Bios Password

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Saturday, March 20, 2010

GSD Recent Comment” Sidebar link references fixed

Posted on 12:48 PM by Unknown

For anyone who cares, I finally took the time to “fix” the html links in the “Recent Comments” sidebar.

While they look good, it has always annoyed me.

The format is this.

(poster name) on (post title) comment bits…(more).

Clicking on any of the HTML links just took you to the top of the post the comment was left on. Not the comment itself as expected.

While users could scroll down to the comment section, it just wasn’t as right or polite as I wanted.

I’m not really much of a coder, particularly JavaScript, but I decided it was time to try to fix it.

So I located the correct comment link HTML format from a post comment as a sample to examine.

http:// <blogtitlelinkurl> ?showComment= <numbersetA> #c <numbersetB>

This code correctly takes you directly to the respective comment under the post.

Then I copied the existing HTML codes the JavaScript was generating into my notepad text editor and set out to compare them all.

Very quickly I found that the original JavaScript code (included at the end of this post for the curious) was replacing the “#” symbol in the working comment HTML structure with a “#comment-“ string instead.  This routed the link-click to the post title when Blogger couldn’t figure it out.

Looking at the JavaScript code I found a line “ctlink = ctlink.replace("#", "#comment-");” and replaced it with “ctlink = ctlink.replace("#", "#");” which was a dirty way to not muck the code up but keep the variable structure the same.  (Note: “ctlink” variable name stands for “comment link” I think).

Testing finds that it works perfectly.

Clicking on either the (poster name) or (more) parts will now take to directly to the comment itself, not the post title.

While clicking on the (post title) link takes you to the top of the post itself.

The only thing I still needed to do (being a bit neurotic) is that while that worked, the (post title) HTML code was sloppy as the JavaScript generating it still seemed to either be tagging it with, or failing to remove the “?showComment=numbers”  bit at the end.  It did work, it’s just not pretty.

That still needed fixin’.

Trial and Editor

Luckily I had recently found the following W3Schools Online Web Tutorials site that also has their “Tryit Editor”.

This is really, really cool as it lets coding doofs like me copy/paste/tweak/test code and scripts into their editor and view the results without nuking my deployed blog until fully tested.

Once I think I have the solution down, I then upload the changes to my gsdtemplatetester blog page.  This is the proving ground where I can experiment with code and templates on a “real” Blogger deployment before moving those changes into production on the GSD blog page template proper.

So I set to work using the JavaScript descriptions there, picking apart more of the code elements and variables, and via trial and editor, found the line to fix.

Originally it was

var ptlink = ctlink.split("#");

Where the variable name “ptlink” stands for “post title link” I think.

Which I finally worked out needed to be

var ptlink = ctlink.split("?showComment=");

Replacing that finally resulted in the comment sidebar (post title) link returning the HTML code format

http:// <blogtitlelinkurl>

and not the incorrect (but still functional)

http:// <blogtitlelinkurl> ?showComment= <numbersetA>

Hurrah! The Recent Comment sidebar links now all work correctly and the HTML code is fully correct as well.

Hopefully this will make monitoring and following the recent comments a bit more enjoyable and efficient for readers.

Cheers!

--Claus V.

Note:

For posterity, here is the original (working but barely) and fixed (working great) JavaScript code I am using if anyone cares to study it more.  I’m clearly not the original author of the JavaScript.  It came from somewhere within this Now See This: Adding Comments to your Blogger sidebar GSD post back in 2008 (gosh has it been that long?!!).

Original (working but barely) JavaScript code

<ul><script style="text/JavaScript">
function showrecentcomments(json) {
for (var i = 0; i < 5; i++) {
var entry = json.feed.entry[i];
var ctlink;
if (i == json.feed.entry.length) break;
for (var k = 0; k < entry.link.length; k++) {
if (entry.link[k].rel == 'alternate') {
ctlink = entry.link[k].href;
break;
}
}
ctlink = ctlink.replace("#", "#comment-");
var ptlink = ctlink.split("#");
ptlink = ptlink[0];
var txtlink = ptlink.split("/");
txtlink = txtlink[5];
txtlink = txtlink.split(".html");
txtlink = txtlink[0];
var pttitle = txtlink.replace(/-/g," ");
pttitle = pttitle.link(ptlink);
if ("content" in entry) {
var comment = entry.content.$t;}
else
if ("summary" in entry) {
var comment = entry.summary.$t;}
else var comment = "";
var re = /<\S[^>]*>/g;
comment = comment.replace(re, "");
document.write('<li>');
document.write('<a href="' + ctlink + '">' + entry.author[0].name.$t + '</a>');
document.write(' on ' + pttitle);
document.write('<br/>');
if (comment.length < 120) {
document.write(comment);
document.write('<li>');document.write('<br/>');
}
else
{
comment = comment.substring(0, 120);
var quoteEnd = comment.lastIndexOf(" ");
comment = comment.substring(0, quoteEnd);
document.write(comment + '...<a href="' + ctlink + '">(more)</a>');
document.write('<li>');document.write('<br/>');
}
}
document.write('</li>');
document.write('<div style="font-size:95%;text-align:center"><a href="http://grandstreamdreams.blogspot.com/feeds/comments/full">GSD RSS Comment Feed link</a></div>');
}
</script>
<script src="http://grandstreamdreams.blogspot.com/feeds/comments/default?alt=json-in-script&callback=showrecentcomments">
</script></ul>
<noscript>You need to enable JavaScript to read this.</noscript>

I’ve also linked to some of the JavaScript examples and actions at w3schools page as well for easy cross-reference to show what these various calls are doing.

Fully Working JavaScript code (changes in yellow)

<ul><script style="text/JavaScript">
function showrecentcomments(json) {
for (var i = 0; i < 5; i++) {
var entry = json.feed.entry[i];
var ctlink;
if (i == json.feed.entry.length) break;
for (var k = 0; k < entry.link.length; k++) {
if (entry.link[k].rel == 'alternate') {
ctlink = entry.link[k].href;
break;
}
}
ctlink = ctlink.replace("#", "#");
var ptlink = ctlink.split("?showComment=");
ptlink = ptlink[0];
var txtlink = ptlink.split("/");
txtlink = txtlink[5];
txtlink = txtlink.split(".html");
txtlink = txtlink[0];
var pttitle = txtlink.replace(/-/g," ");
pttitle = pttitle.link(ptlink);
if ("content" in entry) {
var comment = entry.content.$t;}
else
if ("summary" in entry) {
var comment = entry.summary.$t;}
else var comment = "";
var re = /<\S[^>]*>/g;
comment = comment.replace(re, "");
document.write('<li>');
document.write('<a href="' + ctlink + '">' + entry.author[0].name.$t + '</a>');
document.write(' on ' + pttitle);
document.write('<br/>');
if (comment.length < 120) {
document.write(comment);
document.write('<li>');document.write('<br/>');
}
else
{
comment = comment.substring(0, 120);
var quoteEnd = comment.lastIndexOf(" ");
comment = comment.substring(0, quoteEnd);
document.write(comment + '...<a href="' + ctlink + '">(more)</a>');
document.write('<li>');document.write('<br/>');
}
}
document.write('</li>');
document.write('<div style="font-size:95%;text-align:center"><a href="http://grandstreamdreams.blogspot.com/feeds/comments/full">GSD RSS Comment Feed link</a></div>');
}
</script>
<script src="http://grandstreamdreams.blogspot.com/feeds/comments/default?alt=json-in-script&callback=showrecentcomments">
</script></ul>
<noscript>You need to enable JavaScript to read this.</noscript>

Read More
Posted in Blogger, blogging | No comments

Sunday, March 14, 2010

Skipping Links in a Sunday Stream

Posted on 1:30 PM by Unknown

One of the joys I had as a kid was skipping stones by the lake.

First there was the search for the right stones, wide, round, flat surface (though an oyster-shell half would do fine in a pinch).  Then with my pile collected, I would toss them out, waves or not, seeing how far they could go and how many skips would be produced before the object sank beneath the water.

Here is a mishmash of collected links I’m tossing into the lazy Sunday afternoon waters.

Enjoy.

  • VirtualBox’s Seamless Mode: Combine Two Operating Systems Into One Desktop – makeuseof blog.  For those folks who want to simulate Windows7 XPM but don’t have either the hardware and/or the Windows7 version to do so.
  • Using 1 cent transfers to validate account numbers « Silver Tail Blog.  Reason # 1 I’m tempted at times to go Neo-Luddite and eschew technology and banking, going back to the money-sack buried in the back-yard at night.  Security and fraud-prevention is a never-ending war of escalation.  Sigh.
  • 10 ways you might be breaking the law with your computer - TechRepublic.com.  Reason # 2 for tossing all things related to the digital millennium, Internet, and computer technology in general into the pit of burning fire and walking away.  If you are borderline OCD like me, after a while you end up second-guessing most every thing you do digitally related; is that image really CC licensed?, are those free stock photos really able to be used freely? Now that I gave that CD away to my bro have I really scrubbed all tracks off my iTunes? Oh, wait, did I really even have the legal right to burn them to iTunes to begin with, even if I did buy the physical CD?  Today yes. Maybe or not depending. Tomorrow yes. maybe not period. Don’t even get me started on the debate regarding the slippery slope appropriate portrayal of characters in anime and manga of late.  Oh bother. (Or don’t even bother anymore to ensure you keep 100% on the up-and-up.)
  • EnCase + F-Response + EnScript = very affordable network forensics & eDiscovery -- ForensicKB.
  • Understanding where your virtual machine files are [Hyper-V] – Virtual PC Guy’s Blog..
  • ITsVISTA KB-Link: KB980867 | ITsVISTA – Reminds me quite a lot of this popular GSD: How to Repair Windows Security Center List Items post. Only this time Microsoft now has an official fix for it. Microsoft KB Article KB980867
  • Monitoring Your Windows 7 Resources Right From the Taskbar – Windows 7 hacker.  I’m not keen on lots of stuff running in my taskbar but if that’s your thing, here are two sets of great free utilities.
  • Why sysprep is an obligatory Windows deployment tool – Part 1: All the important sysprep functions and the followup Why Sysprep is an obligatory Windows deployment tool – Part 2: Unique SIDs are necessary from 4Sysops.  Both good refreshers on system image deployments.
  • Print a List of Files in a Folder – Cybernet News tips us to a free utility getFolder. I’ve got a few other tools I use as well but this new one might qualify to be added to the USB utility stick..
  • Home of A43 – my former favorite dual-pane file manager recently was updated to version 3.0.
  • TinyApps.Org Blog : An embarrassment of riches – TinyApps bloggist does a link-back shout to GSD and in doing so, dives deeper into some handy and tiny utilities offered by Olof Lagerkvist (of ImDisk virtual disk driver fame).
  • Sysinternals Site Discussion : Updates: VMMap v2.61 – yeah, they caught a minor oopsie and fixed it.
  • NetRouteView - Network Route Utility for Windows – NirSoft has released yet another neat freeware network utility.  This one “…displays the list of all routes on your current network, including the destination, mask, gateway, interface IP address, metric value, type, protocol, age (in seconds), interface name, and the MAC address.  NetRouteView also allows you to easily add new routes, as well as to remove or modify existing static routes.”  Go get it!
  • Tenniswood Blog | Technology, Design & Architecture – Tenniswood blog contains a dizzyingly wide-ranging collection of cool and beautiful objects of design in addition to some great Windows tips and information.  Pretty stuff.
  • TheCoolist | The Design, Lifestyle and Luxury Community – One periodic source for said items from Tenniswood Blog is TheCoolist.  Lots of great high-end designs and out-of-this world stunning automotives in particular; Bugatti 16 C Galibier Edition, 1937 BMW 328 Mille Miglia, 1946 Saab 92001 Ursaab: The Original Saab, Aston Martin Carbon Black DBS and Vantage (Lavie’s favorite), Superformance MKIII R Cobra (Claus’s old-school favorite), 2011 Audi A8: Lusty Luxury (Claus’s modern favorite of late), and a wicked looking Lotus Exige Scura of which I just love the flat-black paint and wish I could re-finish the old Saturn Ion-3 in….

Cheers.

Claus V.

Read More
Posted in cars, crazy, For the Gentleman, forensics, Link Fest, security, utilities, Virtual PC, virtualization | No comments

WinPE and DISM/PEimg to boost Scratch Space (Ram Disk)

Posted on 12:34 PM by Unknown

Soon after I had posted this Custom Win PE Boot Disk Building: Step Four – Pulling it all together walkthrough binding all the elements on making a custom PE boot disk, I started getting comments that followers were unable to get CubicExplorer working in it.

The solution was a long time coming, but revelation of the solution culminated in the Solved: Run CubicExplorer in Win PE with no Crashes... post.

I’m not revisiting that one, but one path I and parities played with in the process was to fiddle with the PE Ram Disk size.

As this may or may not be something amateur PE builders and hobbies may be familiar with (I really wasn’t fully) I thought I would take a few moments to post some related links about it for future reference.

Very Basic info on RamDisk/ScratchSpace in PE

By default, Windows PE builds “by the book” allocate 32 MB of writeable memory to the PE environment.

I like to think of it (very roughly) like this.

The space of my yard would correspond to the System RAM.

The PE system (containing all the stuff in your PE wim-image file) would correspond to a kiddie-pool placed in the back-yard.

The scratch space would correspond to how big the kiddie-pool is and, thusly, how much water fills it up for everyone to play in.

Now generally, for most stock PE builds, 32 MB of scratch space works very well.  PE environments (base) run a CLI shell box and a simple background.  The services are simple and it’s not like you are running a lot of GUI apps.  This small and shallow pool is more than sufficient to let the kids play happily and safely.

But say you then get a lot of neighborhood kids coming to join in.  And some of them aren’t five-year olds.  These are third and fourth graders.  Suddenly there isn’t enough water in the pool for everyone to feel comfortable in.  Kids get cranky and don’t behave.

Under these circumstances you need to get a larger kiddie-pool!

Microsoft describes it like this:

If your Windows PE environment becomes unresponsive when running an application, you may have run out of memory. By default, Windows PE allocates 32 megabytes (MB) of writeable memory, known as scratch space.

Typically, you don’t need to do anything as the standard 32 MB scratch space size is adequate.  But if you need to, you do have the option to manually set the scratch space size larger…assuming the yard (system RAM) is large enough to accommodate things…

In WinPE, scratch space can be set at 32, 64, 128, 256, or 512 MB levels.

It does make a difference, particularly with GUI-heavy applications running in the WinPE environs.  I’ve personally  observed some applications either not running at all, running very sluggishly, or even not fully displaying all the expected graphical elements.

When I rolled out the larger kiddie-pool, they suddenly sprang to life and made things much more pleasant.

The drawback is you have to know the systems you intend to deploy these specific solutions on, and ensure you find the sweet-spot.  If your supported desktop systems have just 256 MB of RAM, and you go to boot it with a WinPE disk set at a 512 MB scratch-space size, it won’t be pretty.  Then again, if you don’t really use a lot of additional memory-intensive applications in WinPE, then you also don’t probably need a 512 MB scratch space wrapped WinPE setup.

In other words, your kiddie-pool can’t be larger than your yard or else it just won’t fit in there.

WinPE 3.0 and Increasing Scratch Space

WinPE 3.0 is based on the Windows 7 platform.  As such, you have to use a WinPE 3.0 specific tool to make changes to the default scratch-space settings.

The beauty of it is that once you get this basic process down, the rest is gravy.  I’ll come back to that in a minute.

Under WinPE 3.0 building, you must use the DISM.exe command tool.

Go ahead and create your WinPE 3.0 “wim” file image using your own technique or the ones I outlined in the first link of this post.

This assumes you have already installed and are familiar with the Windows® AIK for Windows® 7.  There are a few other related Microsoft WinPE building packages/tools as well that should include the tool (Microsoft Deployment Toolkit).

Launch the “Deployment Tools Command Prompt” and use the following format to adjust the scratch-space of your wim file. (note in this case I am using standard locations to mount the wim file for servicing as well as using the name “winpe.wim” for this example. You will need to adjust to your own particular wim-file and mounting location accordingly.)

Dism /Mount-Wim /WimFile:C:\winpe_x86\winpe.wim /index:1 /MountDir:C:\winpe_x86\mount

dism /image:C:\winpe_x86\mount /Set-ScratchSpace:256

Dism /Unmount-Wim /MountDir:C:\winpe_x86\mount\ /Commit

In the second line of the example above I used the “256” value to set the scratch-space to 256 MB RAM.  Adjust the value you use accordingly (32, 64, 128, 256, or 512 MB levels).

Then toss the updated wim image file either into the correct location of your USB-bootable storage device, or into the proper folder and build/burn your WinPE ISO file to optical media.

To verify that you were successful, launch your PE build, navigate in a CLI window to the X: drive (RamDisk) and run a DIR command.  The size shown should equal the scratch-space size you set.

Easy!

Related WinPE 3.0 Resources:

  • WinPE Crashes – MSFN Forums.

  • Building a Windows PE Image – Microsoft TechNet.

  • How to use DISM to create WinPE 3.0 Boot Environment – eHow.com

  • New Features in the Windows AIK – Microsoft TechNet.

  • Deployment Tools Walkthroughs – Microsoft TechNet.

  • Deployment Image Servicing and Management Command-Line Options – Microsoft TechNet.

  • Walkthrough: Create a Custom Windows PE Image – Microsoft TechNet.

  • Add an Application to a Windows PE Image – Microsoft TechNet.

  • Deploying Windows 7 - Part 2: Using DISM – Windows Networking.

  • ImageX GUI (GImageX) – Super cool GUI utility for mounting/working-with WIM files and ImageX.

  • Je Jin’s DISM Tool - My Digital Life Forums. – Neat GUI utility to also do some WIM file mounting, tricks, and DISM related servicing duties.

WinPE 2.0 and Increasing Scratch Space

WinPE 2.0 is based on the Windows Vista  platform.  As such, you have to use a WinPE 2.0 specific tool to make changes to the default scratch-space settings such as the Windows Automated Installation Kit (AIK) for Vista or (even better) the Automated Installation Kit (AIK) for Windows Vista SP1 and Windows Server 2008.

Under WinPE 2.0 building, you must use the PEimg.exe command tool.

The principle is basically the same as before, and again assumes you already have build your WIM image file and now need to adjust its scratch space.

I’d type it again, but fortunately, The Deployment Guys have already done the hard work so from their post Expanding the Scratch Space in Windows PE 2.1 we have the following:

“With the introduction of Windows PE 2.1 (supplied with the Windows Automated Installation Kit (Windows AIK) 1.1), the scratch area can be changed from the command line. Below is the process for creating a larger scratch area.

   1. Create a temporary mount folder on your hard disk - MD c:\temp\mount
   2. Go to the Windows AIK tools folder for the platform of PE that you will be changing (ie x86/x64) - CD "Program Files\Windows AIK\Tools\x86"
   3. Mount the default Windows PE image supplied with Windows AIK to your temporary mount folder - imagex.exe /MOUNTRW "C:\Program Files\Windows AIK\Tools\PETools\x86\winpe.wim" 1 c:\temp\mount
   4. Go to the Windows AIK PETools folder - CD "C:\Program Files\Windows AIK\Tools\PETools"
   5. Run the PEIMG command to adjust the scratch size in the mounted image using /SCRATCHSPACE flag to set the size of the drive you want (in this case 128Mb)  - peimg.exe /SCRATCHSPACE=128 c:\temp\mount\windows
   6. Change back to the PETools directory - CD "Program Files\Windows AIK\Tools\x86"
   7. Unmount the image and commit the changes - imagex.exe /UNMOUNT /COMMIT c:\temp\mount

“That's it - the scratch area will now be set at 128 Mb for all boot images based on this source - which means all boot images created by MDT will now have the set scratch space set….”

Again, pretty easy stuff.  Just adjust your recipe accordingly.

Related WinPE 2.0 Resources:

  • PEImg Command-Line Options – Microsoft TechNet.

  • Scratch Space aka Ram Drive – All About Windows PE 2.x blog.

  • Configuring WinPE 2.0 scratch space (RAM Drive) – Deploy Vista.

  • Windows PE 2.0 for Windows Vista Overview – Microsoft TechNet.

  • WMI Tracing – All About Windows PE 2.x blog. (Rare condition of when WMI package is added to WinPE, log file generated may exceed ram disk size.  Increasing scratch space or disabling feature in WinPE registry may fix issue.)

  • All About Windows PE 2.x – WinPE blog by Paul Matthews that is currently in hiatus.  Too bad as there was (is) a number of great tips and tricks regarding WinPE (2.x) in here.  Maybe we will eventually hear from Paul again…

Gravy

So earlier in the post I said that once you get down the commands to modify your WIM boot image file, you can easily crank out various versions.

If you are using optical media based WinPE builds, then you just have to carry a few disks in each of the scratch-space flavors you created.

However, if you are using a bootable USB disk, and it has sufficient space, you can get all crazy!

On my own bootable USB flash stick, in addition to the required “SOURCES” folder and contents, I also have a “SOURCES-ALT” folder.  In there I keep all my additional and scratch-space-adjusted WIM files.  So I have a  Boot-32.wim, Boot-128.wim, Boot-256.wim, and a Boot-512.wim file stored in there.  Typically, I have the 512 MB set scratch-space boot.wim file in my SOURCES folder to boot with.  However, if I know I need to WinPE boot a system that that wouldn’t work on, then I can delete the boot.wim file out of my SOURCES folder on the USB stick, and copy another more appropriate version from my SOURCES-ALT folder over into it, say the Boot-128.wim one.  Then I rename it to boot.wim and I am good to go!

In fact, once the contents of the WIM file are loaded into the scratch-space/RAM Disk, it is then released.  That means if you are going from a system that uses the 512 MB scratch-space, and then progress on to one that will require the 64 MB scratch-space version, it seems you can do the boot.wim delete/copy/rename routine on your USB stick still from within your WinPE boot session!  I’ve done this on a number of occasions.

Even more fun is making up not just different scratch-space flavors of the boot.wim file, but even wholly different versions of the boot.wim file itself!  You could have a custom WinPE 2.0 boot.wim file, a custom WinPE 3.0 boot.wim file, an AntiVirus PE Disk to offline-scan a Windows system, or maybe, say, a Win(FE) forensics build boot.wim, and so on…limited only by the size of your USB storage device and your imagination and efforts.  Even different WIM files with different hardware drivers injected for various system platforms.  Instead of carrying a mess of optical disks, just a single large USB storage may do the trick (assuming the system BIOS supports USB based booting).

Of course, you do have to reboot the system to then load whichever WIM file you have swapped out…but I’m sure you knew that already.  Just keep the originals safely and alternatively named in your “storage” folder location and delete/copy/rename the original boot.wim file as needed.

One more Bonus Find

  • Windows 7 Tips & Tweaks – CatPawz.com

The real find on this tip comes at the bottom of the page.

CatPawz has three helpful CLI sections documented that deal with “Build a Windows 7 AIO DVD”, “To Modify a Win7PE Disk”, and “To Create a Win7 Disk”.   If you aren’t familiar or comfortable with CLI usage in WinPE building and servicing, these could be great examples to follow and learn from.

Cheers!

--Claus V.

Read More
Posted in boot-cd's, command-line interface, Microsoft, Win FE, Win PE, Win RE | No comments

Saturday, March 13, 2010

GSD Redesign (again)

Posted on 2:16 PM by Unknown

Probably not the best time to do something like this.  Been out in the back yard for most of the day hand-pulling the thick blanket of weeds from the yard.

My fingers are numb.  My sittin’ bucket is busted. My arms and legs still itch even after a long shower scrub-down.

The smell of wild green onions lingers in my nose.

I’ve got a 50-pound of weed bio-mass pilled in a back corner.

And then I take a moment to rest and find this stupid link:

Official Google Blog: Express yourself with the Blogger Template Designer

Well yeah. Of course I have to go muck around with it.

I’ve generally liked the lightly dark format of some sites/blogs but have never been brave enough to try it on for size.

I have also strongly resisted the image-background/floating layout style as well.

However, the new Blogger Template designs are quite well balanced and I’ve always been a sucker for earthy warm-tone color schemes.

I’m liking this one for now but I expect more tweaks will come down the line.

This is probably one of the largest in-house updates Blogger has released in quite some time.

Rendering so far in Firefox 3.6, Opera 10.5, IE 8, Chrome, and Safari all seem very spot-on.

Sidebar items will require some custom adjustments but I think overall it has translated pretty well.

Stay tuned.

--Claus V.

Read More
Posted in Blogger, blogging | No comments

Saturday, March 6, 2010

March Madness Linkfest #3 – Forensic Fallout

Posted on 3:27 PM by Unknown

Still got chores on the list so I’m afraid I’ll have to drop these into the blog-o-sphere a-la “pooh-sticks” and just let them drift on their own.

Let’s open the race up with the usual bundle of sticks from the Windows Incident Response Blog.  The ones listed here are those that I found particularly thoughtful, helpful, and/or engaging.

  • More Thoughts on Timeline Analysis - Windows Incident Response Blog.  Context is everything.
  • Forensic Analysis Process/Procedures - Windows Incident Response Blog.  Great basic step-through of the process.  Mirrors my own approach quite closely.
  • Timeline Analysis...do we need a standard? - Windows Incident Response Blog.  Creating an meaningful (and digestible) timeline for an incident report is a big challenge.  All the data is great for the investigator but time after time I’ve seen management and and legal’s eyes glaze over a bit.  Once you yourself have an accurate handle on the event timeline, you can then distill it down much simpler for the masses.
  • MFT Analysis - Windows Incident Response Blog. Brief highlight.
  • Links Plus - Windows Incident Response Blog.  Lots of great tips, tools, and leads here! 
  • More Links, and a Thanks - Windows Incident Response Blog.  Keydet89 is starting to do linkfests better than even me!  The intro (A Good Example) is a embarrassingly good illustration why even sysadmins and techs need to be trained in the basics of incident response…as well as having a strong in-house incident-response policy in place. (shudders).
  • Researching Artifacts - Windows Incident Response Blog. No, not the Indiana Jones kind either….
  • Forensic Incident Response: Triage of Agent.BTZ – Hogfly has a great walkthrough on a memory image analysis.  A good refresher.
  • Volume Shadow Copy Forensics.. cannot see the wood for the trees?.  And from the friend across the Pond Forensics from the sausage factory, a discussion on Volume Shadow Copies.
  • The Digital Standard: Analyzing RAM Dumps. – Lite but tasty tips on RAM dumps.
  • (IN)SECURE Magazine issue 24 released. – Yeah, not specifically forensics related but too good to pass up.
  • E-Evidence Information Center - What;s New – new whitepapers and material for security and forensics folks.  This one Virtual Machines in Forensics (PDF) by Jay Varda was interesting…
  • FireFoxForensics : woanware. An outstanding tool (among many standing) to extract info on Firefox usage.  Now updated to version 1.0.4.
  • ChromeForensics : woanware.  This one is now at version 1.0.3
  • PrefetchForensics v1.0.1 : woanware.  Great tool for investigating and exporting data regarding Windows Prefetch stores.
  • Prefetch Parser v1.4 released.  SANS Forensics blog recently posted a review of this one in action.
  • WinPrefetchView v1.05. Then there is this Nirsoft tool. Geared more for sysadmins than the forensics crew, it still also nicely is able to output results quite nicely.
  • Tableau Imager: First Look. SANS Forensic blog has a hands on review of new (free) software from Tableau that might take advantage of multi-core systems during the imaging process. Pretty cool stuff.  Only gotcha is that you have to have a Tableau imaging product first.  I’m still trying to get my approved via purchasing.  Failing that looks like I will be investing in one (Tableau T35es eSATA Forensic Bridge) for my personal collection of hardware tools…
  • TimeLord Time Utility for Forensic Analysts. – Neat little tool to help deal with system time, formats, and encoding.
  • Windows Shortcut Files in Forensic Examinations – PDF paper from Harry Parsonage updated in Nov 09 that goes into great detail on Windows shortcut files.  Great material.

Cheers!

--Claus V.

Read More
Posted in forensics, Link Fest, security, utilities | No comments

March Madness Linkfest #2 – Windows Tips

Posted on 2:39 PM by Unknown

OK. Back from running me errands.  Lavie’s looking particularly fetching today as well, causing additional blogging distractions.

Oh my.

Just saw this tip from Lifehacker: Get Gigabytes of Free, Legitimate Music from SXSW 2010.  For those who don’t know, South by Southwest (SXSW) is a celebration of film and music hosted in Austin, Texas.  Goes to figure that Texas would be one of the few states large enough to try to hold all that material.  (official SXSW web site)

While I’ve not yet attended SXSW, I’ve been in Austin last year on business when it was in full swing.  What a party town!

Anyway, Lifehacker links back to the Home of the Unofficial SXSW torrents which contains music files (apparently freely provided by the artists) from this year back to 2005.  The current torrent file has 646 legit tracks while there is a 2nd torrent coming soon with hopes of 200 more.  Sweet.  Get your jam on.

Now, here are the promised Windows tips for your perusal and studyfication…

  • Make Adobe Reader shine like it should under 64-bit Windows 7/Vista – istartedsomething  – Leo Davidson got tired waiting for Adobe to port their Adobe Reader over to x64 bit Windows.  So he checked their code and fixed it himself.  Leo is the man!
  • [How To] Use Dual Monitors in Remote Desktop Session on Windows 7 | Windows 7 hacker  -- why do you need to enable dual monitor support in RDC?   Because you can!
  • How To Manually Troubleshoot and Repair Windows 7 Bootloader | Windows 7 hacker – There you go.
  • Update for Windows 7 for x64-based Systems (KB974674) -- “Utility for restoring backups made on Windows XP and Windows Server 2003 to computers that are running Windows 7 and Microsoft Windows Server 2008 R2.”  The accompanying Knowledge Base Article has additional information.
  • Using Windows Server 2008 Core on Windows Virtual PC – Virtual PC Guy’s WebLog.  Because maybe you want to test/trial run it before deploying?  Easy to do hack to get it going.
  • Accessing Shared Drives from the Command Prompt under Windows Virtual PC – Virtual PC Guy’s WebLog.   Very simple CLI command to get drive shares reported in VPC.
  • Connecting a Smart Card to a Windows 7 virtual machine – Virtual PC Guy’s WebLog. Two ways to connect up to a Smart Card.
  • Jumplist-Launcher « Ali’s Dünnpfiff - (freeware) – cool little utility to add up to 60 programs/files in groups of your choosing, to a Jump List.  Clever little tool and since it supports applications as well as files/folders, it might be a clean alternative to dock-style app launchers.
  • How to replace default Windows 7/Server 2008 R2 Recovery Environment in Diagnostic and Recovery Toolset - Bink.nu – filed for refrence since it is kinda a WIM/PE thing.
  • Reprofiler - A tool for repairing broken userprofile-associations – granted, almost all the times I’ve had a user profile that got corrupted or went south, I’ve just manually recovered the files, nuked the profile, then ended up building a new one.  It’s a lot of work but got the job done.  This alpha-level tool might be good for actually fixing profile association issues.  However, I see the value in how it is able to simply show which Windows user profile is associate with which user profile folder.  It might not be as straightforward as one always expects. Kinda related: NirSoft UserProfilesView.  Although it does not allow you to make any changes while Reprofiler does.
  • Two Minute Drill – Shutdown.exe, Tsshutdn.exe and Psshutdown.exe – Ask the Performance Team blog – great easy tips on how to shutdown a system from the command line via a couple of neat low-level utilities.

Bonus Stupid Batch File of the Day

Running PGP Whole Disk Encryption can be a drag sometimes.  It works great and protects my system but one of the “timewasters” is when I run into a Windows Update or some other system activity that requires a system reboot.  That means that when the system bounces, I have to then re-log into my BootGuard check with my super long and complex passphrase.  Since my assigned system isn’t a powerhouse by any stretch of the imagination, this just adds to the reboot time by at least an unbearably long five to ten extra seconds on reboot.

So I wrote this stupid batch file that allows me to fire it off, pre-type my crazy-complex passphrase in, then hand it off to the PGP one-time boot bypass switch, and then set the system shutdown/reboot timer to as many seconds as I want.

After the system shuts down, it reboots normally and the passphrase is handed off in milliseconds and the OS boot continues; and I’ve shaved at least five or ten seconds off the reboot time!  brilliant.

I suppose in theory it creates a gaping security hole in that, were I to use this very specific circumstance operating too, then someone were to come and bonk me over the head and make off with my laptop, PGP would be bypasses so they could get at my system.  Or maybe some rouge keylogger could strip my input then the laptop could be physically stolen and the info used against me, but hey, if I’ve got spooks lurking just outside my door to do so, or in my system, then I’ve got bigger issues.

Anyway, it was more an exercise in batch file fiddling then anything else.  Tested on XP.  Your results may vary and I’ve not adjusted it for high altitude cooking.

Cheers.

--Claus V.

 

@echo off

echo.

echo.

echo This will initiate a “fast reboot” of the system and allow

echo a ONE-TIME system reboot without PGP-WDE BootGuard prompt.

echo.

echo.

echo      To initialize     type 1

echo.

echo       To cancel        type 2

echo.

set /P selection =      Type the number and then press Enter:

If “%selection% == “1”  goto PGP

If “%selection%” == “2”  goto end

:PGP

set /P PGPWDEPP=       What is the phassphrase?

cd\

cd Program Files\PGP Corporation\PGP Desktop

pgpwde.exe –-add-bypass –-disk 0 –-passphrase “%PGPWDEPP%”

echo.

echo  PGP passphrase set, bypass enabled.

echo.

set /P Reboot=    How many seconds should system wait for reboot?

shutdown –r –f –t %Reboot%

echo.

echo Reboot initialized

echo.

:end

Read More
Posted in command-line interface, hacks, Link Fest, Microsoft, utilities, Virtual PC, virtualization | No comments

March Madness Linkfest #1 – Freeware Apps

Posted on 11:17 AM by Unknown

I’ve been overwhelmed with projects at work.  All critical priority (to someone else).  All requiring great devotion of shoe-rubber and gray-matter.  Most nights consist of pulling into the house, making sure nothing urgent is unattended, then crawling into bed.

However, the mad rush of cool freeware, Windows tips, and forensic goodies continue to fall into my RSS feeder.  And they are still too great to ignore.

Here is the first of three weekend linkfests; freeware finds

  • SSD Tweak Utility – Performance Tuning Tool for Solid State Drives – (freeware) -- I don’t have a SSD yet.  Probably won’t for quite a while.  In my mind I see an eventual upgrade to a two-drive device.  The first would be the SSD which would contain the OS and the second would be a fast and large SATA drive for data.  The first might allow me faster boot times while then 2nd would (hopefully) deliver dependable storage.  Anyway, this utility offers quick access to settings that might optimize SSD usage under Windows. YMMV. 

  • 7capture - (freeware) – Nice and small-sized free window capture tool.  Pros are that it is free and handles rounded corners and Aero transparencies nicely.  Cons are that it doesn’t come with any image manipulation tools embedded to allow for cropping, resizing, or text/graphic additions (like say FastStone Screen Capture – not free).  Worth checking out and adding to your USB stick…
  • Xirrus Wi-Fi Inspector - (freeware) – really cool Wi-Fi scanner and signal locator.  The “radar” tool is a bit gimmicky but does seem to work as far as visualizing the relative direction/strength of the signals.  It is very easy to use and works off my USB drive where I copied the setup files onto.  Coupled with inSSIDer Wi-Fi Scanner and WirelessNetView you can have a nice little package for general home and office network finding.  Particularly useful if you have a issue like Dwight recently posted on: Ask TechBlog: Tracking an offensive Wi-Fi network [Updated] – TechBlog and your iPhone options have been yanked:  Apple removes Wi-Fi finders from App Store - CNET News and Apple purges Wi-Fi discovery apps from App Store (updated) - ZDNet.com

  • Windows System State Analyzer - (freeware) – I have a number of applications I use to diff a system pre/post activity.  All are portable and this Microsoft in-house tool will probably rise to the top of the list.  It too is portable once you copy out the key files from the install program folder.  Granted, diff’ing a system can take a loooong time, no matter how fast your drive and hardware is.  However, if you really want to find out what an installer does or what activity takes place with a malware loader, tools like this are very important.. Does require .NET 2.x, and the newer the better performance seen (IMHO). 

  • AppCrashView - (freeware) – Nirsoft new tool to pull stats on app crashes under Windows Vista and 7.  No support (yet) for XP systems.  Another great tool for quickly chewing through valuable app-log data when troubleshooting. 

  • TinyApps.Org Blog : Tiny HDD activity monitors - (tiny freeware) – TinyApps bloggist has located three very nice micro-apps to indicate HDD activity in your system tray.  Many laptops have HDD indicator LED’s but they might not be positioned helpfully, or are hard to see in bright light.  Also uploaded for easy downloading.

  • ImDisk Virtual Disk Driver -version 1.2.7 – another update in this virtual disk driver for Windows systems.  Recent updates now include full driver certificate signing support for x64 bit system compatibility. It warms my heart to see the hard work and continued development that Olof Lagerkvist puts into this project.  I have a few other virtual disk driver/mounting apps, but this one is by far my favorite.

  • Updated Sysinternals Suite Installer - (freeware) – update to Michael Murgolo’s little project for installing the Sysinternals Suite. It will create a Sysinternals Suite folder with Start Menu shortcuts.  The Suite can also be uninstalled from add/remove programs.  See also the cool(er?)  NirLauncher tool package that not only downloads the NirSoft tool collection, but can also add in the Sysinternals Suite collection.  Then there is also the WSCC - Windows System Control Center which also includes an update manager.  It too supports both the Nirsoft suite and the Sysinternals suite. 

  • TechTools 3.0 – since I was mentioning Windows utility suites, it seems a good place to mention that this tool also has been upgraded.  Like the others, all actual utilities are downloaded directly from the developer’s sites to respect redistribution rights requirements/limitations.  I must say it’s a giant collection of some of the best sysadmin loved utilities.  All neatly categorized. 

  • Sysinternals Site Discussion : Updates: AdExplorer v1.3, VMMap v2.6, Disk2vhd v1.5, LiveKd v3.14, Sigcheck v1.66. – Quite a few tools from Sysinternals have been updated this week.  Get ‘em while they are still hot! 

Hope you found something here you like!

Got some outdoor chores to do in the pretty Texas coastal weather, then another linkest.  This times, Windows tips and tricks.

Cheers!

--Claus V.

Read More
Posted in Link Fest, networking, utilities | No comments
Newer Posts Older Posts Home
Subscribe to: Posts (Atom)

Popular Posts

  • New Year’s Day - First Post 2011
    Same day I came out with my first post after a long drought, I fell upon this article Blogging Seems To Have Peaked, Says Pew Report over a...
  • Oscar watch Linkpost
    Alvis and Lavie are watching the Oscars tonight and I’m along for the ride. I wasn’t able to come even close to getting out some of the pos...
  • Finally! Time to Post! New material list
    After a recent text from my bro reminding me it has been since March since I’ve done a blog post, I was finally able to clear the schedule a...
  • Ubuntu 13.10 Upgrade - Lessons Learned & VIDMA utility found
    A few weeks ago a new release of Ubuntu came out. Naturally that meant it was update time! I have been getting pretty good at this now so ...
  • iodd : Multi-boot madness!
    Like many computer technicians and responders, I seem to always have at hand a collection of bootable media; CD’s, DVD’s, USB-HDD’s, flash m...
  • Network Capture Tools and Utilities
    At a conference this week, we had quite a section regarding network captures. The instructor was going on about how you can try to sort ou...
  • It just has to be bigger on the inside…
      Last Christmas, Lavie gifted me with a cute little Jawbone JAMBOX unit. I thought it was pretty cool. It uses a Bluetooth connection t...
  • Mostly Minor Network Notes
    Here are some minor tweaks and features, mostly of a network nature. Manual Uninstall of the Cisco VPN Client « Mobile Expertise -- becaus...
  • Windows Live Mail error 0x80041161
    Dad is working with his father-in-law who has an issue with his Suddenlink web-mail-based “forwarding” handling of messages. Seems that (an...
  • FireCAT 1.5 “Plus” Add-On Collection
    In yesterday’s GSD post I noted the following: Both of these tools brought be back to the excellent FireCAT 1.5 collection of Firefox...

Categories

  • Active Directory
  • anti-virus software
  • Apple
  • architecture
  • art
  • AVG
  • Blogger
  • blogging
  • books
  • boot-cd's
  • browsers
  • cars
  • cell-phones
  • cheat sheets
  • Chrome/Chromium
  • command-line interface
  • cooking
  • crafts
  • crazy
  • curmudgeon
  • DHC
  • Dr. Who
  • E-P1
  • Education
  • family
  • Firefox
  • firewalls
  • For the Gentleman
  • forensics
  • Gmail
  • Google
  • graphics
  • hacks
  • hardware
  • humor
  • hurricanes
  • imagex
  • Internet Explorer
  • iOS
  • iPhone
  • iPod
  • iTunes
  • Kindle
  • Learning
  • Link Fest
  • Linux
  • malware tools
  • Microsoft
  • movies
  • music
  • networking
  • NewsFox
  • NFAT
  • Nook
  • Opera
  • organization
  • PDF's
  • photography
  • politics
  • PowerShell
  • recipes
  • Remote Support
  • RSS
  • science
  • Scripting
  • search engines
  • security
  • Shuttle SFF
  • software
  • Texana
  • Thunderbird
  • troubleshooting
  • TrueCrypt
  • tutorials
  • utilities
  • VBscript
  • video
  • Virtual PC
  • virtualization
  • viruses
  • Vista
  • Vista mods
  • wallpapers
  • Win FE
  • Win PE
  • Win RE
  • Windows 7
  • Windows 8
  • Windows Home Server
  • Windows Live Writer
  • Windows Phone
  • writing
  • XP
  • XP mods
  • Xplico

Blog Archive

  • ▼  2013 (83)
    • ▼  November (8)
      • Ubuntu 13.10 Upgrade - Lessons Learned & VIDMA uti...
      • ForSec Linkfest - 2013 DST Fallback Edition
      • CryptoLocker Ransomware Info & Free Prevention Sol...
      • Linkfest for the SysAdmins
      • Microsoft Security Essentials/Defender & PowerShell
      • Miscellaneous TrueCrypt linkage
      • PowerShell 4.0 and a tiny “gotcha”
      • New Software Updates + VMware Tools Update fix
    • ►  October (8)
    • ►  September (14)
    • ►  August (6)
    • ►  July (10)
    • ►  June (10)
    • ►  April (11)
    • ►  March (6)
    • ►  February (7)
    • ►  January (3)
  • ►  2012 (96)
    • ►  December (8)
    • ►  November (4)
    • ►  October (9)
    • ►  September (8)
    • ►  August (12)
    • ►  July (4)
    • ►  June (3)
    • ►  May (7)
    • ►  April (13)
    • ►  March (3)
    • ►  February (5)
    • ►  January (20)
  • ►  2011 (41)
    • ►  December (8)
    • ►  November (7)
    • ►  September (4)
    • ►  August (4)
    • ►  July (2)
    • ►  June (6)
    • ►  March (5)
    • ►  February (1)
    • ►  January (4)
  • ►  2010 (69)
    • ►  December (1)
    • ►  October (3)
    • ►  September (2)
    • ►  August (13)
    • ►  July (17)
    • ►  June (3)
    • ►  May (3)
    • ►  April (3)
    • ►  March (11)
    • ►  February (1)
    • ►  January (12)
  • ►  2009 (177)
    • ►  December (20)
    • ►  November (11)
    • ►  October (7)
    • ►  September (7)
    • ►  August (21)
    • ►  July (17)
    • ►  June (7)
    • ►  May (18)
    • ►  April (9)
    • ►  March (17)
    • ►  February (23)
    • ►  January (20)
  • ►  2008 (35)
    • ►  December (23)
    • ►  November (12)
Powered by Blogger.

About Me

Unknown
View my complete profile