Bios Password

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Saturday, April 14, 2012

Zalman ZM-VE series Enclosures: Next-Gen Virtual ODD

Posted on 12:48 PM by Unknown

Last week I received an anonymous comment on my iodd : Multi-boot madness! post. -- Thanks Tipster!

You may recall the IODD device is an external drive enclosure that supports multi-mode operation:

You can use it in an external hard-drive mode to just copy files back and forth and access them as needed.

You can use it in an ODD (optical disk drive) virtualization mode. In this mode you load a bunch of ISO image files onto it. Then while operating in this mode, you can select the ISO file and PC will see it as a virtual optical disk. If the ISO represents a bootable disk image, you can likewise boot the system with it. This massively cuts down on the number of “burned” boot disks as well as installation media disks you need to carry. Just carry this device and you are limited only by the size of your external drive capacity.

Then there is a multi-mode where it operated in both an external drive/ODD mode.

I love the device I have and it has made my life so much cooler easier when I roll out on an troubleshooting/incident response call.

The model I have and cherish is an older iODD 2501 model. It has both an eSATA connection (requires independent power connection via dual USB plugs), and a USB 2.0 connector.

It’s rock solid, and firmware updates were available to allow it to operate all partitions including any that include your _ISO store to be NTFS. iodd.com download page. My primary (_ISO holding) partition remains FAT32 because I’ve yet to create a 4 GB+ ISO file I need to boot with or access and that’s all I presently use it for on that partition.

Anyway… as my tipster points out, it appears there is a new model out from the IODD manufacturer. Based on the main i-odd.com page, it looks like “worldwide sales” is seeing it marketed/distributed under the “Zalman Tech” name now.

The features of the newest model appear pretty much the same except for the addition now of a USB 3.0 port rather than the older USB 2.0 connection and eSATA combo. The USB 3.0 can net you up to 5 Gbps transfer rate if you have the hardware to support it. Compare that to the 480 Mbps USB 2.0 rate. Wowzers. It also appears to provide some SMART drive stats on the display now as well.

Here are some useful links based on some quick research I did over the last week.

Still Super Cool. Still Valca Recommended.

  • Zalman ZM-VE300 Product Page - Zalman
  • Zalman ZM-VE300 External 2.5IN HDD Case & Virtual Drive Unboxing & First Look - Linus Tech Tips Blog
  • Product Review: Zalman ZM-VE300 USB 3 2.5” Drive Enclosure with ISO Mount Capability A+ - MPECS Inc. Blog
  • Review: Zalman ZM-VE200-SE V1.1 Virtual CD/DVD/BR USB Drive - Run Away Brainz blog
  • Zalman ZM-VE300-B Black 2.5inch SATA USB3.0 External HDD Enclosure: Electronics - Amazon.com Product page.
  • Zalman ZM-VE300-B Aluminum Alloy, Acryl, Poly Carbonate 2.5" Black USB 3.0 ZM-VE300 HDD External Enclosure with Virtualization and One Touch Back-up - NewEgg product page

Related Concept:

  • isostick - the optical drive in a usb stick by Elegant Invention - Kickstarter

As I said, my iODD 2501 model is running strong and I don’t have any systems that support the USB 3.0 hardware (personally or in the trenches) so I’m not rushing out to pick a Zalman model up just yet. However I can’t help but be a bit envious of the transfer rates in this new model.

Cheers.

--Claus V.

Read More
Posted in boot-cd's, hardware, virtualization | No comments

Windows 8 Linkage: “Passage Public Metro” version

Posted on 11:06 AM by Unknown

cc image credit image by david.nikonvscanon on flickr

1tgo4sbe.3sx

So Claus, where do you stand on Windows 8 at this point?

Well, to be honest, I’m really liking the under-the-hood improvement talk on how things are working in Windows 8.

What I still find very hard to overcome are the end-user interface changes and the challenges trying to restore it to some form of a Windows “Classic” interface and operation.

I get that Microsoft wants to forge ahead with a new interface and blending between the Windows Phone interface and the computer system interface. I get that “apps” are all the rage. I like old-school design but am pretty comfortable with moving to new designs. (I no longer curse the Ribbon interface in Office 2007/2010.)

So…when Windows 8 gets released in a final version, I’m not going to be rushing out to upgrade all our systems to it from Windows 7. Windows 7 is super-stable for our needs at home and everyone is very happy. That said, once it looks like things are stable and I’ve come to terms with the new interface, I’ll probably upgrade just one of our systems here at the Valca ranch to Windows 8 and see how things go.

In the meantime, here are an updated collection of Windows 8 linkage building on the prior grand stream dreams: Windows 8 Linkage: “Majestic Metro” version post. It definitely requires an update since the Consumer Preview release of Windows 8 has come out a while back and some of the things from that one either no longer apply or may not work in this release.

Truth be told, tonight will be the first opportunity I’ve budgeted myself to load up with Windows 8 Consumer Preview version in a virtual machine.

Windows 8 “Consumer Preview” Version - Start Here to Get It

  • Windows 8 Consumer Preview available now! - Ask the Performance Team - TechNet Blogs - From that link:
    • Windows 8 Consumer Preview
    • Windows 8 Download Link
    • Welcome to Windows 8 – The Consumer Preview
    • Running the Consumer Preview: system recommendations
    • Windows 8 Consumer Preview Product Guide for Business
  • Windows 8 Consumer Preview ISO formats - Microsoft.com - Links for the ISO setup files rather than the “online installers”. This is what I still prefer.
  • How To Get Windows 8 Consumer Preview Product Key - AddictiveTips
  • Where is the Windows 8 Consumer Preview product key? - Ed Bott
  • Running the Consumer Preview: system recommendations - Building Windows 8 blog

Windows 8 - Related Betas

OK. None of these are required for Windows 8 Consumer Preview. However they are related to it and I thought some folks might be interested in playing around with them as well. If you don’t know what these even are, then just skip down to the next section.

  • Windows Server 8 beta now available! - Ask the Performance Team - TechNet Blogs
  • Windows Server “8” beta available now - Virtual PC Guy's Blog
  • Hyper-V Server “8” Beta available for download - Virtual PC Guy's Blog
  • DOWNLOAD: Test Lab Guide: Base Test Lab Guide for Windows Server "8" Beta - Kurt Shintaku's Blog
  • Download Microsoft SQL Server 2012 RTM - Bink.nu
  • Doing a simple Storage Migration with Windows Server “8” - Virtual PC Guy's Blog
  • TRAINING: Windows Server "8" First Look - Kurt Shintaku's Blog
  • Windows Server “8” Beta Hyper-V Component Architecture Poster - Windows Virtualization Team Blog - TechNet Blogs
  • Windows Server 8 installation notes - 4sysops
  • Doing an advanced Storage Migration with Windows “8” - Virtual PC Guy's Blog

Windows 8 - Install It

There are a number of methods and platforms to install Windows 8. Review all the ones below carefully to figure out which works best for you. I personally am currently going with installing it into a Virtualbox session. When I get closer to pulling the trigger on installation to one of my laptops at home, I’ll first install it into a VHD and then dual-boot my system so the Win8 install can run on real “hardware” to check driver compatibility and system performance on the iron rather than in a virtual system. I did that before with Win7 and found it very beneficial.

  • How to Upgrade Windows 8 Consumer Preview from Developer Preview - Windows7hacker
  • How to install Windows 8 Developer Preview in Virtualbox - 4sysops
  • A quick guide on setting up Windows 8 on VirtualBox - Bleeping Computer
  • VirtualBox 4.1.10 improves Windows 8 compatibility - BetaNews. Note: always be sure you are running the latest version of VirtualBox and have the matching (separate download) Extension Pack installed. At the time of this post, VirtualBox is now at 4.1.12. Downloads – Oracle VM VirtualBox
  • How To Install Windows 8 On VirtualBox - AddictiveTips
  • Installing VMWare Player on Windows 8 - Caschys Blog (Google Translated link)
  • How To Guide to Installing and Booting Windows 8 Consumer Preview off a VHD (Virtual Hard Disk) - Scott Hanselman
  • Native VHD Dual Boot to Windows 8 Consumer Preview with Windows 7 - Windows7hacker
  • An update that postpones the expiration date of Windows 8 Developer Preview and of Windows 8 Server Developer Preview is available - Microsoft Support KB 2671501
  • Windows 8 upgrade - 4sysops
  • Create Bootable Windows 8 Installer USB With Win8USB - AddictiveTips

Windows 8 - Under the Hood Stuff

These are the things that make me look forward to Windows 8 despite the stupid fact the “classic” interface is stripped out and requires considerable effort to restore using tips/tweaks/third-party tools to accomplish. Note: when I say “classic” I’m not talking about the theme that is a toss-back to Windows 2K/XP but rather the “classic” GUI with the program bar, the “start” menu, the system tray icons, etc.

  • Improving our file management basics: copy, move, rename, and delete - Building Windows 8 blog
  • Designing the Windows 8 file name collision experience- Building Windows 8 blog
  • Acting on file management feedback- Building Windows 8 blog
  • Windows 8 Secrets: PC and Device Requirements Within Windows
  • Windows 8 Secrets: The WinX Menu and its hashing algorithm Within Windows
  • Internet Explorer Performance Lab: reliably measuring browser performance - Building Windows 8 blog
  • Building the next generation file system for Windows: ReFS - Building Windows 8 blog
  • Virtualizing storage for scale, resiliency, and efficiency - Building Windows 8 blog
  • Enabling large disks and large sectors in Windows 8 - Building Windows 8 blog
  • Minimizing restarts after automatic updating in Windows Update - Building Windows 8 blog
  • Using Task Manager with 64+ logical processors - Building Windows 8 blog
  • The Windows 8 Task Manager - Building Windows 8 blog
  • Reengineering the Windows boot experience - Building Windows 8 blog
  • Protecting you from malware - Building Windows 8 blog
  • Delivering fast boot times in Windows 8 - Building Windows 8 blog
  • Evolving the Start menu - Building Windows 8 blog
  • Designing the Start screen - Building Windows 8 blog

Windows 8 - To Go

Windows “To Go” is basically a feature in Windows 8 that allows it to run “full OS” from a supported USB storage device like a flash drive or external hard-disk drive. I guess it could be considered an advanced version of WinPE but with all the benefits of the OS with no feature strip-out or additional “hacking” required that custom WinPE builds require to get past a plain DOS box environment “out of the box”. It is very intriguing to me and should be a cool option…if you meet the license requirements as well have a robust and super-fast USB device/port.

  • Ordering "Windows to Go": how to create a bootable Windows 8 USB thumb drive - ArsTechnica
  • How to create your own Windows 8 To Go Developer Preview - Borns IT- und Windows-Blog
  • Creating Windows 8 To Go on a 16 GB USB-Stick - Borns IT- und Windows-Blog
  • Windows 8 To Go with Dual-Boot - Borns IT - und Windows-Blog
  • Windows To Go – Windows 8 Consumer Preview on the run … - Borns IT- und Windows-Blog
  • Windows 8 To Go and USB 3.0 flash drives - Part I - Borns IT - und Windows-Blog (Google Translated Link)
  • Windows 8 To Go and USB 3.0 flash drives - Part II - Borns IT - und Windows-Blog (Google Translated Link)

Windows 8 - Tweakages

Getting Windows to the way you like it is still important. Here are some important (to me) tweaks, tips, and tweaking tools to make it possible.

  • Bypass Windows 8 Start Screen On Startup & Jump Directly To Desktop - AddictiveTips blog
  • How To Disable Windows 8 Lock Screen- AddictiveTips blog
  • BluePoison Disables Windows 8 Immersive Start Menu, Unlocks Hidden Features - Lifehacker
  • Windows 8′s application SmartScreen: speed bump for desktop apps – istartedsomething
  • How to Turn Off or Disable the SmartScreen Filter In Windows 8 - How-To Geek
  • The First Official Windows 8 Theme from Microsoft Available to Download - Windows7hacker
  • You CAN have a Start button on Windows 8 Consumer Preview - BetaNews
  • Start8 Adds Metro Start Menu In Windows 8 - AddictiveTips blog
  • Start8 for Windows® 8 - Bringing back the Windows Start menu - application download page at StarDock
  • Personalize Windows 8 Start Screen With My WCP Start Screen Customizer - AddictiveTips blog
  • My WCP Start Screen Customizer v1.1 - Téléchargements  - My 7 Apps
  • Customizing the Metro style Windows 8 Start screen - Ed Bott
  • The Metro hater's guide to customizing Windows 8 Consumer Preview - ZDNet photogallery by Ed Bott
  • Create Custom Refresh Point In Windows 8 With Recimg Tool - AddictiveTips blog
  • Classic Shell: Get Win 7 Start Menu & XP Explorer Toolbar On Windows 8 - AddictiveTips blog
  • Welcome to Classic Shell - application download page at SourceForge

Windows 8 - Deeper Insights

  • Quickpost: Some Windows 8 Observations - Didier Stevens
  • Windows 8 build recovery image - Caschys Blog (via Google Translate link)
  • Windows 8 Storage Spaces detailed: pooling redundant disk space for all - ArsTechnica
  • Windows Home Server Drive Extender reborn as Windows 8 Storage Spaces - Tenniswood Blog
  • Connecting Windows 8 Consumer Preview with Windows Home Server - Windows Home Server Blog

Windows 8 - DaRT (Diagnostic and Recovery Toolset)

This off-line system boot tool is kitted out with a collection of system administration tools to aid in the diagnosis and recovery of a tanked Windows system.  This isn’t as easy to get your hands onto so some work and signup with Microsoft is required to get it.

  • MDOP: DaRTing to the Future - Windows Team Blog
  • Microsoft DaRT 8 Beta Q&A - Windows Team Blog
  • Diagnostic and Recovery Toolset (DaRT) - 4sysops

Indirectly related but still interesting.

  • MDT 2012 New Feature: DaRT integration - Michael Niehaus' Windows and Office deployment ramblings
  • Integrate Microsoft Diagnostics and Recovery Tools (DaRT) into the MDT boot image - Guillaume Remy

Windows 8 - Usage Tips

New user interface, new things to learn navigating around and completing basic tasks without beating head on desk…

  • Getting started with the Windows 8 Consumer Preview - ZDNet - Ed Bott Report
  • Windows 8 mouse tip: Quick access administrator options from the start screen - Tenniswood Blog
  • Getting around in Windows 8 - Windows Experience Blog
  • Windows 8 Consumer Preview Journey – Day 1 - Windows7hacker
  • How To Shut Down Windows 8 Computer in 4 Ways - Windows7hacker
  • Take Ownership Of Files & Folder And Change Permissions In Windows 8 - AddictiveTips blog
  • What Is Windows 8 Charms Bar? Share, Search, Access Settings & Actions - AddictiveTips blog
  • How To Resize, Group & Manage App Tiles In Windows 8 Start Screen - AddictiveTips blog
  • Windows 8 Remote Desktop: Hands-On Review & Tutorial - AddictiveTips blog
  • Where Is Computer In Windows 8? Show On Desktop, Pin To Start Screen - AddictiveTips blog
  • Where Is Start Menu In Windows 8? - AddictiveTips blog
  • Windows 8 File Sharing: Share Users & System Folders On Network - AddictiveTips blog
  • The Complete Guide To Window 8 Task Manager; New Features And Options - AddictiveTips blog
  • The Complete Guide To Windows 8 Explorer; New Ribbon Tools And Options - AddictiveTips blog
  • The Complete Guide To Windows 8 Metro Control Panel - AddictiveTips blog
  • The Complete Guide To Windows 8 File History Backup - AddictiveTips blog
  • Windows 8 PC Settings [Complete Guide] - AddictiveTips blog
  • Where Is Startup Folder & How To Edit Startup Items In Windows 8 - AddictiveTips blog
  • Windows 8 Apps Don’t Connect to Your Google/Gmail Account? -7 Tutorials
  • Trouble Setting Up Gmail on Windows 8? Here is Why and How to Fix it - Windows7hacker
  • Quick fix for AMD’s OpenGL on Windows 8 - Within Windows
  • How To Create Wireless Ad Hoc Internet Connection In Windows 8 - AddictiveTips blog
  • Windows 8 Guide: The Win+X Menu, aka The Power User Menu - Windows7hacker
  • How To Disable Windows 8 Lock Screen - AddictiveTips blog

Windows 8 - Miscellanea & Rumor Mongering

Already mostly covered in the linkage above, but sometimes you just can’t resist poking that ant-pile with a stick…

  • Start button To be Ditched in Windows 8 - Windows7hacker
  • Cloud Computing with SkyDrive on Windows 8 Revealed, A Desktop Version for Windows 7 too - Windows7hacker
  • Windows 8 Pro details surface, incremental updates - Neowin.net
  • Windows 8 - and 15-office news - Borns IT - und Windows-Blog (Google Translated Link)

Cheers.

--Claus V.

Read More
Posted in boot-cd's, Link Fest, Microsoft, utilities, virtualization, Windows 8, Windows Home Server | No comments

Saturday, April 7, 2012

For-Sec LiveCD Updates

Posted on 7:26 PM by Unknown

It has been a while since I updated the ISO files on my iodd external drive/ISO boot device.

I’ve amassed quite a collection of forensic, security, WinPE, and pen-test distros on it and unless something major gets released, I usually don’t pay close attention to keeping them current.

So during a slow Saturday, I figured I would surf the webs and grab the latest versions of the primary LiveCD distros I keep handy on it.

Turns out there are quite a few updates to be had; most all of them pretty recent!

DEFT 7.1 ready for download - DEFT Linux - Bug fixes, updated packages, new tools and exciting bells-n-whistles. Released around 03-30-2012.

CAINE 2.5.1 SuperNova - Forensic LiveCD version released 11-18-2011. I really like this one and as a added bonus, this distro includes an auto-run tool menu if used in a running Windows system: WinTaylor 2.5.1.

PALADIN 2.06 - Forensic LiveCD from SUMURI group. Free download but registration is required for download access. The LiveCD is free and there is a USB version also available at a nominal cost though you can make your own if you wish. I don’t think this is a “recent” release version, but it was newer than the previous version I had.

Raptor 2.5- Forensic LiveCD from ForwardDiscovery group. Current version released 02-26-012. Free download but registration is required for download access. The LiveCD is free and like Paladin, is also available as a pre-installed USB device for a small expense. Raptor is cool in that they have versions for both Intel and PowerPC systems.

Matriux 1.2 “Krypton” - The Open Source Security Distribution for Ethical Hackers and Penetration Testers LiveCD. Current version was released 02-16-2012. Check out the “arsenal” list for a full roundup of the included packages.

BackTrack 5 R2 Release - Penetration Testing Distribution - Latest release version came out around 03-01-2012. This is one of the largest and best for/sec distros out there and includes an amazing collection of tools with extensive documentation on the website and in the community.

GnackTrack - phillips321.co.uk - is (and apparently ever will be) frozen at the final release as the developer is moving on to newer things and since Back Track now comes in both Gnome and KDE flavors.

Blackbuntu Linux & BackBox Linux are new Sec distros to me but since phillips321 recommended them that makes them worth checking out in my book.

Security Onion 20120405 - LiveCD from Doug Burks is out and includes options for a local install if desired. If the file-naming and post date is any indication, then this release is just a few days out of the oven as of 04-05-2012. I deeply appreciate Doug’s work as he is super-good in keeping it fresh and updated frequently.

Windows Forensic Environment - WinFE - Last but definitely not least, Brett Shavers remains hard at work in the Windows PE (FE focused) WinFE building project. Though not an “off-the-shelf” ISO, the process for building your own is pretty straight-forward and all the hard work has already been done. Recent WinFE building work includes a neat GUI-based app from a script you can add into your WinFE building project.

Need some places to start with WinFE building?

These WinFE Blog posts by Brett are particular good.

  • How easy (or difficult) is it to build a WinFE with WinBuilder? - Easy Peasy!
  • Building your WinFE Update - Options
  • Colin’s Write Protect Application - Handy Gui tool if you aren’t super-comfortable with DISKPART CLI. ForensicFocus has a WinFE (PDF) guide that is still quite good.
  • WinFE Script Updated - Minor correction.

Finally, these last Linux LiveCD distros are really, exactly For-Sec but I’m really liking them for when I just need to pop-onto a system in my own secure environment and am not comfortable with just what is lurking on the “live” host system. Recently mentioned here on GSD but still sharing the goodness all the same. Besides, it just looks cool if anyone is shoulder-surfing.

Software Protection Initiative - Lightweight Portable Security.  This is a USAF/DOD project and is super-cool and super sharp.  The latest versions were released 02-16-2012. The “Deluxe” version is larger than the primary version as it also contains OpenOffice and AdobeReader software.

Selected info from the page linked above:

Lightweight Portable Security (LPS) creates a secure end node from trusted media on almost any Intel-based computer (PC or Mac). LPS boots a thin Linux operating system from a CD or USB flash stick without mounting a local hard drive. Administrator privileges are not required; nothing is installed. The LPS family was created to address particular use cases: LPS-Public is a safer, general-purpose solution for using web-based applications.

Read the LPS-Public Quick Start Guide. (PDF link)

Read the LPS-Public User's Manual. (PDF link)

Easter Joy,

--Claus V.

Read More
Posted in boot-cd's, forensics, Link Fest, Linux, security, utilities, Win FE | No comments

Tools, Tips, and Reverse-Image Searches

Posted on 4:22 PM by Unknown

Last week must have been pretty quiet as folks prepared for the Easter weekend. I didn’t collect near as much material as usual.

That’s a good thing seeing as I’m still digging out the piles of linkage I’ve been buried under.

Submitted for your edification:

NoVirusThanks - Funny name, great tools and freeware utilities for sysadmins and incident responders alike.  I have a few other "elite go-to” sources that offer a spectacular range of utilities for my prime toolsets and I’ve had to add NoVirusThanks to my list.

  • Sysinternals Utilities - Microsoft SysInternals.
  • Nirsoft - Nir Sofer’s amazing collection of freeware tools and utilities.
  • woanware - Mark Woan’s collection of forensics and network security utilities.

There are lots of other great producers of quality freeware Windows tools and utilities both for system administration, incident response, and forensics, but these sites seem to pack the best of them into a single place.

Wireshark · Wireshark 1.6.7 Released - Mostly bugfixes but check out the full 1.6.7 release notes if you care. Then go download the latest version of Wireshark in your favorite flavor.

Just when I thought I covered the series in my last post, Girl, Unallocated slips in a new installment, #2.4 with some timeline/SIFT work.

  • Case Experience #2 - IP Theft Investigation Thought Process
  • Case Experience #2.1 - More About IP Theft Thought Process
  • Case Experience #2.2 - Let the Digging Begin
  • Case Experience #2.3 - Digging Into the Registry
  • Case Experience #2.4 - Exposing Kilroy with Log2Timeline

David Kravets from Wired’s Threat Level authored the post How Forensics Claims Facebook Ownership Contract Is 'Forged' that offers some certainly interesting items out of a forensic examination. I find value in reading publically released incident response and forensic analysis reports to pick up tips as well try to understand both the good, the great and especially the less than stellar (to then be avoided) in techniques used.

New Tools, Registry Findings - Windows Incident Response blog - Harlan Carvey passes on some new tips, tools, and registry bits of his own, one of which is the super-handy RegRipper Plugins maintenance tool from the super-cool Cheeky4n6Monkey. Read both Halan’s and Cheeky’s posts to get some idea if this tool would helpful.

Get out the Vote!

The Forensic 4cast Awards hosted by Forensic 4cast is open for voting through June 17th.

Take a look at the stellar nominees for each category and pass some love and kindness in support of the hard work these oft-unrecognized forensicators do day-in and day-out. Everybody likes some props now and then and here’s a way to show your appreciation for the top-shelf work done in the forensic community. Go and Meet the 2012 Nominees then cast a vote.

The humble GSD blog treads far below these giants but it was cool to see a kind link-back over in a recent SANS Digital Forensics Case Leads blog post. That’s some mighty fine company to be sandwiched amongst. I’m encouraged that some of these posts are as helpful to others as they are rewarding for me to share. Semper paratus, my friends.

Where’s That Image?

And here is how Claus finds new tools/techniques. Scary.

I was ripping though my RSS feed pile this past week and came across this post over at Boing Boing! That piqued my interest: Moon boxes and mystery men. I’m a sucker for old black-n-white techy photos of stuff from bygone era’s. Stuff like old space program photos, crazy industrial equipment, even the ads over at Phil Are Go!

Anyway.

While the question posed by Frank Munger was interesting, I was more curious if/where the photo had previously appeared on the WWW.

So I downloaded the “original” image, popped over to Google Images, clicked on the tiny blue camera in the search bar, uploaded the image I had downloaded and…bingo got the results. Of course, looking down a bit more on the page I found that Frank Munger had since found the answer he was seeking Y-12's moon-box mystery solved, although the Boing Boing didn’t update their story. That particular itch was now considered scratched, but that did lead me to look around for more reverse-image search tools.

There may be times when you find an image on a system or drive and want some more information about it. You could do a search on the file-name but those can be renamed. While you may not be able to draw many conclusions from an image search, it might give you some additional context for understanding.

Since the last time I went blogging about reverse-image-lookup tools on the web was quite a while ago, there are some new ones worth bookmarking.

Google Images - Check out these related links for more information on how to use this Google search feature: Search by Image · Inside Google Search and Search by Image - Google Images Help.

TinEye Reverse Image Search - One of the originals and still quite good. TinEye also offers some Plugins for major web-browsers.

Bing Images - While Bing does some great image searches based on terms, it doesn’t (yet) seem to support reverse-image searching.

Anyone know of any other reverse image search sites and/or tools worth recommending?

Cheers!

--Claus V.

Read More
Posted in forensics, graphics, Link Fest, security, utilities | No comments

Sunday, April 1, 2012

Forensic Linkfest - microwave-ready meals

Posted on 1:26 PM by Unknown

My “For-Sec” to-be-blogged pile is bustin out at the seams.

Unfortunately, I still haven’t been able to find the time to toss the meat on grill in a way that gives it justice…so as of now, that material is still slow-smoking.

In the meantime maybe you will find something noteworthy in the following links-of-note prepared for quick consumption.

NetWitness - Investigator Freeware - Version 9.7.5.4 released 03/16/12. I’ve used this NFAT tool successfully in the past, but had stopped looking for updated versions. So the other day when my one-year’s registration period had expired and I had to “re-enlist” I was advised an update was available. There are a number of free NFAT tools, and each provides its own slant. NetWitness Investigator Freeware version is a must-have tool for your assessment collection. Get the update!

MIR-ROR - This incident response toolset has now been updated to version 2.0: HolisticInfoSec: MIR-ROR 2.0 released. Sure you have to dump a few of the ingredients in the provided bowl before you bake, but it’s, well, a piece of cake. The result is a collection of tools that can speed up your assessment and information collection on a suspect system.

65 Open Source Replacements for Security Software - Datamation’s Cynthia Harvey has composed a knock-out list of great Open Source tools. I’m confident that anybody who regularly reads this blog will find something new or interesting in this list.

NAFT Release - Didier Stevens has released his Network Appliance Forensic Toolkit than can handle network appliances but also supports memory dumps of OS’s like Windows. Basically (for now) it extracts network packets from memory dumps or other devices via pattern recognition.

The Latest Version of Redline Finds Indicators of Compromise and More - Mandiant’s Redline tool has now been updated.

Brett Shavers has a number of new posts about progress in the WinFE building and toolsets.

  • Colin’s Write Protect Application- Windows Forensic Environment Blog
  • WinFE Script Updated - Windows Forensic Environment Blog

The Girl, Unallocated forensic blog has been a great source of how-to’s and advice on approaching investigations. This latest series is quite interesting.

  • Case Experience #2 - IP Theft Investigation Thought Process
  • Case Experience #2.1 - More About IP Theft Thought Process
  • Case Experience #2.2 - Let the Digging Begin
  • Case Experience #2.3 - Digging Into the Registry

Prefetch analysis posts are quite plentiful.

  • Prefetch Analysis, Revisited...Again... - Windows Incident Response blog
  • Second Look at Prefetch Files - Journey Into Incident Response blog

Corey Harrell also has a great in-depth timeline study based on Volume Shadow Copy data. Sharpen your Saw on this one!

  • Volume Shadow Copy Timeline- Journey Into Incident Response blog

We are all learning more and more as Chrome gains in popularity. SANS Computer Forensics and Incident Response blog’s “johnmmccash” has a great roundup of material in his Forensically mining new nuggets of Google Chrome post.

Finally, Security Ripcord blog’s Don C. Weber has a technical post on Hard Drive Acquisition Information Using faidds and makes some interesting observations in the process.

Cheers!

--Claus V.

Read More
Posted in Chrome/Chromium, forensics, Link Fest, malware tools, NFAT, security, software, utilities | No comments

Neat Portable File Encryption Program via the USAF!

Posted on 12:43 PM by Unknown

The other day I needed to transfer a file securely though the emails but didn’t want to deal with setting up a certificate-based method such as Comodo’s Secure Email or an OpenPGP email solution like Enigmail. I wanted to be able to keep this file in my web-based email account for access but didn’t want to leave it in the “free-n-clear” in case my account ever got hacked. Sure, I could have made an encrypted file volume in TrueCrypt and copied it up, but that seemed like overkill.

I just wanted to encrypt the file and decrypt it as needed without a lot of drama as needed when I found myself on a guest system.

I found a big selection of freeware tools to do this and while they all were quite full-featured, they all seemed to be a bit more expansive then the simple task I was looking for. Those that I explored included:

  • Chiave 2 - (AddictiveTips review)
  • SteadyCrypt - Java-based encrypting utility
  • AxCrypt - file encryption software by Axantum that compliments Dropbox, Live Mesh, SkyDrive and Box.net services.
  • Androsa FileProtector
  • File Encryption
  • BoxCryptor - offering on-the-fly encryption for cloud storage. (BoxCryptor Blog)
  • Encoding Decoding Free - (AddictiveTips review)
  • lazarcrypter - (AddictiveTips review)
  • along with a number of clever and tiny DOS-based Encryption & Encoding utilities.

Almost any of these almost fit the need I had, but I just didn’t feel the match was perfect. Plus I wasn’t really looking for something I might have to install on a guest system…especially if it might not be running Windows.

Finally I found exactly what I was looking for courtesy of the US Air Force Research Laboratory geeks.

Software Protection Initiative - Encryption Wizard Public. From the page.

Encryption Wizard (EW) is a simple, strong, Java file and folder encryptor for protection of sensitive information (FOUO, Privacy Act, CUI, etc.). EW encrypts all file types for data-at-rest and data-in-transit protection. Without installation or elevated privileges, EW runs on Windows, Mac, Linux, Solaris, and other computers with Sun Java. Behind its simple drag-n-drop interface, EW offers 128-bit AES encryption, SHA-256 hashing, searchable metadata, archives, compression, secure deleting, and PKI/CAC/PIV support. EW is GOTS - Government invented, owned, and supported software. Over 35,100 copies of EW protect a wide variety of data.

EW comes in two, fully-compatible and interoperable editions, EW-Public and EW-Govt. Anyone can download and use EW-Public. Designed for US Federal Government (and contractor) computers, EW-Govt is accredited by the Army and Air Force for NIPRNet and SIPRNet. EW is free to users.

It was a piece of cake to use.

I downloaded the latest version (EW-Public) v3.3.1

I unzipped the archive (included 2.09 MB PDF user guide, 1.21 MB “jar” application, and 2kB text file for getting started).

I ran the EW-Public-3.3.1 “jar” file and got a cool splash logo followed by the application.

I selected the file I needed to encrypt and drag/dropped in on the application window.

I hit the “Encrypt” button and provided/confirmed a “passphrase.” (note it will provide you feedback on the strength as you go.)

Hit the “next” button and decided if I wanted to keep the original file after encryption or delete it. Your choice. Added it. Done.

Note, it does not randomize or otherwise change the file name itself, so you may want to do so if the file name makes it more interesting to snooping eyes.

To decrypt, launch the app, drag the encrypted file onto the application,choose the “Decrypt” button, pass your passphrase and you are good.

It is a breeze to use, is 100% portable, and is very fast. If you are afraid the system you are working on doesn’t have Java for some bizarre reason, keep a copy of jPortable along side this jar file application.

If you want to encrypt many files at once, drag them all and then encrypt and it will create a “many-in-one” compressed/encrypted file. Sweet!

The PDF User Guide v3.3.x is very detailed and well worth reading if you are interesting in using this tool.

Yes, I know using a US military/govt developed tool for encryption may not appeal to the tinfoil-hat wearing crowd, but on the other hand if you need a fast, easy to use file-encryption tool, this is a great choice. It’s good enough for me and has my full confidence.

Bonus Find:

Software Protection Initiative - Lightweight Portable Security - The same team that developed the encryption tool above also has a public version of a secure ISO-based live-CD linux build that also includes Encryption Wizard - Public. Download the ISO and you burn it to a CD (or create a bootable USB drive from the included “install to USB” tool in Windows on the root of the ISO/CD) and use this distro to securely run on a system.  It’s light-weight and no frills. There is also a “deluxe” version that includes OpenOffice and AdobeReader which are stripped out of the “lite” version.

It’s a nice lite little distro for special needs usage and was an unexpectedly pleasant find.

Cheers!

--Claus V.

Read More
Posted in boot-cd's, security, utilities | No comments

No Foolin! Free Download Gold.

Posted on 11:38 AM by Unknown

Lots of good freeware downloads these past several weeks.

Get panning.

Update for Windows Live Essentials 2011 now available - Windows Experience Blog. Trying to find out exactly what gets updated in these releases is always challenging. Comments on this page report issues with Live Mesh after the upgrade. read these comments if you rely on it before updating. Blaine points us to this page, Windows Live Essentials 2011 release notes that still isn’t great but is better than nothing.

Thesycon USB Descriptor Dumper - displays USB descriptors of any USB device.

sCheckbook - DonationCoder.com - bare-bones check-register application. No bells or whistles. Just the simple basics to record check information and keep a running tab. Others apps are out there with lots more features, but if you are training a young adult in the habits, this could be a simple place to start.

Universal USB Installer – USB Pen Drive Linux - “Live” Linux Booting USB creator tool. Select a distro, go though the steps, and it will load and configure your USB device with the ability to boot a system from that distro. See the link to see all the supported distros. It’s a very comprehensive collection.

Digital Lagniappe’s Photo Collage - Screen saver that tosses images from folders onto your desktop. I’ve been using SE-ScreenSavers for a long time, but this new screensaver is very nice. Options are light but enough to get the job done. It’s a pleasant change.

Audacity 2.0 - My favorite, go-to audio editor got a major version bump lately. I really like the performance and though I have only just started to feel like I have mastered the basics, I’m excited about this new version. For a rundown of the major new features: Audacity 2.0 Update Brings Lots Of Bug Fixes & New Features post addictivetips.com, Six years of betas later, Audacity 2.0 debuts post betanews.com. Also, don’t forget that Wavosaur free audio editor with VST and ASIO support is alike and kicking also.

Oracle VM VirtualBox - Updated to v 4.1.10. Changelog – Oracle VM VirtualBox, and Forum discussion on the 4.1.10 release. First go round I had trouble installing the updated VirtualBox Extension Pack for 4.1.10 and it kept bombing out part way though. VB quickly identified the issue and updated the pack and the new one went on smoothly. You should always download and install the matching Extension Pack when you update the main VirtualBox application. Head over to the Downloads page and grab both.

ISO Toolkit 5.0 - Tweaking with Vishal - This is a nice do-it-all tool to work with ISO files. Wish I had been able to include it in my Mostly ISO burning post a while back. A more detailed review can be found at this freewaregenius post.

If ISO Toolkit is too “geeky” then consider CD Manipulator MOD instead to manage your ISO file and disk-burning needs. The pictures speak for themselves. More details on the features over at this addictivetips post: CD Manipulator: Read/ Write & Master CDs, Create Easy Duplicates.

Greenshot remains my current screen-shot utility of choice. Though not perfect, it runs stably on XP and Windows 7 and contains enough editing and markup extras to make it more than adequate for my screen capture needs. That said, I saw two more screen-shot tools that you might be interested in: aeroshot and livecapture. This post has more details on the former if you are interested: Live Capture: All-In-One Screenshot Tool With 12 Different Modes by AddictiveTips. Their 5 Best Free Screen Capture Software For Windows post is a good place for a pros/cons review of several of these screencapture tools so you can find one that fits your particular needs.

And yesh. Time to update Flash again.

Game on with Adobe Flash 11.2 and AIR 3.2 - BetaNews

Adobe Flash Player APSB12-07 - 28 March 2012 - SANS ISC Diary

New, easier-to-update Flash designed to snuff out malware attacks - ArsTechnica

What’s my Flash Player version? Where’s the latest Flash update? -Ed Bott

Current Version Downloads via FileHippo

  • Flash Player 11.2.202.228 (IE) 64-bit - Download
  • Flash Player 11.2.202.228 (IE) - Download
  • Flash Player 11.2.202.228 (Non-IE) 64-bit - Download
  • Flash Player 11.2.202.228 (Non-IE) - Download

Keeping these updated has been challenging but this new version now gives you options for it to automatically check for and apply updates, notify you of updates (but do nothing else), or to not bother checking for updates. Choose wisely!

Cheers!

--Claus V.

Read More
Posted in boot-cd's, Link Fest, software, utilities, virtualization | No comments
Newer Posts Older Posts Home
Subscribe to: Posts (Atom)

Popular Posts

  • New Year’s Day - First Post 2011
    Same day I came out with my first post after a long drought, I fell upon this article Blogging Seems To Have Peaked, Says Pew Report over a...
  • Oscar watch Linkpost
    Alvis and Lavie are watching the Oscars tonight and I’m along for the ride. I wasn’t able to come even close to getting out some of the pos...
  • Finally! Time to Post! New material list
    After a recent text from my bro reminding me it has been since March since I’ve done a blog post, I was finally able to clear the schedule a...
  • Ubuntu 13.10 Upgrade - Lessons Learned & VIDMA utility found
    A few weeks ago a new release of Ubuntu came out. Naturally that meant it was update time! I have been getting pretty good at this now so ...
  • iodd : Multi-boot madness!
    Like many computer technicians and responders, I seem to always have at hand a collection of bootable media; CD’s, DVD’s, USB-HDD’s, flash m...
  • Network Capture Tools and Utilities
    At a conference this week, we had quite a section regarding network captures. The instructor was going on about how you can try to sort ou...
  • It just has to be bigger on the inside…
      Last Christmas, Lavie gifted me with a cute little Jawbone JAMBOX unit. I thought it was pretty cool. It uses a Bluetooth connection t...
  • Mostly Minor Network Notes
    Here are some minor tweaks and features, mostly of a network nature. Manual Uninstall of the Cisco VPN Client « Mobile Expertise -- becaus...
  • Windows Live Mail error 0x80041161
    Dad is working with his father-in-law who has an issue with his Suddenlink web-mail-based “forwarding” handling of messages. Seems that (an...
  • FireCAT 1.5 “Plus” Add-On Collection
    In yesterday’s GSD post I noted the following: Both of these tools brought be back to the excellent FireCAT 1.5 collection of Firefox...

Categories

  • Active Directory
  • anti-virus software
  • Apple
  • architecture
  • art
  • AVG
  • Blogger
  • blogging
  • books
  • boot-cd's
  • browsers
  • cars
  • cell-phones
  • cheat sheets
  • Chrome/Chromium
  • command-line interface
  • cooking
  • crafts
  • crazy
  • curmudgeon
  • DHC
  • Dr. Who
  • E-P1
  • Education
  • family
  • Firefox
  • firewalls
  • For the Gentleman
  • forensics
  • Gmail
  • Google
  • graphics
  • hacks
  • hardware
  • humor
  • hurricanes
  • imagex
  • Internet Explorer
  • iOS
  • iPhone
  • iPod
  • iTunes
  • Kindle
  • Learning
  • Link Fest
  • Linux
  • malware tools
  • Microsoft
  • movies
  • music
  • networking
  • NewsFox
  • NFAT
  • Nook
  • Opera
  • organization
  • PDF's
  • photography
  • politics
  • PowerShell
  • recipes
  • Remote Support
  • RSS
  • science
  • Scripting
  • search engines
  • security
  • Shuttle SFF
  • software
  • Texana
  • Thunderbird
  • troubleshooting
  • TrueCrypt
  • tutorials
  • utilities
  • VBscript
  • video
  • Virtual PC
  • virtualization
  • viruses
  • Vista
  • Vista mods
  • wallpapers
  • Win FE
  • Win PE
  • Win RE
  • Windows 7
  • Windows 8
  • Windows Home Server
  • Windows Live Writer
  • Windows Phone
  • writing
  • XP
  • XP mods
  • Xplico

Blog Archive

  • ▼  2013 (83)
    • ▼  November (8)
      • Ubuntu 13.10 Upgrade - Lessons Learned & VIDMA uti...
      • ForSec Linkfest - 2013 DST Fallback Edition
      • CryptoLocker Ransomware Info & Free Prevention Sol...
      • Linkfest for the SysAdmins
      • Microsoft Security Essentials/Defender & PowerShell
      • Miscellaneous TrueCrypt linkage
      • PowerShell 4.0 and a tiny “gotcha”
      • New Software Updates + VMware Tools Update fix
    • ►  October (8)
    • ►  September (14)
    • ►  August (6)
    • ►  July (10)
    • ►  June (10)
    • ►  April (11)
    • ►  March (6)
    • ►  February (7)
    • ►  January (3)
  • ►  2012 (96)
    • ►  December (8)
    • ►  November (4)
    • ►  October (9)
    • ►  September (8)
    • ►  August (12)
    • ►  July (4)
    • ►  June (3)
    • ►  May (7)
    • ►  April (13)
    • ►  March (3)
    • ►  February (5)
    • ►  January (20)
  • ►  2011 (41)
    • ►  December (8)
    • ►  November (7)
    • ►  September (4)
    • ►  August (4)
    • ►  July (2)
    • ►  June (6)
    • ►  March (5)
    • ►  February (1)
    • ►  January (4)
  • ►  2010 (69)
    • ►  December (1)
    • ►  October (3)
    • ►  September (2)
    • ►  August (13)
    • ►  July (17)
    • ►  June (3)
    • ►  May (3)
    • ►  April (3)
    • ►  March (11)
    • ►  February (1)
    • ►  January (12)
  • ►  2009 (177)
    • ►  December (20)
    • ►  November (11)
    • ►  October (7)
    • ►  September (7)
    • ►  August (21)
    • ►  July (17)
    • ►  June (7)
    • ►  May (18)
    • ►  April (9)
    • ►  March (17)
    • ►  February (23)
    • ►  January (20)
  • ►  2008 (35)
    • ►  December (23)
    • ►  November (12)
Powered by Blogger.

About Me

Unknown
View my complete profile