Brief list of port monitoring tools

A while back we deployed some special purpose server systems. They are pretty simple in terms of function but do provide some critical infrastructure support.

So when they go off-line for whatever reason (power failure, unplugged network cable, etc.) we need to respond to get them back online.

Proactive monitoring is pretty thin and currently we have more of a reactive monitoring solution. Someone needs one of these systems, finds it is down, and call us to fix it fast.

Nice.

So one solution developed was as simple batch file that ran a ping against the server IP’s. If a ping failed, then notice would be auto-emailed to selected staff to check it out.

That seems ok, but what happens when the NIC is up and responding to ping, but the core applications/OS has actually hung and it really isn’t “operationally” on-line, though the NIC is? Kinda gives the impression you don’t have a problem that you really do.

These systems are very simple and we can’t run any additional “client" software on it to “phone home” for service health and availability…something like Paessler's PRTG Network Monitor.

I did identify a few critical network services running on the systems and found that they communicated out on specific ports.

If we could run port-scans against those ports and found them open/listening, then that might provide a more accurate assessment of the servers’ health rather than the basic ping reply/no-reply feedback.

So here are a few of the tools and utilities I considered in that approach.

• Advanced Port Scanner 1.3 - free - Radmin. I liked this tool the best. Not only is it small and light, you can specify a set list of IP’s to scan against, as well as specific ports. The IP’s of our servers were loaded as well as the ports in question and I quickly can find out which systems are up and have the targeted services running.
  
• Microsoft PortQry Command Line Port Scanner Version 2.0 & PortQryUI - free - This is a command-line tool to query ports and get output. This is a great tool for a wide-number of network administration tasks, but really shines in that it is at the core a single exe file and can be used in batch files. The GUI tool version makes things a bit more visual if you need the functionality but without the CLI. Some additional resource information on the PortQry tool are provided below:
  
  • New features and functionality in PortQry version 2.0 - Microsoft Support
  • How to Make Portqry.exe Only Report Listening Ports - Microsoft Support
  • How To: Mastering PortQry.exe (Part 1) - WindowsSecurity.com
  • How To: Mastering PortQry.exe (Part 2) - WindowsSecurity.com
  • Thread Batch file for checking port status of multiple IP Address - BoardReader forum thread.
  • Simple Admin Tricks: Quick & Dirty Monitoring - Vircom Blog
    
• Angry IP Scanner - free - It had been a long time since I checked in on this IP/Port scanning tool. It has been in my utility toolbox for a long time, but the newer version supports running on Linux, Mac OSX and Windows. The Windows version in both a 32 and 64-bit version. It does require Java.
  
• SoftPerfect Network Scanner - free - This is my go-to favorite network scanner. It always provides very fast scan results and you can also specify port scanning feedback.
  
• Blue's Port Scanner - free - Nice and simple port scanner in both GUI and CLI versions.
  
• YAPS - free - another nice CLI/GUI support port scanner.
  
• PortScanner - free - a simple port scanner by Richard Moss
  
• SLCheck 2.0 - free - This is an alternative CLI port checking tool somewhat similar to PortQry but with a lot more bells and whistles.
  
• Nmap - Free Security Scanner - free - this tool is like serious overkill for our simple task but if you need to do extensive port/network monitoring, it might be the trick.
  
• Service Availability Tool - free - Fluke Networks.  This is a pretty cool network monitoring application tool although it does have it's limits. Set up IP/Servers you are monitoring, define services on those IP’s by port numbers or services names and let it run. Worth checking out if you need a more GUI/reporting-based tool. Download available from link with registration or from CNET Download.com

If you have any additional utilities or tricks for remotely monitoring server/service availability please drop a tip into the comment jar!

Cheers,

--Claus V.

Read More

Scratching at a SCSI Drive Itch - Part I - Hello Ubuntu

So one of the many assignments I have been working on lately is the decommissioning of a hoard of old Dell PowerEdge servers which will be sent to pasture. New technology has been deployed and these are obsolete.

Models range from 1300’s to a 2800; and each contains a pair of SCSI drives.

Accordingly, we need to be sure that all resident data has been purged from the internal drives. (Since apparently just yanking and tossing them into a super-shredder or piercing them with a ram-driven spike isn’t an option.)

The Great Wipe Hope

Instead, I turned to wiping them using DBAN / Darik's Boot And Nuke

I had to use a combo of builds as in some cases the CD ROM drive in the server didn’t work and I didn’t feel like tearing the chassis apart to swap them (or the drive bay carriages). For that I used the last DBAN version that came in a floppy drive format. Otherwise I used the latest CD-based version.

Either way they both seemed to do a good job with a DoD Short 3-pass wipe/zero session. (Yes, yes, I know..a 3-pass now days? The powers that be require a 3-pass minimum wipe if we are passing them on.)

So while DBAN seemed to handle the SCSI drives and daughter-board (?) adapter hardware just fine, every now and then on some of them I would get a “non-fatal errors were encountered” message when the wiping was done.

Obviously I wasn’t tending them full-time so I couldn’t find the error as the logging didn’t work too well; something about writing to a full floppy and/or the CD version obviously couldn’t write to itself.

Anyway…all’s wiped is good correct?

Nay! “Constant Vigilance!”

Reality Check-in

I  just remained uncomfortable releasing these wiped servers without doing an independent verification that the drives really showed all sectors as “zero-out”.  Didn’t want the mess of answering questions if one turned up on E-bay unverified with data still on it. That would be a Bad Thing™.

So my plan was simple.

I’d just pop in one of my custom WinPE CD’s and run a Windows-based "sector editor” against the drives and quickly confirm we found an all-zero pattern.

Simple right?

Not really.

See what I quickly found out is that while my custom WinPE CD is a really cool tool, (big surprise) it didn’t have the needed SCSI adapter board drivers. So while I could boot the iron, I couldn’t see the drives.

That sucks and the plan is now in jeopardy.

I did some reconnoitering via Google and while I found all kinds of things regarding adding drivers to WinPE (something I already knew), trying to find a source for the specific mass-storage SCSI drives that would run under WinPE 2.0 seemed fruitless.

In which Kirk learns that finding WinPE SCSI drivers for the Enterprise may be a problem

In Which “Plan U” is Formed…

So I regrouped.

I knew that Linux seemed to be handling the particular SCSI drives/adapters OK since DBAN was working without any issues.

Since I have been working in Linux quite comfortably, I went directly to Ubuntu for a LiveCD solution.

Sure enough, a check of the Installation Media page found that SCSI CD-ROMs were supported as was the following:

Generally, the Ubuntu installation system includes support for floppies, IDE (also known as PATA) drives, IDE floppies, parallel port IDE devices, SATA and SCSI controllers and drives, USB, and FireWire. The supported file systems include FAT, Win-32 FAT extensions (VFAT) and NTFS.

Disk interfaces that emulate the “AT” hard disk interface — often called MFM, RLL, IDE, or PATA — are supported. SATA and SCSI disk controllers from many different manufacturers are supported. See the Linux Hardware Compatibility HOWTO for more details.

Following that link I confirmed that the particular SCSI controllers I was encountering in these systems was also supported.

Great.

So what process should I use to verify a total zero-out of the drives under Ubuntu?

…and DD is summoned

I knew from my previous secure drive wiping studies that the terminal command tool “dd” could be invoked, not just to wipe a drive but also examine sector data and contents.

From Disk Wiping with dcfldd - Anti-Forensics blog, MAX shows us some techniques (using dcfldd though dd worked fine with the same commands seen below since dcfldd wasn’t on my Ubuntu build):

To view the first sector (with dd) of the first attached drive;

sudo dd if=/dev/sda count=1 bs=512 | hexdump -C

For additional sector spotting, just change the value for count= accordingly.

If the drive had been fully zero-ed out, then running the following command…

sudo dd if=/dev/sda | hexdump -C

…should result in the following output as seen on a blank virutal drive I have handy:

All zero’ed out!

I found some additional tips from Dr. Nikolai Bezroukov over on this super-detailed dd usage information page, including this gem:

I just want to make sure my drive is really zeroed out!!

dd if=/dev/sda | hexdump -C | grep [^00]

... will return output of every nonzero byte on the drive. Play around with it. Sometimes drives don't completely zero out on the first try.

And finally, Raymond McKendall has some super-useful “dd-fu” secure wiping verification tips at his Ray’s Notebook site post Erasing Disk Drives. (Note: no page-scrape offense is intended to Mr. McKendall. I want to record all this in case I need to print this post in entirety and take a single hard-copy output with me for quick reference. Full props to him as I doubt I wouldn’t have easily figured this out on my own!)

It's not a bad idea to verify that the drive has been completely overwritten. When the fill pattern is a constant, like 0x00 or 0xFF, then hexdump provides an easy means to check shredding:

-> time hexdump -C /dev/sdb
00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
df8f90000

real 40m21.654s
user 9m16.822s
sys 1m47.435s

Here, hexdump reports that the file contains 0xdf8f90000 bytes and that each byte has the value 0x00. To verify this byte count, let bc convert from hexadecimal to decimal: -> echo $bytes; echo "ibase=16; DF8F90000" | bc 60011642880 60011642880

As it turns out, hexdump offers formatting options that can be used to condense the previous report:

-> time (hexdump -e ' "%d " "%_Ad bytes\n" ' /dev/sdb; echo $bytes)
0 *
60011642880 bytes
60011642880

real 40m34.971s
user 30m37.536s
sys 1m56.239s

The first output line indicates that all of the bytes are zero, the second line reports the total number of bytes examined, and the third line echos the value of $bytes for easy comparison.

Alternatively couple dd with hexdump to get a record count and timer all in one. This next example also specifies an ouput format to hexdump, just to be fancy:

-> dd if=/dev/sdb | hexdump -e '"hexdump: " "%d"'
hexdump: 0*
117210240+0 records in
117210240+0 records out
60011642880 bytes (60 GB) copied, 2685.18 s, 22.3 MB/s

The "0*" verifies that all bytes are zero, and the record and byte counts show how many bytes were examined. It's easy to verify that these counts meet expectations:

-> echo $sectors sectors $(( $sectors*512)) bytes
117210240 sectors 60011642880 bytes

And to see the elapsed time in minutes:

-> echo "scale=1; 2685/60" | bc -l
44.7

Or, use grep

-> grep -v -P '\0' -c -m1 junk 0

Which was all well and good, but…

This whole process was very time-consuming. To say it nicely.

Running any of even the basic dd verification methods, though quite definitive, would require many hours…per disk. And since the hard-drives I had were in the 16-80 GB range, and I had a gazillon of them to check…this technique while thorough, was a time-killer.

…pssst, Buddy. Got a good Linux sector editor GUI?

Despite my best efforts, I couldn’t find a GUI-based sector editor pre-loaded in the Ubuntu  12.04 base distro.

So I went looking wider.

Experimenting with GNU/Linux: Five gui hex editors for ubuntu - UnixLab blog

This was a great starting point, and I spent last weekend trialing them and others on my virtual Ubuntu system.

Bless Hex Editor - Ubuntu Apps Directory. Bless worked great, was able to be downloaded directly from the Ubuntu Software Center app and was easy to use. When launched via the terminal with “sudo” (a process I had to follow with all the apps listed below), I was able to access the local hard drives sda/sdb and quickly perform a visual inspection of the sector contents.

Tweak: an efficient hex editor - Ubuntu Apps Directory. This is a terminal-based sector-editor, but does provide a GUI-like interface view. See this Ubuntu Manpage: tweak for the terminal command syntax as well as this developer’s Man page for tweak. It worked well and was also installable via the Ubuntu Software Center.

Ncurses-hexedit: Edit files/disks in hex, ASCII and EBCDIC - Ubuntu Apps Directory. This is another terminal-based sector editor in a GUI-like interface view. See this [N]Curses Hexedit manual. It worked well and was again installable via the Ubuntu Software Center.

hexedit - Ubuntu Apps Directory, likewise again could be installed via the Ubuntu Software Center. Invoke from terminal via : sudo hexedit /dev/sda

KDE Utilities - Okteta - This is very nice, but to fetch it you must run: sudo apt-get install okteta  I also had issues accessing and viewing /dev/sda with it that I couldn’t overcome. So despite the nice look, it didn’t fit my bill easily.

There were a few others, but these seemed to be the biggest and easiest to use “out of the box”.

Then there was wxHexEditor…

wxHexEditor  - a Free Hex Editor / Disk Editor for Huge Files or Devices on Linux, Windows and MacOSX

I really, really liked this tool. It is seriously good. Really!

Not only was it rocket-fast and easy to see/navigate around it, as an added bonus it has a helpful “infoPanel” docked in the bottom left corner to verify the drive/size you are looking at. So if I had a 16 GB drive but was only seeing 8.0 GB reporting, I’d be worried.

Getting it on Ubuntu was a particular challenge to me since it was not listed in the Ubuntu Software Center and I am a Linux noobie.

The “easiest” way I could come up with it was to go over to GetDeb.net V2 - Software for Ubuntu Linux’s wxHexEditor page.

Using that source required me to first install the “get-deb” package to then fetch wxHexEditor.

That wasn’t a problem, but for some reason it didn’t work via downloading from Firefox.

So I re-read the instructions and found that bug 476853 applied to me. Which basically says Firefox hoses the downloads. So I then had to download Chrome into my Ubuntu build to fetch things. That worked and I was eventually able to successfully get wxHexEditor running nicely in Ubuntu.

Did I mention it was compiled in Linux, Mac OS X and Windows binaries? Sweet!

Success? Let’s call it a Pyrrhic victory…

OK. So here’s the rub.

To accomplish my GUI-sector-viewing quick-verification goal on each of these servers, since I was using a LiveCD of Ubuntu I had to…

1. Wipe the system with DBAN, wait to finish.
2. Reboot the system with Ubuntu
   1. Did CD-ROM drive work? Yes? Continue to step 3.
   2. No? pull SCSI drive carriage out of system and place into sever that had working CD-ROM drive. Continue to step 3.
3. Carefully select option to try LiveCD rather than install Ubuntu onto (hopefully) wiped drive.
4. Wait for Ubuntu to load into limited server system RAM bank.
5. Wait some more.
6. Connect network cable to server.
7. Wait for network detection.
8. Download “Bless” via the Ubuntu Software Center.
9. Install “Bless”
10. Run Bless to then inspect /dev/sda & /dev/sdb
11. OK?
12. Shut down Ubuntu/eject disk.
13. Open server chassis to visually verify no additional non-detected SCSI drives were present. Two were expected, confirm that only two physical drives are inside the box.
14. If step 2.2 was invoked, replace drives back into original server chassis.
15. Repeat

This took a frigging long time.

Successful? yes.

Efficient? hardly.

So whatcha gonna do? Build a custom Ubuntu LiveCD?

Well, I suppose I could re-master a Linux LiveCD of Ubuntu that has Bless (or wxHexEditor) installed in it. Way, way before I built Windows PE disks, I cut my teeth making custom Knoppix Live CD’s to use to off-line boot and recover files from DOA Windows NTFS partitions. That was how I first got acquainted with LiveCD formats. That was when having a DOS boot floppy disk for system servicing was still required carry.

I checked out that possibility and found a number of techniques and methods to do so:

• LiveCDCustomization - Community Ubuntu Documentation
• MakeALiveCD/DVD/BootableFlashFromHarddiskInstall - Community Ubuntu Documentation
• How to Create Your Own Customized Ubuntu Live CD - How-To Geek
• How to Create a Custom Ubuntu Live CD or USB the Easy Way - How-To Geek
• Make Your Own Live CD With Ubuntu Builder - Digital blog
• Remastering an “Ubuntu alternate” ISO with Ubuntu Customization Kit – the complete guide - Fabrizio Balliano

Here is the deal. While I was pretty confident I could successfully do it, my project timeline to wipe and get the severs returned for surplusing didn’t give me enough time to do so.

Then again, maybe I could find another Linux LiveCD distro that had a GUI-based sector-editor pre-installed and that would support the particular SCSI drive/controller hardware I had.

Not really, I tried but burning lots of CD’s to trial-n-error them didn’t appeal to me and I didn’t want to attempt using my iODD hard drive to emulate ISO’s for this task.

I might have been able to save a “persistent user profile” to a USB/floppy drive…but the USB support on these servers was spotty at best and I didn’t always have the luxury of both a working floppy drive AND a working CD ROM drive in any given server (seriously) so that really wasn’t worth messing with if I could even get the required planets to align.

Concurrently, another enterprise-wide deployment storm was brewing and the squall-line looked serious. Time was of the essence and I had to complete this project. It was bad enough that I was adding in the self-imposed secondary-verification level for this job.

I’d learned a lot and improved my Linux/Ubuntu user skill set, but I was still not satisfied this was the path to continue my investment in.

Stay tuned for Scratching at a SCSI Drive Itch - Part II

…in which the problem is elegantly solved and I learn and find even more awesomeness!

Cheers,

--Claus V.

Now for the “GUI-Gotcha’s” Postscript

Note, one “gotcha” of this GUI-editor method over the “DD” methods noted earlier is that just dragging the scroll bar down the drive doesn’t really allow you a sector-by-sector inspection of the contents. You are more likely “skimming” them and potentially missing data in your speed reading. That said, it should (possibly) be pretty obvious for a heavily used drive that large blocks of data would be present if the drive wasn’t successfully zero-ed out.

YMMV with this technique so use according to your comfort level.

Read More

Windows 8 Linkage: Product Name “Something or Another”

Umm…we’ll get back with you on that…

Glad I’m not the guy in charge of product branding and damage control over in Redmond at the moment!

If it wasn’t challenging enough trying to continue the positive spin on the forced Windows 8 Metro home page (?) interface, and convincing enterprises that this new GUI model will improve productivity and operational excellence with their employees over Windows XP/Window 7, now they have to do some major spin-control on the whole “it was really just a codename” for the Windows 8 look/feel.

• Exclusive: Microsoft's Metro branding to be replaced 'this week' according to internal memo - The Verge
• Report: Trademark dispute scuttles the name ‘Metro’ for Windows 8′s design [Updated] - Chron.com’s TechBlog by Dwight Silverman
• Cleaning up Microsoft’s Metro mess -ZDNet’s Ed Bott’s take on the…dare we say…debacle?

Really?

Anyway…regardless…it’s time to clean out the Windows 8 link hopper and do a Grand Stream Dreams Windows 8 linkfest dump.

Please note references to the former Win8 interface have been struck through for amusement and accuracy.

Win8 - Start Here - Get It

• It’s Official – Windows 8 Will Be Available on October 26, 2012 - Windows7hacker
• Microsoft Reveals Windows 8 Upgrade Path [Chart] - Windows7hacker
• Upgrade to Windows 8 Pro for $39.99 - Windows Team Blog

Win8 - Related Products and Services

• Download the beta release of Windows Server 2012 Essentials today! - Windows Server Blog
• Microsoft confirms enthusiasts' fears: No more versions of Windows Home Server - ZDNet
• Windows Home Server is dead, but we shouldn’t mourn it - Ars Technica
• Microsoft Office Customer Preview - Microsoft Official Site
• Office 2013 preview: cloud subscriptions, Metro flair, and touch improvements - The Verge
• Download Microsoft Office 2013 customer preview now - Ars Technica
• First look: Outlook 2013 - Ars Technica
• First look: Word 2013 - Ars Technica
• First look: Excel 2013 - Ars Technica
• First look: OneNote 2013 - Ars Technica
• First look: PowerPoint 2013 - Ars Technica
• Disabling animations in Office 2013 - Within Windows
• BETA: “The new Office” is announced - Kurt Shintaku's Blog
• Microsoft moves your Office to the cloud - BetaNews
• Office and the Cloud - Office Next Blog
• The New Office 365: Baby Steps in the Right Direction - ReadWriteWeb Blog
• A (p)review of Microsoft Office 2013 - BetaNews
• Microsoft Office 2013: Offline Installer of the preview version - Caschys Blog (Google Translated)
• Reading in the new Office - Office Next blog
• New in Windows Server 2012 – Part 1: Management - 4sysops blog
• New in Windows Server 2012 – Part 2: Storage - 4sysops blog
• Introducing Outlook.com - Modern Email for the Next Billion Mailboxes - Outlook Blog
• Outlook Is a Completely New, Feature-Filled Webmail Service from Microsoft - Lifehacker
• Get Your Email Address for Outlook.com, Microsoft's New Hotmail Killer - ReadWriteWeb blog
• Microsoft unveils Windows 8-inspired “Outlook.com” freemail service - Ars Technica
• Hotmail Gets A New Name – Outlook.com - Windows7hacker
• Microsoft relaunches Hotmail as Outlook - BetaNews
• Outlook.com: Take a Tour of Microsoft's Hotmail Replacement - ReadWriteWeb blog
• Making an Alias for Your Outlook Account Is Crazy Easy - Lifehacker
• Outlook.com: a big tour - Caschys Blog (Google Translated)

Win8 - Install It

• Windows 8 and Windows 8 Upgrade Clean Install: these are the existing information - Caschys Blog (Google Translated)
• New Windows Server 2012 puts virtualization front and center - Ars Technica
• Microsoft confirms enthusiasts' fears: No more versions of Windows Home Server - ZDNet
• Microsoft sets Server 2012 lineup and pricing, ditches Home Server - BetaNews

Win8 - Under the Hood

• Designing the Windows 8 Calendar app - Building Windows 8 blog
• Windows Aero Glass without 8: How it looks - Born’s IT & Windows Blog (Google Translated)
• Fixing up a virtual machine while importing it on Windows 8 / Windows Server 2012 - Virtual PC Guy's Blog
• Windows 8: Explorer "File Explorer" renamed - Born’s IT & Windows Blog (Google Translated)
• What’s The Difference Between Windows 8 & Windows RT? - MakeUseOf Blog
• No more freezes in Windows 8? - Born’s IT & Windows Blog (Google Translated)
• Hotfix available for Windows 8 freezing issues - Within Windows
• Fast start-Winlogon bug in Windows 8? - Born’s IT & Windows Blog (Google Translated)
• ISO mounting bug in Windows 8? - Born’s IT & Windows Blog (Google Translated)
• Protecting user files with File History - Building Windows 8
• A step back in time with Windows 8′s File History - Ars Technica
• Windows 8 file version history: the time machine for Windows 8 makes other tools superfluous - Caschys Blog (Google Translated)
• Microsoft details File History, Windows 8's automated backup tool - The Verge
• wbadmin: full backup on Windows 8 using a system image - Caschys Blog (Google Translated)
• BitLocker in Windows 8 - 4sysops Blog
• Windows 8: Final still to optical changes - Caschys Blog (Google Translated)
• Microsoft says Windows 8 Store: 7-day trial period & Co - Caschys Blog (Google Translated)
• Windows 8 Secrets: RTM Windows Store Revealed - Within Windows
• Simplifying printing in Windows 8 -Building Windows 8

Win8 - To Go

• 53 - Windows 8 To Go (boot Windows 8 from a USB drive!) - RMPrepUSB - Really great “how-to” guide (from a site with tons of USB boot device tips and tricks).

Win8 - Tweaks

• You can hack Windows 8 Metro - BetaNews
• How To Try Out Metro Version of Chrome in Windows 8 - Windows7hacker
• Skip Windows 8 Start Screen & Go Directly To Desktop On System Startup - AddictiveTips
• Workaround for Windows 8 freezing issues - Within Windows
• ViStart to Enable Start Menu (Windows Orb) in Windows 8 - Windows7hacker
• Windows 8 boot menu text vary between Metro and… - Born’s IT & Windows Blog (Google Translated)
• How To Disable and Bypass Windows 8 Lock Screen - Windows7hacker
• SystemPowerShortcuts Adds System Power Option Shortcuts on Windows 8 Start Screen - Windows7hacker
• How To Add Shutdown, Restart & Log Off Tiles To Windows 8 Start Screen - AddictiveTips
• How to “Set users home folder” via group policy in Windows 8 - GroupPolicyCentral
• RecImg Manager, a free backup and restore software for Windows 8 - The Windows Club
• RecImg Manager: Backup And Restore System Snapshots In Windows 8 - AdditiveTips
• How To Prevent Anyone From Uninstalling Metro Apps from Start Screen in Windows 8 - Windows7hacker
• Power8: Start Menu For Windows 8 That Can Block Metro Features - AddictiveTips
• Windows 8: Faster boot into the desktop - Born’s IT & Windows Blog (Google Translated)
• Windows 8: System Power Shortcuts - Caschys Blog (Google Translated)
• Upgrade Windows 8 with an awesome Metro-themed Explorer - BetaNews
• Tame the Windows 8 All Apps screen -BetaNews

Win8 - Deeper Insights

• Windows 8: CPU compatibility problems during setup - Born’s IT & Windows Blog (Google Translated)
• Windows 8: CPU compatibility problems - Part 2 - Born’s IT & Windows Blog (Google Translated)
• Windows 8: Using Hyper-V on non SLAT CPUs? - Born’s IT & Windows Blog (Google Translated)
• Caution, if at partitioning Windows 8 - Part 1 - Born’s IT & Windows Blog (Google Translated)
• Dynamic disk to basic disk conversion - Part 2 - Born’s IT & Windows Blog (Google Translated)
• UMTS: No Internet for Metro Apps (Win8) - Born’s IT & Windows Blog (Google Translated)

Win8 - DaRT

• DaRT 8 Overview - Diagnose, Troubleshoot PC Issues - Microsoft TechNet video discussion

Win8 - Usage Tips

• How To Open Dos Command Prompt Window As Administrator in Windows 8 - Windows7hacker
• Windows 8: Network Error, Access Denied - Born’s IT & Windows Blog (Google Translated)
• INFO: Hints on using Windows 8 as a Desktop OS - Kurt Shintaku's Blog
• How to Shutdown or Restart Windows 8 - Cybernet News blog

Win8 - Miscellanea, Rumors, & General Grumblings

• Why Microsoft killed the Windows Start button - PC Pro
• What’s Missing From Windows 8? - MakeUseOf blog
• Final thoughts on Windows 8: A design disaster -ZDNet
• Windows 8 is like a bad blind date  - BetaNews
• Windows 8 will flop - BetaNews
• What if Windows 8 fails? - BetaNews
• Microsoft reportedly killing off desktop gadget support in Windows 8 - The Verge
• Imagine what Metro could have been... - BetaNews
• Windows 8 Metro is pointless for the enterprise - BetaNews
• Windows 8 Mail leaves users pining for the desktop—or even their phones - Ars Technica
• Windows 8: The end of the full retail version? - CNET Reviews
• Microsoft should follow Apple's lead and ditch the disc in Windows 8 - BetaNews
• Eight awesome ways to improve Windows 8  - BetaNews
• Office politics are killing Windows 8 - BetaNews
• The New Microsoft Office: 20 Things to Like, Not Like and Worry About - ReadWriteWeb blog
• OneNote MX Available on Windows Store As Native Metro App - Windows7hacker
• EU trustbusters tire of Microsoft tricks, probe Windows 8 - BetaNews
• Microsoft Office lifestyle: making consumers more like enterprisers - Ars Technica

Windows 8 - GSD Previously Posted

• Windows 8 Linkage: “Majestic Metro” version - GrandStreamDreams blog
• Windows 8 Linkage: “Passage Public Metro” version - GrandStreamDreams blog
• Windows 8 Linkage: “Metro Santiago” edition - GrandStreamDreams blog
• Windows 8 Linkage: “Metro at Nightfall” edition - GrandStreamDreams blog

Cheers!

--Claus V.

Read More

GSD Linkfest - a little bit of everything today

Quick collection of links gathered in this week.

• Data recovery tutorial - As discovered and described by TinyApps.org. Very nice guide covering a number of Linux-based tools and techniques. DataRecovery - Community Ubuntu Documentation
• Copy files from failing devices - Another great tippage from TinyApps bloggist. Check out safecopy
• Create a system recovery partition - Great finds from TinyApps must come in “threes” as a link to Steve Si’s Create a system recovery partition post is found. It’s a detailed walkthough on setting up a Windows system-restore partition…just in case bad things ever strike.
• Add to the file carving kit - TinyApps bonus links to POC for “Smart Carving” methods. Drop into the project’s SourceForge Documentation page to get the details.
• FreeRecover - Free file recovery app for NTFS drives. It’s pretty fast. You can select options to get file paths as well as check “file integrity” to evaluate recovery value.  At this moment you cannot seem to sort results by column headings. It’s a good start.
• Redo Backup and Recovery - BootCD format ISO file to handle system backups, recovery, partition editing, file recovery, and may more additional tools.
• | Free Security & Utilities software downloads at SourceForge.net
• The Case of the Veeerrry Slow Logons - Mark's Blog - Great post by the Windows Master Mark Russinovich. Covers a number of angles as well as the Windows login process in detail (and how it can be hampered). Good reading.
• Google Chrome Bookmarks Menu Extension - CybernetNews found a really refined and polished  Google Chrome Bookmarks Menu Extension. I had been using Atomic Bookmarks but this one is much better IMHO.
• Ads Are Coming to Google Chrome Extensions - TheNextWeb blog. Choose your extensions wisely now, my friends…
• Release: NewsFox 1.0.8.4 - My favorite in-Firefox RSS feed add-on has a new release. newsfox: NEWEST
• Filelist Creator - Free mini-app to create great lists of files/directories for indexing documentation. I have a few of these and this one is very, very nicely done. It’s been added to my carry-list.  Spotted and reviewed over at this Create Detailed File Lists In Various Formats With Filelist Creator AddictiveTips post.  Check out the big collection of other great utilities over at Stefan Trost Media. I grabbed more than a few!
• TED V3.0 : The TEDinator - New update to the super-duper “TED Downloaded”.  I really appreciate the detail and help this tools brings in allowing me to download a local file of favorite “TED” talks. See also the new TED Radio Hour : NPR.
• HexDive 0.3 - Hexacorn has just released a new version of HexDive which helps look for key strings in possible malware and other executable files. It’s CLI so it is really fast.
• Forensic Artifacts blog has been releasing a large list of posts detailing forensic-worthy artifact bits left over from many applications. I found the PsTools Artifacts post extra interesting since it is used by a lot of us SysAdmins.
• NTFS Tools collection - reboot.pro. Joakim Schicht has just announced an updated collection of NTFS tools he has been grinding away on.  After you read the overview on the first link, hop over to his Google Project hosting page mft2csv to check out:
• NTFS File Extractor which extracts systemfiles (metafiles) off an NTFS volume.
• mft2csv which takes a $MFT file and rip info from all the records and dump to CSV file.
• MFTRCRD is a cli file dumper to pull all info mft2csv can decode. can also dump the $MFT record of a specific file to console and detailed run information.
• SetMACE which is a timestamp fiddling tool.
  
  Note, Joakim doesn’t have them all bundled up in a single archive package so look at the Downloads page carefully to pick out the most recent versions of each of them. It isn’t hard but does take a moment to make sure you are grabbing the right file. Also be aware that these are compiled in “AutoIt” script. It’s very flexible and powerful but some AV apps might complain…  Joakim has done a great job with his documentation on each tool. Check out the Wiki for more details on each one.

Have fun!

--Claus V.

Read More

Material Roundup: Linkfest

Been a semi-relaxing weekend.

Read with interest this TaoSecurity blog post Bejtlich's Thoughts on "Why Our Best Officers Are Leaving" as well as this one Whither United States Air Force Academy? both by Richard Bejtlich. I also noted that the USAFA was evacuated this week as cadets were heading in due to the area fires. These things still catch my attention as I had started the process to become a USAFA candidate my senior year of high-school before removing myself from the process for family reasons (my choice…no excuses). Still, I will always wonder about the path not taken.

Also, while IANAL, I was left scratching my head and heartbroken just a bit by the recent SCOTUS decision. The USNI blog had a post that resonated with my own feelings: The U.S. Supreme Court just diminished the significances of Military Valor [opinion].

Little bro was in town so he brought some pizza’s over, I grabbed some super-good local micro-brewed root beers and we had a party catching up, comparing life notes, and watching Act of Valor on this pre-July 4th weekend.

I wrapped things up yesterday with a viewing of Cave of Forgotten Dreams (Wikipedia) which covers the Chauvet Cave (Wikipedia). Very interesting and well filmed documentary. The cave-art is really fascinating…I just wish we could have learned more about the people behind it.

I guess if there was a theme it was reflecting on the importance of what remains of us, of our efforts, of the world around us.

Back to the shallows…

Sometimes I feel a bit guilty just dumping a super-post like this that is heavy-laden with linkage.

Some weeks are busier than others, however, and while I have more than a few posts still pending in the hopper that are deeper collections of “how-to”, personal reviews, or troubleshooting sessions, I hope that some find value in these “linkfests”.  Primarily they serve to help me quickly search and find material, tools, and techniques that I believe will either be useful, or are useful, when I am away from my desk and my USB dongle is at home rather than in hand. It’s challenging finding that right software or tip and maybe something here will be useful to others or pique their interest and send them in the right direction.

Security Bits

• Adobe updates Flash Player 11.3 to fix Firefox crashing problem - The H Security - Adobe issued a new Flash (non-IE only) version 11.3.300.262 to address some issues in Firefox 13. Get your update.
• Analysis of drive-by attack sample set  - ISC Diary - I always value posts like these that teach and show how “drive-by” vectors work. I’ve cleaned more than a few systems that fell victim to a drive-by because Java/Flash/OS/etc. wasn’t correctly patched.
• Firefox thumbnails could expose private data; fix 'coming soon' - ZDNet. I hadn’t thought of it as an issue since I am use to Chrome doing the same thing, but the thumbnails are larger in Firefox and I could make out some detail to the webmail pages I saw as compared to how they render in Chrome.
• Stop Firefox 13 Speed Dial Thumbnails From Showing Secure Content - AddictiveTips
• How to turn off Firefox’s New Tab Page Completely - ghacks.net blog.
• Our password hashing has no clothes - Troy Hunt’s Blog - Troy lays out an excellent (developer level) case for the new challenges of password hashing and salting. This was excellent reading and I really took a lot out of it in terms of password security in general.
• John the Ripper password cracker - speaking of which Jon the Ripper “jumbo” edition just got released at version 1.7.9-jumbo-6 for Unit. WIndows binaries seem to be at 1.7.9-jumbo-5. Announcement here.
• oxid.it - Cain & Abel - seems worth mentioning…
• Free Computer Security - Personal Software Inspector (PSI) - Secunia. New Version 3.0 released with even more awesomeness!
• Third edition of vulnerability spotter Secunia PSI - The H Security. More breakdowns.
• Secunia PSI 3.0 released - HelpNet Security - more details here regarding this release version.
• Free Online Computer Scan - Online Software Inspector (OSI) - Secunia. If the “installed” client isn’t your thing, the on-line scan is still super awesome and helpful.
• Qualys BrowserCheck - Related - don’t browse the web in your browser without checking it for patch and plugin update availability!
• Detect & Remove Fake Antivirus Scams From Your Windows PC - AddictiveTips post for a new MicroTrend tool to help with fake-av infection removal. See below.
• Removing Fake Antivirus (FakeAV) - TrendMicro. Comes in both CLI and GUI downloads.
• Remove 50 Known Fake Antivirus Software From Windows - AddictiveTips related post on another fake-av removal tool
• Remove Fake Antivirus 1.86 - download tool as offered by free of virus & comptuer tips blog.
• Security Center reports Virus Protection is On - ever handy tip from TinyApps blog.

For Sec News

• Registry Decoder 1.3 released! - Digital Forensics Solutions. Bug fixes and some new plugins.
• More good stuff - RegRipper - new plugins from Elizabeth Schweinsberg coming soon.
• SANS Digital Forensics and Incident Response Poster Released - Handy! SANS
• Training, and Learning - Windows Incident Response blog
• When was a file accessed? - Windows Incident Response blog (How many times does this question get asked?)
• Investigator's Tool-kit: Timeline - ISC Diary. Quite detailed overview and issues post
• Win7 HomeGroup Reg Particulars - Forensic Artifacts
• WinFE “Lite” - Windows Forensic Environment
• Build questions -Windows Forensic Environment
• HexDive 0.2 - Hexacorn Blog

Network Resources

• Wireshark 1.8.0 can capture from multiple interfaces at once - The H Security
• Wireshark · Wireshark 1.8.0 Release Notes - new Wireshark release in the waters…if you didn’t figure it out.
• Wireshark · Download links
• SoftPerfect Network Scanner - freeware - release 5.4.4 now out. Changelog Comes in both x32 and x64 flavors. My favorite stand-alone IP scanner (out of more than many I carry).
• Chatter on the Wire: OS Fingerprinting - Satori was recently updated and now supports many more network fingerprints.
• http://kitty.9bis.com - Never heard of KiTTY before but it is a fork of .62 PuTTY telnet client with some extra features.
• New: KiTTY Portable 0.62.1.2 (telnet and SSH with added features) Released - PortableApps.com has a portable version.
• PuTTY: a free telnet/ssh client - For the purists.
• Announcing TightVNC Version 2.5.2 -TightVNC - New version just released. Love this app.
• TightVNC: VNC-Compatible Free Remote Control / Remote Desktop Software - Download TightVNC here.
• Announcing TightVNC Java Viewer - Yeah, the Java version rocks the beans as well. Super easy to use, compatible with standard VNC, TightVNC, UltraVNC, x11vnc, Apple Remote Desktop in Mac OS X, Xen/HVM, VMWare, Qemu etc. The link/page says 2.1 but there is a download link present for TightVNC Java Viewer version 2.5.2 so be sure you grab the latest version!

Tools and Utilities of Note

• Updates: Autoruns v11.32, Process Explorer v15.21, Process Monitor v3.02 - Sysinternals. Stop, Drop, and Download now; the holy trinity of software tools just got updated again!
• Monitor Any Folder Or Disk Drive For Changes In Real-Time, Even Across Networks - AddictiveTips blog post review of new NirSoft tool.
• FolderChangesView - Monitor folder/drive changes - NirSoft
• ExtremeCopy: Probably The Fastest File/Folder Move & Copy Utility - AddictiveTips blog review.
• ExtremeCopy - Easersoft. I’m a dedicated TeraCopy fan but this one sounds intriguing. Will need to put it through the paces soon.
• Remove Items from the Windows Explorer and IE Context Menus - CyberNet News.
• MenuMaid - SD Software - software utility link
• 4 Better Windows Console Tools Alternatives to Windows Built In Command Prompt -Windows7hacker - Kent has a really nice roundup. While the good-ole cmd.exe will do the job, I must say these “replacements” are quite nice. I’ve used “Console2” quite a bit and like the tab format and transparency/font/color tweaking options. PowerCMD surprised me with its feature set and I really can see myself using it more regularly. Check out the others as well.
• GetFoldersize - Michael Thummerer Software Design - Super nice freeware tool to locate and understand just what is taking up space on your hard-drive. Was recently updated to version 2.5.10. I really like this tool.
• SizeOnDisk Folder Size - new to me freeware tool found on CodePlex.  Another nice tool to find file/folder size hogs.
• Folder Size - another freeware file/folder size tool.
• SpaceSniffer - Uderzo Software - freeware tool that is amazingly fast and amazingly fun to use. While the previously mentioned tools excel at a tabular report, this one provides a super easy visual layout presentation of your space usage. You can drill down very easily. It gives you a easy-to-grasp picture on what is using up your hard-drive space..
• SequoiaView - I keep this one around just because it is so beautiful. It does a great job even though it hasn’t been updated in quite a long time. It may have been one of the first to present space on disk usage in a “squarified” treemap format.
• FolderSize - tiny little app (174 kb) from developer Jan Horn that is standalone and gives you a basic what-you-need-to-know report on drive/folder space usage.
• DirectorySlicer - With giant (and cheap) USB sticks and network connections aplenty, splitting files and folders to specific sizes is become a rarified task. That said this CodePlex project is worth snagging in that it splits files of a folder into partitions of a specified size. So that super-folder you are trying to burn to CD doesn’t fit? Directory Slicer takes the work out of guessing by allowing you to set the size (or use a preset) then it divvies it up accordingly! Clever.
• Unlock & Delete Empty Folders via Wildcard-Based Rules - AddictiveTips post review of…
• Empty Folder Cleaner - 4dots Software
• Reminded me of a previously GSD mentioned Empty Folder Nuker by Simon Wai.

For the Admins: Mostly from Microsoft

• Rights Protected Folder Explorer 1.0 - Bink.nu blog. “Rights Protected Folder Explorer is a Windows based application that allows you to work with Rights Protected Folders. A Rights Protected Folder is similar to a file folder in that it contains files and folders. However, a Rights Protected Folder controls access to the files that it contains, no matter where the Rights Protected Folder is located.” Also Download Rights Protected Folder Explorer from Microsoft info from TheWindowsClub blog. Get it here Download: RPF Explorer - Microsoft Download Center(Download Details).
• The Group Policy Setting “Verbose vs normal status messages” has a new name in Windows 8 - Anything about IT  blog
• Comprehensive Linux course - TinyApps bloggist shares an amazing resource find for us Linux wannabe-better’s offered by Paul Cobbaut. Although it is claims to be Linux basics, it covers a wide range of topics and material.  This is a great find! Check back to the site often as the material is getting frequent updates.
• Microsoft Outlook Configuration Analyzer Tool 2.0 - Bink.nu blog - “The Outlook Configuration Analyzer Tool 2.0 provides a detailed report of your current Outlook profile and mailbox. This report includes many parameters about your profile, and it highlights any known problems that are found in your profile or mailbox. For any problems that are listed in the report, you are provided a link to a Microsoft Knowledge Base (KB) article that describes a possible fix for the problem.” Go get the Download OCAT_Setup.zip over at the Microsoft Download Center’s Download Details page
• FREE: Service Credential Manager – Search Windows services - 4sysops post on a new tool Service Credential Manager to help check all scheduled services and tasks based on a specific user account across your domain. Nice! In free/$ flavors.
• FREE: ADREPLSTATUS – Active Directory Replication Status Tool - 4sysops blog post on a new Microsoft tool with a snazzy GUI to check for AD replication issues. Has export ability for reporting. Download: ADREPLSTATUS at the Microsoft Download Center (Download Details).

Cheers and happy pre-July 4th State-side well wishes to all.

Claus V.

Read More

Father’s Day Linkage - Tie Down Edition

cc image credit image by Fernando de Sousa on flickr

Happy Father’s Day!

Here is a real varied collection of links. Enjoy!

Security Solids

• Java 7u5 and 6u33 released - ISC Diary - Make sure you get your Java updates on. Despite all attempts, my Java app still doesn’t want to notify me updates are available (at home) so I keep a constant eye out for update notices and install them myself.
  
• Oracle Java Runtime Environment 7 Downloads - Oracle - Here’s one place to get them direct from source.
  
• Inside Flash Player Protected Mode for Firefox -Adobe Secure Software Engineering Team (ASSET) Blog - Adobe Flash Player also got updated, particularly impactful for Firefox users (see next tie-in grouping below). YMMV. You can get the very latest version for different platforms here at this Adobe - Web Players link. Or hop over to Major Geeks.
  
• (IN)SECURE Magazine - Issue #34 is now out in PDF format.
  
• How LogMeIn is enabling scammers to profit - Troy Hunt’s blog - Troy continues his ongoing battle against fake tech-help scams. This time he examines how “LogMeIn” could do more to help prevent their great service from being leveraged for The 3vil, if they chose to.
  
• Free cruise phone scam masquerades as political survey - ESET ThreatBlog - I’ve started to periodically get a few calls now on our cellulars from unknown numbers…they follow a pattern of tracing back to a cruise-operation. If it isn’t a number already in my contacts, I just don’t answer and if critical, the caller will leave a voicemail and I will call back immediately. If not…too-bad-do-dad!  So it was with interest I read this ESET post by Aryeh Goretsky and how an end-run may be going on around cellular do-not-call list participation.
  
• Close Call with a Caribbean Cruise Line Scam - IT Secure Site - More on the above.
  
• 'State-sponsored attackers' using IE zero-day to hijack GMail accounts - ZDNet’s Zero Day blog. I’ve seen the notice of “state sponsored attackers” recently and was wondering “what’s up with that?”. Now I know. more details at this Google Blog post: Security warnings for suspected state-sponsored attacks. Chron.com TechBlog’s Dwight Silverman has some advice and links to a Microsoft “hotfix” for the issue: Bad guys using unpatched Internet Explorer flaw to hack Gmail accounts.

Firefox Paisleys

In my last GSD post, I touched a bit on some issues I was having with Firefox 13 and Flash.  My issues may or may not have been related to these, however there are some serious headaches for Firefox 13 and Flash users.

• Firefox 13 tripped up by Flash patch - Update - The H Security: News and Features
  
• Inside Flash Player Protected Mode for Firefox - Adobe Secure Software Engineering Team (ASSET) Blog
  
• Flash 11.3 doesn't load video in Firefox - Firefox Help
  
• Flash 11.3 Video Issues In Firefox - Firefox Extension Guru's Blog
  
• Firefox 13.0 Release Notes - Mozilla Desktop
  
• Firefox 13.0.1 Released -Firefox Extension Guru's Blog. The Guru helpfully points out the following:
  
  ”Note: In regards to the Flash Bug (747683) this does NOT address issues related to Flash videos not playing in Firefox (which may also be affecting Firefox 12.0.x users as well) for Windows Vista and 7 users. “
  
• Wallpaper your Firefox new tab page - Mozilla Links. However all is not lost, you Firefox freakers can tweak your “new tab page” to display a wallpaper background image if desired.

Sysadmin Stripes

• Malware Hunting with the Sysinternals Tools -  TechEd North America 2012 \ Channel 9 - A new presentation video from Mark Russinovich on using Sysinternals Tools to do some malware thumpin! Watch streaming or pick from one of two formats for direct downloading and viewing later. This presentation includes real-case reviews as well as a live analysis of a Stuxnet infection. Sweet!
  
• Windows Exploratory Surgery with Process Hacker - SANS Windows Security Blog - Jason Fossen shares PDF version of his presentation primarily using the freeware tool "Process Hacker”.  It is a really great review of the different angles one can take with a limited tool-set.
  
  That got me thinking a bit. Process Hacker has matured quite a lot since I last downloaded a copy and the new one certainly has more polish on it. I went through my utility pile and offer below some other great freeware utility process-monitoring tools you may be interested in visiting again.
  • Process Explorer - Sysinternals - One ring to rule them all. Still the very first utility I place on my Windows systems and swap out the default Task-Manager with. It continues to be upgraded so if you haven’t got the latest version for a while, you are missing out!
  • System Explorer - This one also has grown up quite a bit from my last download a few years ago. I like the tabbed interface. The “Performance View” tab is very neat. Process Explorer’s graphs are still a bit more detailed looking but it doesn’t provide an all-in-one dashboard view like System Explorer offers.
    
    
    
  • Daphne - Not as GUI pretty as the others, but what it lacks in pretty it more than makes up in back-to-basics tightness.
  • Process Viewer for Windows - This project hasn’t been updated in a while but again, the “latest” update was still fresher than the one I’ve been carrying around for quite a while. This one is a bit more feature basic. If you aren’t ready for the power of some of these other process utility tools, but need more detail than the default Windows Task Manager (at least in XP) then this may be a friendly choice.
  • ProcessActivityView and  ProcessThreadsView - These two application from NirSoft compliment each other nicely.
  • NoVirusThanks EXE Radar Pro - Provides process monitoring and alerting as well as to kill processes on demand.
  • ESET SysInspector - This is a complex, single-file-executable. It provides detailed information on running processes as well heuristics reporting on items found. I find it particularly helpful in assessing a system. It may not tell me exactly what is going on, but it often will help be refine my focus a bit.
    
• WHITEPAPER: Windows PowerShell 3.0 and Server Manager Quick Reference Guides - Kurt Shintaku's Blog

I learned this week about a “honeypot” project that attempts to capture USB-seeking virus/malware by creating a virtual USB-drive honeypot. This is a cool project and I hope it continues to see success in development.

• Catching worms with ghost flash drives - The H Security: News and Features
• HPSoC Project 1 - Ghost USB Honeypot -The Honeynet Project
• ghost-usb-honeypot - A honeypot for USB malware - Google Project Hosting
• Ghost USB honeypot released - Help Net Security blog

More interesting tips for admins…

• Microsoft .NET Framework Repair Tool Download - Microsoft Downloads
  
• Windows 8 – Script for customizing WinPE 4.0 – Part 2 – Customizing the Wallpaper - Anything about IT
  
• Local admin accounts vs. the default Administrator account - Windows Networking
  
• Where is That Group Policy Setting? - Windows Networking
  
• Active Directory Replication Status Tool - Bink.nu
  
• Download: ADREPLSTATUS - Microsoft Download Center
  
• Video: User Rights - Server vs Domain Controller - Windows Networking
  
• INFO: Why the heck is my Outlook .OST so big? - Kurt Shintaku's Blog

Network Knitted

• ARP Scans - A Ping Alternative - LoveMyTool blog video presentation by Tony Fortunato.What’s really going on the wire with Colasoft MAC Scanner Free.
  
• Script to resolve hostnames to IP address - Computer Security Forum. Recently I was presented with a massive list of Hostnames for PC’s on our network. The assignment was quite simple, provide the associated IP addresses.  No problem, I could manually ping each one by hostname, copy the result (if alive) and paste into my spreadsheet. Well, no. I wanted to go home to my family that night. Instead I found and ran this nice simple script against a cleaned up text-file of the Hostnames. My success ratio for IP grabs was over 90%. The other 10% required some manual followup (systems turned off, shelved, etc.) but it made quick work. I wasn’t able to find a good free GUI-based alternative, but this did the job wonderfully.
  
• Extracting DNS queries - NETRESEC Blog - Either by Tshark or NetworkMiner.

Utility Dotted

• NTFSLinksView - View NTFS symbolic links and junction points - NirSoft utility update
  
• Backup Windows User Profile Folders & Web Browser Profiles - Auslogics BitReplica - AddictiveTips review and walkthough for a new profile backup utility.
  
• Backup for Windows 8 & Co: BitReplica - (Google Translated from German) - Caschys Blog
  
• BitReplica - A free tool for backing up files stored on your Windows PC
  
• Batch-Rename Files In Windows Using 8 Different Presets - AddictiveTips reviews the PDFN
  Batch File Rename Utility.
  
• Spreadsheet Compare - The Fool on the Hill - Neat little Microsoft Excel Add-in to compare and highlight two spreadsheets. As seen in this review How to Compare Previous Version of Excel Spreadsheet– A Diff for Spreadsheet over at Windows7hacker.
  
• VMware closes holes in its virtualisation products - The H Security: News and Features
  
• New VMware Workstation 8.0.4 and Player 4.0.4 - (Google Translated from German) - Born and Windows IT Blog. What I found interesting is Gunter’s catch of the EULA details that allow VMware to collect and use info about your use of software including IP address, hardware ID, OS information and other “non-personally identifiable” usage stats.  Also that by accepting the EULA and using the software you agree to a two-year post termination of software use agreement for folks to audit your books, records and computing devices to determine your compliance with the EULA and payment of license and support service fees.  I’m sure this is pretty standard stuff and proper use of the free software they make available shouldn’t concern the average user, but it is another reminder of what lives in the EULA’s. Just be aware.
  
• VMware Player: Run Windows 7, Chrome OS - Free Download for a Virtual PC - VMware
  
• Download VMware Player 4.0.4 - FileHippo.com - alternative download link

Foresensically Checked

• New Plugin – “TypedURLsTime RegRipper Plugin” - RegRipper
  
• Digital Forensics Stream: TypedURLsTime RegRipper Plugin - Digital Forensics Stream blog
  
• RegRipper Supplemental Plugins Updated (regripperplugins_20120528.zip) - RegRipper
  
• DEFT Pen ready for download DEFT Linux - 2GB and 4GB versions of DEFT “LiveCD” 7.x to load onto a USB pen-drive rather than the optical media version.
  
• WinPentest v1.3.0 - woanware - Major updates.
  
• Compromise Root Cause Analysis Model - Corey Harrell wonderfully thought-provoking post on DFIR concepts over at his Journey into Incident Response blog. There will be a pop-test after the review…
  
• Am I pwn3d? Windows *Non-Native* Tool Triage is a follow-up post to the Am I pwn3d? Windows *Native* Tool Triage on using “simple” tools to perform system triage. Posted on Foundstone’s Open Security Research blog.
  
• Red Rock Solutions - RRTX Blog: ShadowKit - Red Rock Solutions RRTX blog - Neat and easy-to-use tool for recovery of Windows Volume Shadow Copy files. I’ve got several tools like this, and having a few makes it easier for me to find the one that helps me best in a particular event.
  
• Windows 8 Forensic - File History - Random Thoughts of Forensics blog brief post with some backing linkage.
  
• Timeline Analysis and Timeline Analysis, and Program Execution - Two excellent posts over at Windows Incident Response blog.
  
• Prefetch Hash Calculator + a hash lookup table xp/vista/w7/w2k3/w2k8 - Hexacorn blog utility/technique.

Cheers!

--Claus V.

Read More