dougee

Thursday, April 22, 2010

The effects on date and times of manipulating email messages within Outlook 2007

This document was created out of the need to establish the effects of manipulating email messages within Outlook 2007 for a recent client file.

Although the test was carried out in a controlled environment it is shared only as a report of findings and is no way a white paper on the subject.

Document is here

Samsung uSATA SSD Drive and Tableau Imager

I have been very impressed to date with the tableau Imager software, provided by Tableau Tableau Imager Product Page. Today I had the chance to really see how fast it could be, as I had a Samsung 64GB uSATA SSD drive to image.

Using the Tableau SATA write blocker with a micro-sata adaptor connected to my Windows 7 workstation (x64) via firewire I was able to show the shear speed of the 64GB uSATA SSD drive and the Tableau software.

The Tableau Imager was configured using the following settings;

EnCase E0 format
2 GB file size
Full Compression
MD5 and SHA1 hashes selected

The results of the speed of the imaging in my opinion was simply staggering;

The Tableau log file showed that the imaging was finished in only 17minutes!

-----------------------Start of Tableau Imager Log entry------------------------

Task: Disk to File
Status: Ok
Created: Thu Apr 22 12:15:06 2010
Started: Thu Apr 22 12:15:06 2010
Closed: Thu Apr 22 12:31:38 2010
Elapsed: 17 min
User:
Case ID:
DELL-
Case Notes:
Number:

Imager App: Tableau Imager
Imager Ver: 1.1

64GB fully compressed in 17 minutes!

Saturday, March 27, 2010

Using the F-Response Linux Boot CD From a Remote Location

F-Response this week anounced the release of the F-Response Linux Boot CD that allows a dead machine (powered off) to be booted and connected to all of the F-Response Product range across the network, I guess you could say F-Response can now “Raise a computer from the grave".

I created a small document showing how to use the Boot CD Rom from a remote location.

Document is Here

Thursday, February 18, 2010

Twitter your Keynote Presentation

After being inspired by Lee Whitfield's (@Schizophreud) tweet about adding automatic Twitter posts from your Powerpoint presentation, I thought as a Apple Keynote user I would search to see if the same functionality existed for Keynote.

It turns out it does with the help from an open source Apple Script called Keynotetweet. The script is very simple to run and as long as you have your Twitter account info saved in the keychain, it will tweet everything that is in the notes field between the tags [twitter] text here [twitter].

Link

Adding Google Reader Feeds to Apple Mail

I have wanted for a while to add my Google Reader feeds to Apple Mail, but did not want to manually enter each feed. After a bit of googling I found the below method at;

Link

Just need to add that you need to CD into the download directory before running the Perl command. I also added a Smart mailbox to capture all the unread messages in one location.

If you'd like to move your collection of RSS feeds into 10.5's Mail, here's how:

Export an OPML file from your favorite feed reader (Google Reader for me)
Run the following command in Terminal: perl -lne 'print $1 if /"(http.*?)"/' google-reader-subscriptions.xml | pbcopy
Open Mail
Go to File » Add RSS Feeds...
Choose the Specify a custom feed URL radio button
Click in the entry box and hit Command-V to paste the feed URLs
Click the Add button

Thursday, November 26, 2009

Google ChromeOS First Impressions

Along with echosix I got my interest raised in the GoogleChromeOS from a forensic prospective and thought I would take a very basic quick look under the hood.

The default install boots to a tabbed GUI interface and if you have network connectivity then you can login with an existing gmail account. If not then the default username name is chronos and the default password is chronos.

Once at the GUI you can use crtl/alt/T to bring up a shell and root access can be gained using the sudo command.

The terminal is actually really really slow to type and run commands in, so I invoked ssh and used putty /etc/init.d/ssh start did the trick.

Using putty the terminal surprisingly quick to use.

The new OS is based on Ubuntu 9.10;

The root partition of the drive was mounted read only, which I found to be interesting and mounted with the data=writeback option, which after some googling translated to mean.

“does no journaling of data; metadata only. fastest. data corruption possible in system crash”.

It appears the root partition is always mounted as read only upon boot and the user data is encrypted under the /home directory.

I logged in as test with my gmail account and located a directory under the default user account “chronos” named after my gmail account that contained further folder structure.

Navigating through the gmail account directory I found that most of the account information for my gmail account was located at the location of home/chronos/dougee652\@gmail.com/.config/google-chrome/Default/

From the tabbed GUI interface I saved an attachment from an email message and this file was saved locally to the Downloads directory.

I am going to look at the GoogleChromOS in a lot more detail and look at what user information is saved locally and what is stored in the cloud, stay tuned…………………….

Imaging a GoogleChromeOS with F-Response

After downloading the VMware image of the new released Beta version of GoogleChromeOS, I thought what can I use to image the new operating system?

So I figured F-Response would be my tool of choice to connect to the GoogleChromeOS running system and then use the great MAC Forensic Imager tool by Ryan Kubasiak.

Upon boot ChromeOS gives you a tabbed interface and not much else, but after a bit of digging I found access to the shell using ctrl/alt/T and up popped the shell. I guessed the root password “chronos” and logged in.

I had previously emailed the F-Response Field Kit Linux script to my gmail account and saved the attachment to the Downloads folder.

To get the F-Response Linux script to run I had to copy it to /tmp and run it using the command;

sudo ./f-response-fk-lin –u andyandy –p 12345678901234 –i 3260

Issue 1 IPtables

I then had some connection issues as GoogleChromeOS comes with IPtables configured so I removed all the iptables rules and changed the policy from Deny to Accept;

Comands;

iptables -L INPUT -n –linenumbers

iptables -D INPUT [line number here]

iptables -P INPUT ACCEPT