sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] Autopsy...

[Grundy B. J T. <Bar...@ti...>]

Greg's answer is dead on.  

I would add that 'cross verification' is always a good idea.  You can use a primary tool as much as you like.  Take your results and verify them with another tool.  That does not mean re-running the entire exam.  It can be as simple as taking a half dozen data points and comparing the various metadata (allocation and block status, attribution/ownership, temporal data, etc.).  Even then, keep in mind that different tools may show different results.  It's explaining these differences (if they exist) that makes your testimony stronger.  Understand the output.  Digital forensics is about interpreting results, not simply recovering data.  If you trust the output of a tool simply because 'everyone else is using it', then you are dead wrong.

My $.02

/*******************************************
Barry J. Grundy
Assistant Special Agent in Charge
Digital Forensic Support Group
Treasury Inspector General for Tax Administration
(301) 210-8741 (desk)
(202) 527-5778 (cell)
Bar...@ti...
********************************************\


> -----Original Message-----
> From: Greg Freemyer [mailto:gre...@gm...]
> Sent: Thursday, October 16, 2014 9:52 AM
> To: Frederick Haggerty
> Cc: sle...@li... users
> Subject: Re: [sleuthkit-users] Autopsy...
> 
> There is no such thing as a court approved tool.
> 
> Testifying experts are approved.  Their choice of tools reflects on them, but
> even then the tool is the minor player.
> 
> For instance many think a Ghost image is unacceptable, but in the hands of
> someone that knows how to use it and explain it, then Ghost Images can be
> used as a tool by a testifying expert.
> 
> On the hand, an untrained person using FTK or EnCase doesn't suddenly
> become an expert just because they use a tool often used by testifying
> experts.
> 
> Greg
> 
> On Thu, Oct 16, 2014 at 9:26 AM, Frederick Haggerty
> <fre...@gm...> wrote:
> > Hello,
> >
> > I have been using Autopsy (windows version) for about a year or so and
> > I really enjoy it and I try to stay up-to-date by subscribing to this
> > mailing list.  I was hoping to attend the Open Source Digital
> > Forsensics Conference in November but due my schedule I don't think
> > I'll make it but will look to take some Autopsy training in the near future.
> >
> > The question I want to ask the users is regarding using Autopsy on an
> > actual case.
> >
> > Is Autopsy a recommended/allowable tool to use on an actual court case
> > (in the eyes or the courts) if I am requested to help?
> >
> > If such a list exists can someone provide me point me in the direction
> > of court approved tools that could be used?
> >
> > Thanks in advance for all your help.
> >
> > -Frederick
> >
> > ----------------------------------------------------------------------
> > -------- Comprehensive Server Monitoring with Site24x7.
> > Monitor 10 servers for $9/Month.
> > Get alerted through email, SMS, voice calls or mobile push notifications.
> > Take corrective actions from your mobile device.
> > http://p.sf.net/sfu/Zoho
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >
> 
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://p.sf.net/sfu/Zoho
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Autopsy...

[Frederick H. <fre...@gm...>]

Awesome.  Thank you so much Mr. Barry.

On Thu, Oct 16, 2014 at 10:07 AM, Grundy Barry J TIGTA <
Bar...@ti...> wrote:

> Greg's answer is dead on.
>
> I would add that 'cross verification' is always a good idea.  You can use
> a primary tool as much as you like.  Take your results and verify them with
> another tool.  That does not mean re-running the entire exam.  It can be as
> simple as taking a half dozen data points and comparing the various
> metadata (allocation and block status, attribution/ownership, temporal
> data, etc.).  Even then, keep in mind that different tools may show
> different results.  It's explaining these differences (if they exist) that
> makes your testimony stronger.  Understand the output.  Digital forensics
> is about interpreting results, not simply recovering data.  If you trust
> the output of a tool simply because 'everyone else is using it', then you
> are dead wrong.
>
> My $.02
>
> /*******************************************
> Barry J. Grundy
> Assistant Special Agent in Charge
> Digital Forensic Support Group
> Treasury Inspector General for Tax Administration
> (301) 210-8741 (desk)
> (202) 527-5778 (cell)
> Bar...@ti...
> ********************************************\
>
>
> > -----Original Message-----
> > From: Greg Freemyer [mailto:gre...@gm...]
> > Sent: Thursday, October 16, 2014 9:52 AM
> > To: Frederick Haggerty
> > Cc: sle...@li... users
> > Subject: Re: [sleuthkit-users] Autopsy...
> >
> > There is no such thing as a court approved tool.
> >
> > Testifying experts are approved.  Their choice of tools reflects on
> them, but
> > even then the tool is the minor player.
> >
> > For instance many think a Ghost image is unacceptable, but in the hands
> of
> > someone that knows how to use it and explain it, then Ghost Images can be
> > used as a tool by a testifying expert.
> >
> > On the hand, an untrained person using FTK or EnCase doesn't suddenly
> > become an expert just because they use a tool often used by testifying
> > experts.
> >
> > Greg
> >
> > On Thu, Oct 16, 2014 at 9:26 AM, Frederick Haggerty
> > <fre...@gm...> wrote:
> > > Hello,
> > >
> > > I have been using Autopsy (windows version) for about a year or so and
> > > I really enjoy it and I try to stay up-to-date by subscribing to this
> > > mailing list.  I was hoping to attend the Open Source Digital
> > > Forsensics Conference in November but due my schedule I don't think
> > > I'll make it but will look to take some Autopsy training in the near
> future.
> > >
> > > The question I want to ask the users is regarding using Autopsy on an
> > > actual case.
> > >
> > > Is Autopsy a recommended/allowable tool to use on an actual court case
> > > (in the eyes or the courts) if I am requested to help?
> > >
> > > If such a list exists can someone provide me point me in the direction
> > > of court approved tools that could be used?
> > >
> > > Thanks in advance for all your help.
> > >
> > > -Frederick
> > >
> > > ----------------------------------------------------------------------
> > > -------- Comprehensive Server Monitoring with Site24x7.
> > > Monitor 10 servers for $9/Month.
> > > Get alerted through email, SMS, voice calls or mobile push
> notifications.
> > > Take corrective actions from your mobile device.
> > > http://p.sf.net/sfu/Zoho
> > > _______________________________________________
> > > sleuthkit-users mailing list
> > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > > http://www.sleuthkit.org
> > >
> >
> >
> ------------------------------------------------------------------------------
> > Comprehensive Server Monitoring with Site24x7.
> > Monitor 10 servers for $9/Month.
> > Get alerted through email, SMS, voice calls or mobile push notifications.
> > Take corrective actions from your mobile device.
> > http://p.sf.net/sfu/Zoho
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>

Re: [sleuthkit-users] Autopsy...

[Frederick H. <fre...@gm...>]

Hello Mr. Freemyer,

Thank you for the quick response.  Understood.

I've been a developer most/all my career and I've been making the
transition to digital forensics.
This is one of the questions I've been wanting to get some clarity on.
Thank you so much for
the insight.

-Frederick

On Thu, Oct 16, 2014 at 9:51 AM, Greg Freemyer <gre...@gm...>
wrote:

> There is no such thing as a court approved tool.
>
> Testifying experts are approved.  Their choice of tools reflects on
> them, but even then the tool is the minor player.
>
> For instance many think a Ghost image is unacceptable, but in the
> hands of someone that knows how to use it and explain it, then Ghost
> Images can be used as a tool by a testifying expert.
>
> On the hand, an untrained person using FTK or EnCase doesn't suddenly
> become an expert just because they use a tool often used by testifying
> experts.
>
> Greg
>
> On Thu, Oct 16, 2014 at 9:26 AM, Frederick Haggerty
> <fre...@gm...> wrote:
> > Hello,
> >
> > I have been using Autopsy (windows version) for about a year or so and I
> > really enjoy it and I try to
> > stay up-to-date by subscribing to this mailing list.  I was hoping to
> attend
> > the Open Source Digital
> > Forsensics Conference in November but due my schedule I don't think I'll
> > make it but will look to take some Autopsy training in the near future.
> >
> > The question I want to ask the users is regarding using Autopsy on an
> actual
> > case.
> >
> > Is Autopsy a recommended/allowable tool to use on an actual court case
> (in
> > the eyes or the courts) if I am requested to help?
> >
> > If such a list exists can someone provide me point me in the direction of
> > court approved tools that could be used?
> >
> > Thanks in advance for all your help.
> >
> > -Frederick
> >
> >
> ------------------------------------------------------------------------------
> > Comprehensive Server Monitoring with Site24x7.
> > Monitor 10 servers for $9/Month.
> > Get alerted through email, SMS, voice calls or mobile push notifications.
> > Take corrective actions from your mobile device.
> > http://p.sf.net/sfu/Zoho
> > _______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> >
>

Re: [sleuthkit-users] Autopsy...

[Greg F. <gre...@gm...>]

There is no such thing as a court approved tool.

Testifying experts are approved.  Their choice of tools reflects on
them, but even then the tool is the minor player.

For instance many think a Ghost image is unacceptable, but in the
hands of someone that knows how to use it and explain it, then Ghost
Images can be used as a tool by a testifying expert.

On the hand, an untrained person using FTK or EnCase doesn't suddenly
become an expert just because they use a tool often used by testifying
experts.

Greg

On Thu, Oct 16, 2014 at 9:26 AM, Frederick Haggerty
<fre...@gm...> wrote:
> Hello,
>
> I have been using Autopsy (windows version) for about a year or so and I
> really enjoy it and I try to
> stay up-to-date by subscribing to this mailing list.  I was hoping to attend
> the Open Source Digital
> Forsensics Conference in November but due my schedule I don't think I'll
> make it but will look to take some Autopsy training in the near future.
>
> The question I want to ask the users is regarding using Autopsy on an actual
> case.
>
> Is Autopsy a recommended/allowable tool to use on an actual court case (in
> the eyes or the courts) if I am requested to help?
>
> If such a list exists can someone provide me point me in the direction of
> court approved tools that could be used?
>
> Thanks in advance for all your help.
>
> -Frederick
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://p.sf.net/sfu/Zoho
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] Autopsy...

[Frederick H. <fre...@gm...>]

Hello,

I have been using Autopsy (windows version) for about a year or so and I
really enjoy it and I try to
stay up-to-date by subscribing to this mailing list.  I was hoping to
attend the Open Source Digital
Forsensics Conference in November but due my schedule I don't think I'll
make it but will look to take some Autopsy training in the near future.

The question I want to ask the users is regarding using Autopsy on an
actual case.

Is Autopsy a recommended/allowable tool to use on an actual court case (in
the eyes or the courts) if I am requested to help?

If such a list exists can someone provide me point me in the direction of
court approved tools that could be used?

Thanks in advance for all your help.

-Frederick

Re: [sleuthkit-users] Using libtsk.lib with qt under windows

[<ma...@mh...>]

Hi Brian,

I compile to program with mingw. I allready tried to convert the lib  
with the reimp tool. The tool runs around 10 minutes but I didn't get  
any output.

On the second step I tried to compile the sleuthkit with mingw. During  
the compilation I found 2 Problems:

- I was not able to include the libewf library. If I determine the  
path, the libtool throws an error.
- If I try to compile the sleuthkit without libewf support, I get an  
error because of a missing regex.h header file.

Markus

Quoting Brian Carrier <ca...@sl...>:

> Are you compiling your program with mingw?
>
>
> On Oct 9, 2014, at 9:17 AM, ma...@mh... wrote:
>
>>
>> Hi,
>>
>> I tried to use the libtsk.lib in a qt project under windows.
>> So I downloaded the sleuthkit-4.1.3-win32 and the src files of  
>> version 4.1.3.
>> After this I add the link to the library in my project file:
>>
>>      win32: LIBS +=
>> -L$$PWD/../../sleuthkit/sleuthkit-4.1.3-win32/lib/ -llibtsk
>>
>>      INCLUDEPATH += $$PWD/../../sleuthkit/sleuthkit-4.1.3-win32
>>      DEPENDPATH += $$PWD/../../sleuthkit/sleuthkit-4.1.3-win32
>>
>> In my main.cpp I include the <tsk/libtsk.h> header and try to open an Image:
>>     TskImgInfo *imgInfo;
>>     imgInfo = new TskImgInfo();
>>     imgInfo->open("F:\37-0147-14\02\02.E01", TSK_IMG_TYPE_DETECT, 0);
>>
>> The compilation works well, but during the linking I get the  
>> following error:
>> E:\Projects\ICQGrabber\tsk_api_test\TSK_API_TEST\main.cpp:-1: Fehler:
>> undefined reference to `tsk_img_open_utf8_sing'
>>
>> I tried build my own lib with visual studio. But when I use the same
>> library I get the same error.
>>
>> Thanks for your help
>>
>> Markus
>>
>>
>> ------------------------------------------------------------------------------
>> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
>> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
>> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
>> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
>> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org

Re: [sleuthkit-users] Using libtsk.lib with qt under windows

[Brian C. <ca...@sl...>]

Are you compiling your program with mingw?


On Oct 9, 2014, at 9:17 AM, ma...@mh... wrote:

> 
> Hi,
> 
> I tried to use the libtsk.lib in a qt project under windows.
> So I downloaded the sleuthkit-4.1.3-win32 and the src files of version 4.1.3.
> After this I add the link to the library in my project file:
> 
>      win32: LIBS +=  
> -L$$PWD/../../sleuthkit/sleuthkit-4.1.3-win32/lib/ -llibtsk
> 
>      INCLUDEPATH += $$PWD/../../sleuthkit/sleuthkit-4.1.3-win32
>      DEPENDPATH += $$PWD/../../sleuthkit/sleuthkit-4.1.3-win32
> 
> In my main.cpp I include the <tsk/libtsk.h> header and try to open an Image:
>     TskImgInfo *imgInfo;
>     imgInfo = new TskImgInfo();
>     imgInfo->open("F:\37-0147-14\02\02.E01", TSK_IMG_TYPE_DETECT, 0);
> 
> The compilation works well, but during the linking I get the following error:
> E:\Projects\ICQGrabber\tsk_api_test\TSK_API_TEST\main.cpp:-1: Fehler:  
> undefined reference to `tsk_img_open_utf8_sing'
> 
> I tried build my own lib with visual studio. But when I use the same  
> library I get the same error.
> 
> Thanks for your help
> 
> Markus
> 
> 
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Open Autopsy multiple times

[Brian C. <ca...@sl...>]

My guess is that you'd get into trouble with SOLR.  Autopsy detects if its SOLR instance is running at startup and kills it if it is and then starts a new one.  It kills existing ones because we've had cases where it did not shut down properly when Autopsy shuts down. Do you really want Autopsy open multiple times or do you want multiple cases open or both?



On Oct 10, 2014, at 4:48 AM, Adam Mariš <mar...@gm...> wrote:

> Hello,
> 
> is it possible to open Autopsy multiple times? Is there any command option that would allow me to run multiple instances of program?
> 
> Thank you very much,
> 
> Adam
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Brian C. <ca...@sl...>]

TSK/Autopsy support sparse files.  If you can run the 'istat' TSK tool on the files, it would be interesting to see what it reports as the layout of the file.  this info is not currently available in Autopsy because:

1) We don't populate the layout table in the SQLite table because it is slow and makes the initial ingest take much longer (and we don't really need it because we use the TSK code each time we read the file content, not the DB layout details).
2) We don't display the 'istat' output in Autopsy. But, we really should. 


On Oct 10, 2014, at 8:49 PM, Luís Filipe Nassif <lfc...@gm...> wrote:

> Jon Stewart has pointed that $BadClus·$Bad files are sparse files. Does anyone know if that is the case with the  {xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}{3808876b-c176-4e48-b7ae-04046e6cc752} volume shadow files?
> 
> If yes, does sleuthkit have support for ntfs sparse files?
> 
> Thanks,
> Luis
> 
> 2014-10-08 18:40 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
> The blue color are also used to render the contents of $BadClus·$Bad files...
> 
> 2014-10-08 18:34 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
> 
> Another useful information: the contents of those files are rendered with a blue color by the hex viewer of Encase, so it means they are special in some way. Does anyone know what it means?
> 
> 2014-10-06 13:31 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
> 
> Hi Alex,
> 
> I am using the Autopsy 3.1 interface to view the files and the sleuthkit java bindings api within a custom java application to extract its contents through the ReadContentInputStream class.
> 
> Thanks
> Luis
> 
> 2014-10-06 12:38 GMT-03:00 Alex Nelson <ajn...@cs...>:
> Hi Luis,
> 
> 
> Which of the TSK tools are you using to extract those files?  Could you provide an example command?  (I'd forgotten TSK could do anything with volume shadow copies.)
> 
> --Alex
> 
> 
> On Oct 5, 2014, at 21:47 , Luís Filipe Nassif <lfc...@gm...> wrote:
> 
> > Hi,
> >
> > We are getting incorrect results with sleuthkit 4.1.3 and 4.2.0 when reading the contents of a lot of windows volume shadow copy files from many disk images. The contents of these files are being reported as zeroed files by sleuthkit. But they are not zeroed files, as reported by other forensic tools. So we are not being able to carve these files using sleuthkit. If we can provide more info to help addressing the issue, please let us know.
> >
> > Any help will be appreciated,
> > Luis Nassif
> > ------------------------------------------------------------------------------
> > Slashdot TV.  Videos for Nerds.  Stuff that Matters.
> > http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk_______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
> 
> 
> 
> 
> 
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://p.sf.net/sfu/Zoho_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Regex in Keyword Lists

[Brian C. <ca...@sl...>]

Hi Josh,

That is a known bug that has been fixed. Thanks and sorry.  There is no work around...

brian


On Oct 15, 2014, at 4:10 PM, Josh McCune <mc...@ks...> wrote:

> I must be missing something obvious, but I can’t seem to make regex based
> keyword searches work in Autopsy 3.1.0 (running on Windows 8).  In the
> Advanced Keyword Search Configuration Dialog, the “Regular Expression”
> checkbox is greyed out and won’t allow you to select it.  I tried to work
> around it by manually editing the the xml and then importing the list.
> When I do that, it shows up in the keyword list with the RegEx box
> checked, but it doesn’t seem to actually return any results.  Granted, I’m
> trying to do a somewhat complicated query:
> 
> Foo((\s{1,3}(?:[a-zA-Z\-\.]{1,} ?){0,2}\s)|\s{1,3})Bar
> 
> …”Bar" within 3 words after “Foo”.  But even simple regex entered in to
> the Keyword Search bar doesn’t seem to return results properly.
> 
> Suggestions?
> 
> Thanks,
> Josh
> 
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://p.sf.net/sfu/Zoho
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Regex in Keyword Lists

[Josh M. <mc...@ks...>]

I must be missing something obvious, but I can’t seem to make regex based
keyword searches work in Autopsy 3.1.0 (running on Windows 8).  In the
Advanced Keyword Search Configuration Dialog, the “Regular Expression”
checkbox is greyed out and won’t allow you to select it.  I tried to work
around it by manually editing the the xml and then importing the list.
When I do that, it shows up in the keyword list with the RegEx box
checked, but it doesn’t seem to actually return any results.  Granted, I’m
trying to do a somewhat complicated query:

 Foo((\s{1,3}(?:[a-zA-Z\-\.]{1,} ?){0,2}\s)|\s{1,3})Bar

…”Bar" within 3 words after “Foo”.  But even simple regex entered in to
the Keyword Search bar doesn’t seem to return results properly.

Suggestions?

Thanks,
Josh

Re: [sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Luís F. N. <lfc...@gm...>]

Jon Stewart has pointed that $BadClus·$Bad files are sparse files. Does
anyone know if that is the case with the  {xxxxxxx-xxxx-xxxx-xxxx-
xxxxxxxxxxxx}{3808876b-c176-4e48-b7ae-04046e6cc752} volume shadow files?

If yes, does sleuthkit have support for ntfs sparse files?

Thanks,
Luis

2014-10-08 18:40 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:

> The blue color are also used to render the contents of $BadClus·$Bad
> files...
>
> 2014-10-08 18:34 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>
> Another useful information: the contents of those files are rendered with
>> a blue color by the hex viewer of Encase, so it means they are special in
>> some way. Does anyone know what it means?
>>
>> 2014-10-06 13:31 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>>
>> Hi Alex,
>>>
>>> I am using the Autopsy 3.1 interface to view the files and the sleuthkit
>>> java bindings api within a custom java application to extract its contents
>>> through the ReadContentInputStream class.
>>>
>>> Thanks
>>> Luis
>>>
>>> 2014-10-06 12:38 GMT-03:00 Alex Nelson <ajn...@cs...>:
>>>
>>>> Hi Luis,
>>>>
>>>>
>>>> Which of the TSK tools are you using to extract those files?  Could you
>>>> provide an example command?  (I'd forgotten TSK could do anything with
>>>> volume shadow copies.)
>>>>
>>>> --Alex
>>>>
>>>>
>>>> On Oct 5, 2014, at 21:47 , Luís Filipe Nassif <lfc...@gm...>
>>>> wrote:
>>>>
>>>> > Hi,
>>>> >
>>>> > We are getting incorrect results with sleuthkit 4.1.3 and 4.2.0 when
>>>> reading the contents of a lot of windows volume shadow copy files from many
>>>> disk images. The contents of these files are being reported as zeroed files
>>>> by sleuthkit. But they are not zeroed files, as reported by other forensic
>>>> tools. So we are not being able to carve these files using sleuthkit. If we
>>>> can provide more info to help addressing the issue, please let us know.
>>>> >
>>>> > Any help will be appreciated,
>>>> > Luis Nassif
>>>> >
>>>> ------------------------------------------------------------------------------
>>>> > Slashdot TV.  Videos for Nerds.  Stuff that Matters.
>>>> >
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk_______________________________________________
>>>> > sleuthkit-users mailing list
>>>> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>>> > http://www.sleuthkit.org
>>>>
>>>>
>>>
>>
>

[sleuthkit-users] Open Autopsy multiple times

[Adam M. <mar...@gm...>]

Hello,

is it possible to open Autopsy multiple times? Is there any command option
that would allow me to run multiple instances of program?

Thank you very much,

Adam

[sleuthkit-users] Using libtsk.lib with qt under windows

[<ma...@mh...>]

Hi,

I tried to use the libtsk.lib in a qt project under windows.
So I downloaded the sleuthkit-4.1.3-win32 and the src files of version 4.1.3.
After this I add the link to the library in my project file:

      win32: LIBS +=  
-L$$PWD/../../sleuthkit/sleuthkit-4.1.3-win32/lib/ -llibtsk

      INCLUDEPATH += $$PWD/../../sleuthkit/sleuthkit-4.1.3-win32
      DEPENDPATH += $$PWD/../../sleuthkit/sleuthkit-4.1.3-win32

In my main.cpp I include the <tsk/libtsk.h> header and try to open an Image:
     TskImgInfo *imgInfo;
     imgInfo = new TskImgInfo();
     imgInfo->open("F:\37-0147-14\02\02.E01", TSK_IMG_TYPE_DETECT, 0);

The compilation works well, but during the linking I get the following error:
E:\Projects\ICQGrabber\tsk_api_test\TSK_API_TEST\main.cpp:-1: Fehler:  
undefined reference to `tsk_img_open_utf8_sing'

I tried build my own lib with visual studio. But when I use the same  
library I get the same error.

Thanks for your help

Markus

Re: [sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Luís F. N. <lfc...@gm...>]

I think tsk_file_layout is only populated with virtual files, like
unallocated clusters, and allocated files do not have entries in that table.

2014-10-09 9:58 GMT-03:00 Atila <ati...@dp...>:

>  In tsk_loaddb, resident files don't get into tsk_file_layout (and
> sometimes there are two series of sequences to one file, but that's another
> problem).
> Maybe the same thing is happening here too?
>
>
> On 08-10-2014 18:34, Luís Filipe Nassif wrote:
>
> Another useful information: the contents of those files are rendered with
> a blue color by the hex viewer of Encase, so it means they are special in
> some way. Does anyone know what it means?
>
> 2014-10-06 13:31 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>
>> Hi Alex,
>>
>>  I am using the Autopsy 3.1 interface to view the files and the
>> sleuthkit java bindings api within a custom java application to extract its
>> contents through the ReadContentInputStream class.
>>
>>  Thanks
>> Luis
>>
>> 2014-10-06 12:38 GMT-03:00 Alex Nelson <ajn...@cs...>:
>>
>>> Hi Luis,
>>>
>>>
>>> Which of the TSK tools are you using to extract those files?  Could you
>>> provide an example command?  (I'd forgotten TSK could do anything with
>>> volume shadow copies.)
>>>
>>> --Alex
>>>
>>>
>>> On Oct 5, 2014, at 21:47 , Luís Filipe Nassif <lfc...@gm...>
>>> wrote:
>>>
>>> > Hi,
>>> >
>>> > We are getting incorrect results with sleuthkit 4.1.3 and 4.2.0 when
>>> reading the contents of a lot of windows volume shadow copy files from many
>>> disk images. The contents of these files are being reported as zeroed files
>>> by sleuthkit. But they are not zeroed files, as reported by other forensic
>>> tools. So we are not being able to carve these files using sleuthkit. If we
>>> can provide more info to help addressing the issue, please let us know.
>>> >
>>> > Any help will be appreciated,
>>> > Luis Nassif
>>>  >
>>> ------------------------------------------------------------------------------
>>> > Slashdot TV.  Videos for Nerds.  Stuff that Matters.
>>> >
>>> http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk_______________________________________________
>>> > sleuthkit-users mailing list
>>> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> > http://www.sleuthkit.org
>>>
>>>
>>
>
>
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzerhttp://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
>
>
>
> _______________________________________________
> sleuthkit-users mailing listhttps://lists.sourceforge.net/lists/listinfo/sleuthkit-usershttp://www.sleuthkit.org
>
>
>
>
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
>
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Atila <ati...@dp...>]

In tsk_loaddb, resident files don't get into tsk_file_layout (and 
sometimes there are two series of sequences to one file, but that's 
another problem).
Maybe the same thing is happening here too?

On 08-10-2014 18:34, Luís Filipe Nassif wrote:
> Another useful information: the contents of those files are rendered 
> with a blue color by the hex viewer of Encase, so it means they are 
> special in some way. Does anyone know what it means?
>
> 2014-10-06 13:31 GMT-03:00 Luís Filipe Nassif <lfc...@gm... 
> <mailto:lfc...@gm...>>:
>
>     Hi Alex,
>
>     I am using the Autopsy 3.1 interface to view the files and the
>     sleuthkit java bindings api within a custom java application to
>     extract its contents through the ReadContentInputStream class.
>
>     Thanks
>     Luis
>
>     2014-10-06 12:38 GMT-03:00 Alex Nelson <ajn...@cs...
>     <mailto:ajn...@cs...>>:
>
>         Hi Luis,
>
>
>         Which of the TSK tools are you using to extract those files? 
>         Could you provide an example command?  (I'd forgotten TSK
>         could do anything with volume shadow copies.)
>
>         --Alex
>
>
>         On Oct 5, 2014, at 21:47 , Luís Filipe Nassif
>         <lfc...@gm... <mailto:lfc...@gm...>> wrote:
>
>         > Hi,
>         >
>         > We are getting incorrect results with sleuthkit 4.1.3 and
>         4.2.0 when reading the contents of a lot of windows volume
>         shadow copy files from many disk images. The contents of these
>         files are being reported as zeroed files by sleuthkit. But
>         they are not zeroed files, as reported by other forensic
>         tools. So we are not being able to carve these files using
>         sleuthkit. If we can provide more info to help addressing the
>         issue, please let us know.
>         >
>         > Any help will be appreciated,
>         > Luis Nassif
>         >
>         ------------------------------------------------------------------------------
>         > Slashdot TV.  Videos for Nerds.  Stuff that Matters.
>         >
>         http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk_______________________________________________
>         > sleuthkit-users mailing list
>         > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>         > http://www.sleuthkit.org
>
>
>
>
>
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
>
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Luís F. N. <lfc...@gm...>]

The blue color are also used to render the contents of $BadClus·$Bad
files...

2014-10-08 18:34 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:

> Another useful information: the contents of those files are rendered with
> a blue color by the hex viewer of Encase, so it means they are special in
> some way. Does anyone know what it means?
>
> 2014-10-06 13:31 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:
>
> Hi Alex,
>>
>> I am using the Autopsy 3.1 interface to view the files and the sleuthkit
>> java bindings api within a custom java application to extract its contents
>> through the ReadContentInputStream class.
>>
>> Thanks
>> Luis
>>
>> 2014-10-06 12:38 GMT-03:00 Alex Nelson <ajn...@cs...>:
>>
>>> Hi Luis,
>>>
>>>
>>> Which of the TSK tools are you using to extract those files?  Could you
>>> provide an example command?  (I'd forgotten TSK could do anything with
>>> volume shadow copies.)
>>>
>>> --Alex
>>>
>>>
>>> On Oct 5, 2014, at 21:47 , Luís Filipe Nassif <lfc...@gm...>
>>> wrote:
>>>
>>> > Hi,
>>> >
>>> > We are getting incorrect results with sleuthkit 4.1.3 and 4.2.0 when
>>> reading the contents of a lot of windows volume shadow copy files from many
>>> disk images. The contents of these files are being reported as zeroed files
>>> by sleuthkit. But they are not zeroed files, as reported by other forensic
>>> tools. So we are not being able to carve these files using sleuthkit. If we
>>> can provide more info to help addressing the issue, please let us know.
>>> >
>>> > Any help will be appreciated,
>>> > Luis Nassif
>>> >
>>> ------------------------------------------------------------------------------
>>> > Slashdot TV.  Videos for Nerds.  Stuff that Matters.
>>> >
>>> http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk_______________________________________________
>>> > sleuthkit-users mailing list
>>> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>>> > http://www.sleuthkit.org
>>>
>>>
>>
>

Re: [sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Luís F. N. <lfc...@gm...>]

Another useful information: the contents of those files are rendered with a
blue color by the hex viewer of Encase, so it means they are special in
some way. Does anyone know what it means?

2014-10-06 13:31 GMT-03:00 Luís Filipe Nassif <lfc...@gm...>:

> Hi Alex,
>
> I am using the Autopsy 3.1 interface to view the files and the sleuthkit
> java bindings api within a custom java application to extract its contents
> through the ReadContentInputStream class.
>
> Thanks
> Luis
>
> 2014-10-06 12:38 GMT-03:00 Alex Nelson <ajn...@cs...>:
>
>> Hi Luis,
>>
>>
>> Which of the TSK tools are you using to extract those files?  Could you
>> provide an example command?  (I'd forgotten TSK could do anything with
>> volume shadow copies.)
>>
>> --Alex
>>
>>
>> On Oct 5, 2014, at 21:47 , Luís Filipe Nassif <lfc...@gm...>
>> wrote:
>>
>> > Hi,
>> >
>> > We are getting incorrect results with sleuthkit 4.1.3 and 4.2.0 when
>> reading the contents of a lot of windows volume shadow copy files from many
>> disk images. The contents of these files are being reported as zeroed files
>> by sleuthkit. But they are not zeroed files, as reported by other forensic
>> tools. So we are not being able to carve these files using sleuthkit. If we
>> can provide more info to help addressing the issue, please let us know.
>> >
>> > Any help will be appreciated,
>> > Luis Nassif
>> >
>> ------------------------------------------------------------------------------
>> > Slashdot TV.  Videos for Nerds.  Stuff that Matters.
>> >
>> http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk_______________________________________________
>> > sleuthkit-users mailing list
>> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> > http://www.sleuthkit.org
>>
>>
>

[sleuthkit-users] Autopsy 3.1.1 release

[Adam M. <mar...@gm...>]

Hello,

please, I'd like to know when approximately will the new version 3.1.1 be
released. Will be possible to take part in testing?

Thank you very much,

Adam

Re: [sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Luís F. N. <lfc...@gm...>]

Hi Alex,

I am using the Autopsy 3.1 interface to view the files and the sleuthkit
java bindings api within a custom java application to extract its contents
through the ReadContentInputStream class.

Thanks
Luis

2014-10-06 12:38 GMT-03:00 Alex Nelson <ajn...@cs...>:

> Hi Luis,
>
> Which of the TSK tools are you using to extract those files?  Could you
> provide an example command?  (I'd forgotten TSK could do anything with
> volume shadow copies.)
>
> --Alex
>
>
> On Oct 5, 2014, at 21:47 , Luís Filipe Nassif <lfc...@gm...> wrote:
>
> > Hi,
> >
> > We are getting incorrect results with sleuthkit 4.1.3 and 4.2.0 when
> reading the contents of a lot of windows volume shadow copy files from many
> disk images. The contents of these files are being reported as zeroed files
> by sleuthkit. But they are not zeroed files, as reported by other forensic
> tools. So we are not being able to carve these files using sleuthkit. If we
> can provide more info to help addressing the issue, please let us know.
> >
> > Any help will be appreciated,
> > Luis Nassif
> >
> ------------------------------------------------------------------------------
> > Slashdot TV.  Videos for Nerds.  Stuff that Matters.
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk_______________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Alex N. <ajn...@cs...>]

Hi Luis,

Which of the TSK tools are you using to extract those files?  Could you provide an example command?  (I'd forgotten TSK could do anything with volume shadow copies.)

--Alex


On Oct 5, 2014, at 21:47 , Luís Filipe Nassif <lfc...@gm...> wrote:

> Hi,
> 
> We are getting incorrect results with sleuthkit 4.1.3 and 4.2.0 when reading the contents of a lot of windows volume shadow copy files from many disk images. The contents of these files are being reported as zeroed files by sleuthkit. But they are not zeroed files, as reported by other forensic tools. So we are not being able to carve these files using sleuthkit. If we can provide more info to help addressing the issue, please let us know.
> 
> Any help will be appreciated,
> Luis Nassif
> ------------------------------------------------------------------------------
> Slashdot TV.  Videos for Nerds.  Stuff that Matters.
> http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Wrong results when reading System Volume Shadow Files

[Luís F. N. <lfc...@gm...>]

Hi,

We are getting incorrect results with sleuthkit 4.1.3 and 4.2.0 when
reading the contents of a lot of windows volume shadow copy files from many
disk images. The contents of these files are being reported as zeroed files
by sleuthkit. But they are not zeroed files, as reported by other forensic
tools. So we are not being able to carve these files using sleuthkit. If we
can provide more info to help addressing the issue, please let us know.

Any help will be appreciated,
Luis Nassif

Re: [sleuthkit-users] evidence locker directory change

[Brian C. <ca...@sl...>]

Hi David,

There is no evidence locker in Autopsy 3.  In Autopsy 2, the evidence locker was a hard coded base directory to store cases in. As Jason mentioned, in Autopsy 3, you can change the base directory for each case in the New Case wizard.

brian



On Oct 2, 2014, at 4:45 PM, David Granger <l3...@gm...> wrote:

> Just installed autopsy 3.1 and want to change evidence locker directory. Only reference I see is to modify conf.pl lockdir but this is not available in the windows version. Can anyone help out?
> 
> -- 
> Best,
> 
> David 
> ------------------------------------------------------------------------------
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] evidence locker directory change

[Jason L. <jle...@ba...>]

Hi David - when you create a case you can select the "base directory" in
the case wizard - the folder in that location will be named for the name of
the case you enter.  If you're looking to move an existing case directory,
you can just move the directory - it's all self contained.  Is this what
you are looking for?

Jason

On Thursday, October 2, 2014, David Granger <l3...@gm...> wrote:

> Just installed autopsy 3.1 and want to change evidence locker directory.
> Only reference I see is to modify conf.pl lockdir but this is not
> available in the windows version. Can anyone help out?
>
> --
> Best,
>
> David
>

[sleuthkit-users] evidence locker directory change

[David G. <l3...@gm...>]

Just installed autopsy 3.1 and want to change evidence locker directory.
Only reference I see is to modify conf.pl lockdir but this is not available
in the windows version. Can anyone help out?

-- 
Best,

David