common term for forensic programs.
>>>>>>
>>>>>> Whatever the term is going to be, I really wish there was just a
>>>>>> column
>>>>>> with a check box for this action. It is ridiculous to have to go
>>>>>> through a
>>>>>> secondary click menu when this is one of the most common functions of
>>>>>> an
>>>>>> investigation (marking an item for a report).
>>>>>>
>>>>>> What are the chances people agree with me and we could see a feature
>>>>>> like
>>>>>> this in the next version?
>>>>>>
>>>>>> Thanks for your time.
>>>>>>
>>>>>> Billy
>>>>>>
>>>>>>
>>>>>> ------------------------------------------------------------------------------
>>>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>>>> from Actuate! Instantly Supercharge Your Business Reports and
>>>>>> Dashboards
>>>>>> with Interactivity, Sharing, Native Excel Exports, App Integration &
>>>>>> more
>>>>>> Get technology previously reserved for billion-dollar corporations,
>>>>>> FREE
>>>>>>
>>>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>>>>> _______________________________________________
>>>>>> sleuthkit-users mailing list
>>>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>>>> http://www.sleuthkit.org
>>>>>>
>>>>>>
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>>> from Actuate! Instantly Supercharge Your Business Reports and
>>>>> Dashboards
>>>>> with Interactivity, Sharing, Native Excel Exports, App Integration &
>>>>> more
>>>>> Get technology previously reserved for billion-dollar corporations,
>>>>> FREE
>>>>>
>>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk_______________________________________________
>>>>> sleuthkit-users mailing list
>>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>>> http://www.sleuthkit.org
>>>>>
>>>>>
>>>>>
>>>>
>>>
>>
>>
>> ------------------------------------------------------------------------------
>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>> Get technology previously reserved for billion-dollar corporations, FREE
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>
>
> --
> Sincerely,
>   Karl Mortensen
>
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Autopsy Users / Version

[Billy P. <bg...@gm...>]

I think the one thing we are learning and agreeing on is that a better way needs to be found. We are all going to have different preferences. This is going to be because we all will have different methods in how we approach working a case. 

For me, nothing is simpler than the column approach because the spacebar activates/toggles the checkbox. What could be simpler for a keyboard shortcut?

The difference comes in what happens next. It sounds like Ketil, Karl and Simson like to categorize in this first step. For me, I like to put all my tagged items in once place then go back and relook and categorize them. I feel I have a better idea of what is happening with the evidence as I look at all this a second time and sort.

Now, I am sure a method could be created that would allow flexibility for the user. Just because a checkbox was available to tag, doesn't mean you couldn't use a keyboard shortcut with predefined values (Karl's idea). Personally, I do find a pop up going the wrong direction for ease of use, but that is just my preference and may not be the common view.

Billy

> On Nov 19, 2014, at 9:47 AM, Ketil Froyn <ke...@fr...> wrote:
> 
> I like keyboard shortcuts. What about ctrl-t (or something) popping up a small window, where you can click on the tag you want if it's visible, or use a keyboard shortcut to select the tag you want. If you have lots of tags, simply typing could do a (sub)string search to filter matching tags and display those, and the user can type until there's only one tag left and just hit enter, or use mouse click or keyboard shortcut when they see the wanted tag. This could tag all selected files, or the current file only, or a complete tree structure.
> 
> Just my 2 cents. If at all possible, I usually prefer the keyboard-only option.
> 
> Cheers, Ketil
> 
>> On 19 Nov 2014 17:58, "Karl Mortensen" <kmo...@ba...> wrote:
>> Would keyboard shortcuts help? Control-1 assigns Tag1 to the currently selected item (or items), Control-2 for Tag2, etc?
>> 
>> Tag names would be configurable.
>> 
>> Karl
>> 
>>> On Wed, Nov 19, 2014 at 10:24 AM, Billy Pronovost <bg...@gm...> wrote:
>>> Richard,
>>> 
>>> I think a generic bookmark/tag checkbox is fine to start. When the item is checked, it goes into a tree location for "bookmarks' that you can go look at all your bookmarked items. From here if you wanted to classify a category "Needs further review" or "Fraud Evidence" (etc) you could do that. 
>>> 
>>> I find the multiple section to be non-user friendly. This would mean that I would need to mentally keep track of the files I want to tag and then go back and select them all. If I am looking at pictures and there is 1000 clip art or pointless pictures and 5 non-similarly named evidence pictures, I would have to wade through the pics to find my 5 important pictures. 
>>> 
>>> I am not looking for a new version tomorrow, I am looking to try and help make Autopsy the best it can be and this to me is something that users would enjoy as it would make their lives easier. 
>>> 
>>> Billy
>>> 
>>>> On Wed, Nov 19, 2014 at 6:57 AM, Richard Cordovano <rco...@ba...> wrote:
>>>> Simson, not being a Mac user, I was not aware of the tagging feature of the OSX UI. Thanks for the idea. I will add it to the notes for this issue in our issue tracking system. I can also imagine adding menu items for the existing tags to the first level of the context (right-click) menu. This could be the new implementation of the "quick tag" feature, while still allowing for the "tag and comment" feature. Of course, this would get unwieldy if someone defined a large number of tags. 
>>>> 
>>>> As an alternative to popping up tag definition dialogs from the context menu, I'm wondering if having a separate UI, perhaps an options panel, for defining tags might fit in well with the NetBean RCP (rich client platform) framework with which Autopsy is built, while also being less cumbersome.
>>>> 
>>>> Billy, I'm not sure I fully understand your suggestion. Thinking about your use case, something that we can consider is adding a column to the table results viewer with a check box just for the predefined "Bookmark" tag. This could be a way to make for a sort of quick tagging capability. You could then select the Bookmark tagged items in the tree view and sort them further with additional tags.
>>>> 
>>>> Tagging can still be fairly quick with the current implementation, though. Is everyone aware of the ability to do multiple selection in the table view, a feature I added about a year ago? Billy, you might feel less pain if you select everything you want to bookmark, then tag them all in one go.
>>>> 
>>>> I should also mention that the digital forensics team at Basis is pretty busy with customer paid work right now, so changes to the tagging feature by Basis staff are not on the horizon yet. 
>>>> 
>>>> 
>>>>  
>>>> 
>>>>> On Mon, Nov 17, 2014 at 12:34 PM, Billy Pronovost <bg...@gm...> wrote:
>>>>> Simson, 
>>>>> 
>>>>> This is an interesting concept. I am a Mac user, I do understand, but I still don't use it. Mostly because I filter my stuff in folders already so the Tag seems redundant. 
>>>>> 
>>>>> I guess the only difference I would want to point out for Autopsy is that I am looking for a quick way to "tag" an item and move on and that is why a check box would be beneficial (because I can hit the space bar and tag the item and move on with the arrow keys). 
>>>>> 
>>>>> This method you described might be good for the next step of going back to my tagged items section, and filtering the items by putting them into categories. Your method would allow me to select multiple files at one time and categorize them from an easy dropdown menu.  Also, having this dropdown available in the evidence window would allow someone that didn't just want to tag an item (like me) to select a file and tag/categorize it from here. If someone does this, then the Checkbox should automatically be checked by the system when a category is attached to a file. 
>>>>> 
>>>>> Make sense? 
>>>>> 
>>>>> Billy
>>>>> 
>>>>>> On Mon, Nov 17, 2014 at 8:17 AM, Simson Garfinkel <si...@gm...> wrote:
>>>>>> Richard,
>>>>>> 
>>>>>> For a tag UI, you might look at how tags are implemented in MacOS 10.10. There's a "tag" button that brings up an interface that allows people to specify new tags or choose from an existing one:
>>>>>> 
>>>>>> <PastedGraphic-1.png>
>>>>>> 
>>>>>> New tags are created by simply typing their names:
>>>>>> 
>>>>>> <PastedGraphic-2.png>
>>>>>> 
>>>>>> Tags can then be listed whenever file names are shown:
>>>>>> 
>>>>>> <PastedGraphic-3.png>
>>>>>> 
>>>>>> However, it is worth pointing out that the vast majority of OSX users do not understand about the tag feature and do not use it.
>>>>>> 
>>>>>> 
>>>>>> 
>>>>>> 
>>>>>>> On Nov 17, 2014, at 7:14 AM, Richard Cordovano <rco...@ba...> wrote:
>>>>>>> 
>>>>>>> Tags in general are intended to allow a user to flag files or results of interest. Tags have names (e.g., Bookmark) so that  files or results can be classified into different categories. Bookmark is actually just a predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.
>>>>>>> 
>>>>>>> In addition to the ability to only include items with particular tags in reports, you can also see what items fall under what tags in the tree view on the left hand side of the main Autopsy window. This allows you to select a group of items with the same tag and view them in the table and thumbnail views to the right of the tree view.
>>>>>>> 
>>>>>>> The UI for tags is definitely cumbersome. We already have a "story" in our internal issue tracking system at Basis Technology about making tagging more streamlined. 
>>>>>>> 
>>>>>>> The idea of having columns with check boxes in the table view is interesting. I think we would have difficulty scaling this up though. Let's say a user defines ten tags. A column for each tag would crowd out the actual data being displayed. This is not purely hypothetical; I know of at least one use case which requires five tags to do what the user needs to do with tagging.
>>>>>>> 
>>>>>>> Richard Cordovano
>>>>>>> Basis Technology
>>>>>>> 
>>>>>>> 
>>>>>>> 
>>>>>>>> On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...> wrote:
>>>>>>>> Hello TSK users... I had a question and a comment/suggestion.
>>>>>>>> 
>>>>>>>> What is the intended purpose of Bookmark and Tag (or versus)?
>>>>>>>> 
>>>>>>>> I get that Bookmarking is putting the item into the Report, but what about
>>>>>>>> Tag?
>>>>>>>> 
>>>>>>>> For me, it seems like it should be just "tagging" and item, but I know that
>>>>>>>> Bookmarking is a common term for forensic programs.
>>>>>>>> 
>>>>>>>> Whatever the term is going to be, I really wish there was just a column
>>>>>>>> with a check box for this action. It is ridiculous to have to go through a
>>>>>>>> secondary click menu when this is one of the most common functions of an
>>>>>>>> investigation (marking an item for a report).
>>>>>>>> 
>>>>>>>> What are the chances people agree with me and we could see a feature like
>>>>>>>> this in the next version?
>>>>>>>> 
>>>>>>>> Thanks for your time.
>>>>>>>> 
>>>>>>>> Billy
>>>>>>>> 
>>>>>>>> ------------------------------------------------------------------------------
>>>>>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>>>>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>>>>>>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>>>>>>>> Get technology previously reserved for billion-dollar corporations, FREE
>>>>>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>>>>>>> _______________________________________________
>>>>>>>> sleuthkit-users mailing list
>>>>>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>>>>>> http://www.sleuthkit.org
>>>>>>> 
>>>>>>> ------------------------------------------------------------------------------
>>>>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>>>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>>>>>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>>>>>>> Get technology previously reserved for billion-dollar corporations, FREE
>>>>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk_______________________________________________
>>>>>>> sleuthkit-users mailing list
>>>>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>>>>> http://www.sleuthkit.org
>>> 
>>> 
>>> ------------------------------------------------------------------------------
>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>>> Get technology previously reserved for billion-dollar corporations, FREE
>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>> 
>> 
>> 
>> -- 
>> Sincerely,
>>   Karl Mortensen
>> 
>> 
>> ------------------------------------------------------------------------------
>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>> Get technology previously reserved for billion-dollar corporations, FREE
>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy Users / Version

[Karl M. <kmo...@ba...>]

Would keyboard shortcuts help? Control-1 assigns Tag1 to the currently
selected item (or items), Control-2 for Tag2, etc?

Tag names would be configurable.

Karl

On Wed, Nov 19, 2014 at 10:24 AM, Billy Pronovost <bg...@gm...> wrote:

> Richard,
>
> I think a generic bookmark/tag checkbox is fine to start. When the item is
> checked, it goes into a tree location for "bookmarks' that you can go look
> at all your bookmarked items. From here if you wanted to classify a
> category "Needs further review" or "Fraud Evidence" (etc) you could do
> that.
>
> I find the multiple section to be non-user friendly. This would mean that
> I would need to mentally keep track of the files I want to tag and then go
> back and select them all. If I am looking at pictures and there is 1000
> clip art or pointless pictures and 5 non-similarly named evidence pictures,
> I would have to wade through the pics to find my 5 important pictures.
>
> I am not looking for a new version tomorrow, I am looking to try and help
> make Autopsy the best it can be and this to me is something that users
> would enjoy as it would make their lives easier.
>
> Billy
>
> On Wed, Nov 19, 2014 at 6:57 AM, Richard Cordovano <
> rco...@ba...> wrote:
>
>> Simson, not being a Mac user, I was not aware of the tagging feature of
>> the OSX UI. Thanks for the idea. I will add it to the notes for this issue
>> in our issue tracking system. I can also imagine adding menu items for the
>> existing tags to the first level of the context (right-click) menu. This
>> could be the new implementation of the "quick tag" feature, while still
>> allowing for the "tag and comment" feature. Of course, this would get
>> unwieldy if someone defined a large number of tags.
>>
>> As an alternative to popping up tag definition dialogs from the context
>> menu, I'm wondering if having a separate UI, perhaps an options panel, for
>> defining tags might fit in well with the NetBean RCP (rich client platform)
>> framework with which Autopsy is built, while also being less cumbersome.
>>
>> Billy, I'm not sure I fully understand your suggestion. Thinking about
>> your use case, something that we can consider is adding a column to the
>> table results viewer with a check box just for the predefined "Bookmark"
>> tag. This could be a way to make for a sort of quick tagging capability.
>> You could then select the Bookmark tagged items in the tree view and sort
>> them further with additional tags.
>>
>> Tagging can still be fairly quick with the current implementation,
>> though. Is everyone aware of the ability to do multiple selection in the
>> table view, a feature I added about a year ago? Billy, you might feel less
>> pain if you select everything you want to bookmark, then tag them all in
>> one go.
>>
>> I should also mention that the digital forensics team at Basis is pretty
>> busy with customer paid work right now, so changes to the tagging feature
>> by Basis staff are not on the horizon yet.
>>
>>
>>
>>
>> On Mon, Nov 17, 2014 at 12:34 PM, Billy Pronovost <bg...@gm...>
>> wrote:
>>
>>> Simson,
>>>
>>> This is an interesting concept. I am a Mac user, I do understand, but I
>>> still don't use it. Mostly because I filter my stuff in folders already so
>>> the Tag seems redundant.
>>>
>>> I guess the only difference I would want to point out for Autopsy is
>>> that I am looking for a quick way to "tag" an item and move on and that is
>>> why a check box would be beneficial (because I can hit the space bar and
>>> tag the item and move on with the arrow keys).
>>>
>>> This method you described might be good for the next step of going back
>>> to my tagged items section, and filtering the items by putting them into
>>> categories. Your method would allow me to select multiple files at one time
>>> and categorize them from an easy dropdown menu.  Also, having this dropdown
>>> available in the evidence window would allow someone that didn't just want
>>> to tag an item (like me) to select a file and tag/categorize it from here.
>>> If someone does this, then the Checkbox should automatically be checked by
>>> the system when a category is attached to a file.
>>>
>>> Make sense?
>>>
>>> Billy
>>>
>>> On Mon, Nov 17, 2014 at 8:17 AM, Simson Garfinkel <si...@gm...>
>>> wrote:
>>>
>>>> Richard,
>>>>
>>>> For a tag UI, you might look at how tags are implemented in MacOS
>>>> 10.10. There's a "tag" button that brings up an interface that allows
>>>> people to specify new tags or choose from an existing one:
>>>>
>>>>
>>>> New tags are created by simply typing their names:
>>>>
>>>>
>>>> Tags can then be listed whenever file names are shown:
>>>>
>>>>
>>>> However, it is worth pointing out that the vast majority of OSX users
>>>> do not understand about the tag feature and do not use it.
>>>>
>>>>
>>>>
>>>>
>>>> On Nov 17, 2014, at 7:14 AM, Richard Cordovano <
>>>> rco...@ba...> wrote:
>>>>
>>>> Tags in general are intended to allow a user to flag files or results
>>>> of interest. Tags have names (e.g., Bookmark) so that  files or results can
>>>> be classified into different categories. Bookmark is actually just a
>>>> predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.
>>>>
>>>> In addition to the ability to only include items with particular tags
>>>> in reports, you can also see what items fall under what tags in the tree
>>>> view on the left hand side of the main Autopsy window. This allows you to
>>>> select a group of items with the same tag and view them in the table and
>>>> thumbnail views to the right of the tree view.
>>>>
>>>> The UI for tags is definitely cumbersome. We already have a "story" in
>>>> our internal issue tracking system at Basis Technology about making tagging
>>>> more streamlined.
>>>>
>>>> The idea of having columns with check boxes in the table view is
>>>> interesting. I think we would have difficulty scaling this up though. Let's
>>>> say a user defines ten tags. A column for each tag would crowd out the
>>>> actual data being displayed. This is not purely hypothetical; I know of at
>>>> least one use case which requires five tags to do what the user needs to do
>>>> with tagging.
>>>>
>>>> Richard Cordovano
>>>> Basis Technology
>>>>
>>>>
>>>>
>>>> On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...>
>>>> wrote:
>>>>
>>>>> Hello TSK users... I had a question and a comment/suggestion.
>>>>>
>>>>> What is the intended purpose of Bookmark and Tag (or versus)?
>>>>>
>>>>> I get that Bookmarking is putting the item into the Report, but what
>>>>> about
>>>>> Tag?
>>>>>
>>>>> For me, it seems like it should be just "tagging" and item, but I know
>>>>> that
>>>>> Bookmarking is a common term for forensic programs.
>>>>>
>>>>> Whatever the term is going to be, I really wish there was just a column
>>>>> with a check box for this action. It is ridiculous to have to go
>>>>> through a
>>>>> secondary click menu when this is one of the most common functions of
>>>>> an
>>>>> investigation (marking an item for a report).
>>>>>
>>>>> What are the chances people agree with me and we could see a feature
>>>>> like
>>>>> this in the next version?
>>>>>
>>>>> Thanks for your time.
>>>>>
>>>>> Billy
>>>>>
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>>> from Actuate! Instantly Supercharge Your Business Reports and
>>>>> Dashboards
>>>>> with Interactivity, Sharing, Native Excel Exports, App Integration &
>>>>> more
>>>>> Get technology previously reserved for billion-dollar corporations,
>>>>> FREE
>>>>>
>>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>>>> _______________________________________________
>>>>> sleuthkit-users mailing list
>>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>>> http://www.sleuthkit.org
>>>>>
>>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>>> with Interactivity, Sharing, Native Excel Exports, App Integration &
>>>> more
>>>> Get technology previously reserved for billion-dollar corporations, FREE
>>>>
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk_______________________________________________
>>>> sleuthkit-users mailing list
>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>> http://www.sleuthkit.org
>>>>
>>>>
>>>>
>>>
>>
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>


-- 
Sincerely,
  Karl Mortensen

Re: [sleuthkit-users] Autopsy Users / Version

[Richard C. <rco...@ba...>]

Billy, thanks for the input! I also want Autopsy to be the best it can be.
It just might take awhile to get there. ;-)

On Wed, Nov 19, 2014 at 10:24 AM, Billy Pronovost <bg...@gm...> wrote:

> Richard,
>
> I think a generic bookmark/tag checkbox is fine to start. When the item is
> checked, it goes into a tree location for "bookmarks' that you can go look
> at all your bookmarked items. From here if you wanted to classify a
> category "Needs further review" or "Fraud Evidence" (etc) you could do
> that.
>
> I find the multiple section to be non-user friendly. This would mean that
> I would need to mentally keep track of the files I want to tag and then go
> back and select them all. If I am looking at pictures and there is 1000
> clip art or pointless pictures and 5 non-similarly named evidence pictures,
> I would have to wade through the pics to find my 5 important pictures.
>
> I am not looking for a new version tomorrow, I am looking to try and help
> make Autopsy the best it can be and this to me is something that users
> would enjoy as it would make their lives easier.
>
> Billy
>
> On Wed, Nov 19, 2014 at 6:57 AM, Richard Cordovano <
> rco...@ba...> wrote:
>
>> Simson, not being a Mac user, I was not aware of the tagging feature of
>> the OSX UI. Thanks for the idea. I will add it to the notes for this issue
>> in our issue tracking system. I can also imagine adding menu items for the
>> existing tags to the first level of the context (right-click) menu. This
>> could be the new implementation of the "quick tag" feature, while still
>> allowing for the "tag and comment" feature. Of course, this would get
>> unwieldy if someone defined a large number of tags.
>>
>> As an alternative to popping up tag definition dialogs from the context
>> menu, I'm wondering if having a separate UI, perhaps an options panel, for
>> defining tags might fit in well with the NetBean RCP (rich client platform)
>> framework with which Autopsy is built, while also being less cumbersome.
>>
>> Billy, I'm not sure I fully understand your suggestion. Thinking about
>> your use case, something that we can consider is adding a column to the
>> table results viewer with a check box just for the predefined "Bookmark"
>> tag. This could be a way to make for a sort of quick tagging capability.
>> You could then select the Bookmark tagged items in the tree view and sort
>> them further with additional tags.
>>
>> Tagging can still be fairly quick with the current implementation,
>> though. Is everyone aware of the ability to do multiple selection in the
>> table view, a feature I added about a year ago? Billy, you might feel less
>> pain if you select everything you want to bookmark, then tag them all in
>> one go.
>>
>> I should also mention that the digital forensics team at Basis is pretty
>> busy with customer paid work right now, so changes to the tagging feature
>> by Basis staff are not on the horizon yet.
>>
>>
>>
>>
>> On Mon, Nov 17, 2014 at 12:34 PM, Billy Pronovost <bg...@gm...>
>> wrote:
>>
>>> Simson,
>>>
>>> This is an interesting concept. I am a Mac user, I do understand, but I
>>> still don't use it. Mostly because I filter my stuff in folders already so
>>> the Tag seems redundant.
>>>
>>> I guess the only difference I would want to point out for Autopsy is
>>> that I am looking for a quick way to "tag" an item and move on and that is
>>> why a check box would be beneficial (because I can hit the space bar and
>>> tag the item and move on with the arrow keys).
>>>
>>> This method you described might be good for the next step of going back
>>> to my tagged items section, and filtering the items by putting them into
>>> categories. Your method would allow me to select multiple files at one time
>>> and categorize them from an easy dropdown menu.  Also, having this dropdown
>>> available in the evidence window would allow someone that didn't just want
>>> to tag an item (like me) to select a file and tag/categorize it from here.
>>> If someone does this, then the Checkbox should automatically be checked by
>>> the system when a category is attached to a file.
>>>
>>> Make sense?
>>>
>>> Billy
>>>
>>> On Mon, Nov 17, 2014 at 8:17 AM, Simson Garfinkel <si...@gm...>
>>> wrote:
>>>
>>>> Richard,
>>>>
>>>> For a tag UI, you might look at how tags are implemented in MacOS
>>>> 10.10. There's a "tag" button that brings up an interface that allows
>>>> people to specify new tags or choose from an existing one:
>>>>
>>>>
>>>> New tags are created by simply typing their names:
>>>>
>>>>
>>>> Tags can then be listed whenever file names are shown:
>>>>
>>>>
>>>> However, it is worth pointing out that the vast majority of OSX users
>>>> do not understand about the tag feature and do not use it.
>>>>
>>>>
>>>>
>>>>
>>>> On Nov 17, 2014, at 7:14 AM, Richard Cordovano <
>>>> rco...@ba...> wrote:
>>>>
>>>> Tags in general are intended to allow a user to flag files or results
>>>> of interest. Tags have names (e.g., Bookmark) so that  files or results can
>>>> be classified into different categories. Bookmark is actually just a
>>>> predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.
>>>>
>>>> In addition to the ability to only include items with particular tags
>>>> in reports, you can also see what items fall under what tags in the tree
>>>> view on the left hand side of the main Autopsy window. This allows you to
>>>> select a group of items with the same tag and view them in the table and
>>>> thumbnail views to the right of the tree view.
>>>>
>>>> The UI for tags is definitely cumbersome. We already have a "story" in
>>>> our internal issue tracking system at Basis Technology about making tagging
>>>> more streamlined.
>>>>
>>>> The idea of having columns with check boxes in the table view is
>>>> interesting. I think we would have difficulty scaling this up though. Let's
>>>> say a user defines ten tags. A column for each tag would crowd out the
>>>> actual data being displayed. This is not purely hypothetical; I know of at
>>>> least one use case which requires five tags to do what the user needs to do
>>>> with tagging.
>>>>
>>>> Richard Cordovano
>>>> Basis Technology
>>>>
>>>>
>>>>
>>>> On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...>
>>>> wrote:
>>>>
>>>>> Hello TSK users... I had a question and a comment/suggestion.
>>>>>
>>>>> What is the intended purpose of Bookmark and Tag (or versus)?
>>>>>
>>>>> I get that Bookmarking is putting the item into the Report, but what
>>>>> about
>>>>> Tag?
>>>>>
>>>>> For me, it seems like it should be just "tagging" and item, but I know
>>>>> that
>>>>> Bookmarking is a common term for forensic programs.
>>>>>
>>>>> Whatever the term is going to be, I really wish there was just a column
>>>>> with a check box for this action. It is ridiculous to have to go
>>>>> through a
>>>>> secondary click menu when this is one of the most common functions of
>>>>> an
>>>>> investigation (marking an item for a report).
>>>>>
>>>>> What are the chances people agree with me and we could see a feature
>>>>> like
>>>>> this in the next version?
>>>>>
>>>>> Thanks for your time.
>>>>>
>>>>> Billy
>>>>>
>>>>>
>>>>> ------------------------------------------------------------------------------
>>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>>> from Actuate! Instantly Supercharge Your Business Reports and
>>>>> Dashboards
>>>>> with Interactivity, Sharing, Native Excel Exports, App Integration &
>>>>> more
>>>>> Get technology previously reserved for billion-dollar corporations,
>>>>> FREE
>>>>>
>>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>>>> _______________________________________________
>>>>> sleuthkit-users mailing list
>>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>>> http://www.sleuthkit.org
>>>>>
>>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>>> with Interactivity, Sharing, Native Excel Exports, App Integration &
>>>> more
>>>> Get technology previously reserved for billion-dollar corporations, FREE
>>>>
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk_______________________________________________
>>>> sleuthkit-users mailing list
>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>> http://www.sleuthkit.org
>>>>
>>>>
>>>>
>>>
>>
>

Re: [sleuthkit-users] Autopsy Users / Version

[Billy P. <bg...@gm...>]

Richard,

I think a generic bookmark/tag checkbox is fine to start. When the item is
checked, it goes into a tree location for "bookmarks' that you can go look
at all your bookmarked items. From here if you wanted to classify a
category "Needs further review" or "Fraud Evidence" (etc) you could do
that.

I find the multiple section to be non-user friendly. This would mean that I
would need to mentally keep track of the files I want to tag and then go
back and select them all. If I am looking at pictures and there is 1000
clip art or pointless pictures and 5 non-similarly named evidence pictures,
I would have to wade through the pics to find my 5 important pictures.

I am not looking for a new version tomorrow, I am looking to try and help
make Autopsy the best it can be and this to me is something that users
would enjoy as it would make their lives easier.

Billy

On Wed, Nov 19, 2014 at 6:57 AM, Richard Cordovano <rco...@ba...
> wrote:

> Simson, not being a Mac user, I was not aware of the tagging feature of
> the OSX UI. Thanks for the idea. I will add it to the notes for this issue
> in our issue tracking system. I can also imagine adding menu items for the
> existing tags to the first level of the context (right-click) menu. This
> could be the new implementation of the "quick tag" feature, while still
> allowing for the "tag and comment" feature. Of course, this would get
> unwieldy if someone defined a large number of tags.
>
> As an alternative to popping up tag definition dialogs from the context
> menu, I'm wondering if having a separate UI, perhaps an options panel, for
> defining tags might fit in well with the NetBean RCP (rich client platform)
> framework with which Autopsy is built, while also being less cumbersome.
>
> Billy, I'm not sure I fully understand your suggestion. Thinking about
> your use case, something that we can consider is adding a column to the
> table results viewer with a check box just for the predefined "Bookmark"
> tag. This could be a way to make for a sort of quick tagging capability.
> You could then select the Bookmark tagged items in the tree view and sort
> them further with additional tags.
>
> Tagging can still be fairly quick with the current implementation, though.
> Is everyone aware of the ability to do multiple selection in the table
> view, a feature I added about a year ago? Billy, you might feel less pain
> if you select everything you want to bookmark, then tag them all in one go.
>
> I should also mention that the digital forensics team at Basis is pretty
> busy with customer paid work right now, so changes to the tagging feature
> by Basis staff are not on the horizon yet.
>
>
>
>
> On Mon, Nov 17, 2014 at 12:34 PM, Billy Pronovost <bg...@gm...>
> wrote:
>
>> Simson,
>>
>> This is an interesting concept. I am a Mac user, I do understand, but I
>> still don't use it. Mostly because I filter my stuff in folders already so
>> the Tag seems redundant.
>>
>> I guess the only difference I would want to point out for Autopsy is that
>> I am looking for a quick way to "tag" an item and move on and that is why a
>> check box would be beneficial (because I can hit the space bar and tag the
>> item and move on with the arrow keys).
>>
>> This method you described might be good for the next step of going back
>> to my tagged items section, and filtering the items by putting them into
>> categories. Your method would allow me to select multiple files at one time
>> and categorize them from an easy dropdown menu.  Also, having this dropdown
>> available in the evidence window would allow someone that didn't just want
>> to tag an item (like me) to select a file and tag/categorize it from here.
>> If someone does this, then the Checkbox should automatically be checked by
>> the system when a category is attached to a file.
>>
>> Make sense?
>>
>> Billy
>>
>> On Mon, Nov 17, 2014 at 8:17 AM, Simson Garfinkel <si...@gm...>
>> wrote:
>>
>>> Richard,
>>>
>>> For a tag UI, you might look at how tags are implemented in MacOS 10.10.
>>> There's a "tag" button that brings up an interface that allows people to
>>> specify new tags or choose from an existing one:
>>>
>>>
>>> New tags are created by simply typing their names:
>>>
>>>
>>> Tags can then be listed whenever file names are shown:
>>>
>>>
>>> However, it is worth pointing out that the vast majority of OSX users do
>>> not understand about the tag feature and do not use it.
>>>
>>>
>>>
>>>
>>> On Nov 17, 2014, at 7:14 AM, Richard Cordovano <rco...@ba...>
>>> wrote:
>>>
>>> Tags in general are intended to allow a user to flag files or results of
>>> interest. Tags have names (e.g., Bookmark) so that  files or results can be
>>> classified into different categories. Bookmark is actually just a
>>> predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.
>>>
>>> In addition to the ability to only include items with particular tags in
>>> reports, you can also see what items fall under what tags in the tree view
>>> on the left hand side of the main Autopsy window. This allows you to select
>>> a group of items with the same tag and view them in the table and thumbnail
>>> views to the right of the tree view.
>>>
>>> The UI for tags is definitely cumbersome. We already have a "story" in
>>> our internal issue tracking system at Basis Technology about making tagging
>>> more streamlined.
>>>
>>> The idea of having columns with check boxes in the table view is
>>> interesting. I think we would have difficulty scaling this up though. Let's
>>> say a user defines ten tags. A column for each tag would crowd out the
>>> actual data being displayed. This is not purely hypothetical; I know of at
>>> least one use case which requires five tags to do what the user needs to do
>>> with tagging.
>>>
>>> Richard Cordovano
>>> Basis Technology
>>>
>>>
>>>
>>> On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...>
>>> wrote:
>>>
>>>> Hello TSK users... I had a question and a comment/suggestion.
>>>>
>>>> What is the intended purpose of Bookmark and Tag (or versus)?
>>>>
>>>> I get that Bookmarking is putting the item into the Report, but what
>>>> about
>>>> Tag?
>>>>
>>>> For me, it seems like it should be just "tagging" and item, but I know
>>>> that
>>>> Bookmarking is a common term for forensic programs.
>>>>
>>>> Whatever the term is going to be, I really wish there was just a column
>>>> with a check box for this action. It is ridiculous to have to go
>>>> through a
>>>> secondary click menu when this is one of the most common functions of an
>>>> investigation (marking an item for a report).
>>>>
>>>> What are the chances people agree with me and we could see a feature
>>>> like
>>>> this in the next version?
>>>>
>>>> Thanks for your time.
>>>>
>>>> Billy
>>>>
>>>>
>>>> ------------------------------------------------------------------------------
>>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>>> with Interactivity, Sharing, Native Excel Exports, App Integration &
>>>> more
>>>> Get technology previously reserved for billion-dollar corporations, FREE
>>>>
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>>> _______________________________________________
>>>> sleuthkit-users mailing list
>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>> http://www.sleuthkit.org
>>>>
>>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>>> Get technology previously reserved for billion-dollar corporations, FREE
>>>
>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk_______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>>>
>>>
>>>
>>
>

Re: [sleuthkit-users] Autopsy Users / Version

[Richard C. <rco...@ba...>]

Simson, not being a Mac user, I was not aware of the tagging feature of the
OSX UI. Thanks for the idea. I will add it to the notes for this issue in
our issue tracking system. I can also imagine adding menu items for the
existing tags to the first level of the context (right-click) menu. This
could be the new implementation of the "quick tag" feature, while still
allowing for the "tag and comment" feature. Of course, this would get
unwieldy if someone defined a large number of tags.

As an alternative to popping up tag definition dialogs from the context
menu, I'm wondering if having a separate UI, perhaps an options panel, for
defining tags might fit in well with the NetBean RCP (rich client platform)
framework with which Autopsy is built, while also being less cumbersome.

Billy, I'm not sure I fully understand your suggestion. Thinking about your
use case, something that we can consider is adding a column to the table
results viewer with a check box just for the predefined "Bookmark" tag.
This could be a way to make for a sort of quick tagging capability. You
could then select the Bookmark tagged items in the tree view and sort them
further with additional tags.

Tagging can still be fairly quick with the current implementation, though.
Is everyone aware of the ability to do multiple selection in the table
view, a feature I added about a year ago? Billy, you might feel less pain
if you select everything you want to bookmark, then tag them all in one go.

I should also mention that the digital forensics team at Basis is pretty
busy with customer paid work right now, so changes to the tagging feature
by Basis staff are not on the horizon yet.




On Mon, Nov 17, 2014 at 12:34 PM, Billy Pronovost <bg...@gm...> wrote:

> Simson,
>
> This is an interesting concept. I am a Mac user, I do understand, but I
> still don't use it. Mostly because I filter my stuff in folders already so
> the Tag seems redundant.
>
> I guess the only difference I would want to point out for Autopsy is that
> I am looking for a quick way to "tag" an item and move on and that is why a
> check box would be beneficial (because I can hit the space bar and tag the
> item and move on with the arrow keys).
>
> This method you described might be good for the next step of going back to
> my tagged items section, and filtering the items by putting them into
> categories. Your method would allow me to select multiple files at one time
> and categorize them from an easy dropdown menu.  Also, having this dropdown
> available in the evidence window would allow someone that didn't just want
> to tag an item (like me) to select a file and tag/categorize it from here.
> If someone does this, then the Checkbox should automatically be checked by
> the system when a category is attached to a file.
>
> Make sense?
>
> Billy
>
> On Mon, Nov 17, 2014 at 8:17 AM, Simson Garfinkel <si...@gm...>
> wrote:
>
>> Richard,
>>
>> For a tag UI, you might look at how tags are implemented in MacOS 10.10.
>> There's a "tag" button that brings up an interface that allows people to
>> specify new tags or choose from an existing one:
>>
>>
>> New tags are created by simply typing their names:
>>
>>
>> Tags can then be listed whenever file names are shown:
>>
>>
>> However, it is worth pointing out that the vast majority of OSX users do
>> not understand about the tag feature and do not use it.
>>
>>
>>
>>
>> On Nov 17, 2014, at 7:14 AM, Richard Cordovano <rco...@ba...>
>> wrote:
>>
>> Tags in general are intended to allow a user to flag files or results of
>> interest. Tags have names (e.g., Bookmark) so that  files or results can be
>> classified into different categories. Bookmark is actually just a
>> predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.
>>
>> In addition to the ability to only include items with particular tags in
>> reports, you can also see what items fall under what tags in the tree view
>> on the left hand side of the main Autopsy window. This allows you to select
>> a group of items with the same tag and view them in the table and thumbnail
>> views to the right of the tree view.
>>
>> The UI for tags is definitely cumbersome. We already have a "story" in
>> our internal issue tracking system at Basis Technology about making tagging
>> more streamlined.
>>
>> The idea of having columns with check boxes in the table view is
>> interesting. I think we would have difficulty scaling this up though. Let's
>> say a user defines ten tags. A column for each tag would crowd out the
>> actual data being displayed. This is not purely hypothetical; I know of at
>> least one use case which requires five tags to do what the user needs to do
>> with tagging.
>>
>> Richard Cordovano
>> Basis Technology
>>
>>
>>
>> On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...>
>> wrote:
>>
>>> Hello TSK users... I had a question and a comment/suggestion.
>>>
>>> What is the intended purpose of Bookmark and Tag (or versus)?
>>>
>>> I get that Bookmarking is putting the item into the Report, but what
>>> about
>>> Tag?
>>>
>>> For me, it seems like it should be just "tagging" and item, but I know
>>> that
>>> Bookmarking is a common term for forensic programs.
>>>
>>> Whatever the term is going to be, I really wish there was just a column
>>> with a check box for this action. It is ridiculous to have to go through
>>> a
>>> secondary click menu when this is one of the most common functions of an
>>> investigation (marking an item for a report).
>>>
>>> What are the chances people agree with me and we could see a feature like
>>> this in the next version?
>>>
>>> Thanks for your time.
>>>
>>> Billy
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>>> Get technology previously reserved for billion-dollar corporations, FREE
>>>
>>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>>>
>>>
>>
>> ------------------------------------------------------------------------------
>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>> Get technology previously reserved for billion-dollar corporations, FREE
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk_______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>>
>

Re: [sleuthkit-users] Autopsy Users / Version

[Billy P. <bg...@gm...>]

Simson,

This is an interesting concept. I am a Mac user, I do understand, but I
still don't use it. Mostly because I filter my stuff in folders already so
the Tag seems redundant.

I guess the only difference I would want to point out for Autopsy is that I
am looking for a quick way to "tag" an item and move on and that is why a
check box would be beneficial (because I can hit the space bar and tag the
item and move on with the arrow keys).

This method you described might be good for the next step of going back to
my tagged items section, and filtering the items by putting them into
categories. Your method would allow me to select multiple files at one time
and categorize them from an easy dropdown menu.  Also, having this dropdown
available in the evidence window would allow someone that didn't just want
to tag an item (like me) to select a file and tag/categorize it from here.
If someone does this, then the Checkbox should automatically be checked by
the system when a category is attached to a file.

Make sense?

Billy

On Mon, Nov 17, 2014 at 8:17 AM, Simson Garfinkel <si...@gm...> wrote:

> Richard,
>
> For a tag UI, you might look at how tags are implemented in MacOS 10.10.
> There's a "tag" button that brings up an interface that allows people to
> specify new tags or choose from an existing one:
>
>
> New tags are created by simply typing their names:
>
>
> Tags can then be listed whenever file names are shown:
>
>
> However, it is worth pointing out that the vast majority of OSX users do
> not understand about the tag feature and do not use it.
>
>
>
>
> On Nov 17, 2014, at 7:14 AM, Richard Cordovano <rco...@ba...>
> wrote:
>
> Tags in general are intended to allow a user to flag files or results of
> interest. Tags have names (e.g., Bookmark) so that  files or results can be
> classified into different categories. Bookmark is actually just a
> predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.
>
> In addition to the ability to only include items with particular tags in
> reports, you can also see what items fall under what tags in the tree view
> on the left hand side of the main Autopsy window. This allows you to select
> a group of items with the same tag and view them in the table and thumbnail
> views to the right of the tree view.
>
> The UI for tags is definitely cumbersome. We already have a "story" in our
> internal issue tracking system at Basis Technology about making tagging
> more streamlined.
>
> The idea of having columns with check boxes in the table view is
> interesting. I think we would have difficulty scaling this up though. Let's
> say a user defines ten tags. A column for each tag would crowd out the
> actual data being displayed. This is not purely hypothetical; I know of at
> least one use case which requires five tags to do what the user needs to do
> with tagging.
>
> Richard Cordovano
> Basis Technology
>
>
>
> On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...>
> wrote:
>
>> Hello TSK users... I had a question and a comment/suggestion.
>>
>> What is the intended purpose of Bookmark and Tag (or versus)?
>>
>> I get that Bookmarking is putting the item into the Report, but what about
>> Tag?
>>
>> For me, it seems like it should be just "tagging" and item, but I know
>> that
>> Bookmarking is a common term for forensic programs.
>>
>> Whatever the term is going to be, I really wish there was just a column
>> with a check box for this action. It is ridiculous to have to go through a
>> secondary click menu when this is one of the most common functions of an
>> investigation (marking an item for a report).
>>
>> What are the chances people agree with me and we could see a feature like
>> this in the next version?
>>
>> Thanks for your time.
>>
>> Billy
>>
>>
>> ------------------------------------------------------------------------------
>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>> Get technology previously reserved for billion-dollar corporations, FREE
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
>

Re: [sleuthkit-users] Autopsy Users / Version

[Richard C. <rco...@ba...>]

Tags in general are intended to allow a user to flag files or results of
interest. Tags have names (e.g., Bookmark) so that  files or results can be
classified into different categories. Bookmark is actually just a
predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.

In addition to the ability to only include items with particular tags in
reports, you can also see what items fall under what tags in the tree view
on the left hand side of the main Autopsy window. This allows you to select
a group of items with the same tag and view them in the table and thumbnail
views to the right of the tree view.

The UI for tags is definitely cumbersome. We already have a "story" in our
internal issue tracking system at Basis Technology about making tagging
more streamlined.

The idea of having columns with check boxes in the table view is
interesting. I think we would have difficulty scaling this up though. Let's
say a user defines ten tags. A column for each tag would crowd out the
actual data being displayed. This is not purely hypothetical; I know of at
least one use case which requires five tags to do what the user needs to do
with tagging.

Richard Cordovano
Basis Technology



On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...> wrote:

> Hello TSK users... I had a question and a comment/suggestion.
>
> What is the intended purpose of Bookmark and Tag (or versus)?
>
> I get that Bookmarking is putting the item into the Report, but what about
> Tag?
>
> For me, it seems like it should be just "tagging" and item, but I know that
> Bookmarking is a common term for forensic programs.
>
> Whatever the term is going to be, I really wish there was just a column
> with a check box for this action. It is ridiculous to have to go through a
> secondary click menu when this is one of the most common functions of an
> investigation (marking an item for a report).
>
> What are the chances people agree with me and we could see a feature like
> this in the next version?
>
> Thanks for your time.
>
> Billy
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

[sleuthkit-users] Autopsy Users / Version

[Billy P. <bg...@gm...>]

Hello TSK users... I had a question and a comment/suggestion.

What is the intended purpose of Bookmark and Tag (or versus)?

I get that Bookmarking is putting the item into the Report, but what about
Tag?

For me, it seems like it should be just "tagging" and item, but I know that
Bookmarking is a common term for forensic programs.

Whatever the term is going to be, I really wish there was just a column
with a check box for this action. It is ridiculous to have to go through a
secondary click menu when this is one of the most common functions of an
investigation (marking an item for a report).

What are the chances people agree with me and we could see a feature like
this in the next version?

Thanks for your time.

Billy

[sleuthkit-users] botnet hacker authentication through investigate HEX of malware

[Enkidu Mo S. <vol...@gm...>]

Hi everyone,
i am master research student. i was working on bitcoin wallet
investigation, but i didnt find it challenging and changed my research
topic.
my new topic is about botnet detection. there are possibility of online
network trafic analyzing also offline scanning computer for malwares, but
my question is, does anyone have experience of investigating a botnet
malware for any evidence of original attacker (C&C server) ip address?
thank you
*Ehsan Moshiri (Enkidu)*
*Digital Forensic Student*
*H/P:+96164953954 , +961124249769*

*Linkedin: http://my.linkedin.com/pub/enkidu-moshiri/59/baa/90b/
<http://my.linkedin.com/pub/enkidu-moshiri/59/baa/90b/>*
*Facebook: Enkidu Mo Shi Ri*
*wechat: Enkidu-Moshiri*
*Line: Enkidu.Moshiri*

Re: [sleuthkit-users] Hash MD5 and HMAC

[maría e. d. <dar...@gm...>]

I believe that is really important to include in the new version of Autopsy
(3.11) a  keyed hash or hmac, it is so relevant in the legal context, to
certificate a digital file  behind the vulnerabilities that a criptographic
hash could have, because it is possible to offer  the judge a reliable
digital evidence. I was reading some documentation from Encase but I did
not found anything about hmac. There is a sourceforge project that
generated the tool  fehashmac (
http://sourceforge.net/projects/fehashmac/files/), I tried it  and works
fine. But, it will be really important that this type of keyed hash could
be added to sleuthkit and then in Autopsy, because of the legal aspect.
(when a file is keyed hash, the key is a way to mantain reliable the
evidence and it is transfer in a close envelope with the form of  chain of
custody). I think that working with open source code is the best way to
demostrate that any tool does what is expected (as Brian Carrier wrote in
his article) and therefore is reliable and as we say here: transparent.

Best regards.

María Elena

2014-11-12 14:56 GMT-03:00 <sle...@li...>:

> Send sleuthkit-users mailing list submissions to
>         sle...@li...
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> or, via email, send a message with subject or body 'help' to
>         sle...@li...
>
> You can reach the person managing the list at
>         sle...@li...
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of sleuthkit-users digest..."
>
>
> Today's Topics:
>
>    1. Re: fiwalk (Jason Wright)
>    2. Re: fiwalk (RB)
>    3. Re: fiwalk (Simson Garfinkel)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 12 Nov 2014 12:19:22 -0500
> From: Jason Wright <jwr...@gm...>
> Subject: Re: [sleuthkit-users] fiwalk
> To: Simson Garfinkel <si...@ac...>
> Cc: "sle...@li... users"
>         <sle...@li...>
> Message-ID:
>         <CAOm9=EmaxQ0cg2v8dJoVkHghV5EYhWUD67=
> 7Fz...@ma...>
> Content-Type: text/plain; charset="utf-8"
>
> Separately from this, but somewhat related, given the chatter regarding MD5
> of late, e.g.
>
> http://arstechnica.com/security/2014/11/crypto-attack-that-hijacked-windows-update-goes-mainstream-in-amazon-cloud/
> ,
> is there any concern for relying on MD5 in digital forensics?
>
> I ask because it seems that tsk_loaddb only calculates MD5s for an
> image.Typically, we use fiwalk to gather MD5, SHA1, and SHA256 from files
> in a drive image. We use those for whitelisting/blacklisting, but do turn
> immediately to MD5 for filtering knowns (good and bad) from unknowns. SHA1,
> and then of course SHA256, are secondary to that process. Outside of this
> article, has there been any other MD5 collisions encountered?
>
>
> On Wed, Nov 12, 2014 at 11:59 AM, Simson Garfinkel <si...@ac...>
> wrote:
>
> > Hi, Jason.
> >
> > Sadly, tsk_loaddb does not grab file signatures. It can hash, but I don't
> > know if it just does MD5 or if it does SHA1. It does not do SHA256.  The
> > byte runs are available.
> >
> > I gather you are running fiwalk on Linux?
> >
> >
> >
> > On Nov 12, 2014, at 11:23 AM, Jason Wright <jwr...@gm...>
> wrote:
> >
> > Simson et al,
> >
> > In my organization, we still use fiwalk too. We use it to gather as much
> > file metadata as possible, to include file signatures, MD5, SHA1, and
> > SHA256, and byte runs for file allocation along with the regular
> complement
> > from the MFT indices. We have not used tsk_loaddb and if need be we can
> > switch to that, provided we still get all of that info. Does it provide
> > that breadth of detail?
> >
> > V/R,
> >
> > Jason
> >
> > On Mon, Nov 10, 2014 at 3:43 PM, Alex Nelson <ajn...@cs...>
> wrote:
> >
> >> Hi Simson, all,
> >>
> >> I'm making extensive use of Fiwalk.  I believe the BitCurator folks are
> >> as well.
> >>
> >> --Alex
> >>
> >>
> >>
> >> On Mon, Nov 10, 2014 at 3:18 PM, Simson Garfinkel <si...@ac...>
> >> wrote:
> >>
> >>> Derrick,
> >>>
> >>> My recommendation is that you transition away from fiwalk.
> >>>
> >>> My one concern with tsk_loaddb is that the filenames it produces are
> not
> >>> necessarily UTF-8. It seems to be putting in the database whatever is
> on
> >>> the disk, which can cause problems in post-analysis.  I'm not sure how
> >>> others are dealing with this. My problem is that on Windows, I'm
> reading
> >>> these values with Python and I'm getting exceptions when I attempt to
> write
> >>> them to a file.
> >>>
> >>>
> >>>
> >>> > On Nov 10, 2014, at 1:17 PM, Derrick Karpo <dk...@gm...> wrote:
> >>> >
> >>> > I am still using fiwalk but have been transitioning to tsk_loaddb.
> >>> >
> >>> > My primary reason is that my forensic indexer (Xapian) automatically
> >>> > indexes fiwalk text output and I haven't configured it to include
> >>> > sqlite files yet.  It's a simple config change for me to fully
> >>> > transition over.
> >>> >
> >>> > Derrick
> >>> >
> >>> >
> >>> > On Mon, Nov 10, 2014 at 10:43 AM, Simson Garfinkel <si...@ac...>
> >>> wrote:
> >>> >> I see.
> >>> >>
> >>> >> The other approach would be to abandon fiwalk and move the things
> >>> that use it over to using the database produced by tsk_loaddb.
> >>> >>
> >>> >> Is anyone other than me using fiwalk at this point?
> >>> >>
> >>> >> Simson
> >>> >>
> >>> >>
> >>> >>> On Nov 10, 2014, at 12:40 PM, Brian Carrier <ca...@sl...
> >
> >>> wrote:
> >>> >>>
> >>> >>> We don't use mingw for the TSK packaging.  Just Visual Studio.  So,
> >>> it would be much easier to include if there were a visual studio
> project
> >>> for it.
> >>> >>>
> >>> >>>
> >>> >>>
> >>> >>>
> >>> >>>
> >>> >>> On Nov 10, 2014, at 12:16 PM, Simson Garfinkel <si...@ac...>
> >>> wrote:
> >>> >>>
> >>> >>>> Hi. I see that fiwalk.exe is not being compiled as part of the
> >>> pre-compiled SleuthKit download.
> >>> >>>>
> >>> >>>> Is there some reason why fiwalk is not included, and is there any
> >>> packaging change that I could make to make it more likely to include
> the
> >>> executable in the future?
> >>> >>>>
> >>> >>>> Simson
> >>> >>>>
> >>> >>>>
> >>> >>>>
> >>>
> ------------------------------------------------------------------------------
> >>> >>>> _______________________________________________
> >>> >>>> sleuthkit-users mailing list
> >>> >>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >>> >>>> http://www.sleuthkit.org
> >>> >>>
> >>> >>
> >>> >>
> >>> >>
> >>>
> ------------------------------------------------------------------------------
> >>> >> _______________________________________________
> >>> >> sleuthkit-users mailing list
> >>> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >>> >> http://www.sleuthkit.org
> >>>
> >>>
> >>>
> >>>
> ------------------------------------------------------------------------------
> >>> Comprehensive Server Monitoring with Site24x7.
> >>> Monitor 10 servers for $9/Month.
> >>> Get alerted through email, SMS, voice calls or mobile push
> notifications.
> >>> Take corrective actions from your mobile device.
> >>>
> >>>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> >>> _______________________________________________
> >>> sleuthkit-users mailing list
> >>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >>> http://www.sleuthkit.org
> >>>
> >>
> >>
> >>
> >>
> ------------------------------------------------------------------------------
> >> Comprehensive Server Monitoring with Site24x7.
> >> Monitor 10 servers for $9/Month.
> >> Get alerted through email, SMS, voice calls or mobile push
> notifications.
> >> Take corrective actions from your mobile device.
> >>
> >>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> >> _______________________________________________
> >> sleuthkit-users mailing list
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> >> http://www.sleuthkit.org
> >>
> >>
> >
> >
> -------------- next part --------------
> An HTML attachment was scrubbed...
>
> ------------------------------
>
> Message: 2
> Date: Wed, 12 Nov 2014 10:55:57 -0700
> From: RB <ao...@gm...>
> Subject: Re: [sleuthkit-users] fiwalk
> To: Jason Wright <jwr...@gm...>
> Cc: "sle...@li... users"
>         <sle...@li...>
> Message-ID:
>         <CADkMHCmgby8h8YRoFhvtyypDJd=
> 8ae...@ma...>
> Content-Type: text/plain; charset=UTF-8
>
> On Wed, Nov 12, 2014 at 10:19 AM, Jason Wright <jwr...@gm...>
> wrote:
> > Separately from this, but somewhat related, given the chatter regarding
> MD5
> > of late, e.g.
> >
> http://arstechnica.com/security/2014/11/crypto-attack-that-hijacked-windows-update-goes-mainstream-in-amazon-cloud/
> ,
> > is there any concern for relying on MD5 in digital forensics?
>
> I'd love to jump right in there.  MD5 is passing its use-by date
> should generally not be used for new projects, but it's not quite the
> "abandon ship" picture the original author and everyone else seems to
> want to paint.  Hooray for headline-chasing rather than realism.
> Let's inject a little of the latter.
>
> The linked attack takes two dissimilar images of the same size and
> requires their differences be "of a particular form."  Someone closer
> to cryptography can explain the "particular form" better than I, but
> what it boils down to is that it is NOT a generalized attack for any
> file type.  The attack then modifies _both_ files progressively,
> adding semi-random data until their MD5 matches, something of a
> "birthday attack meets in the middle" approach.
>
> This is bad, but any analyst with their head on their shoulders will
> recognize that:
> a) to be exploited it would require access to modify the "original" as
> well as the "new" file and
> b) the data added is non-meaningful
>
> Full stop.  Nobody has figured out a way to change "mary had a little
> lamb" to "drink your ovaltine", this is random data appended to an
> already lossy format in a highly detectable manner.  Those files you
> have with only md5 checksums from 10 years ago are still mostly safe
> so long as your attacker doesn't have access to modify them as well.
>
> Should you use more than just MD5 to track or identify files?  Yes.
> Size and multiple checksums are a great way to guard against this kind
> of attack.
>
> Should new applications depend solely on MD5?  Probably not, there are
> better alternatives whose additional cost (both programming and
> computational) are effectively zero.
>
> Someone wake me up when (or at least stop the sensationalism until) an
> attacker can generate an arbitrary, meaningful file with minimal size
> difference from and the same MD5 as the original without altering the
> original.  Then MD5 is completely dead.
>
>
>
> ------------------------------
>
> Message: 3
> Date: Wed, 12 Nov 2014 12:56:41 -0500
> From: Simson Garfinkel <si...@ac...>
> Subject: Re: [sleuthkit-users] fiwalk
> To: Jason Wright <jwr...@gm...>
> Cc: "sle...@li... users"
>         <sle...@li...>
> Message-ID: <A23...@ac...>
> Content-Type: text/plain; charset="us-ascii"
>
> My take:
>
> - MD5 collisions are generally not an issue in digital forensics if you
> are looking for known content. If you have the MD5 of a piece of stolen IP,
> it is unlikely that an adversary will attempt to craft multiple files to
> have the same MD5 as that stolen IP.
>
> - MD5 collisions may be an issue if you are using MD5s as an "ignore" list
> rather than as an "alert" list. That is, if you have a list of MD5s that
> you routinely ignore (e.g. executables), then there is a chance that an
> adversary may modify the MD5 of one of their files to match one of the
> files that you ignore. However it's hard. Currently it's possible to make
> two files have the same MD5, but I'm not aware that it is possible to tune
> a second file to match the MD5 of an arbitrary first file. That is, MD5 no
> longer has collision resistance, but I believe it still has preimage
> resistance.
>
> In your case below, using MD5 for filtering known bads from unknowns is
> fine. However, using them for known goods is potentially problematic if you
> think that the adversary can get their known good into your known goods
> list.
>
> Simson
>
>
>
> > On Nov 12, 2014, at 12:19 PM, Jason Wright <jwr...@gm...>
> wrote:
> >
> > Separately from this, but somewhat related, given the chatter regarding
> MD5 of late, e.g.
> http://arstechnica.com/security/2014/11/crypto-attack-that-hijacked-windows-update-goes-mainstream-in-amazon-cloud/
> <
> http://arstechnica.com/security/2014/11/crypto-attack-that-hijacked-windows-update-goes-mainstream-in-amazon-cloud/>,
> is there any concern for relying on MD5 in digital forensics?
> >
> > I ask because it seems that tsk_loaddb only calculates MD5s for an
> image.Typically, we use fiwalk to gather MD5, SHA1, and SHA256 from files
> in a drive image. We use those for whitelisting/blacklisting, but do turn
> immediately to MD5 for filtering knowns (good and bad) from unknowns. SHA1,
> and then of course SHA256, are secondary to that process. Outside of this
> article, has there been any other MD5 collisions encountered?
> >
> >
> > On Wed, Nov 12, 2014 at 11:59 AM, Simson Garfinkel <si...@ac...
> <mailto:si...@ac...>> wrote:
> > Hi, Jason.
> >
> > Sadly, tsk_loaddb does not grab file signatures. It can hash, but I
> don't know if it just does MD5 or if it does SHA1. It does not do SHA256.
> The byte runs are available.
> >
> > I gather you are running fiwalk on Linux?
> >
> >
> >
> >> On Nov 12, 2014, at 11:23 AM, Jason Wright <jwr...@gm...
> <mailto:jwr...@gm...>> wrote:
> >>
> >> Simson et al,
> >>
> >> In my organization, we still use fiwalk too. We use it to gather as
> much file metadata as possible, to include file signatures, MD5, SHA1, and
> SHA256, and byte runs for file allocation along with the regular complement
> from the MFT indices. We have not used tsk_loaddb and if need be we can
> switch to that, provided we still get all of that info. Does it provide
> that breadth of detail?
> >>
> >> V/R,
> >>
> >> Jason
> >>
> >> On Mon, Nov 10, 2014 at 3:43 PM, Alex Nelson <ajn...@cs...
> <mailto:ajn...@cs...>> wrote:
> >> Hi Simson, all,
> >>
> >> I'm making extensive use of Fiwalk.  I believe the BitCurator folks are
> as well.
> >>
> >> --Alex
> >>
> >>
> >>
> >> On Mon, Nov 10, 2014 at 3:18 PM, Simson Garfinkel <si...@ac...
> <mailto:si...@ac...>> wrote:
> >> Derrick,
> >>
> >> My recommendation is that you transition away from fiwalk.
> >>
> >> My one concern with tsk_loaddb is that the filenames it produces are
> not necessarily UTF-8. It seems to be putting in the database whatever is
> on the disk, which can cause problems in post-analysis.  I'm not sure how
> others are dealing with this. My problem is that on Windows, I'm reading
> these values with Python and I'm getting exceptions when I attempt to write
> them to a file.
> >>
> >>
> >>
> >> > On Nov 10, 2014, at 1:17 PM, Derrick Karpo <dk...@gm... <mailto:
> dk...@gm...>> wrote:
> >> >
> >> > I am still using fiwalk but have been transitioning to tsk_loaddb.
> >> >
> >> > My primary reason is that my forensic indexer (Xapian) automatically
> >> > indexes fiwalk text output and I haven't configured it to include
> >> > sqlite files yet.  It's a simple config change for me to fully
> >> > transition over.
> >> >
> >> > Derrick
> >> >
> >> >
> >> > On Mon, Nov 10, 2014 at 10:43 AM, Simson Garfinkel <si...@ac...
> <mailto:si...@ac...>> wrote:
> >> >> I see.
> >> >>
> >> >> The other approach would be to abandon fiwalk and move the things
> that use it over to using the database produced by tsk_loaddb.
> >> >>
> >> >> Is anyone other than me using fiwalk at this point?
> >> >>
> >> >> Simson
> >> >>
> >> >>
> >> >>> On Nov 10, 2014, at 12:40 PM, Brian Carrier <ca...@sl...
> <mailto:ca...@sl...>> wrote:
> >> >>>
> >> >>> We don't use mingw for the TSK packaging.  Just Visual Studio.  So,
> it would be much easier to include if there were a visual studio project
> for it.
> >> >>>
> >> >>>
> >> >>>
> >> >>>
> >> >>>
> >> >>> On Nov 10, 2014, at 12:16 PM, Simson Garfinkel <si...@ac...
> <mailto:si...@ac...>> wrote:
> >> >>>
> >> >>>> Hi. I see that fiwalk.exe is not being compiled as part of the
> pre-compiled SleuthKit download.
> >> >>>>
> >> >>>> Is there some reason why fiwalk is not included, and is there any
> packaging change that I could make to make it more likely to include the
> executable in the future?
> >> >>>>
> >> >>>> Simson
> >> >>>>
> >> >>>>
> >> >>>>
> ------------------------------------------------------------------------------
> >> >>>> _______________________________________________
> >> >>>> sleuthkit-users mailing list
> >> >>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> >> >>>> http://www.sleuthkit.org <http://www.sleuthkit.org/>
> >> >>>
> >> >>
> >> >>
> >> >>
> ------------------------------------------------------------------------------
> >> >> _______________________________________________
> >> >> sleuthkit-users mailing list
> >> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> >> >> http://www.sleuthkit.org <http://www.sleuthkit.org/>
> >>
> >>
> >>
> ------------------------------------------------------------------------------
> >> Comprehensive Server Monitoring with Site24x7.
> >> Monitor 10 servers for $9/Month.
> >> Get alerted through email, SMS, voice calls or mobile push
> notifications.
> >> Take corrective actions from your mobile device.
> >>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> <
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> >
> >> _______________________________________________
> >> sleuthkit-users mailing list
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> >> http://www.sleuthkit.org <http://www.sleuthkit.org/>
> >>
> >>
> >>
> ------------------------------------------------------------------------------
> >> Comprehensive Server Monitoring with Site24x7.
> >> Monitor 10 servers for $9/Month.
> >> Get alerted through email, SMS, voice calls or mobile push
> notifications.
> >> Take corrective actions from your mobile device.
> >>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> <
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> >
> >> _______________________________________________
> >> sleuthkit-users mailing list
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> >> http://www.sleuthkit.org <http://www.sleuthkit.org/>
> >>
> >>
> >
> >
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
>
> ------------------------------
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>
> ------------------------------
>
> _______________________________________________
> sleuthkit-users mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>
>
> End of sleuthkit-users Digest, Vol 101, Issue 7
> ***********************************************
>



-- 
Prof. Ing. María Elena Darahuge
M P Copitec 5100

Re: [sleuthkit-users] fiwalk

[Simson G. <si...@ac...>]

My take:

- MD5 collisions are generally not an issue in digital forensics if you are looking for known content. If you have the MD5 of a piece of stolen IP, it is unlikely that an adversary will attempt to craft multiple files to have the same MD5 as that stolen IP. 

- MD5 collisions may be an issue if you are using MD5s as an "ignore" list rather than as an "alert" list. That is, if you have a list of MD5s that you routinely ignore (e.g. executables), then there is a chance that an adversary may modify the MD5 of one of their files to match one of the files that you ignore. However it's hard. Currently it's possible to make two files have the same MD5, but I'm not aware that it is possible to tune a second file to match the MD5 of an arbitrary first file. That is, MD5 no longer has collision resistance, but I believe it still has preimage resistance.

In your case below, using MD5 for filtering known bads from unknowns is fine. However, using them for known goods is potentially problematic if you think that the adversary can get their known good into your known goods list.

Simson



> On Nov 12, 2014, at 12:19 PM, Jason Wright <jwr...@gm...> wrote:
> 
> Separately from this, but somewhat related, given the chatter regarding MD5 of late, e.g. http://arstechnica.com/security/2014/11/crypto-attack-that-hijacked-windows-update-goes-mainstream-in-amazon-cloud/ <http://arstechnica.com/security/2014/11/crypto-attack-that-hijacked-windows-update-goes-mainstream-in-amazon-cloud/>, is there any concern for relying on MD5 in digital forensics? 
> 
> I ask because it seems that tsk_loaddb only calculates MD5s for an image.Typically, we use fiwalk to gather MD5, SHA1, and SHA256 from files in a drive image. We use those for whitelisting/blacklisting, but do turn immediately to MD5 for filtering knowns (good and bad) from unknowns. SHA1, and then of course SHA256, are secondary to that process. Outside of this article, has there been any other MD5 collisions encountered? 
> 
> 
> On Wed, Nov 12, 2014 at 11:59 AM, Simson Garfinkel <si...@ac... <mailto:si...@ac...>> wrote:
> Hi, Jason.
> 
> Sadly, tsk_loaddb does not grab file signatures. It can hash, but I don't know if it just does MD5 or if it does SHA1. It does not do SHA256.  The byte runs are available.
> 
> I gather you are running fiwalk on Linux?
> 
> 
> 
>> On Nov 12, 2014, at 11:23 AM, Jason Wright <jwr...@gm... <mailto:jwr...@gm...>> wrote:
>> 
>> Simson et al,
>> 
>> In my organization, we still use fiwalk too. We use it to gather as much file metadata as possible, to include file signatures, MD5, SHA1, and SHA256, and byte runs for file allocation along with the regular complement from the MFT indices. We have not used tsk_loaddb and if need be we can switch to that, provided we still get all of that info. Does it provide that breadth of detail?
>> 
>> V/R,
>> 
>> Jason
>> 
>> On Mon, Nov 10, 2014 at 3:43 PM, Alex Nelson <ajn...@cs... <mailto:ajn...@cs...>> wrote:
>> Hi Simson, all,
>> 
>> I'm making extensive use of Fiwalk.  I believe the BitCurator folks are as well.
>> 
>> --Alex
>> 
>> 
>> 
>> On Mon, Nov 10, 2014 at 3:18 PM, Simson Garfinkel <si...@ac... <mailto:si...@ac...>> wrote:
>> Derrick,
>> 
>> My recommendation is that you transition away from fiwalk.
>> 
>> My one concern with tsk_loaddb is that the filenames it produces are not necessarily UTF-8. It seems to be putting in the database whatever is on the disk, which can cause problems in post-analysis.  I'm not sure how others are dealing with this. My problem is that on Windows, I'm reading these values with Python and I'm getting exceptions when I attempt to write them to a file.
>> 
>> 
>> 
>> > On Nov 10, 2014, at 1:17 PM, Derrick Karpo <dk...@gm... <mailto:dk...@gm...>> wrote:
>> >
>> > I am still using fiwalk but have been transitioning to tsk_loaddb.
>> >
>> > My primary reason is that my forensic indexer (Xapian) automatically
>> > indexes fiwalk text output and I haven't configured it to include
>> > sqlite files yet.  It's a simple config change for me to fully
>> > transition over.
>> >
>> > Derrick
>> >
>> >
>> > On Mon, Nov 10, 2014 at 10:43 AM, Simson Garfinkel <si...@ac... <mailto:si...@ac...>> wrote:
>> >> I see.
>> >>
>> >> The other approach would be to abandon fiwalk and move the things that use it over to using the database produced by tsk_loaddb.
>> >>
>> >> Is anyone other than me using fiwalk at this point?
>> >>
>> >> Simson
>> >>
>> >>
>> >>> On Nov 10, 2014, at 12:40 PM, Brian Carrier <ca...@sl... <mailto:ca...@sl...>> wrote:
>> >>>
>> >>> We don't use mingw for the TSK packaging.  Just Visual Studio.  So, it would be much easier to include if there were a visual studio project for it.
>> >>>
>> >>>
>> >>>
>> >>>
>> >>>
>> >>> On Nov 10, 2014, at 12:16 PM, Simson Garfinkel <si...@ac... <mailto:si...@ac...>> wrote:
>> >>>
>> >>>> Hi. I see that fiwalk.exe is not being compiled as part of the pre-compiled SleuthKit download.
>> >>>>
>> >>>> Is there some reason why fiwalk is not included, and is there any packaging change that I could make to make it more likely to include the executable in the future?
>> >>>>
>> >>>> Simson
>> >>>>
>> >>>>
>> >>>> ------------------------------------------------------------------------------
>> >>>> _______________________________________________
>> >>>> sleuthkit-users mailing list
>> >>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
>> >>>> http://www.sleuthkit.org <http://www.sleuthkit.org/>
>> >>>
>> >>
>> >>
>> >> ------------------------------------------------------------------------------
>> >> _______________________________________________
>> >> sleuthkit-users mailing list
>> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
>> >> http://www.sleuthkit.org <http://www.sleuthkit.org/>
>> 
>> 
>> ------------------------------------------------------------------------------
>> Comprehensive Server Monitoring with Site24x7.
>> Monitor 10 servers for $9/Month.
>> Get alerted through email, SMS, voice calls or mobile push notifications.
>> Take corrective actions from your mobile device.
>> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk <http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk>
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
>> http://www.sleuthkit.org <http://www.sleuthkit.org/>
>> 
>> 
>> ------------------------------------------------------------------------------
>> Comprehensive Server Monitoring with Site24x7.
>> Monitor 10 servers for $9/Month.
>> Get alerted through email, SMS, voice calls or mobile push notifications.
>> Take corrective actions from your mobile device.
>> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk <http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk>
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
>> http://www.sleuthkit.org <http://www.sleuthkit.org/>
>> 
>> 
> 
> 

Re: [sleuthkit-users] fiwalk

[RB <ao...@gm...>]

On Wed, Nov 12, 2014 at 10:19 AM, Jason Wright <jwr...@gm...> wrote:
> Separately from this, but somewhat related, given the chatter regarding MD5
> of late, e.g.
> http://arstechnica.com/security/2014/11/crypto-attack-that-hijacked-windows-update-goes-mainstream-in-amazon-cloud/,
> is there any concern for relying on MD5 in digital forensics?

I'd love to jump right in there.  MD5 is passing its use-by date
should generally not be used for new projects, but it's not quite the
"abandon ship" picture the original author and everyone else seems to
want to paint.  Hooray for headline-chasing rather than realism.
Let's inject a little of the latter.

The linked attack takes two dissimilar images of the same size and
requires their differences be "of a particular form."  Someone closer
to cryptography can explain the "particular form" better than I, but
what it boils down to is that it is NOT a generalized attack for any
file type.  The attack then modifies _both_ files progressively,
adding semi-random data until their MD5 matches, something of a
"birthday attack meets in the middle" approach.

This is bad, but any analyst with their head on their shoulders will
recognize that:
a) to be exploited it would require access to modify the "original" as
well as the "new" file and
b) the data added is non-meaningful

Full stop.  Nobody has figured out a way to change "mary had a little
lamb" to "drink your ovaltine", this is random data appended to an
already lossy format in a highly detectable manner.  Those files you
have with only md5 checksums from 10 years ago are still mostly safe
so long as your attacker doesn't have access to modify them as well.

Should you use more than just MD5 to track or identify files?  Yes.
Size and multiple checksums are a great way to guard against this kind
of attack.

Should new applications depend solely on MD5?  Probably not, there are
better alternatives whose additional cost (both programming and
computational) are effectively zero.

Someone wake me up when (or at least stop the sensationalism until) an
attacker can generate an arbitrary, meaningful file with minimal size
difference from and the same MD5 as the original without altering the
original.  Then MD5 is completely dead.

Re: [sleuthkit-users] fiwalk

[Jason W. <jwr...@gm...>]

Separately from this, but somewhat related, given the chatter regarding MD5
of late, e.g.
http://arstechnica.com/security/2014/11/crypto-attack-that-hijacked-windows-update-goes-mainstream-in-amazon-cloud/,
is there any concern for relying on MD5 in digital forensics?

I ask because it seems that tsk_loaddb only calculates MD5s for an
image.Typically, we use fiwalk to gather MD5, SHA1, and SHA256 from files
in a drive image. We use those for whitelisting/blacklisting, but do turn
immediately to MD5 for filtering knowns (good and bad) from unknowns. SHA1,
and then of course SHA256, are secondary to that process. Outside of this
article, has there been any other MD5 collisions encountered?


On Wed, Nov 12, 2014 at 11:59 AM, Simson Garfinkel <si...@ac...> wrote:

> Hi, Jason.
>
> Sadly, tsk_loaddb does not grab file signatures. It can hash, but I don't
> know if it just does MD5 or if it does SHA1. It does not do SHA256.  The
> byte runs are available.
>
> I gather you are running fiwalk on Linux?
>
>
>
> On Nov 12, 2014, at 11:23 AM, Jason Wright <jwr...@gm...> wrote:
>
> Simson et al,
>
> In my organization, we still use fiwalk too. We use it to gather as much
> file metadata as possible, to include file signatures, MD5, SHA1, and
> SHA256, and byte runs for file allocation along with the regular complement
> from the MFT indices. We have not used tsk_loaddb and if need be we can
> switch to that, provided we still get all of that info. Does it provide
> that breadth of detail?
>
> V/R,
>
> Jason
>
> On Mon, Nov 10, 2014 at 3:43 PM, Alex Nelson <ajn...@cs...> wrote:
>
>> Hi Simson, all,
>>
>> I'm making extensive use of Fiwalk.  I believe the BitCurator folks are
>> as well.
>>
>> --Alex
>>
>>
>>
>> On Mon, Nov 10, 2014 at 3:18 PM, Simson Garfinkel <si...@ac...>
>> wrote:
>>
>>> Derrick,
>>>
>>> My recommendation is that you transition away from fiwalk.
>>>
>>> My one concern with tsk_loaddb is that the filenames it produces are not
>>> necessarily UTF-8. It seems to be putting in the database whatever is on
>>> the disk, which can cause problems in post-analysis.  I'm not sure how
>>> others are dealing with this. My problem is that on Windows, I'm reading
>>> these values with Python and I'm getting exceptions when I attempt to write
>>> them to a file.
>>>
>>>
>>>
>>> > On Nov 10, 2014, at 1:17 PM, Derrick Karpo <dk...@gm...> wrote:
>>> >
>>> > I am still using fiwalk but have been transitioning to tsk_loaddb.
>>> >
>>> > My primary reason is that my forensic indexer (Xapian) automatically
>>> > indexes fiwalk text output and I haven't configured it to include
>>> > sqlite files yet.  It's a simple config change for me to fully
>>> > transition over.
>>> >
>>> > Derrick
>>> >
>>> >
>>> > On Mon, Nov 10, 2014 at 10:43 AM, Simson Garfinkel <si...@ac...>
>>> wrote:
>>> >> I see.
>>> >>
>>> >> The other approach would be to abandon fiwalk and move the things
>>> that use it over to using the database produced by tsk_loaddb.
>>> >>
>>> >> Is anyone other than me using fiwalk at this point?
>>> >>
>>> >> Simson
>>> >>
>>> >>
>>> >>> On Nov 10, 2014, at 12:40 PM, Brian Carrier <ca...@sl...>
>>> wrote:
>>> >>>
>>> >>> We don't use mingw for the TSK packaging.  Just Visual Studio.  So,
>>> it would be much easier to include if there were a visual studio project
>>> for it.
>>> >>>
>>> >>>
>>> >>>
>>> >>>
>>> >>>
>>> >>> On Nov 10, 2014, at 12:16 PM, Simson Garfinkel <si...@ac...>
>>> wrote:
>>> >>>
>>> >>>> Hi. I see that fiwalk.exe is not being compiled as part of the
>>> pre-compiled SleuthKit download.
>>> >>>>
>>> >>>> Is there some reason why fiwalk is not included, and is there any
>>> packaging change that I could make to make it more likely to include the
>>> executable in the future?
>>> >>>>
>>> >>>> Simson
>>> >>>>
>>> >>>>
>>> >>>>
>>> ------------------------------------------------------------------------------
>>> >>>> _______________________________________________
>>> >>>> sleuthkit-users mailing list
>>> >>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> >>>> http://www.sleuthkit.org
>>> >>>
>>> >>
>>> >>
>>> >>
>>> ------------------------------------------------------------------------------
>>> >> _______________________________________________
>>> >> sleuthkit-users mailing list
>>> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> >> http://www.sleuthkit.org
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Comprehensive Server Monitoring with Site24x7.
>>> Monitor 10 servers for $9/Month.
>>> Get alerted through email, SMS, voice calls or mobile push notifications.
>>> Take corrective actions from your mobile device.
>>>
>>> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> sleuthkit-users mailing list
>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> http://www.sleuthkit.org
>>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Comprehensive Server Monitoring with Site24x7.
>> Monitor 10 servers for $9/Month.
>> Get alerted through email, SMS, voice calls or mobile push notifications.
>> Take corrective actions from your mobile device.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>
>

Re: [sleuthkit-users] fiwalk

[Simson G. <si...@ac...>]

Hi, Jason.

Sadly, tsk_loaddb does not grab file signatures. It can hash, but I don't know if it just does MD5 or if it does SHA1. It does not do SHA256.  The byte runs are available.

I gather you are running fiwalk on Linux?



> On Nov 12, 2014, at 11:23 AM, Jason Wright <jwr...@gm...> wrote:
> 
> Simson et al,
> 
> In my organization, we still use fiwalk too. We use it to gather as much file metadata as possible, to include file signatures, MD5, SHA1, and SHA256, and byte runs for file allocation along with the regular complement from the MFT indices. We have not used tsk_loaddb and if need be we can switch to that, provided we still get all of that info. Does it provide that breadth of detail?
> 
> V/R,
> 
> Jason
> 
> On Mon, Nov 10, 2014 at 3:43 PM, Alex Nelson <ajn...@cs... <mailto:ajn...@cs...>> wrote:
> Hi Simson, all,
> 
> I'm making extensive use of Fiwalk.  I believe the BitCurator folks are as well.
> 
> --Alex
> 
> 
> 
> On Mon, Nov 10, 2014 at 3:18 PM, Simson Garfinkel <si...@ac... <mailto:si...@ac...>> wrote:
> Derrick,
> 
> My recommendation is that you transition away from fiwalk.
> 
> My one concern with tsk_loaddb is that the filenames it produces are not necessarily UTF-8. It seems to be putting in the database whatever is on the disk, which can cause problems in post-analysis.  I'm not sure how others are dealing with this. My problem is that on Windows, I'm reading these values with Python and I'm getting exceptions when I attempt to write them to a file.
> 
> 
> 
> > On Nov 10, 2014, at 1:17 PM, Derrick Karpo <dk...@gm... <mailto:dk...@gm...>> wrote:
> >
> > I am still using fiwalk but have been transitioning to tsk_loaddb.
> >
> > My primary reason is that my forensic indexer (Xapian) automatically
> > indexes fiwalk text output and I haven't configured it to include
> > sqlite files yet.  It's a simple config change for me to fully
> > transition over.
> >
> > Derrick
> >
> >
> > On Mon, Nov 10, 2014 at 10:43 AM, Simson Garfinkel <si...@ac... <mailto:si...@ac...>> wrote:
> >> I see.
> >>
> >> The other approach would be to abandon fiwalk and move the things that use it over to using the database produced by tsk_loaddb.
> >>
> >> Is anyone other than me using fiwalk at this point?
> >>
> >> Simson
> >>
> >>
> >>> On Nov 10, 2014, at 12:40 PM, Brian Carrier <ca...@sl... <mailto:ca...@sl...>> wrote:
> >>>
> >>> We don't use mingw for the TSK packaging.  Just Visual Studio.  So, it would be much easier to include if there were a visual studio project for it.
> >>>
> >>>
> >>>
> >>>
> >>>
> >>> On Nov 10, 2014, at 12:16 PM, Simson Garfinkel <si...@ac... <mailto:si...@ac...>> wrote:
> >>>
> >>>> Hi. I see that fiwalk.exe is not being compiled as part of the pre-compiled SleuthKit download.
> >>>>
> >>>> Is there some reason why fiwalk is not included, and is there any packaging change that I could make to make it more likely to include the executable in the future?
> >>>>
> >>>> Simson
> >>>>
> >>>>
> >>>> ------------------------------------------------------------------------------
> >>>> _______________________________________________
> >>>> sleuthkit-users mailing list
> >>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> >>>> http://www.sleuthkit.org <http://www.sleuthkit.org/>
> >>>
> >>
> >>
> >> ------------------------------------------------------------------------------
> >> _______________________________________________
> >> sleuthkit-users mailing list
> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> >> http://www.sleuthkit.org <http://www.sleuthkit.org/>
> 
> 
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk <http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> http://www.sleuthkit.org <http://www.sleuthkit.org/>
> 
> 
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk <http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> http://www.sleuthkit.org <http://www.sleuthkit.org/>
> 
> 

Re: [sleuthkit-users] fiwalk

[Jason W. <jwr...@gm...>]

Simson et al,

In my organization, we still use fiwalk too. We use it to gather as much
file metadata as possible, to include file signatures, MD5, SHA1, and
SHA256, and byte runs for file allocation along with the regular complement
from the MFT indices. We have not used tsk_loaddb and if need be we can
switch to that, provided we still get all of that info. Does it provide
that breadth of detail?

V/R,

Jason

On Mon, Nov 10, 2014 at 3:43 PM, Alex Nelson <ajn...@cs...> wrote:

> Hi Simson, all,
>
> I'm making extensive use of Fiwalk.  I believe the BitCurator folks are as
> well.
>
> --Alex
>
>
>
> On Mon, Nov 10, 2014 at 3:18 PM, Simson Garfinkel <si...@ac...> wrote:
>
>> Derrick,
>>
>> My recommendation is that you transition away from fiwalk.
>>
>> My one concern with tsk_loaddb is that the filenames it produces are not
>> necessarily UTF-8. It seems to be putting in the database whatever is on
>> the disk, which can cause problems in post-analysis.  I'm not sure how
>> others are dealing with this. My problem is that on Windows, I'm reading
>> these values with Python and I'm getting exceptions when I attempt to write
>> them to a file.
>>
>>
>>
>> > On Nov 10, 2014, at 1:17 PM, Derrick Karpo <dk...@gm...> wrote:
>> >
>> > I am still using fiwalk but have been transitioning to tsk_loaddb.
>> >
>> > My primary reason is that my forensic indexer (Xapian) automatically
>> > indexes fiwalk text output and I haven't configured it to include
>> > sqlite files yet.  It's a simple config change for me to fully
>> > transition over.
>> >
>> > Derrick
>> >
>> >
>> > On Mon, Nov 10, 2014 at 10:43 AM, Simson Garfinkel <si...@ac...>
>> wrote:
>> >> I see.
>> >>
>> >> The other approach would be to abandon fiwalk and move the things that
>> use it over to using the database produced by tsk_loaddb.
>> >>
>> >> Is anyone other than me using fiwalk at this point?
>> >>
>> >> Simson
>> >>
>> >>
>> >>> On Nov 10, 2014, at 12:40 PM, Brian Carrier <ca...@sl...>
>> wrote:
>> >>>
>> >>> We don't use mingw for the TSK packaging.  Just Visual Studio.  So,
>> it would be much easier to include if there were a visual studio project
>> for it.
>> >>>
>> >>>
>> >>>
>> >>>
>> >>>
>> >>> On Nov 10, 2014, at 12:16 PM, Simson Garfinkel <si...@ac...>
>> wrote:
>> >>>
>> >>>> Hi. I see that fiwalk.exe is not being compiled as part of the
>> pre-compiled SleuthKit download.
>> >>>>
>> >>>> Is there some reason why fiwalk is not included, and is there any
>> packaging change that I could make to make it more likely to include the
>> executable in the future?
>> >>>>
>> >>>> Simson
>> >>>>
>> >>>>
>> >>>>
>> ------------------------------------------------------------------------------
>> >>>> _______________________________________________
>> >>>> sleuthkit-users mailing list
>> >>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> >>>> http://www.sleuthkit.org
>> >>>
>> >>
>> >>
>> >>
>> ------------------------------------------------------------------------------
>> >> _______________________________________________
>> >> sleuthkit-users mailing list
>> >> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> >> http://www.sleuthkit.org
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Comprehensive Server Monitoring with Site24x7.
>> Monitor 10 servers for $9/Month.
>> Get alerted through email, SMS, voice calls or mobile push notifications.
>> Take corrective actions from your mobile device.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>
>
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

[sleuthkit-users] Data errors occurred while running add image

[Alonso C. Q. / R. <re...@gm...>]

Saludos:

  I'm adding a forensic image file with this layout.

---------------
vol1 (Unallocated: 0-62)    1    0    63    Unallocated    Unallocated
vol2 (Linux Swap / Solaris x86 (0x82): 63-996029)    2    63    995967
Linux Swap / Solaris x86 (0x82)    Allocated
vol3 (Linux (0x83): 996030-20964824)    3    996030    19968795    Linux
(0x83)    Allocated
vol4 (Unallocated: 20964825-20971519)    4    20964825    6695
Unallocated    Unallocated
---------------

  But Autopsy 3 expose this messages. Most of the folders have the
"deleted" icon, and size 0.

------------------
ADVERTENCIA: Data errors occurred while running add image.
Exception:  org.sleuthkit.datamodel.TskDataException: Errors occured while
ingesting image
1. Cannot determine file system type (Sector offset: 63, Partition Type:
Linux Swap / Solaris x86 (0x82))

nov 11, 2014 3:53:39 PM org.sleuthkit.autopsy.casemodule.AddImageTask
postProcess
INFORMACIÓN: There were errors that occured in add image process
nov 11, 2014 3:53:39 PM org.sleuthkit.autopsy.casemodule.AddImageTask
commitImage
INFORMACIÓN: Image committed, imageId: 1
nov 11, 2014 3:53:39 PM org.sleuthkit.autopsy.casemodule.AddImageTask
commitImage
INFORMACIÓN: Physical memory usage (max, total, free): 518979584, 37380096,
2262464
JVM heap usage: init = 25165824(24576K) used = 35117632(34294K) committed =
37380096(36504K) max = 518979584(506816K), JVM non-heap usage: init =
163840(160K) used = 27939056(27284K) committed = 28966912(28288K) max =
-1(-1K)
Process Virtual Memory: 881.123.328
------------------

Thanks by your answers.

Atte.

-- 
Alonso Eduardo Caballero Quezada - www.ReYDeS.com/d/?q=blog -
Re...@gm...
Brainbench Certified Network Security, Computer Forensics (US) & Linux
Administration
http://pe.linkedin.com/in/alonsocaballeroquezada -
https://twitter.com/Alonso_ReYDeS
<Re...@gm...>

Re: [sleuthkit-users] fiwalk

[Simson G. <si...@ac...>]

Hi, Brian.

fiwalk uses regular expressions to allow people to specify glob patterns of which files to process and which to ignore, as well as for processing plug-ins.   

For compiling under Windows, the correct thing to do would be to modify fiwalk to use the Microsoft regular expression library. As you indicate, this requires someone building and maintaining a Visual Studio profile. 

I don't recall the exact discussion we had about the file and path names  that TSK returns. I thought that the TSK functions were returning UTF-8, even when data in the file system are stored in UCS-2.  There is a function called tsk_UTF16toUTF8  which receives significant use. Clearly there is some transformation happening, even now.

As Alex indicated, it seems unlikely that we will be able to get current DFXML users to move to SQLite at this point.

I suspect that the correct way forward is your #3 - modify tsk_loaddb to output DFXML and incorporate the other features that are in fiwalk.  But realistically I don't think that anyone is going to do that at this point, since most of the DFXML users are on Linux, not Windows. What they have works.




> On Nov 11, 2014, at 12:26 PM, Brian Carrier <ca...@sl...> wrote:
> 
> Re Encoding:  At one point in TSK's life, we did cleanup of the names to ensure that they were stored in a 'printable' way.  The request was then make (from Simson, as I recall) to not do this cleanup so that there was an accurate representation of what was on disk and it was up to the user of the data to then clean it up as it saw fit for writing to disk or displaying to the user.   If people would rather return to the days of cleaning up in TSK, then we can certainly revisit that. 
> 
> There are certainly things that fiwalk can do that tsk_loaddb doesn't do:
> - SHA-1
> - Can limit output to certain files (based on arguments defined here: http://sancho.ccd.uniroma2.it/cgi-bin/man/man2html?fiwalk+1). 
> 
> I thought there used to be a bunch of regular expression and bloom filter stuff too, but don't see them mentioned in the man page. 
> 
> There seem to be three options:
> 1) Update fiwalk to compile with Visual Studio (i thought the regular expression libraries were an issue here, but I could be wrong -- it's been a while since I tried)
> 2) Force everyone to start using SQLite
> 3) Expand  tsk_loaddb to output DFXML instead of SQLite and as many of the other features as needed that are in fiwalk and not in tsk_loaddb that people want to have transferred.
> 
> 
> On Nov 10, 2014, at 3:18 PM, Simson Garfinkel <si...@ac...> wrote:
> 
>> Derrick,
>> 
>> My recommendation is that you transition away from fiwalk.
>> 
>> My one concern with tsk_loaddb is that the filenames it produces are not necessarily UTF-8. It seems to be putting in the database whatever is on the disk, which can cause problems in post-analysis.  I'm not sure how others are dealing with this. My problem is that on Windows, I'm reading these values with Python and I'm getting exceptions when I attempt to write them to a file. 
>> 
>> 
>> 
>>> On Nov 10, 2014, at 1:17 PM, Derrick Karpo <dk...@gm...> wrote:
>>> 
>>> I am still using fiwalk but have been transitioning to tsk_loaddb.
>>> 
>>> My primary reason is that my forensic indexer (Xapian) automatically
>>> indexes fiwalk text output and I haven't configured it to include
>>> sqlite files yet.  It's a simple config change for me to fully
>>> transition over.
>>> 
>>> Derrick
>>> 
>>> 
>>> On Mon, Nov 10, 2014 at 10:43 AM, Simson Garfinkel <si...@ac...> wrote:
>>>> I see.
>>>> 
>>>> The other approach would be to abandon fiwalk and move the things that use it over to using the database produced by tsk_loaddb.
>>>> 
>>>> Is anyone other than me using fiwalk at this point?
>>>> 
>>>> Simson
>>>> 
>>>> 
>>>>> On Nov 10, 2014, at 12:40 PM, Brian Carrier <ca...@sl...> wrote:
>>>>> 
>>>>> We don't use mingw for the TSK packaging.  Just Visual Studio.  So, it would be much easier to include if there were a visual studio project for it.
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>> On Nov 10, 2014, at 12:16 PM, Simson Garfinkel <si...@ac...> wrote:
>>>>> 
>>>>>> Hi. I see that fiwalk.exe is not being compiled as part of the pre-compiled SleuthKit download.
>>>>>> 
>>>>>> Is there some reason why fiwalk is not included, and is there any packaging change that I could make to make it more likely to include the executable in the future?
>>>>>> 
>>>>>> Simson
>>>>>> 
>>>>>> 
>>>>>> ------------------------------------------------------------------------------
>>>>>> _______________________________________________
>>>>>> sleuthkit-users mailing list
>>>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>>>> http://www.sleuthkit.org
>>>>> 
>>>> 
>>>> 
>>>> ------------------------------------------------------------------------------
>>>> _______________________________________________
>>>> sleuthkit-users mailing list
>>>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>> http://www.sleuthkit.org
>> 
>> 
>> ------------------------------------------------------------------------------
>> Comprehensive Server Monitoring with Site24x7.
>> Monitor 10 servers for $9/Month.
>> Get alerted through email, SMS, voice calls or mobile push notifications.
>> Take corrective actions from your mobile device.
>> http://pubads.g.doubleclick.net/gampad/clk?id=154624111&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>