Forensic Focus

General Discussion: NAND flash disk ECC

Sat, 25 May 2013 11:06:57 GMT

Hello, jaclaz I have edited the previous post with the description of the NAND and equipped to better understand with an example of Hexdumpe. KA8712 has your question, I think so, very well answered. I'm just going to reconstruct the long way (ECC solution) and putting it on paper. I hope that I can present this as soon as possible. Kind regards

General Discussion: Way to tell what program or process accessed a file?

Sat, 25 May 2013 10:49:39 GMT

twjolson wrote: That logs changes. But the original question asked about last access times. If a file was accessed, but not changed, why would it be in the $UsnJrnl file? I didn't say that it would be...remember, I said these are possibilities. Given the nature of the original question, I was offering up a possibility, in case there was more than just an access to the file. twjolson wrote: To clarify my post a little. Computers are so 'busy', as you well know. Even if the poster found an executable what was launched at the same time, or near, the file in question, I would be hesitant to ever say that one caused the other. Windows has many, many processes going on, and you could never say that any particular one (with some caveats) accessed a particular file. Agreed. Like I said, "possibilities". twjolson wrote: You could theorize, of course, but coming up with theories is easy (and kind of pointless in our profession). Of course...if that is all that is done. However, there is considerable value in proving or disproving those theories in order to further your examination.

General Discussion: Discrepancy in Word Document Dates

Sat, 25 May 2013 10:19:25 GMT

corey_h wrote: Alright, my curiousity got the best of me. I was looking at a different way to create a document; using the Save As function. I never tested this before. There is another way to create a document that will result in "the Created Date on the disk is earlier than the Document Birth time". Working on an existing document and then saving it on top of itself using the Save As feature. By on top of itself I mean to don't create a new document. The filesystem create date remains the same while the document "birth" date is when the document was saved. CoreyThat sounds a lot more probable to me. <img src="images/smiles/icon_smile.gif" alt="Smile" title="Smile" /> (this is something I could do - and actually do sometimes). Actually being a pendrive, it would make even more sense. Example: you have a file on a pendrive you want to edit/update it and either copy it to internal hard disk or open it from the pendrive and then do a "Save as" on hard disk you then edit the copy on the hard disk, then save it (still on hard disk) you save it again with "Save as" to the pendrive to "synchronize" the edits Another (open) question, actually possibly Off Topic, we do know that the document is in the .docx format, but nowadays there are tens of tools/apps that can save text in that format, question is, do they all provide the "correct" metadata (in the sense of: do they "sign" the document with the app name or do they simply use the same MS strings)? I.e. till now it was assumed (and surely this is the most common case) that the Word document was actually created by Word, but - especially because it appears on a pen drive, and thus we have no additional info on the system and on programs installed on it - this is not 100% safe to assume. jaclaz

Employment and Career Issues: How much is training to be evaluated against experience ?

Sat, 25 May 2013 09:48:00 GMT

TuckerHST wrote: To attempt an apples-to-apples comparison of 12 credit hours with a year's experience, one might multiply 12 by 3 (hours in and out of class per week), then by 15 (weeks in a semester, more or less) for a total of 540 hours. While significantly shorter than the number of hours in a year of "experience," it's at least in the same ballpark. That's like devoting 10-12 hours a week (every week) for a year. Put that way, the comparison is probably not that unreasonable.Yes, this definitely clears the matter, "not unreasonable" sounds much better than "totally absurd" <img src="images/smiles/icon_biggrin.gif" alt="Very Happy" title="Very Happy" /> . The only issue (if any) remaining is that - at least from the "level" shown by some posters here that revealed being on their last year or just graduated, the education they get at Uni could be better, but this is an alltogether different thing. Thanks for clarifying the matters. jaclaz

Forensic Software: Extracting all NTFS attributes

Sat, 25 May 2013 08:41:37 GMT

New tool: http://code.google.com/p/mft2csv/wiki/ExtractAllAttributes I have missed an option to easily be able to extract all NTFS attributes for a given file, not just the $DATA attribute. In one of the great posts by Corey; http://journeyintoir.blogspot.no/2012/12/extracting-zeroaccess-from-ntfs.html he explains how to extract the $EA and $EA_INFORMATION attributes by using commandline tools in the Sluthkit. However the commands are not that easy unless you are familiar with it. Now there's an easy way of extracting all of them in one go. The output files follow a specific naming convention to reflect what is extracted. It's described in the documentation. Current features: Images (partition and disk types) Disk images can be of either MBR or GPT style. Direct access into Volume Shadow Copies. Direct access to PhysicalDrive and into un-mounted volumes. Mounted volumes. Browsing to target file on mounted volumes. Specify MFT reference number in all other modes than the "Browse" option. Resident and non-resident Compressed and fragmented attributes. Attribute lists. Try it out on MFT reference 5 or 9 for instance. They both have several attributes you normally can't extract in an easy way.

General Discussion: Recovered Lotus Notes nsf files can not be opened

Fri, 24 May 2013 18:10:49 GMT

> Thanks for your reply so do you think there is any chance to recover a fragmented nsf file?Or is it possible to > just extract email messages from the fragmented nsf file? Really depends of various factors: * what are you after? * how is the resulting information going to be used as indicative findings or evidence? * how much data do you have? * how much effort is it worth? * what is the skill level of the person doing the recovery? I agree with mscotgrove here that try the low hanging fruit first, e.g. is a string search sufficient to find the evidence you seek, e.g. icw. searching through compressed data (e.g. bulkextractor)? Is there a backup notes/domino has this nice feature that it replicates files on the server (in some cases), VSS? etc, etc.

Digital Forensics Job Vacancies: E-Discovery Sales Executive, UK

Fri, 24 May 2013 15:57:15 GMT

The Role The role will be Office/ Field based covering the UK and you will need to be able to travel throughout this area developing existing opportunities and forging new client relationships. You will be targeting companies within commercial litigation and dispute resolution practice areas. This is the ideal role for someone coming from an IT sales or consultancy background. Experience and characteristic: • 2 - 5 year of Legal or Sales experience • Strong client facing skills, as well as pre-sales and account management skills. • Excellent organizational skills and proven ability to manage multiple tasks • Experience of litigation support and eDiscovery is an advantage but not essential. Responsibilities will include: • Develop and close new business opportunities • Analyse customers’ needs and propose solutions • Meet regularly with clients and potential customers • Consistently generate new leads for new business prospects • Consult and sell across the EDRM • Meet all sales targets set • Provide client demonstrations and quotes You will have to pass an indepth background check to obtain a security clearance. For more information about this role please contact Georgia Goldhawk at Georgia.Goldhawk@cooperrowley.com CooperRowley acts as an employment agency and is a free and confidential service to candidates.

General Discussion: Internet Content Reviewer UK

Fri, 24 May 2013 12:29:09 GMT

There is the IWF (Internet Watch Foundation) in the UK. They focus primarily on IIOC/obscene publications. Unfortunately, they're not currently recruiting. If you wanted to look at copyright protection, the main UK organisation is FACT. They don't seem to have a recruitment page....

General Discussion: INFO2 file details

Fri, 24 May 2013 09:57:05 GMT

Just in case, rifiuti and rifiuti2: http://www.mcafee.com/us/downloads/free-tools/rifiuti.aspx http://code.google.com/p/rifiuti2/ Original whitepaper: http://sourceforge.net/projects/odessa/files/ODESSA/White%20Papers/ http://downloads.sourceforge.net/project/odessa/ODESSA/White%20Papers/Recycler_Bin_Record_Reconstruction.pdf?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fodessa%2Ffiles%2FODESSA%2FWhite%2520Papers%2F&ts=1369389400&use_mirror=switch jaclaz

General Discussion: NIST deleted file recovery test images

Fri, 24 May 2013 06:13:35 GMT

I had a try on a couple of them while making the parser for the $LogFile on NTFS. But found the file to be more or less empty (due to formatting in linux I suppose). The NTFS images was thus worthless for me with my specific task. That's all I know about them.