Thursday, April 22, 2010

The effects on date and times of manipulating email messages within Outlook 2007

 

This document was created out of the need to establish the effects of manipulating email messages within Outlook 2007 for a recent client file.

Although the test was carried out in a controlled environment it is shared only as a report of findings and is no way a white paper on the subject.

Document is here

Samsung uSATA SSD Drive and Tableau Imager

I have been very impressed to date with the tableau Imager software, provided by Tableau Tableau Imager Product Page. Today I had the chance to really see how fast it could be, as I had a Samsung 64GB uSATA SSD drive to image.

 

ssd

Using the Tableau SATA write blocker with a micro-sata adaptor connected to my Windows 7 workstation (x64) via firewire I was able to show the shear speed of the 64GB uSATA SSD drive and the Tableau software.

 

tableau-sata

The Tableau Imager was configured using the following settings;

  • EnCase E0 format
  • 2 GB file size
  • Full Compression
  • MD5 and SHA1 hashes selected

The results of the speed of the imaging in my opinion was simply staggering;

The Tableau log file showed that the imaging was finished in only 17minutes!

-----------------------Start of Tableau Imager Log entry------------------------

Task: Disk to File
Status: Ok
Created: Thu Apr 22 12:15:06 2010
Started: Thu Apr 22 12:15:06 2010
Closed: Thu Apr 22 12:31:38 2010
Elapsed: 17 min
User:
Case ID:
  DELL-
Case Notes: 
  Number:

Imager App: Tableau Imager
Imager Ver: 1.1

64GB fully compressed in 17 minutes!

Saturday, March 27, 2010

Using the F-Response Linux Boot CD From a Remote Location

F-Response this week anounced the release of the F-Response Linux Boot CD that allows a dead machine (powered off) to be booted and connected to all of the F-Response Product range across the network, I guess you could say F-Response can now “Raise a computer from the grave".

I created a small document showing how to use the Boot CD Rom from a remote location.



Document is Here

Thursday, February 18, 2010

Twitter your Keynote Presentation

After being inspired by Lee Whitfield's (@Schizophreud) tweet about adding automatic Twitter posts from your Powerpoint presentation, I thought as a Apple Keynote user I would search to see if the same functionality existed for Keynote.

It turns out it does with the help from an open source Apple Script called Keynotetweet. The script is very simple to run and as long as you have your Twitter account info saved in the keychain, it will tweet everything that is in the notes field between the tags [twitter] text here [twitter].

Adding Google Reader Feeds to Apple Mail

I have wanted for a while to add my Google Reader feeds to Apple Mail, but did not want to manually enter each feed. After a bit of googling I found the below method at;


Just need to add that you need to CD into the download directory before running the Perl command. I also added a Smart mailbox to capture all the unread messages in one location.


If you'd like to move your collection of RSS feeds into 10.5's Mail, here's how:
  1. Export an OPML file from your favorite feed reader (Google Reader for me)
  2. Run the following command in Terminal: perl -lne 'print $1 if /"(http.*?)"/' google-reader-subscriptions.xml | pbcopy
  3. Open Mail
  4. Go to File » Add RSS Feeds...
  5. Choose the Specify a custom feed URL radio button
  6. Click in the entry box and hit Command-V to paste the feed URLs
  7. Click the Add button


Thursday, November 26, 2009

Google ChromeOS First Impressions

Along with echosix I got my interest raised in the GoogleChromeOS from a forensic prospective and thought I would take a very basic quick look under the hood.

The default install boots to a tabbed GUI interface and if you have network connectivity then you can login with an existing gmail account. If not then the default username name is chronos and the default password is chronos.

Once at the GUI you can use crtl/alt/T to bring up a shell and root access can be gained using the sudo command.

The terminal is actually really really slow to type and run commands in, so I invoked ssh and used putty /etc/init.d/ssh start did the trick.

Using putty the terminal surprisingly quick to use.

The new OS is based on Ubuntu 9.10;

image

image

The root partition of the drive was mounted read only, which I found to be interesting and mounted with the data=writeback option, which after some googling translated to mean.

“does no journaling of data; metadata only. fastest. data corruption possible in system crash”.

It appears the root partition is always mounted as  read only upon boot and the user data is encrypted under the /home directory.

image

image

I logged in as test with my gmail account and located  a directory under the default user account “chronos” named after my gmail account that contained further folder structure.

image

Navigating through the gmail account directory I found that most of the account information for my gmail account was located at the location of home/chronos/dougee652\@gmail.com/.config/google-chrome/Default/

image

From the tabbed GUI interface I saved an attachment from an email message and this file was saved locally to the Downloads directory.

I am going to look at the GoogleChromOS in a lot more detail and look at what user information is saved locally and what is stored in the cloud, stay tuned…………………….

Imaging a GoogleChromeOS with F-Response

After downloading the VMware image of the new released Beta version of GoogleChromeOS, I thought what can I use to image the new operating system?

clip_image002

So I figured F-Response would be my tool of choice to connect to the GoogleChromeOS running system and then use the great MAC Forensic Imager tool by Ryan Kubasiak.

Upon boot ChromeOS gives you a tabbed interface and not much else, but after a bit of digging I found access to the shell using ctrl/alt/T and up popped the shell. I guessed the root password “chronos” and logged in.

I had previously emailed the F-Response Field Kit Linux script to my gmail account and saved the attachment to the Downloads folder.

To get the F-Response Linux script to run I had to copy it to /tmp and run it using the command;

sudo ./f-response-fk-lin –u andyandy –p 12345678901234 –i 3260

Issue 1 IPtables

I then had some connection issues as GoogleChromeOS comes with IPtables configured so I removed all the iptables rules and changed the policy from Deny to Accept;

Comands;

iptables -L INPUT -n –linenumbers

iptables -D INPUT [line number here]

iptables -P INPUT ACCEPT

clip_image004

Now with connectivity I was able to reach my Macbookpro and start the connection process.

clip_image006

I then used the Globalscan ISCSI client on the Macbookpro to establish the connection.

clip_image008

The F-Response status then showed me that the connection was established;

clip_image010

The F-Response status then showed me that the connection was established;

clip_image012

The GoogleChromeOS disk showed up on my Mac as rdisk4 and contained 3 partitions;

Fdisk output from the shell on the Mac.

clip_image014

Output from the GUI Disk Util Tool

clip_image016

Mounted Partions on my Desktop;

clip_image017

File explorer view of each partition;

Root Partition;

clip_image019

Second Partition;

clip_image021

I then used the great MAC Forensic Imager tool by Ryan Kubasiak, to create an image of the GoogleChromeOS physical drive.

clip_image023

The imaging took no time at all to complete and successfully completed to E01 file format. The log recorded the imaging as follows;

Physical Disk Infoscheme: fdisk

block size: 512

_ ## Type_________________ Name_________________ Start___ Size____

+ MBR Master Boot Record 0 1

1 Linux_Ext2FS 1 1945600

2 Linux_Swap 1945601 1945600

3 Linux_Ext2FS 3891201 1945600

+ synthesized

ewfacquirestream 20080501 (libewf 20080501, zlib 1.2.3, libcrypto 0.9.7)

Using the following acquiry parameters:

Image path and filename: /Users/dougee/Desktop/GCOS-FRes.E01

Case number: 652

Description: GoogleChromeOsF-Response

Evidence number: 652

Examiner name: Dougee

Notes: GoogleChromeOs with F-Response Field Kit

Media type: fixed

Volume type: physical

Compression used: none

Compress empty blocks: no

EWF file format: EnCase 5

Acquiry start offet: 0

Amount of bytes to acquire: 0 (until end of input)

Evidence segment file size: 1.4 GiB (1572864000 bytes)

Block size: 64 sectors

Error granularity: 64 sectors

Retries on read error: 2

Wipe sectors on read error: no

Acquiry started at: Thu Nov 26 11:28:30 2009