Forensics

IWETHEY v. 0.3.0 | TODO

1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User

Welcome to IWETHEY!

Post #68,511

by kmself

12/12/02 10:07:02 PM

Forensics

legacy MS Windows has several ways of hiding files from you, some better known than others.

\r\n\r\n

I'd very strongly suggest you boot the system with another OS, inventory the drive, and run MD5 checksums on all executables. Particularly, note the ones that change. Debian's going to bypass virtually all of NTFS's security. Being able to compare images at different times would also be useful.

\r\n\r\n

A friend recommends [link|http://www.sysinternals.com/|sysinternals.com] as a useful site for forensics tools.

\r\n

--\r\n Karsten M. Self [link|mailto:kmself@ix.netcom.com|kmself@ix.netcom.com]\r\n [link|http://kmself.home.netcom.com/|http://kmself.home.netcom.com/]\r\n What part of "gestalt" don't you understand?\r\n [link|http://twiki.iwethey.org/twiki/bin/view/Main/|TWikIWETHEY] -- an experiment in collective intelligence. Stupidity. Whatever.\r\n \r\n Keep software free. Oppose the CBDTPA. Kill S.2048 dead.\r\n[link|http://www.eff.org/alerts/20020322_eff_cbdtpa_alert.html|http://www.eff.org/alerts/20020322_eff_cbdtpa_alert.html]\r\n

Seeking serious opinions - advice - (dmarker) - (29) - Dec. 11, 2002, 03:54:24 AM EST

Perhaps some separation of duties. - (static) - Dec. 11, 2002, 04:48:56 AM EST

is the win2k installed locally produced recently? - (boxley) - (1) - Dec. 11, 2002, 07:47:15 AM EST

Re: iGood point Bill - go head to head - (dmarker) - Dec. 11, 2002, 07:54:44 AM EST

Re: Is it possible to hide programs on someone computer - (dmarker) - (13) - Dec. 12, 2002, 02:55:31 AM EST

Hidden directories? - (Ashton) - (3) - Dec. 12, 2002, 06:05:53 AM EST

Re: Hidden directories? - (dmarker) - (2) - Dec. 12, 2002, 08:02:16 AM EST

OT: About your PIC... - (folkert) - (1) - Dec. 12, 2002, 08:39:49 AM EST

Re: That Pic (grin) Miss HK 2000 - I used it - (dmarker) - Dec. 12, 2002, 09:23:02 PM EST

you have been smacked - (boxley) - (1) - Dec. 12, 2002, 08:39:26 AM EST

Re: Hmmm that does it - will reinstall from scratch - (dmarker) - Dec. 12, 2002, 09:31:07 PM EST

Forensics - (kmself) - Dec. 12, 2002, 10:07:02 PM EST

Re: Is it possible to hide programs on someone computer - (deSitter) - (4) - Dec. 15, 2002, 03:06:06 AM EST

Hidden files & really hidden files ... - (dmarker) - (3) - Dec. 22, 2002, 09:37:34 PM EST

could you forward a copy of the virus to me? - (boxley) - Dec. 22, 2002, 10:10:08 PM EST

"Opening" attachments - (rickmoen) - Dec. 23, 2002, 12:14:22 AM EST

Obvious flaw - (rickmoen) - Dec. 22, 2002, 10:18:09 PM EST

Hey Doug, - (jb4) - Dec. 23, 2002, 02:42:27 PM EST

Goal? - (kmself) - (2) - Dec. 12, 2002, 10:50:35 PM EST

Re: Goal? - At the moment is to figure out what thyz up 2 - (dmarker) - Dec. 13, 2002, 12:31:48 AM EST

Why I bought a laptop - (rickmoen) - Dec. 13, 2002, 02:13:59 PM EST

Have you tried Spybot Search & Destroy? - (Another Scott) - (6) - Dec. 12, 2002, 11:09:35 PM EST

Re: Downloaded & will try - looks good - (dmarker) - Dec. 13, 2002, 12:43:48 AM EST

Re: Interesting results - (dmarker) - (3) - Dec. 13, 2002, 12:58:43 AM EST

Most of the found items are just information. - (Another Scott) - Dec. 13, 2002, 01:14:50 AM EST

Re: Doug's strange new fascination with Re: - (tseliot) - (1) - Dec. 13, 2002, 11:21:30 AM EST

Not new by any stretch of imagination... -NT - (hnick) - Dec. 13, 2002, 12:03:07 PM EST

Re: Have you tried Spybot Search & Destroy? - (dmarker) - Dec. 14, 2002, 12:07:34 AM EST

Re: Seeking serious opinions - advice - (rickmoen) - Dec. 13, 2002, 04:37:29 AM EST

FYI: XP & Zonealarm - holey shit - (kmself) - Dec. 15, 2002, 12:03:38 AM EST

iwethey.org

This must be true. They made a bumper sticker.
42 ms