You are currently browsing the archives for 2015.
Displaying 1 - 4 of 4 entries.

Everything you really need in Arch

  • Posted on December 13, 2015 at 18:07

Creating a list of everything installed:

# pacman -Qe | awk '{print $1 " \\" }'

 

apache \
atril \
autoconf \
automake \
bash \
bind-tools \
binutils \
bison \
bzip2 \
caja-gksu \
caja-image-converter \
caja-open-terminal \
caja-sendto \
caja-share \
coreutils \
cryptsetup \
device-mapper \
dcfldd \
dhcpcd \
dialog \
diffutils \
e2fsprogs \
engrampa \
eom \
fakeroot \
file \
filesystem \
findutils \
flex \
foremost \
fping \
galculator-gtk2 \
gawk \
gcc \
gcc-libs \
gettext \
glibc \
grep \
groff \
grub \
gzip \
hfsprogs \
htop \
inetutils \
iproute2 \
iputils \
jfsutils \
less \
libtool \
licenses \
lightdm \
linux \
logrotate \
lsof \
lvm2 \
m4 \
make \
man-db \
man-pages \
marco \
mate-applets \
mate-backgrounds \
mate-control-center \
mate-icon-theme-faenza \
mate-media \
mate-netspeed \
mate-notification-daemon \
mate-power-manager \
mate-screensaver \
mate-sensors-applet \
mate-system-monitor \
mate-terminal \
mate-themes \
mate-user-guide \
mate-user-share \
mate-utils \
mc \
mdadm \
mlocate \
mozo \
mtools \
nano \
net-tools \
netctl \
nfs-utils \
nmap \
openssh \
os-prober \
p7zip \
php-apache \
php-gd \
pacman \
par2cmdline \
patch \
pciutils \
pcmciautils \
perl \
perl-dbd-pg \
pkg-config \
pluma \
postgresql \
procps-ng \
psmisc \
reiserfsprogs \
rsync \
s-nail \
screen \
sed \
shadow \
sleuthkit \
sshfs \
sudo \
sysfsutils \
tar \
testdisk \
texinfo \
tree \
unrar \
usbutils \
util-linux \
vi \
vim \
vimpager \
wget \
which \
xfsprogs \
zip \

And then CPAN:

Authen::NTLM
Config::Simple
Email::Send
Email::Sender
DBI
DBD::Pg
Digest::SHA1
Digest::SHA2
Digest::SHA256
Digest::SHA3
File::Binary
File::Tail 
File::Slurp
Filesys::Df
Email::Find
Log::Log4perl
Moose
MooseX
MooseX::ClassAttribute
MooseX::Singleton
SQL::Abstract

Python: My own Evernote

  • Posted on December 8, 2015 at 21:31

Search for file with extension (case-insensitive)

#!/usr/bin/python

import re


"""
CASE INDEPENDENT SEARCH FOR EXTENSION (JPG)
"""

filename = "KrusjMe_at_the_dentist.jpg"

prog  = re.compile(r"\.jpe{0,1}g$", re.IGNORECASE)
if prog.search(filename):
    print "Match!"
else:
    print "No match :-("

Arch LAMP: Super quick start guide

  • Posted on October 7, 2015 at 19:14

Get your terminal ready…

Install necessary packages

# pacman -S --noconfirm apache
# pacman -S --noconfirm mysql

Set DocumentRoot in /etc/http/conf/httpd.conf

Afterwards continue install PHP stuff…

# pacman -S --noconfirm php-apache
# pacman -S --noconfirm php
# pacman -S --noconfirm php-gd

Uncomment some extensions (modules) in /etc/php/php.ini

extension=gd.so
extension=iconv.so
extension=mysql.so
extension=openssl.so
extension=pdo_mysql.so
extension=soap.so

Now it’s time to configure your Virtual Hosts in /etc/httpd/conf/extra/httpd-vhosts.conf
When all is done, check your configuration and make Apache en MySQL startup automatically from now on

# apachectl configtest
# systemctl enable httpd
# systemctl enable mysql

Done! Happy webserving!

 

References:
https://www.digitalocean.com/community/tutorials/how-to-install-linux-apache-mysql-php-lamp-stack-on-arch-linux

Deduplicating: EWF vs Raw

  • Posted on August 4, 2015 at 14:24

Is ‘good old’ Expert Witness Format still the preferred choice?

In the recent years huge centralized storage has become pretty much a standard everywhere. And pretty much everywhere EWF has become standard for forensics imaging.
I wonder if this is still the most optimal combination from the perspective of storage-efficiency.

How does deduplicating perform on ewf-images compared to raw? In fact, my assumption is: The more raw images saved to a deduplicating volume, the more efficient duplicating will do its job.

 

Let’s bring them to the test!

EnCase
After booting up with a Windows 7 machine, I imaged the boot disk using EnCase 6. (run 1)
Immediately after, I initiated a second acquisition using the same EnCase session (run 2)
All settings for acquisition are kept to default, using ‘Good compression’ and a split size of 640MB.

FTK Imager
After EnCase finished both acquisition sessions successfully, I started two acquisition sessions with FTK Imager using the same approach: Start one, When it runs, start session number two.