Journey down bmap lane.

Bmap is quite the obscure tool. (reference) Not only is it difficult to find, but, good luck with any documentation. The --help is all you've got! I was able to find the source at packetstormsecurity but had problems compiling. But, we can fast forward to the part where it is working.

Hiding ASCII in Slack

Let me walk through the example that everyone uses for bmap with the file test.gif:

> du -sch test.gif

16.0K total

> echo "redleatheryellowleather" | bmap --putslack test.gif

>du -sch test.gif

16.0K total

>echo "redleatheryellowleather" > text

>du -sch text

4.0K total

So, we can see here, that there du command should be showing a change in the file size due to the slack data. Of which it is not.

>bmap --slack test.gif

getting from block 2051

file was: 13166

slack size: 3218

block size: 4096

redleatheryellowleather

>bmap --slack --outfile sometext test.gif

The 'outfile' option dumps the contents into the file sometext.

>file sometext

sometext: ASCII text

>less sometext

redleatheryellowleather
(it actually gave me a binary file but contained the phrase I was looking for)

The md5 hash of test.gif before and after slack space has been manipulated is exactly the same. However, the cp command does not copy slack. Which I just happened to stumble upon, but was interesting none-the-less. Knowing this, I decided to delete the file with slack space stuffed to see if magicrescue would restore the document with slack in tact. After the search, rescue and another cup of coffee the results are in. The document was recovered but the slack space was empty. This result makes sense. Magicrescue will carve out only the file contents. Which also leads me to believe that a file just stored in slack space will not be recovered by magicrescue as a lost document. Or will it?

Hiding Files in Slack

Hiding ASCII in slack space is similar to carving a file into slack space. Here's how I did it:

>bmap --carve ppt2.ppt | bmap --putslack test.gif

I am testing to see if magicrescue will find ppt2.ppt, thinking it is an unallocated file needing recovery. While working with magicrescue I have noticed that it only recovers data that needed to be recovered. Meaning, files that haven't been deleted don't appear in the results. Of course data that matches the mask you throw at it. So, if something is stuffed in a file's slack space and the file is still considered allocated space, my assumption is that it will get overlooked. Well, that assumption was correct. Multiple scans of one partition with data stored in slack recovered nothing. It did recover one document that was purposefully deleted, yet the slack data was missing.

Other tools?

I haven't found any other tools that detect slack space contents, in a limited amount of searching. Sleuthkit had the ability to search through slack space, but in recent revisions of the app ils, this feature was removed. (reference) Which makes this method of hiding information very tough to detect. I would rank this method of hiding data right up there with alternate data streams in terms of quick and dirty. Now, if anyone really wanted to hide something, one could couple these methods with encrypted filesystems...but that's a topic for another time.

Concluding Remarks

I feel as though I haven't even begun to scratch the surface with forensics. When at the same time, I really learned a lot. My goal out of this course was just to basically broaden my overall understanding of forensic analysis. That was accomplished. The two books proved for perfect stepping stones to get started. They focused mainly on case studies in forensic analysis and business aspects. Also, the details of inspections and analysis were discussed, which lead me down other avenues to research.

What I really liked about this course was the fact that I got to wear the white and the black hat. Answering questions like: How do you hide information? How do you hide information on different file systems? Now that it's hidden, how would you attempt to detect/find it? What tools are are used?

It wasn't until researching these topics that I found out about HPA space on hard disks, ext2 and ext3 slack space stuffing, and NTFS alternate data streams. These three areas are where I spent most of my time. Which lead to work with Sleuthkit, TCT, magicrescue, recuva, bmap and netcat. Each of these tools were fun to learn and essential for proper analysis.

This class piqued my interest again in studying forensics and security. Next semester I am going to be taking a course on the mathematics of encryption. Which sounds very cool! I'm hoping to pair up forensics and encryption to see if anything looks promising for a research topic.

Fun with ADS

I'm surprised how easy it is to hide data via alternate data streams (ADS) in Windows. It's a quick and dirty way of hiding information. However, you must know the exact file name in order to view the contents of the hidden document. It's kind of like the Room of Requirement in Hogwarts. If you don't know where it is, you can't get to it. Although, ADS data won't just reveal itself if you really need it, like the room will... did I go too far with the Harry Potter reference? Anyways, in order to test ADS, I decided to test out Identity Finder. Identity Finder is the application that ensures each workstation does not house any FERPA protected data. So, I would assume, that this application would be aware of alternate data streams or would simply detect something in an ADS file.

The Setup

I created two text files; one with the contents being "Hello World!", the other containing "ssn: 333-44-5555." Identity finder will flag any files with a social security number or a credit card number or anything close. I probably didn't even need to put the fake ssn in that format, as Identity Finder will flag any file with a 9 digit number in it. None-the-less, I did, and the file should be flagged.

Now, to ADS-ing a document. From the command line I ran:

> type ads_data.txt > doc1.txt:a.txt

Voila! That's it! An ADS file has been created. Again, while in a shell, if you run 'notepad doc1.txt', you will see "Hello World!" However, if you run 'notepad doc1.txt:a.txt' you will see the contents of the ADS file. The neat thing is that the containing folder only contains one document. That being the doc1.txt file. The alternate data stream is not visible at all. Pretty cool stuff huh? Well, I thought it was! Okay so ADS hiding is more like using the invisibility cloak than the room of requirement. And that will be my last Harry Potter reference.

Identity Finder Scan

So, now it's time to scan my machine to see if Identity finder would locate the ADS file. I separated the ads_data.txt and doc1.txt files into different folders just for safe keeping. The scan completed in approximately 2 hours. The end result is, insert drum roll here, Alternate Data Stream wins! Identity Finder flagged the ads_data.txt file, but did not catch the doc1.txt:a.txt file. I expected it to find something in doc1.txt. I thought Identity Finder would run a more thorough scan, but apparently it does not.

So, what's next?

I'm going to see if I can get bmap running and try to do some slack space packing. (I've got a copy of the BCCD, since I can't get it compiled on my own.)

References

http://www.windowsecurity.com/articles/Alternate_Data_Streams.html
http://support.microsoft.com/kb/105763
http://www.informit.com/articles/article.aspx?p=413685&seqNum=3
http://www.linuxsecurity.com/content/view/117638/49/

Document Found!

Here's the setup. I created a partition, placed a Microsoft Office created Word document in that partition. I then deleted the document and designated the partition as HPA space. Well, magicrescue doesn't care about HPA space, as it was able to recover the deleted file. Which makes me wonder why this is so easy to find? Also, what are other ways to hide data? Which brought me to these articles on ext2 and ext3 slack space, and NTFS Alternate Data Streams (ADS). Of course I can only find bmap on packetstormsecurity.com. Yet, I can't get it compiled correctly. (sgml2latex error....and you want to be my latex salesman?) What I really want to do is hide data with bmap and see if magicrescue can find it. Also, I would like to hide a file via ADS and see if Identity Finder can locate it on my work computer. Just hoping some things go correctly for me here in the next week and a half. I've had enough of Identity Finder breaking and Symantec Endpoint Protection bombing thus removing my network drivers. But, I digress....

Anyways, this is what I've been attempting to work on. Below are links to other articles I've been reading when I have had a chance. I've been busy with some other forensic-esk work at work lately. Anyone else find that Canadians like to try and hack php servers? I have a simple chat forum running for an event in our office that has been sluggish, to say the least. I attributed it to updates, but that wasn't the case. The error and access logs showed systematic attempts to find administrator login pages. Thousands of them in a short period of time. After blocking those individuals I'm still trying to figure out why it's slow. To be continued I guess.

Articles:

http://www.linuxsecurity.com/content/view/117638/49/
http://blog.crowdway.com/2009/04/15/hide-data-in-hidden-partitions/
http://www.docstoc.com/docs/13637545/Data-hiding-and-finding-on-Linux
http://www.wikistc.org/wiki/Slack_space_data
http://books.google.com/books?id=nEqHuVht7HgC&pg=PA92&lpg=PA92&dq=linux+hide+data+in+slack+space&source=bl&ots=bLewREp97f&sig=ejFTtjwomuaIYNXBOWnL0MYyZRA&hl=en&ei=_D30SryVPInENpmz_OgF&sa=X&oi=book_result&ct=result&resnum=5&ved=0CBQQ6AEwBA#v=onepage&q=&f=false

Holy Hidden Partition Batman...

Happy dance time, again! I've been unable to recover any Microsoft Office documents that I purposefully delete. Until now! The only difference is that the document was created in Microsoft Office and not in Open Office. Apparently something is different in the file format/file signature. Which will be an investigation for another time. What I'm going to do now is, hide the partition again. (designate HPA space) and run another scan on the entire drive. I know the size of the file, and document type. So, if magic rescue is able to read HPA space, I *should* find the document in the recovery reservoir. The only problem is, scanning 30 G is going to take 9+ hours. So, time to start the scan, and we'll see where we're at tomorrow!

More magicrescue...

Well, I'm having a difficult time finding any data that I have purposefully hidden or deleted. I'm using Open Office to create Word documents and saving them to a partition. Now, magicrescue is recovering several documents just not any of the documents I want it to find. Also, this is without the partition being declared HPA space. I'm going to try a couple of different things. First, create the documents in Microsoft Word. Each of the documents recovered were created in Microsoft Office, and I'm not sure if Open Office is the problem. I'm just trying to eliminate variables. Second, I'm going to try to search for something else, like jpeg's or pdf's. The problem isn't recovering data, it's recovering files I've purposefully deleted. So, if someone is hiding data in an HPA protected partition, I can find the partition and remove the HPA designation. (Thank you Sleuth Kit tools!) Yet, if there was data in the partition that was deleted, I'm having a tough time recovering it.

To be continued...

Oh by the way, it takes 61 minutes to search a 3G partition. Did I mention this machine was slow?

Magicrescue to the rescue

I've been running magic rescue on this machine since 9:00 am. It's currently 11:15 am and I have recovered 453 office documents and it is still not done scanning. Apparently, I should have used shred before I installed over Windows XP. None the less, it's recovering a lot of data, but, not the HPA hidden files yet.

Update: 1:52pm and it's still running. We're at 570 files and 336M. I might as well let it keep running. But, I'm going to try changing the options next time around. I'll probably tinker with the default block size, as well as create a recipe file for a gif image. It's picking up every type of Microsoft Office document...sigh...

To be continued...

Update: Well it has finished scanning! Yay! I wish I would have timed it, as I am not sure when it finished Friday night or Saturday morning. The problem now is sifting through all the 1073 files recovered. Only 207 of which are Word docs. If I was thinking, before I deleted the files from HPA space, I would have noted the file size. Oh well, now I'm manually checking to see if the files were recovered. I'm also going to unhide the HPA partition and just run magic rescue just on that partition. We will see if that makes a difference.

Happy Dance!

Preparation
Well, I'm actually getting somewhere with the HPA project now. I had to do a fresh Debian 5.0.3 install, as recovery wasn't working from my latest error. Although, this was inevitable as I didn't have the drive partitioned correctly. Or, as the HPA project needed. So, here is a look at the drive.


#>sfdisk -luS

Disk /dev/hda: 3648 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0

Device Boot Start End #sectors Id System
/dev/hda1 63 16064 16002 83 Linux
/dev/hda2 16065 1975994 1959930 82 Linux swap / Solaris
/dev/hda3 * 1975995 52757459 50781465 83 Linux
/dev/hda4 52757460 58605119 5847660 83 Linux

The /dev/hda4 partition needs to be mounted manually. Which, is probably the way it would be if I were actually hiding data. A red flag would be raised instantly if /etc/fstab contained a partition that was inaccessible. So, I created a partition at the end of the disk, placed a couple images in it, now it's time to hide the partition.

HPA designation!
I have found a great new way to bomb your machine! Just run

#> ./setmax --delta 52757460 /dev/hda

Then try to do something simple like, oh, I don't know, browse the web. Slowly but surely the load on your machine will rise and lock everything up. It's kind of like a slow fork bomb, a la :(){:|:&};:. (Possible suggestion for a red team member at CDC?) It was actually kind of fun to watch the load slowly rise until it halted. Anyway, here's what went wrong. The instructions I have been following to hide data with HPA has an error. (http://niiconsulting.com/checkmate/2006/09/15/hiding-data-with-hpahost-protected-area-in-linux/) The instructions inform you to run, ./setmax --delta D /dev/hda, where D is the starting sector number you want to hide data. (or just designate HPA) I was running ./setmax --delta 52757460 /dev/hda and bombing my system. Thankfully a hard reboot and a restart fixed everything. The D does not indicate the sector number to start HPA space, it is the number of sectors *minus* the end-of-disk. Thank you code comments! So, essentially, I was trying to hide 27GB worth of space on a 30GB drive, when I wanted to hide 3GB.

Here is the command that worked to hide the data:

#>./setmax --delta 5847660 /dev/hda

And to unhide:

#>./setmax --delta 0 /dev/hda

SleuthKit has a handy tool that will detect HPA protected areas called disk_stat. When the partition was hidden disk_stat gave the following output:

#> disk_stat /dev/hda
Maximum Disk Sector: 58605119
Maximum User Sector: 52757459

** HPA Detected (Sectors 52757460 - 58605119) **

And when the data was visible:

#> disk_stat /dev/hda
Maximum Disk Sector: 58605119
Maximum User Sector: 58605119

I also tried to mount /dev/hda4 while hidden and received an error. Very cool!

Well now that the hide/unhide is possible I need to take it up a notch. I'm thinking. Delete the 2 pictures, rehide the partition, and see what I can find with magicrescue. That's on the agenda for today!

Reading and attempting to do other things...

Interesting discussion on crimes in the next chapter of Digital Evidence and Computer Crime. The motives for criminal behavior never change and the laws remain the same. Technologies just open up different avenues for carrying out these crimes. I had a rant all ready here about legislation, net neutrality and John McCain but I will save that for another day.

Enough with current events, on to the HPA disaster I've created! It's funny how quickly the rust appears when you haven't used Linux in a while. Ignorance is bliss in the Windows/Apple world, but I digress. I've installed debian on a junky laptop from work, then needed to resize and create a new partition. The rust is already showing as this should have been taken care of during the initial install. The process took me way longer than it needed to and still may need to be fixed. My next step is using a little script to mark the partition as HPA space, drop data in it, cover it with some dirt and we're done! The only problem is now I am receiving a boot error:

BUG: soft lockup - CPU#0 stuck for 61s! [ipw2200/0:1415]

So, I'll see what I can do otherwise another fresh install may be in order. Which, may not be a bad thing. Did I mention that this was a junky laptop?

Unfortunately, along the way I read the last chapter of the book first. By that I mean that I spoiled the ending by reading about Sleuth Kit. I am attempting to see if hiding data in HPA designated space can be found using different forensic tools. Apparently, Sleuth Kit has no problem finding such data. Now, if I can only get to the point where I can hide the data then I will attempt to find it again.

Again, to be continued...

Since we last spoke...

Well, since the last time I posed, my time has been spent looking at better applications for doing forensic analysis. I have read a couple articles on The Coroner's Toolkit, (http://www.sans.org/reading_room/whitepapers/incident/the_coroners_toolkit_in_depth_651?show=651.php&cat=incident, http://www.giac.org/certified_professionals/practicals/gsec/0325.php). Since some of the data recovered, described in my last post, was corrupted using Lazarus piqued my interest. Now, I have TCT installed on a machine at work, yet have not yet tried to use it.

My next goal is to use a technique for hiding data on the disk, then to see if TCT or the Sleuth Kit can find it. Oh, and by the way, I found the Sleuth Kit at some point and am eager to try it out! The information hiding technique is Hiding Data with HPA. I need to gain a better understanding of how to hide data as well as how to use my tools. As the saying goes, the carpenter is only as good as his tools.

To be continued...

Actual physical evidence!

I have a hard drive that needs data extracted off of it. Here's the situation, there was a folder on this hard disk that somehow was deleted. My job, if I choose to accept it, is to get that data back. (Note: I chose to accept it.)

Going into the situation I expected a hard drive containing a Windows XP directory structure, one user, missing a folder on the desktop. That guess wasn't very close. The drive was NTFS formatted, but that was the extent of my correct assumptions. The drive was possibly a second disk in a workstation being used as a backup drive. There were 2 folders on the drive. A third folder was deleted and needed to be restored along with all recoverable contents.

Since I was working off of a copy of the original disk, I simply popped the drive in the external enclosure and began perusing. The two applications I used are Recuva, and Restoration. Both applications work very well, but each has it's own nuisances. For instance, Recuva can only restore files to the original location on the disk. There was no option to restore files in a different location. So, I decided to try Restoration, which had that functionality. If there was a competition between the two applications, the score would be Restoration 1 and Recuva 0. However, Restoration has a more cumbersome restoration process. Recuva allows a user to select multiple files to restore, where Restoration does not. So, restoring a large number of files is not ideal with Restoration. The score is now Restoration 1 and Recuva 1.

One thing I found very interesting is the inablity of either application to find the actual name of the folder I am attempting to restore. I am able to recover data from the disk with both applications. Yet, since the originating folder was deleted, and possibly over written, both applications cannot pick up the originating folder name. When Recuva finds a file it displays the location to which it will be restored. Since the folder no longer exists, there is a '?' in it's place. What I assumed, was that everything on the disk that would be restored to the '?' location, was data that needed to be restored. There was close to 5 Gig total on the disk that could have been restored. Only 2 Gig was located in the indicated folder.

This was a great learning experience. In the process I found a fantastic article on file carving with a hex editor. I was hoping to use some file carving techniques on this project. Yet, the file types were unknown, leaving me to do some further investigating before restoring any data.

A couple items I would like to continue to explore:

- Whether or not the Folder Name can be discovered off of the disks' inodes.

- How to search for data when someone is really trying to hide it. (Guess that means I have to learn how the hiding process works first.)

Chapter 3 The Investigator's Office and Laboratory

Looking forward to chapter 4. Most of the stuff in this chapter is common sense. For instance, there is a section on the investigators lab, office ergonomics, and environmental conditions in an office. Needless to say, if you have had any experience as a system administrator, this chapter can be skipped.

The only part that I enjoyed was reading was on the forensic certifications and training. It makes me wonder what, if any, forensics experts are in the Cedar Falls area that work with law enforcement that have this training. Or if forensic analysis is just contracted out. I know ACES and Iowa Technology Services are in the area and will probably be able to handle such a case. But, back to the forensic certification and training. This has always been appealing to me, as, I thought it would be my way in to a career with the FBI. It wasn't until later when I realized that working to find the scum of the earth really wouldn't be my favorite job. However, these certifications are always an option in continuing my education.

I really shouldn't knock on this chapter too much. It discusses some important 'things to consider' in handling budgets, necessary equipment, hiring staff, machine maintenance, storage, etc. All good stuff, but, not exactly things that I'm worried about.

Chapter 4 covers the software and tools! Looking forward to it.

Weekend with dd

In the past I had only used dd sparingly. I knew that it has great potential, but haven't really used it a whole lot. This weekend I had a great reason to use it. The application was simple, create an image of a hard drive. Here's the command I used.

crsvcs-techlap01-3:Forensics hartzd$ dd if=/dev/disk1 of=/Users/hartzd/Desktop/Forensics/drive-20090913-1900.dmg conv=noerror,sync
1024000+0 records in
1024000+0 records out
524288000 bytes transferred in 92.648891 secs (5658870 bytes/sec)

The original plan was to image an old hard drive that was in my external laptop enclosure. Unfortunately, the external hard disk was the same size as my internal disk. So, time for plan B. I decided to use my wife's USB drive instead. Which is great, because, I had no idea what was on it. The funny thing was it turned out to be my old thumb drive that I lost a while back. Score!

Anyways, the result was nice. I was able to create a dmg image that can be mounted and examined. I never tried to recover any deleted files off of the drive, as the only application I've ever used were windows executables. (Suggestions?) I did find a site with some OSX tools and was able to take a look at the drive image through a hex editor. (http://www.macosxforensics.com). Although, I was only able to pick up bits and pieces of files on the disk.

To be continued with any analysis of this drive. . .

That's my choice, and I'm sticking to it.

I've decided reading more than one book at a time is probably not a good idea. So, I'm going to read, Guide To Computer Forensics and Investigations, first. That being said, I've proceeded through chapter 2 and here are some findings.

Chapter 2: Understanding Computer Investigations
This chapter discusses the in's and out's of an investigation. I really never thought of the proper way to investigate a machine legally, but, obviously documentation is key. The stuff I am more interested in is actually doing the investigating. Even though this book is only three years old, it shows age in this chapter. I understand that this book is tailored to those who use Windows machines and have little forensic background. However, this chapter discusses in detail how to create a DOS based boot floppy. Need I say more? Needless to say I glazed over during much of this discussion, as I have found much more useful tools. All of which are not restricted to 1.44 MB floppies. Knoppix, as stated in an earlier post, being the primary tool of use. Other bootable operating systems I've used are Bart's PE (http://www.nu2.nu/pebuilder/), Oophcrack (http://ophcrack.sourceforge.net/), and last but definitely not least the BCCD (http://www.bccd.net/)

Bart's PE is a Windows XP bootable environment. There are quite a few optional pluggins to enhance what is already available. One of which will reset the administrative password on Windows XP machines. This has helped me a few times in the past after dropping a machine out of active directory. I have had some difficulties trying to create a fully bloated Bart's disk that includes all the plugins. Yet, you can usually find prebuilt iso's with the plugins already installed.

Ophcrack is simply a bootable password cracker. That is if you don't want to use a Bart's disk to change the password. Ophcrack uses rainbow tables that are preloaded, but, there is an option to add additional tables from removable media if available. I've always wanted to try the 80 GB worth of hashes from Project Rainbow Crack, but never found the time. (http://project-rainbowcrack.com/table.htm)

DriveSpy is the bootable environment on a floppy that is discussed in this chapter. Upon doing some further investigation, there is nothing that drivespy can do that Knoppix cannot. For instance, you can tailor DriveSpy to keep a log of all the commands you run while looking at evidence on the command line. Enter, bash_history, in Knoppix. However, the chapter does mention the ability to look through unallocated and slack space on a disk. Add that to the To Do list, because I'm not exactly sure how to look through slack space on a disk. Maybe I'm making that sound more difficult than it really is.

A great piece of information discussed in this chapter was about finding deleted files on a Windows machine. The FAT32 file system uses the lowercase sigma character to signify that a file has been deleted. So, when perusing the file allocation tables, file names that begin with a sigma have been deleted. Very cool! I am guessing this is how my Undelete freeware application works. I found a little more information on the subject from Informit here: http://www.informit.com/articles/article.aspx?p=339066 This reading piqued my interest into how other file systems do trash cleanup.

While this chapter wasn't exactly enthralling, it did touch on a couple items that I would like to investigate further. Hopefully, I'll find some time over the weekend to do this. So, I've discussed one item on my To Do list to research for this class, here are a few more items:

- Unallocated and Slack Space Research
- How do other file systems denote deleted files (HFS+, Ext's, NTFS)
- Also, getting an exact copy of a drive or "piece of evidence" as the book would call it. What I'm interested in is creating an iso of an HFS+ Mac OSX drive, then to stepping into the drive backup. I have the perfect situation ready at home. I recently purchased a new hard drive for my Macbook and didn't wipe the contents off of the old disk. Sounds like a date with Netcat and DD are in order for this weekend!

Introductions....

Well, I've started reading Digital Evidence and Computer Crime, and have gotten through the first two introductory chapters. They were, just that, very introductory. It's hard to find anything very interesting to talk about. The chapters covered definitions and just set the stage for later chapters. I have a feeling this book is going to cover aspects of specific cases and study what was found therein. I will like reading about the Electronic Communication and Privacy Act, as well as the Computer Fraud and Abuse Act in later chapters. Not having a great knowledge of the specific laws currently in place, that should make for a good read.

It was interesting to read some phrases were defined in these opening chapters. For example:

Hardware as contraband was defined as hardware used to intercept electronic communication. Which makes me wonder how www.thinkgeek.com can remain open when it sells a Key Katcher key logger.

The information as contraband section discussed how having encryption software was illegal in some states. This must be an old example, because, honestly any and every machine could be considered suspect. Maybe that was the intention.

Digital information as instrumentality was defined as programs used as a means for committing computer crimes. This made me think of the first time I met Rick Seeley as an undergraduate. During the conversation I mentioned using Knoppix for some task. He then gave me a strange look and quipped something about it being a hacking tool. Well, yes it was, but that wasn't exactly the purpose of the project. Yet, just having such a cd can look incriminating to some. Needless to say, I may have to figure out a good alibi for having Oophcrack, Kismat, Nmap, Desniff, Nessus, Netcat, Hping....et al all installed at home.

Digital information as evidence was really defined as the paper trail. No not T.I's latest album. Unless you obtained it via bittorrent, then yes that is evidence.

I've also made it through the first chapter of Guide to Computer Forensics and Investigations. Which really just discussed being an forensics professional. Most of what was covered seemed to be common sense. Topics included lawful search and seizure procedures, preparing for investigations, working in the private sector, having a working knowledge of multiple operating systems, becoming a part of different computer related user groups and organizations, etc.

What peaked my interest in this first chapter came about through one of the case studies. They described a case involving a murder investigation and the seizure of a computer containing evidence. Files were recovered off of the suspects computer that had been deleted and were timestamped prior to the murder which were then used during litigation to prove premeditation. Now, I've recovered data from drives in the past. However, I don't remember if the timestamp had been preserved. As, obviously, the timestamp didn't matter. The application used was a free Windows program called undelete. It simply scoured hard drives for files that had the pointers deleted but still remained in tact on the drive. Hopefully this and more topics will be discussed later in the book.

I haven't read much about network forensic work, but, I decided to play around with netcat this week. Doing some simple connections and file transfers. Seeing how netcat is the TCP/IP swiss army knife, I should get to know it! I did find how to use netcat to send a hard drive image across the network via: nc -w3 hostname port | dd of=/dev/hda. This could be handy in doing forensic analysis of a drive.