Meta tags:
description=A blog by Jonathon Poling - Musings and posts on all things DFIR (Digital Forensics and Incident Response), both technical and non-technical.;
keywords=jonathon poling,dfir,incident response,forensics,aws,cloud,linux,windows,mac,osx,event logs,rdp,remote desktop,command line,incident response,linux,mac,osx,md5,sha1,fls,macb,timestamps,hibernation file,decompression,hibernation recon,strings,page_brute,bulk_extractor,volatility,dfir,lvm,linux,vmdk,dfir,incident response,scoping,assessment;

Headings (most frequently used words):

log, windows, and, microsoft, operational, the, from, security, terminalservices, localsessionmanager, network, connection, authentication, logon, session, disconnect, reconnect, logoff, system, of, conclusion, ponder, bits, rdp, related, event, logs, identification, tracking, investigation, wrap, up, generating, file, listings, command, line, with, full, macb, timestamps, hashes, decompressing, extracting, artifacts, server, 2012, hibernation, files, quick, er, mounting, dismounting, lvm, on, forensic, images, importance, incident, scoping, assessment, background, testing, results, subscribe, rss, tweet, tweets, jpoforenso, archives, topics, musings, confusings, all, things, dfir, terminal, services, remoteconnectionmanager, linux, mac,

Text of the page (most frequently used words):
the (517), and (263), that (137), for (129), 2017 (105), windows (95), this (94), not (84), with (82), utc (80), 0000 (80), file (79), you (77), volatility (72), from (70), #hibernation (67), can (66), rdp (64), 708 (64), system (62), image (54), exe (54), event (52), #session (49), output (47), are (46), will (43), device (43), files (42), user (42), cmd (42), command (39), here (37), microsoft (36), type (34), time (33), have (33), which (32), when (32), find (32), dev (31), all (30), use (30), network (30), simply (29), like (29), root (29), also (29), our (28), only (28), profile (28), against (28), stat (28), however (27), has (27), was (27), what (26), svchost (26), log (26), now (25), there (25), address (25), using (25), name (25), information (24), they (24), but (24), just (24), each (24), note (24), see (24), kdbg (24), kpcr (24), cpu (24), logs (23), these (23), well (23), python (23), hibernated (23), lvm (22), how (22), out (22), activememory (22), bin (22), win10x64_14393 (22), system32 (22), source (22), remote (21), would (21), any (21), one (21), some (21), been (21), need (21), vol (21), run (21), timestamps (20), harddiskvolume6 (20), md5 (20), logon (20), linux (19), order (19), into (19), below (19), following (19), read (19), data (19), local (19), more (18), nbd (18), does (18), decompressed (18), shutdown (18), tools (17), desktop (17), full (17), may (17), via (17), crtime (17), sha1 (17), description (17), recon (16), artifacts (16), useful (16), filesystem (16), memory (16), print (16), inode (16), both (15), analysis (15), available (15), where (15), them (15), testing (15), strings (15), awk (15), getline (15), timestamp (15), connection (15), notes (15), provider (15), response (14), first (14), point (14), commands (14), again (14), about (14), mount (14), successfully (14), decompress (14), 0xf800a81d0e00 (14), foundation (14), framework (14), close (14), logoff (14), terminalservices (14), dfir (13), line (13), images (13), set (13), their (13), get (13), successful (13), very (13), number (13), through (13), tool (13), live (13), printf (13), last (13), disconnect (13), disconnected (13), localsessionmanager (13), vmdk (12), though (12), identify (12), few (12), way (12), various (12), many (12), able (12), access (12), then (12), extract (12), decompression (12), machine (12), services (12), security (12), often (11), date (11), needed (11), post (11), done (11), why (11), great (11), start (11), different (11), typically (11), additional (11), while (11), version (11), bit (11), precision (11), debugfs (11), target (11), authentication (11), your (10), related (10), such (10), client (10), sort (10), back (10), right (10), systems (10), before (10), mnt (10), mounted (10), sidebar (10), thus (10), raw (10), qemu (10), together (10), could (10), format (10), found (10), work (10), registry (10), missing (10), native (10), dll (10), winevt (10), evtx (10), dtb (10), changed (10), size (10), most (10), fls (10), 2016 (9), mounting (9), server (9), hashes (9), don (9), take (9), questions (9), something (9), let (9), down (9), actually (9), external (9), other (9), should (9), same (9), path (9), true (9), jpw10_hiberfil (9), directory (9), hibr2bin (9), existing (9), option (9), cut (9), bsd (9), nanosecond (9), paired (9), indicate (9), mac (8), tracking (8), doing (8), even (8), comprehensive (8), appropriate (8), check (8), free (8), step (8), devices (8), provide (8), loop (8), volume (8), properly (8), block (8), expect (8), mapper (8), long (8), convert (8), hives (8), offset (8), results (8), much (8), etc (8), gnu (8), second (8), csv (8), birth (8), default (8), indicates (8), systemroot (8), location (8), activity (8), scoping (7), incident (7), assessment (7), 2018 (7), 2012 (7), instead (7), initial (7), say (7), did (7), look (7), physical (7), understand (7), previous (7), issue (7), modified (7), must (7), within (7), perform (7), process (7), multiple (7), had (7), given (7), associated (7), those (7), were (7), blog (7), going (7), readable (7), test (7), might (7), its (7), events (7), 0800 (7), bulk_extractor (7), always (7), space (7), boot (7), reason (7), xargs (7), username (7), excel (7), sed (7), off (7), occur (7), window (7), occurs (7), know (6), community (6), february (6), march (6), forensic (6), investigation (6), search (6), performing (6), above (6), simple (6), looking (6), certain (6), enabled (6), still (6), running (6), during (6), means (6), because (6), wanted (6), times (6), loopback (6), mknod (6), major (6), specified (6), enough (6), already (6), another (6), contains (6), things (6), plugins (6), rwd (6), 4operational (6), 628 (6), 0x1ab000 (6), pslist (6), page_brute (6), doesn (6), upon (6), disk (6), without (6), human (6), parameter (6), liner (6), listing (6), over (6), formatting (6), course (6), dec (6), accessed (6), versus (6), vmwaretools (6), 6627299 (6), tar (6), epoch (6), fri (6), solution (6), formally (6), auditing (6), logged (6), section (6), logonid (6), forensics (5), macb (5), purposeful (5), due (5), end (5), further (5), level (5), specifically (5), best (5), interested (5), contain (5), keep (5), mind (5), intended (5), rather (5), provided (5), unique (5), every (5), fact (5), sometimes (5), jonathon (5), poling (5), hopefully (5), remove (5), partition (5), group (5), logical (5), list (5), nothing (5), exist (5), ensure (5), imol (5), easy (5), copy (5), example (5), essentially (5), statement (5), along (5), single (5), plugin (5), new (5), booted (5), obviously (5), extracted (5), yields (5), resources (5), kernel (5), move (5), attempt (5), sys (5), discovered (5), structures (5), base (5), input (5), 4096 (5), generated (5), click (5), mode (5), slack (5), https (5), utilities (5), thanks (5), maxdepth (5), translate (5), research (5), whatever (5), digits (5), sha1sum (5), hex (5), article (5), ext4 (5), nanoseconds (5), 0x5a18c9a4 (5), nov (5), remount (5), initiated (5), terminal (5), reconnection (5), covers (5), identifying (5), reconnected (5), encountered (5), nla (5), next (4), detail (4), goals (4), entities (4), ask (4), purpose (4), show (4), logging (4), specific (4), put (4), either (4), non (4), success (4), dealing (4), types (4), attempted (4), than (4), problem (4), help (4), critical (4), across (4), force (4), structure (4), aware (4), good (4), reference (4), options (4), create (4), descriptions (4), his (4), method (4), formats (4), less (4), enter (4), lot (4), two (4), seem (4), looks (4), amount (4), otherwise (4), function (4), ran (4), deviceapi (4), cmnotify (4), iaahcic (4), 14393 (4), building (4), 528 (4), 1096 (4), vmware (4), hgfs (4), hibernation_testing (4), based (4), pae (4), imagecopy (4), short (4), got (4), open (4), case (4), compressed (4), thing (4), extraction (4), standard (4), pages (4), really (4), aforementioned (4), fully (4), hibernate (4), rate (4), currently (4), vista (4), support (4), account (4), mean (4), hard (4), include (4), xdev (4), leading (4), shell (4), filesystems (4), print0 (4), echo (4), permissions (4), avoid (4), datetime (4), care (4), resolution (4), reading (4), entries (4), fashion (4), decimal (4), crt (4), sense (4), produce (4), portion (4), after (4), attempting (4), field (4), hit (4), helpful (4), code (4), logontype (4), menu (4), 4624 (4), succeeded (4), sessionid (4), associating (4), operational (4), logons (4), password (4), failure (4), uncategorized (3), topics (3), july (3), decompressing (3), extracting (3), identification (3), page (3), pay (3), later (3), investigations (3), situation (3), lack (3), variety (3), completely (3), priority (3), past (3), getting (3), engagement (3), load (3), virtual (3), actions (3), current (3), think (3), background (3), addition (3), feel (3), efficiency (3), clients (3), important (3), consulting (3), view (3), own (3), themselves (3), begin (3), refer (3), suggested (3), said (3), else (3), dismount (3), man (3), job (3), volumes (3), groups (3), part (3), minus (3), walk (3), cheat (3), immediately (3), pretty (3), awesome (3), starting (3), utility (3), imaging (3), converting (3), between (3), parsed (3), natively (3), converted (3), ftk (3), imager (3), used (3), saving (3), recently (3), came (3), manager (3), insight (3), arsenal (3), sans (3), since (3), restored (3), previously (3), appears (3), identified (3), verified (3), works (3), resident (3), program (3), cat (3), info (3), debug (3), items (3), shellbags (3), requested (3), userassist (3), parse (3), instantiating (3), owner (3), tag (3), suggestion (3), kdbgheader (3), psactiveprocesshead (3), psloadedmodulelist (3), kernelbase (3), 0xfffff800a8000000 (3), win2016x64_14393 (3), fileaddressspace (3), service (3), pack (3), resulting (3), spreadsheet (3), yield (3), namely (3), addresses (3), yes (3), wait (3), never (3), build (3), processes (3), greatest (3), directly (3), allowed (3), parsing (3), built (3), bytes (3), comparison (3), collection (3), richard (3), methods (3), environment (3), hiberfil (3), enable (3), recovery (3), supports (3), modern (3), brute (3), latest (3), com (3), issues (3), mathieu (3), changes (3), describes (3), produced (3), yet (3), display (3), changing (3), update (3), fish (3), aka (3), want (3), likely (3), specify (3), add (3), dollar (3), sign (3), shasum (3), filename (3), decreasing (3), users (3), come (3), filenames (3), provides (3), alas (3), future (3), pst (3), vimrc (3), outputs (3), make (3), denoting (3), present (3), least (3), avoiding (3), purposes (3), prompt (3), md5sum (3), makes (3), dead (3), comma (3), execute (3), 799279489 (3), mtime (3), hal (3), seconds (3), colon (3), 5740e928 (3), creation (3), links (3), atime (3), decided (3), shortly (3), wrong (3), precise (3), exec (3), reasons (3), noatime (3), sudo (3), bind (3), possibly (3), result (3), flow (3), formal (3), remoteinteractive (3), disconnects (3), reconnects (3), codes (3), reconnect (3), failed (3), 4625 (3), attacker (3), credentials (3), ipaddress (3), 1149 (3), remoteconnectionmanager (3), understanding (3), powered (2), yara (2), osx (2), importance (2), quick (2), dismounting (2), generating (2), listings (2), industry (2), spending (2), diligence (2), front (2), paying (2), consequences (2), uncommon (2), questioning (2), depending (2), suffice (2), required (2), areas (2), ranging (2), sub (2), practice (2), stated (2), determine (2), asking (2), exactly (2), question (2), span (2), concern (2), content (2), web (2), dns (2), aren (2), collected (2), assist (2), particularly (2), under (2), blocks (2), place (2), performed (2), anomalies (2), legitimate (2), notice (2), organization (2), serve (2), change (2), effort (2), pertinent (2), aspects (2), sizes (2), whether (2), people (2), professional (2), comprehensively (2), hand (2), requires (2), high (2), action (2), especially (2), nonetheless (2), effective (2), call (2), errors (2), split (2), considered (2), reboot (2), dmsetup (2), optional (2), losetup (2), kpartx (2), mappings (2), vgchange (2), activate (2), once (2), become (2), uses (2), operate (2), minor (2), requiring (2), proc (2), volumegroup (2), volumename (2), described (2), gives (2), who (2), paste (2), stick (2), lucky (2), skip (2), mapping (2), ensuring (2), extension (2), called (2), stands (2), performs (2), real (2), translation (2), waited (2), conversion (2), entire (2), spend (2), begins (2), install (2), hours (2), posts (2), anyone (2), love (2), locate (2), reconstructed (2), zeroed (2), substantial (2), obfuscated (2), encoded (2), ultimately (2), capability (2), ability (2), conclusion (2), unicode (2), compared (2), relatively (2), providing (2), mftparser (2), mbrparser (2), ptr (2), hnd (2), 0x0000f000000f0820 (2), harddiskvolume2 (2), extend (2), rmmetadata (2), repair (2), corrupt (2), 0x0000f000000fe2d0 (2), coreaudiopolicymanagerext (2), 0x0000f00000100420 (2), xaml (2), 0x0000f00000100720 (2), office (2), clipart (2), pub60cor (2), na02386_ (2), wmf (2), 0x0000f00000102ef0 (2), dsreg (2), 0x0000f00000113080 (2), 32753 (2), 0x0000f000001132a0 (2), vcruntime140 (2), 0x0000f00000114cc0 (2), power (2), 0x0000f0000011c370 (2), 32708 (2), appxdeploymentserver (2), 0x0000f00000127ef0 (2), driverstore (2), filerepository (2), inf_amd64_6c0fb3e072c6ec98 (2), 0x0000f0000012e740 (2), 32768 (2), 0x0000f00000135a00 (2), inf (2), msgpiowin32 (2), pnf (2), 0x0000f00000140cd0 (2), winsxs (2), manifests (2), x86_microsoft (2), utomation (2), proxystub_6595b64144ccf1df_1 (2), 0_none_1e9c04c01886b354 (2), manifest (2), filescan (2), seems (2), complete (2), shimcache (2), scanning (2), registries (2), gathering (2), shellbag (2), tree (2), key (2), hive (2), searched (2), 0xffff87063f057000 (2), 0x00000000059f3000 (2), hardware (2), hivelist (2), pid (2), ppid (2), thds (2), hnds (2), sess (2), wow64 (2), exit (2), 0xffff9e04362eb6c0 (2), 0xffff9e043acbf800 (2), smss (2), 372 (2), 0xffff9e043b4e9080 (2), csrss (2), 540 (2), 0xffff9e043c439800 (2), wininit (2), 0xffff9e043c4d8800 (2), 0xffff9e043c540400 (2), lsass (2), 752 (2), 0xffff9e043c4d4800 (2), 872 (2), 0xffff9e043c4ce800 (2), 936 (2), 0xffff9e043c472800 (2), 348 (2), 0xffff9e043c626080 (2), 388 (2), 0xffff9e043c683800 (2), 1032 (2), 0xffff9e043c681800 (2), 0xffff9e043c67d800 (2), 1212 (2), 0xffff9e043c67b800 (2), 1236 (2), 0xffff9e043c66f800 (2), nvvsvc (2), 1580 (2), 0xffff9e043c66b800 (2), nvscpapisvr (2), 1588 (2), 0xffff9e043637d080 (2), 2000 (2), 0xffff9e043ca1f800 (2), 1292 (2), 0xffff9e043ca8b800 (2), spoolsv (2), 2056 (2), 0xffff9e043c042700 (2), sched (2), 2168 (2), 0xffff9e043c036800 (2), avguard (2), 2428 (2), 120 (2), 0xffff9e043c032800 (2), armsvc (2), 2440 (2), 0xffff9e043c034800 (2), avira (2), serviceh (2), 2448 (2), 0xffff9e043c030800 (2), officeclicktor (2), 2476 (2), 0xffff9e043c02e800 (2), iprosetmonitor (2), 2508 (2), 0xffff9e043c02c800 (2), logiregistryse (2), 2516 (2), 0xffff9e043c02a800 (2), 2524 (2), 0xffff9e043c028800 (2), nvnetworkservi (2), 2544 (2), 0xffff9e043c026800 (2), nvstreamservic (2), 2680 (2), 0xffff9e043c024800 (2), dashost (2), 2740 (2), 0xffff9e043be64740 (2), 2760 (2), 0xffff9e043be66800 (2), 2768 (2), 0xffff9e043be75800 (2), vmnetdhcp (2), 2776 (2), 0xffff9e043be70800 (2), usbarbi (2), 2792 (2), 0xffff9e043be72800 (2), vmnat (2), 2808 (2), 0xffff9e043be74800 (2), authd (2), 2824 (2), 0xffff9e043be91800 (2), msmpeng (2), 2836 (2), 0xffff9e043be97800 (2), ss_conn_servic (2), 2844 (2), 0xffff9e043beed040 (2), memcompression (2), 2952 (2), winxpsp2x86 (2), 32bit (2), 0x3e0a9730 (2), 0xa82ff3d0 (2), 0xa8305060 (2), kdbgscan (2), determining (2), layer1 (2), win10amd64pagedmemory (2), layer2 (2), 0x1ab000l (2), 0xf800a82f0500l (2), processors (2), 0xfffff800a8342000l (2), 0xffffda019e020000l (2), 0xffffda019e09b000l (2), 0xffffda019e116000l (2), 0xffffda019e193000l (2), 0xffffda019e1d2000l (2), 0xffffda019e291000l (2), 0xffffda019e310000l (2), kuser_shared_data (2), 0xfffff78000000000l (2), imageinfo (2), showing (2), sys_conv (2), ascii (2), substantially (2), relies (2), excellent (2), try (2), string (2), optionalheader (2), win10x64 (2), header (2), sys_2_conv (2), sys_2 (2), contents (2), light (2), mention (2), measure (2), extracts (2), manual (2), signatures (2), email (2), figured (2), too (2), explain (2), methodology (2), collect (2), sylve (2), marziale (2), iii (2), paper (2), shut (2), button (2), pro (2), website (2), ntfs (2), metadata (2), sake (2), brevity (2), perhaps (2), features (2), big (2), allowing (2), active (2), legacy (2), paid (2), release (2), reconstruction (2), levels (2), developed (2), leave (2), longer (2), please (2), september (2), suiche (2), compression (2), expected (2), assume (2), similar (2), being (2), adding (2), writing (2), progress (2), store (2), surely (2), containing (2), nearly (2), prior (2), everyone (2), painstakingly (2), script (2), enumerate (2), evidence (2), substitution (2), interpret (2), characters (2), shown (2), meaning (2), osx_listing (2), hardlinks (2), groupname (2), lastmodified (2), lastaccess (2), appending (2), delimiter (2), ended (2), hash (2), signs (2), delimiters (2), ymmv (2), values (2), piping (2), utilize (2), straight (2), forward (2), hfs (2), implemented (2), separate (2), implement (2), sep (2), working (2), prepending (2), idea (2), maybe (2), attempts (2), happening (2), original (2), everything (2), beyond (2), millisecond (2), cells (2), select (2), tab (2), 000 (2), ephemeral (2), operating (2), easier (2), null (2), grep (2), 09d (2), fs_listing (2), 000000000 (2), happen (2), made (2), dir (2), strtonum (2), strftime (2), until (2), shift (2), documenting (2), converts (2), sets (2), object (2), entry (2), little (2), 405357 (2), regular (2), 0444 (2), 56375699 (2), acl (2), 110112 (2), ctime (2), be902604 (2), resides (2), error (2), seen (2), ext3 (2), making (2), recorded (2), seeing (2), md5deep (2), lacking (2), included (2), ways (2), www (2), endpoint (2), org (2), challenge (2), although (2), drive (2), letter (2), sda (2), actively (2), necessarily (2), write (2), planning (2), common (2), empirically (2), encounter (2), fit (2), gui (2), closed (2), initiates (2), 4634 (2), station (2), sessionname (2), clientaddress (2), ing (2), kicked (2), disconnection (2), initialization (2), answer (2), delineating (2), assigned (2), confusing (2), failures (2), status (2), targetusername (2), targetdomainname (2), unlocked (2), clear (2), someone (2), launched (2), chronological (2), documentation (2), commonly (2), parts (2), repeating (2), sheet (2), presentations (2), podcasts (2), home (2), toggle (2), ponder (2), bits (2), theme, anders, norén, wordpress, rekall, osxpmem, introduction, inspirations, cloud, azure, aws, december, january, archives, tweets, jpoforenso, subscribe, rss, tweet, exception, highly, encourage, throughout, merit, excruciating, complexity, consider, minimum, requirements, misunderstandings, lead, undesirable, optimal, outcome, disastrous, company, verbatim, slap, sow, guide, possible, achieve, tandem, box, fulfilling, requirement, gauging, investment, cause, defenses, prove, disprove, business, frame, interest, vpn, syslog, interface, balancer, query, host, appliance, hosted, disparate, locations, machines, involved, workstations, servers, notified, regulations, tons, firewall, responsive, timeframe, malicious, causes, inclusive, solid, baseline, facilitating, augmented, perspective, entity, replace, pronouns, instances, application, lower, acquire, addressing, affect, efficacy, private, sector, experience, wide, array, verticals, industries, organizational, unjustly, distill, topic, bullets, approaching, nor, applicable, tune, forms, rely, heavily, professionals, respond, guidance, mitigate, threats, protect, harm, situations, effectively, addressed, ourselves, onset, alert, suspected, compromise, formulated, concerted, difficult, diving, higher, management, wanting, answers, yesterday, ten, fold, engagements, sure, arduous, monotonous, involve, absolutely, overlooked, admittedly, unsexy, integral, piece, comedy, conference, convoluted, deprecated, detach, fails, activated, umount, unnecessarily, illogically, troublesome, steps, creating, tells, dynamically, assign, ibm, explaining, probably, relate, structured, major_, minor_, numbers, congratulations, recombined, vgscan, lvscan, pvscan, listed, scan, lvdisplay, pvdisplay, tables, byte_offset, modprobe, dm_mod, module, loaded, mostly, mirrors, subtle, differences, won, lay, sheets, instructions, translated, queried, huh, nbd2, image_2, nbd1, image_1, nbd0, image_0, comprise, created, issuing, connect, supported, cloop, cow, qcow, qcow2, vdi, vhdx, vpc, betwixt, word, serious, tone, slightest, hiccup, render, useless, spent, wasted, faster, toward, capacities, fly, prepare, prepared, presenting, merged, stitched, interpreted, mountable, stitching, respective, continued, branch, eliminates, potentially, lvm2, defining, layout, int, leisure, didn, reconstruct, restoring, easily, satisfied, chunks, noted, witness, anomaly, arbitrary, alphabet, namespace, hidden, discovery, form, warning, 206, offsets, wasn, uni, board, pieces, storing, itself, finding, mainly, guess, tact, 209, 104, retrieved, unnamed, 64bit, 0xf800a82f0500, 0x469cf0500, kdcopydatablock, 0xd6dc0c37f24a0453, 0x940ac90a25873204, cmntcsdversion, ntbuildlab, 693, amd64fre, rs1_release, 0xfffff800a82ff3d0, 0xfffff800a8305060, 189, modules, matches, 0xfffff800a8342000, 0xffffda019e020000, 0xffffda019e09b000, 0xffffda019e116000, 0xffffda019e193000, 0xffffda019e1d2000, 0xffffda019e291000, 0xffffda019e310000, happens, win10x64_10586, usable, suitable, tried, machoaddressspace, limeaddressspace, lime, windowshiberfilespace32, windowscrashdumpspace64bitmap, windowscrashdumpspace64, ia32pagedmemory, incompatible, selected, osxpmemelf, elf, signature, invalid, armaddressspace, valid, verify, hibernation_testing_results, sys_3, legend, produces, copied, pasted, beautiful, extremely, threaded, hog, caution, exercised, letting, throttle, dedicated, insanely, fast, intelligent, artifact, quantity, terms, zip, rar, operates, processed, scanners, designed, pagefile, byte, lose, added, default_signatures, yar, ruleset, url, occurrences, scientist, layman, roi, representative, quantitative, outlined, mentioned, subject, supposedly, decompresses, powercfg, three, procedures, downloaded, functionality, imagine, focus, hands, bonus, rarity, personal, commercial, noice, kudos, guys, priced, 399, digital, expert, arm, license, team, offers, partially, overwritten, segregation, particular, hibernations, proper, handling, friendly, decoding, parallel, processing, massive, folks, brought, releases, mounter, hilarious, btw, paddle, schitt, creek, 7hibernation, dump, analyze, github, volatilityfoundation, matthieu, released, sourced, dumpit, states, demonstrated, relying, figure, recap, nitty, gritty, details, joe, vico, golden, titled, evident, saw, subset, surmised, restoration, loader, ignoring, entirely, apply, began, algorithm, defined, including, pat, contained, beginning, huffman, encoding, variant, turn, rendered, severely, hindered, rewrite, neither, believe, eagerly, awaits, updates, proven, incredibly, respects, xpress, anymore, trusted, accept, loss, dig, deeper, wealth, years, pillaged, specialized, noticed, usual, ranged, nonexistent, hanging, whole, takes, worth, teach, walked, enumeration, jim, clausing, limitations, cannot, pull, btime, attributes, macrobber, share, sooooo, wow, captured, sanity, tested, mine, value, efficient, imho, harder, smarter, latter, realized, choked, escape, wouldn, mis, indication, variable, disclosure, choke, special, around, augment, equivalent, disks, final, sorted, calculating, argument, having, pound, atom, app, tick, quote, encapsulation, names, break, correlated, taken, acquisition, customize, creative, lacks, hearty, fortunate, apfs, discussion, pdt, discussed, earlier, reflect, okay, acronym, upside, 16777220, 1451064, staff, basis, core, differ, life, pain, weird, displaying, gets, confused, tries, text, negative, fix, formula, review, displays, milliseconds, highlight, trailing, voila, valuable, die, fans, yyyy, custom, protips, directories, paths, collecting, traversal, shares, media, privileges, var, guarantees, pass, kept, appeared, random, 1969, crtimes, heads, goes, awry, replacement, adjust, bout, apples, painstaking, spades, steroids, dreams, deal, unsavory, spaces, parentheses, screw, character, chose, retrieve, regex, assertion, bash, functions, formatted, lookbehind, give, ugliest, epic, alllll, reach, goal, outputting, largely, third, party, programmatically, dan, banging, head, discovering, bitwise, huge, monumental, efforts, nuances, hal_pomeranz, 4n6k, respectively, divides, four, necessary, per, pomeranz, column, delineated, turns, alter, construct, noticing, zeroes, hmmm, trace, match, analysts, today, flags, 0x80000, generation, 763788199, 0x00000000, 00000001, project, blockcount, fragment, 0x5a5941b3, 7cf76e1c, jan

Text of the page (random words):
em directory will be re mounted to a new mount point it will still be mounted read write by default so before you go accessing anything on it you need to re mount it yes again read only like so sudo mount o remount ro bind noatime mnt remount note that you don t necessarily need the noatime attribute given that you re already mounting the system read only and in theory should not be modifying any of the file timestamps upon access however i m a belt and suspenders kind of guy so i d rather have redundancy even if unneeded for the peace of mind disclaimer i did not search the internet for a solution to this article s challenge as i wanted to come up with one myself thus a solution may already exist that is similar or not however the point of the below article was not to just find a solution and move on rather i wanted to walk readers through a problem statement step by step piecing together a solution thoroughly documenting and teaching a man to fish versus just giving out a fish that said i am in no way guaranteeing the below commands to work perfectly in ensuring it finds and properly processes every single file on the filesystem in fact when running this live we are actively avoiding certain areas of the filesystem that are actively changing ephemeral to minimize the error outputs the only thing i can guarantee in true nix ad hoc one liner development is dis function in ways beyond the imagination tis a fact we just live with this post simply describes options you can add to your toolkit that can always very much benefit from testing troubleshooting and improving in addition while i attempted to identify and explain various aspects of each of my commands i recognize that there are still improvements that can be done to this command i attempted to find the balance of thorough explanation and efficiency while not bleeding over into the esoteric tl dr yymmv the first y stands for yuuuuuuge enough with the caveats and disclaimers let s get down to it linux recently a teammate posed a request to be able to generate a file listing of a directory in linux showing the size and hash of each file in the output format of ls lhs list files in long format with human readable sizes in decreasing size output as i hit reply to the email my initial thoughts were why don t you use fls as that is essentially the de facto standard for producing a file system listing from an image however i got to thinking fls doesn t really provide a comprehensive solution here for a few reasons we need a command to run against a live system and fls only runs against a dead system image fls requires a second step to convert its output to bodyfile format for human readable timestamps fls doesn t perform any file hashing actually this is not true as one of my colleagues ever so graciously reminded me although it is not well documented fls can run against live systems you can run it against a live windows system by using named pipes a la fls options x where x is a logical drive letter like c d etc and a september 2011 sans blog post here describes it in operation for windows to run it against a live linux or mac os x system you may do so as such fls options dev sd x y where x is the physical drive letter like dev sd a dev sd b etc and y is the partition number like dev sda 1 dev sda 2 etc at any rate the last two points remain so it s good thing i waited to hit send before looking like a dummy instead i took the challenge in attempting to come up with a command line one liner to provide what was requested initially i came up with the following find path to dir maxdepth 1 type f print0 xargs 0 r ls lh awk cmd md5deep q 9 cmd getline md5 close cmd cmd sha1sum 9 cmd getline sha1 close cmd print 1 2 3 4 5 6 7 8 9 md5 sha1 awk nf 1 sed s g sort t hr k5 you may need to right click and open view image in new tab to see these inserted screenshots in full resolution sorry about that however as we can see here the timestamps produced from a simple ls lh were rather lacking in both what was provided solely last modification time by default as well as precision only precise to the second by default and a lot can happen on a system in a singular second that we d need to distinguish during an investigation sidebar 1 you might be wondering why i am piping find s output to xargs to execute the ls lh against the results versus simply using find s built in exec parameter that ostensibly does the same thing in short this is for performance reasons which you can read about at the below links https www everythingcli org find exec vs find xargs https www endpoint com blog 2010 07 28 efficiency of find exec vs find xargs sidebar 1 sidebar 2 also note that all timestamps will be in the system s local time so it would behoove you to collect that information from the system as well for future reference during analysis this can be done a few different ways as shown below sidebar 2 in light of the aforementioned issues lacking additional timestamps and precision i worked through a few different solutions and came up with the following which included not only timestamps with much greater precision now with full nanosecond precision but also included all of the gnu find command s printable timestamps i e last modified last accessed and inode changed find root maxdepth 1 type f printf i m n g u s ty tm td tt ay am ad at cy cm cd ct p n awk f cmd md5deep q 9 cmd getline md5 close cmd cmd sha1sum 9 cmd getline sha1 close cmd print 1 2 3 4 5 6 7 8 9 md5 sha1 awk nf 1 sed s g sort t hr k5 note that printf s time field format is precise to 10 digits while nanoseconds are by definition only precise to 9 digits thus it is appending a 0 in the 10 th digit spot why i frankly don t know i mean uhh the reason of which will be left as an exercise to the reader sidebar 3 i later discovered that you can show timestamps with full nanosecond resolution in ls via the full time parameter as i will show below ls l full time total 55088 drwxr xr x 2 root root 4096 2017 11 22 14 22 30 165725454 0800 desktop sidebar 3 at any rate we re making progress but we re still missing something what about inode file creation is that not recorded in linux in short ext3 filesystems only record last modified mtime last accessed atime and inode changed ctime while ext4 filesystem on which a large majority of linux distress operate fortunately include the additional inode creation time crtime lucky for us i am doing this on an ext4 filesystem so we should be seeing those times if they re implemented and recorded right you d think so but you d be wrong unfortunately linux decided not to implement an easy way aka a natively integrated api to view include these crtime timestamps in various tools output as seen here in the find command and shortly in the stat command alas fret not as there is a way to extract this timestamp using the debugfs utility intended as a ext2 ext3 ext4 file system debugger it provides a r option to execute a given command for debugging purposes we will ab use this option to extract more information i e the crtime timestamp from the stat command than is originally provided by running the command on its own first we will run stat against a file stat root vmwaretools 10 1 15 6627299 tar gz file root vmwaretools 10 1 15 6627299 tar gz size 56375699 blocks 110112 io block 4096 regular file device fe01h 65025d inode 405357 links 1 access 0444 r r r uid 0 root gid 0 root access 2018 01 12 15 16 03 524147591 0800 modify 2017 11 24 17 38 44 799279489 0800 change 2017 11 24 17 38 44 799279489 0800 birth now we will use the debugfs command to get the inode file birth crtime timestamp keep in mind you will need to provide the volume partition on which the referenced file resides as a parameter to the command otherwise the command will not work namely yielding a no such file or directory while opening filesystem error for my example below my system is using lvm volumes and the file we re querying resides on my root k2 vg root lvm volume partition debugfs r stat root vmwaretools 10 1 15 6627299 tar gz dev mapper k2 vg root inode 405357 type regular mode 0444 flags 0x80000 generation 763788199 version 0x00000000 00000001 user 0 group 0 project 0 size 56375699 file acl 0 directory acl 0 links 1 blockcount 110112 fragment address 0 number 0 size 0 ctime 0x5a18c9a4 be902604 fri nov 24 17 38 44 2017 atime 0x5a5941b3 7cf76e1c fri jan 12 15 16 03 2018 mtime 0x5a18c9a4 be902604 fri nov 24 17 38 44 2017 crtime 0x5a18c9a4 5740e928 fri nov 24 17 38 44 2017 size of extra inode fields 32 inode checksum 0x53c3b2b6 extents 0 10239 1859584 1869823 10240 12287 1873920 1875967 12288 13763 1902149 1903624 there s actually a lot of great output here that can be very useful to us as forensic analysts but we really only need the crtime for our purposes today so we can do a little command line fu to just extract the human readable portion of the crtime timestamp we care about debugfs r stat root vmwaretools 10 1 15 6627299 tar gz dev mapper k2 vg root sed n s crtime 1 p fri nov 24 17 38 44 2017 to go a bit further and match stat s default timestamp formatting we can do a bit more command line fu to yield the following date y m d h m s n z d debugfs r stat root vmwaretools 10 1 15 6627299 tar gz dev mapper k2 vg root sed n s crtime 1 p 2017 11 24 17 38 44 000000000 0800 great now we have a crtime inode file creation timestamp we know and love but wait anyone else noticing something here the nanoseconds are all zeroes hmmm well if we trace our process back a bit we can see that this is because we are attempting to produce a nanosecond precision datetime object from a source that obviously doesn t include it obviously we can t extract nanosecond precision from an input that doesn t contain it so where do we go from here well if we look back at the crtime output crtime 0x5a18c9a4 5740e928 fri nov 24 17 38 44 2017 we can see that the second column there contains two sets of hex digits 0x5a18c9a4 5740e928 delineated by a colon could it be that this is simply a hex version of the decimal and nanosecond epoch timestamps oh it could and it is it turns out the first entry previous to the colon is the epoch seconds and the second entry after the colon is the nanoseconds so we ll need to go back to our command and alter it to extract convert and construct the nanosecond epoch timestamp we re looking to produce the below command extracts both the first and second set of hex digits epoch seconds and epoch nanoseconds respectively converts both of the hex sets to decimal converts the epoch seconds to a human readable datetime object using awk s strftime formatting and then divides the nanoseconds portion by four essentially performing a two bit shift as is necessary per hal pomeranz s article on ext4 timestamps here big thanks to dan aka 4n6k for his assist here in leading me to hal s article as i was banging my head on this last portion for a bit until discovering this bitwise shift needed to be done also of course huge thanks to hal hal_pomeranz as well for this monumental efforts in painstakingly documenting ext4 timestamps and these nuances debugfs r stat root vmwaretools 10 1 15 6627299 tar gz dev mapper k2 vg root sed n s mtime 0x 0 9a f 0 9a f 1 0x 2 p awk f n strtonum 2 4 print strftime y m d t strtonum 1 n 2017 11 24 17 38 44 799279489 awesome we can now successfully extract the crtime file timestamps programmatically now let s put it alllll together and build our one liner that s going to help us reach our original goal here of outputting a file listing with all the available timestamps in macb order as well as file hashes md5 and sha1 we will be using the largely native md5sum and sha1sum utilities to produce our hashes so as to avoid the need to install any additional third party tools and here it is i give the ugliest most epic command to date to output everything we ve been looking for find path to dir maxdepth 1 type f printf i m n g u s ty tm td tt ay am ad at cy cm cd ct p n awk f cmd debugfs r stat 1 dev mapper k2 vg root 2 dev null grep po crtime 0x 0 9a f 0 9a f tr read e n echo date y m d h m s d printf d 0x e printf 09d printf d 0x n 4 cmd getline crt close cmd cmd md5sum 10 cut d f1 cmd getline md5 close cmd cmd sha1sum 10 cut d f1 cmd getline sha1 close cmd print 1 2 3 4 5 6 7 8 9 crt 10 md5 sha1 sed s g sort t hr k6 note that we had to do a few things to deal with various unsavory characters that may occur within filenames e g spaces parentheses comma s etc first we can t use comma s as our print output delimiter as filenames with comma s would then screw up our awk parsing so we needed to use a non standard character i e one we would never expect to see in our output in this case i chose but you could use whatever you d like to get our debugfs stat output as well as md5 and sha1 hashes we utilize awk s ability to execute commands and retrieve the output with its getline function you may notice that the debugfs stat command one liner strings together a regex with a lookbehind assertion along with some bash read print date functions in order to translate the hex decimal formatted human readable datetime for us so how bout them apples we ve done it all of that painstaking work has paid off in spades we ve put together a command that is essentially fls on steroids with hashes that we can run against both a live and dead system this is what dreams are made of if you d like to use this as an fls replacement against a dead system image simply mount the image s file system read only of course adjust the command to point to the root of the file system remove the last sort command as we can do that later during analysis as needed and simply output to csv like so again i provide no guarantees here only a best effort here and initial pass on doing this for example in one of my test vm s i kept getting what appeared to be random sh 1 printf 0x not completely converted errors that output a default crtime date of 1969 12 31 16 00 00 000000000 which makes no sense as i ve verified that the crtimes on these files are present and properly output via stat debugfs and a manual conversion of the values yields success yet it did not happen in other vm s so just a heads up in case something goes awry on your end echo inode permissions hardlinks groupname username size bytes lastmodified lastaccess changed birth filename md5 sha1 fs_listing csv find xdev path var run path run path proc type f printf i m n g u s ty tm td tt ay am ad at cy cm cd ct p n awk f cmd debugfs r stat 1 dev mapper k2 vg root 2 dev null grep po crtime 0x 0 9a f 0 9a f tr read e n echo date y m d h m s d printf d 0x e printf 09d printf d 0x n 4 cmd getline crt close cmd cmd md5sum 10 cut d f1 cmd getline md5 close cmd cmd sha1sum 10 cut d f1 cmd getline sha1 close cmd print 1 2 3 4 5 6 7 8 9 crt 10 md5 sha1 sed s g fs_listing csv note that we are first writing a header line to the csv file for easier reference during analysis now operating from a root prompt e g the lead...