sleuthkit-users

Re: [sleuthkit-users] Unallocated files in Solaris

[Brian C. <ca...@sl...>]

brian hutson <bh...@ne...> said:

> hello
> i am at present examining a Solaris 8 system that has a large number
> of files
> deleted around the period of a possible break in. My understanding
> is that
> Solaris unlinks deleted filenames from metadata thus making retrieval of
> unallocated data very difficult. Is this correct?


Yes, that is correct.  Solaris removes the link between the file name
and meta data structure and the link between meta data structure
(inode) and the fragments.  


> Apart from doing string searches etc. is there anything else I can
do? Using the
> data unit menu to display the data in autopsy does not show anything
readable e.g 

Looking at random fragments takes a LONG time and is usually not
useful.   The first thing is to extract the unallocated space, which
can be done from the keyword search mode.  That file can than be
examined fragment by fragment in the data unit mode.  A more useful
approach would be to run tools like 'foremost' on the unallocated data.  

If you are very desperate and the data of found files is very
important, try the following (not intended for the average user):

- Get the inode number of the parent directory where the deleted files
are located
- Identify which Cylinder Group the parent directory is in (meta data
mode)
- Identify the fragments that are in the same cylinder group
- Run 'dls' by hand for the fragments in the range:
  # dls -f solaris img.dd 123456-2345678
- Examine the unallocated data for just that group.

brian

[sleuthkit-users] Questions on new version

[Eagle I. S. <in...@ea...>]

I've installed the 1.71 version of Autopsy and 1.61 version of Sleuthkit on
my SUSe Linux
machine and I have a couple of questions

1. When I run ./autopsy, I get the URL as  usual, and I paste
it into my browser and the program runs. The bitmap image
however, shows 1.70, not 1.71. Is this normal?

2. What is the purpose of the symbolic link in the sleuthkit installation?
I created a directory called sleuthkit, and created the symbolic link, which
appears in that directory just fine. However, I'm not sure why I would link
a new directory
to an existing directory? Can anyone shed some light?

Thanks!

Niall.

Re: [sleuthkit-users] Questions on new version

[Brian C. <ca...@sl...>]

Eagle Investigative Services <in...@ea...> said:

> I've installed the 1.71 version of Autopsy and 1.61 version of
Sleuthkit on
> my SUSe Linux
> machine and I have a couple of questions
> 
> 1. When I run ./autopsy, I get the URL as  usual, and I paste
> it into my browser and the program runs. The bitmap image
> however, shows 1.70, not 1.71. Is this normal?

Yea, the graphic is for the major version which is 1.7X.  If you click
on the image, then it brings you to the 'about' section which has the
exact version.


> 2. What is the purpose of the symbolic link in the sleuthkit
installation?
> I created a directory called sleuthkit, and created the symbolic
link, which
> appears in that directory just fine. However, I'm not sure why I
would link
> a new directory
> to an existing directory? Can anyone shed some light?

You don't have to create the generic directory and the symbolic link.
 The installation will make a directory such as autopsy-1.71.  The
goal of the symbolic link is to just reference 'autopsy' and skip the
version number.  For example, /usr/local/autopsy links to
/usr/local/autopsy-1.71.  

The generic directory is more useful for the sleuth kit than autopsy.
 Then, you can have all the binaries always in your path and you can
install new versions of the slueth kit with out reconfiguring an older
version of Autopsy.  

brian