Next Page »
Pages (83): [1] 2 3 4 » ... Last »

Thanks for visiting Daily Cup of Tech!
Here are a few things that you may want to do while you are visiting:

Hope you enjoy your stay!


UPS devices have become so cheap these days that everyone should have one on all of their computers. What surprises me is that nobody has designed a standard computer power supply with built-in UPS capabilities.

Some of the advantages of such a design include:

  1. Continued running even when power goes out.
  2. Can (carefully) move a computer to a different room or location without shutting it down.
  3. Laptops do it, why not desktops?
  4. Only the critical devices (i.e. the computer) are on the UPS and not other non-essentials like monitors and printers. This will allow for a longer running system without power.
  5. The ability to gently shut down the system from a hardware (not OS) perspective.

If any of the readers out there are hardware developers and would like to pick up on this idea, feel free. Just drop me a line to let me know how the idea pans out!

If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


It is only a matter of time before most IT professionals find themselves having to do some sort of a forensic analysis on a computer. The problem that most people come are then faced with is their lack of experience in performing these tasks.

And all of the pressure does not help either because there are often some pretty high staked involved.

This is where Helix comes in. Helix is a live CD that is designed to find out exactly what is on that computer and what individuals have done with it. From their website:

Helix is a customized distribution of the Knoppix Live Linux CD. Helix is more than just a bootable live CD. You can still boot into a customized Linux environment that includes customized linux kernels, excellent hardware detection and many applications dedicated to Incident Response and Forensics.

Helix has been modified very carefully to NOT touch the host computer in any way and it is forensically sound. Helix wil not auto mount swap space, or auto mount any attached devices. Helix also has a special Windows autorun side for Incident Response and Forensics.

Helix focuses on Incident Response & Forensics tools. It is meant to be used by individuals who have a sound understanding of Incident Response and Forensic techniques. That said Helix is used by the following organizations for Incident Response/Forensics Training:

  • Some of the tools that are on the Helix CD include:
    • sleuthkit: Brian Carrier’s replacement to TCT.
    • autopsy: Web front-end to sleuthkit.
    • mac-robber: TCT’s graverobber written in C.
    • fenris: debugging, tracing, decompiling.
    • wipe: Secure file deletion.
    • MAC_Grab: e-fense MAC time utility.
    • AIR: Steve Gibson Forensic Acquisition Utility.
    • foremost: Carve files based on header and footer.
    • fatback: Analyze and recover deleted FAT files.
    • md5deep: Recursive md5sum with db lookups.
    • sha15deep: Recursive sha1sum with db lookups.
    • dcfldd: dd replacement from the DCFL.
    • sdd: Specialized dd w/better preformance.
    • PyFLAG: Forensic and Log Analysis GUI.
    • Faust: Analyze elf binaries and bash scripts.
    • e2recover: Recover deleted files in ext2 file systems.
    • Pasco: Forensic tool for Internet Explorer Analysis.
    • Galleta: Cookie analyzer for Internet Explorer.
    • Rifiuti: “Recycle BIN” analyzer.
    • Bmap: Detect & Recover data in used slackspace.
    • Ftimes: A toolset for forensic data acquisition.
    • chkrootkit: Look for rootkits.
    • rkhunter: Rootkit hunter.
    • ChaosReader: Trace tcpdump files and extract data.
    • lshw: Hardware Lister.
    • logsh: Log your terminal session (Borrowed from FIRE).
    • ClamAV: ClamAV Anti Virus Scanner.
    • F-Prot: F-Prot Anti Virus Scanner.
    • 2 Hash: MD5 & SHA1 parallel hashing.
    • glimpse: Indexing and query system.
    • Outguess: Stego detection suite.
    • Stegdetect: Stego detection suite.
    • Regviewer: Windows Registry viewer.
    • Chntpw: Change Windows passwords.
    • Grepmail: Grep through mailboxes.
    • logfinder: EFF logfinder utility.
    • linen: EnCase Image Acquisition Tool.
    • Retriever: Find pics/movies/docs/web-mail.
    • Scalpel: Carve files based on header and footer.

    I think that digital forensics is a really cool career. Kind of like CSI for geeks!

  • If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


    Many of you are familiar with the concept of computer imaging. Essentially, you take a system, configure it the way that you would like, and then duplicate the hard drive to all of the other systems, saving yourself all of the same steps that you did on the first system.

    Now, there are a lot of great commercial software programs out there that can do this for you. Acronis and Ghost come to mind. But, not everyone can afford these options. For those of you find yourself in this situation, I present you with a list of options that are available for free or are open source. (All descriptions are copied from their respective websites.)


    Partimage

    Partimage is a Linux utility which saves partitions having a supported filesystem to an image file. Most Linux and Windows filesystems are supported. The image file can be compressed with the gzip / bzip2 programs to save disk space, and they can be splitted into multiple files to be copied on CDs / DVDs, … Partitions can also be saved across the network since version 0.6.0 using the partimage network support, or using Samba / NFS. If you don’t want to install Partimage, you can download and burn SystemRescueCd. It’s a livecd that allows to use Partimage immediately even if your computer has no operating system installed (useful to restore an image), and it allows to save an image on a DVD on the fly.

    PING (Partimage Is Not Ghost)

    PING is a live Linux ISO, based on the excellent Linux From Scratch (LFS) documentation. It can be burnt on a CD and booted, or integrated into a PXE / RIS environment. Several tools have been added and written, so to make this ISO the perfect choice to backup and restore whole partitions, an easy way. It sounds like Symantec Ghost(tm), but has even better features, and is totally free.

    Clonezilla

    Clonezilla, based on DRBL, Partition Image, ntfsclone, and udpcast, allows you to do bare metal backup and recovery. Two types of Clonezilla are available, Clonezilla live and Clonezilla server edition. Clonezilla live is suitable for single machine backup and restore. While Clonezilla server edition is for massive deployment, it can clone many (40 plus!) computers simultaneously. Clonezilla saves and restores only used blocks in the harddisk. This increases the clone efficiency. At the NCHC’s Classroom C, Clonezilla server edition was used to clone 41 computers simultaneously. It took only about 10 minutes to clone a 5.6 GBytes system image to all 41 computers via multicasting!

    IRestorer

    Drive Snapshot (IRestorer) creates an exact drive image of your system into a file, including the operating system, installed programs, your data and all security attributes, while Windows is running and you continue to work. If disaster strikes (a virus, worm, trojan, or hard disk crash), a complete and exact restoration of your system will be possible in only few minutes. The image file can be mounted as a virtual drive, so you can easily restore (or use) single files or directories, using the Windows Explorer, or other programs. Restart to DOS is only necessary, if you must restore your system partition. Otherwise there is no need to reboot, not even during installation. Drive Snapshot saves only the used disk space, compresses the data and is extremely fast, a P4 - 3.0 GHz will save approx. 2.5 GB/Min on a modern hard disk!

    Linbox Rescue Server

    The Linbox Rescue Server is an asset management software including 5 modules :

    HDClone

    Copies smaller drives onto larger ones for migrating or backing up complete installations as well as for data rescue. The download package contains a program to easily create a bootable floppy disk or CD/DVD under Windows with only few clicks. A floppy image, ISO image, and manual as PDF are also enclosed.

    DiscWizard

    If you are setting up your new drive, you can use the install instructions to assist in mounting the drive, then use the tools built into your operating system to prepare the drive.

    G4L

    G4L is a hard disk and partition imaging and cloning tool. The created images are optionally compressed and transferred to an FTP server instead of cloning locally.

    MaxBlast 5

    If you are setting up your new drive, you can use the install instructions to assist in mounting the drive, then use the tools built into your operating system to prepare the drive.

    DriveImage XML Backup Software

    DriveImage XML is an easy to use and reliable program for imaging and backing up partitions and logical drives.

    The program allows you to:

  • Backup logical drives and partitions to image files
  • Browse these images, view and extract files
  • Restore these images to the same or a different drive
  • Copy directly from drive to drive
  • Schedule automatic backups with your Task Scheduler
  • Image creation uses Microsoft’s Volume Shadow Services (VSS), allowing you to create safe “hot images” even from drives currently in use.Images are stored in XML files, allowing you to process them with 3rd party tools. Never again be stuck with a useless backup!

    Restore images to drives without having to reboot.

    DriveImage XML runs under Windows XP, Windows Server 2003 and Windows Vista only. The program will backup, image and restore drives formatted with FAT 12, 16, 32 and NTFS.

    DuBaron DiskImage

    DiskImage is the ultimate tool to backup and restore partitions, entire harddisks, USB keys, floppy drives and (read-only) optical media. DiskImage features built-in zip compression, it’s own compression method for data
    > 2Gb, MD5 and SHA1 checksumming, a hex editor, and various tools like drive speed and seek testing.

    Dumping and restoring partitions, USB sticks, floppies, optical media, diskimage is the swiss army knife.

    WinDD - Disk Dump for Windows

    WinDD - Disk Dump for Windows! Windows XP version of Unix ‘dd’ command. Safe, effort-free backup for FAT, FAT32, NTFS, ext2, ext3 partitions.

    Partition Saving

    Partition Saving is a DOS and Windows program that is used to save, restore and copy hard-drive, partitions, floppy disk and DOS or Windows devices.

    With this program you could save all data on a partition to a file (such as you could save this file on a CD for example). Then if something goes wrong, you can completely restore the partition from the backup file. You no longer have to reinstall every piece of software from scratch. All you have to do is restore the partition from the backup file and then update any software that was modified since the backup was created.

    NFGDump

    nfgdump (Ntfs-Fat-Generic-dump) is a Win32/Linux tool that dumps/restores NTFS (including 3.1=XP), COMPRESSED NTFS, FAT16, FAT32 and arbitrary (generic) partitions. Dump files support compression, encryption, splits, page file content removal, etc.

    Forensic Acquisition Utilities

    This is a collection of utilities and libraries intended for forensic or forensic-related investigative use in a modern Microsoft Windows environment. The components in this collection are intended to permit the investigator to sterilize media for forensic duplication, discover where logical volume information is located and to collect the evidence from a running computer system while at the same time ensuring data integrity (e.g. with a cryptographic checksums) and while minimizing distortive alterations to the subject system. The components of this package are not intended to preclude changes to the subject system while the evidence collection process is under way. A third party hardware or software write blocker should be employed in those circumstances where it is deemed necessary to guarantee that no changes occur to the subject volume prior to and after the imaging process.

    Self Image

    SelfImage is the little hard drive utility with big aspirations.SelfImage is capable of making an image file of a hard disk or hard disk partition, and can restore an image back to any drive or partition that doesn’t have open files. Useful for making backups. Unlike dd for Windows (or cygwin), SelfImage is capable of creating an image of a partition that is currently in use.

    SelfImage can even create images of partitions that Windows doesn’t recognize (partitions that Windows doesn’t have mounted on a drive letter). This is perfect for the dual-boot system, you can create an image backup of a Linux partition directly from Windows.

    PC inspector clone maxx

    PC INSPECTOR™ clone maxx is the new professional hard drive copying program from CONVAR. Using the new direct DMA support, data can be copied from hard drives in high speed mode with speeds up to 3.3 GB per minute.This high speed is achieved by PC INSPECTOR™ clone maxx through intelligent inspection of the PC motherboard and the hard drive controller. The software independently determines the fastest data transmission rate and achieves these exceptional speeds through optimal utilization of the DMA chipset on the motherboard of your PC.

    PC INSPECTOR™ clone maxx can be started directly from a boot diskette. The copying process is always based on the physical drive and is independent of the file system (e.g. FAT12, FAT16, FAT32, HPFS, NTFS, Ext2, Reiser, etc.) or the number of partitions.

    g4u - Harddisk Image Cloning for PCs

    g4u (”ghosting for unix”) is a NetBSD-based bootfloppy/CD-ROM that allows easy cloning of PC harddisks to deploy a common setup on a number of PCs using FTP. The floppy/CD offers two functions. The first is to upload the compressed image of a local harddisk to a FTP server, the other is to restore that image via FTP, uncompress it and write it back to disk. Network configuration is fetched via DHCP. As the harddisk is processed as an image, any filesystem and operating system can be deployed using g4u. Easy cloning of local disks as well as partitions is also supported.

    FOG :: A Ghost-like Computer Cloning Solution

    Fog is a Linux-based, free and open source computer imaging solution for Windows XP and Vista that ties together a few open-source tools with a php-based web interface. Fog doesn’t use any boot disks, or CDs; everything is done via TFTP and PXE. Also with fog many drivers are built into the kernel, so you don’t really need to worry about drivers (unless there isn’t a linux kernel module for it). Fog also supports putting an image that came from a computer with a 80GB partition onto a machine with a 40GB hard drive as long as the data is
    less than 40GB.

    Fog also includes a graphical Windows service that is used to change the hostname of the PC, restart the computer if a task is created for it, and auto import hosts into the FOG database. The service also installs printers, and does simple snap-ins.

    Each has its own pros and cons but all have a purpose. I am personally really liking FOG and am finding a lot of different places to put it to work.

    If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


    FarewellFriday was my last day of work before the big move. I have had to leave jobs a number of times in my IT career and I think this was probably one of my best exits so far. With the average person changing jobs several times over their careers, leaving one’s job with class is an extremely important skill to master.

    While this may not be a very technical post, I think that it is something that is critical for every IT person to know. So, with that in mind, here is what I have learned about leaving gracefully.

    Don’t Burn Your Bridges

    In my mind, this goes without saying but for some it may not be as obvious. You never know when you will need these people or this company again. You might be looking for work in the future and need a reference or maybe they will be hiring again in a few years and you might be needing a job.

    It never hurts to have more people on your side than against and pushing people away is never a good thing.

    Give As Much Advance Notice as Possible

    When my wife and I first decided that we were going to move, we know that this was going to happen more than two years in advance. I notified my employer immediately and they have known for a very long time that I was moving on. While I understand that this is a very unusual situation, it is generally in everyone’s best interest for you to give as much advance notice as possible.

    My general rule of thumb is to give my employer twice as long notice as is legally required of me. I generally give at least one month.

    Also, the more specialized your position and the harder it is to find a replacement, the longer your notice should be. This benefits your old employer and also indicates to your new employer that you are loyal and trustworthy.

    Help to Find Your Replacement

    Only you really know what you do and that makes you a very important asset when recruiting for a replacement. Help your old employer find your replacement by offering to help with the interviews, talking with friends whom you know in your industry that may be interested in your position and help them word the Internet and newspaper “Help Wanted” ad.

    Train Your Replacement

    Once your replacement has been found, help to train them. Get them to work a few days with you so that they can learn the ropes from a veteran. While your company can provide them with a job description and basic training, only you can show them those special nuances of the job that you have learned from your years of experience.

    Work As If It Is Your First Day Until Your Last

    A lot of people start to slack off as their last day draws near. This can be a huge mistake. This became very clear to me as I was leaving my last position. I did a lot of extra tasks that I was not technically required to do but it was noticed and because I pushed hard right to the very end, they decided to give me the annual bonus even though I was not technically eligible for it because I was leaving before the bonuses were distributed. Sounds like a win-win to me!

    Maintain a Positive Attitude

    It is really tempting to have a “What are they gonna do? Fire me?!” attitude once you have handed in your resignation. Don’t fall into this trap. These are the types of things that people remember when prospect employers call for references. You also don’t want people’s final thought of you to be “What a jerk!” or worse.

    Ask For Letters of Reference

    Letters of reference can be very helpful when looking for future work, even if you already have a new job lined up. Now is the time to ask for them because you are in a better position to positively influence what is in the letter. It is much harder to get an accurate and glowing letter of reference several years down th road.

    Offer to Help in an Emergency

    This hold especially true if you are in a technical position. I told my old employer that if there was an emergency, I would do what I could to help out my replacement and the rest of the technical crew. I made it very clear that this would be on a best effort basis and that their would be some compensation required for my help but that I would be there if needed.  This increases people’s opinion of you while also protecting yourself from being taken advantage of.

    Make a Clean Break

    I remember very clearly one individual that I worked with who quit to work for another company. His decided to take some time off before starting his new position.  Imagine how surprised we were when he showed up at the office the day after his last day of work!  He hung out at in the break room.  He would wait for people at the coffee shop during coffee break.  Eventually, his old manager had to come right out and tell him that he didn’t work there anymore and could no longer come around to “visit”.

    Once you have quit your job, move on and do not dwell on the “good ol’ days”.

    Keep In Touch With Your Work Friends

    This may seem contrary to the previous point but actually, it is complimentary to it.  A friend that I met at a previous job has become a real mentor and support to me, even though he and I have not worked together a coworkers in over six years.  We made it a weekly ritual to get together for lunch and shoot the breeze.  But, we made sure to meet at a restaurant that was not one frequented by other former employees.  This way there was a very clear break between me and the company but not between me and my friends.

    Write a “Thank You” Letter to Your Boss

    Your parents taught you from a young age to always say thank you.  This also goes for the people who were responsible for putting food on your table and shelter over your head in exchange for work over the past number of months or years.  Do the classy thing and put a thank you in writing emphasizing everything you learned from working for them and for the opportunities that you received from the position.

    Send a Farewell E-mail

    Depending on your company, this can be a broadcast e-mail to everyone in your company, your office, your department, or just a few select friends.  Make sure you thank everyone for their contributions and let them know what the future holds for you.  You may even want to provide them with updated contact information.

    Don’t Brag About Your New Job

    I remember once a person working on the same team as me got a new job and from the time he announced he was leaving to the actual moment he walked out the door for the last time, all he could talk about was how wonderful his new job was, how much more money he was going to be making, and how wonderful the new company’s corporate culture was. All he ended up doing was making those up us left with our crappy, low-paying jobs and depressing corporate culture feel depressed.

    While you want people to feel happy about your new career, you want them to be happy that you are moving on to bigger and better things, not that you are just moving on.  Don’t lift yourself up by putting others down.

    Conclusion

    I know that some of these are not going to be possible in every situation, especially if you are leaving under less than desirable circumstances (i.e. fired, laid off, etc.) but do whatever you can to implement as many of these as possible to maintain your professional status.

    If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


    Dark MadnessIt is quite popular these days to hire a headhunter when looking for work. And, on the surface, I thought it was a great idea. Why should I pound the pavement looking for jobs when these people do this full time and are willing to find me work without charging me? They get paid by the companies who are looking for employees and they get a percentage of my first year’s salary.  This means that they would get me the largest possible salary and it doesn’t cost me a dime!

    Or does it?

    When speaking with the two headhunters that I was working with, I made it very clear that I was looking for a management position.  It was also very clearly stated in my cover letter and in my resume that, while I was also very technical, I was definitely looking for a career in IT management.

    At this point, the blinders went on.  Both headhunters wanted me to rewrite my resume to emphasis my technical side.  One headhunter even called me up later in the day and told me that she had a great leadership position for me.  The position ended up being a tech lead, something that I did almost a decade ago!

    Based off my, albeit limited, experience with headhunters, I have made some observations which may or may not apply to other headhunters:

    1. Headhunters are not actually working for you.  Rather, they are working for the employers and themselves.  You are really nothing more than a trading commodity akin to cattle.
    2. Headhunters are not motivated to find me the best job.  Rather, they are motivated to fill as many open positions as possible.  This keeps their bosses happy by keeping the actual clients (the employers) happy.
    3. Headhunters are not motivated to get me the highest possible salary.  If a headhunter can spend half an hour to get me a $40,000 per year job, do you really think that they are going to work to get me an extra $10,000 if it takes an extra five hours?  Especially when they can place ten more $40,000 people in that time frame.  This is typically referred to as the law of diminishing returns.
    4. Headhunts will try to make you fit the job, not find the job that fits you.  I was told that I would never get the type of job I wanted with my resume (even though I already had the type of job I wanted already) but that she had the perfect job for me.  I was also told that my salary expectations were too high and that I would have to be more realistic, even though I was already making more that I was asking for and in a tougher market.
    5. If you don’t fall in line, they will drop you.  Once I made it clear what I was looking for and that I was not willing to settle for a job similar to what I had done ten years ago, I never heard back from my two headhunters again. I am assuming that the effort wasn’t worth it.

    Now, as I stated, this is based off a relatively short time with two headhunters and I could be completely off base.  Maybe I just got the two bad headhunters in the entire world.  Let us know about your headhunter experiences, good or bad.

    If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


    For those of you who are unfamiliar with Red Green, he is the quintessential handyman/technologist! There is nothing that he can’t do with same spare pieces of junk and a roll (or two) of duct tape. For example, power Windows:

    or a computer desk:

    If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


    Wireless TowerI would be completely lost without my Internet connection. I had my central firewall die one day and it only took a few minutes for me to go into withdrawal! But, a lot of the times it is just sitting there doing nothing. And, like the lazy house guest who takes the trash out once a week, you really wish you could get more out of it.

    One of the ideas that I have been working on is setting up my Internet connection with a WiFi hotspot so that people who are in the area and want quick Internet access can pay a small fee and get what they need.

    This is a project that is still in the research phase but I have already made some really interesting discoveries.

    1. I am probably going to use a piece of software made by Coova called CoovaAP. It is based on OpenWrt and allows you to turn several different stand alone commercial WiFi routers/firewalls into a full blown manageable hotspot. From the website:“CoovaAP is an OpenWRT-based firmware designed especially for HotSpots. It comes with the CoovaChilli access controller built-in and makes it easily configurable. CoovaAP is perfect for just about any HotSpot application - from WPA Enterprise (with RADIUS accounting) to Free WiFi with Terms of Service acknowledgment to commercial HotSpot captive portal applications. Use the embedded captive portal for a simple self contained HotSpot or use your own captive portal and RADIUS back-end. It is all up to you!” Other options that I have been looking at include WiFi-CPA and Worldspot.net.
    2. If you are planning on doing this, make sure you read your Internet provider’s terms of service. You may not be allowed to do this without putting yourself at risk of being cut off!
    3. You may want to look at boosting your WiFi signal to allow for the greatest amount of coverage. There are several ways to do this.
    4. Make sure that you set up traffic shaping so that you can give your own computers priority over those who are using the hotspot. After all, it is your Internet connection.
    5. Split up your internal network and protect it with a separate firewall. The last thing you want is your hotspot clients getting access to your personal information.
    6. I’m still trying to figure out how to allow users to pay automatically when they create an account. It looks like PayPal will be the first most logical choice.
    7. If you have a number of Internet connections in several different places, you could set up a single sign-on configuration to make it really easy for your clients.
    8. It will be very important to determine how lucrative this will be because it could potentially be worth getting more Internet connections specifically for this purpose.

    I think there could be some real opportunity here.  What are your thoughts?

    If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


    BoxI have been getting a number of e-mail and posts asking how the job hunt is going.

    Yesterday, I accepted a position with a consulting firm as Manager of IT Services (at least that is my working title).  Now comes the fun part of house hunting, selling our house, packing, moving, etc.

    I am really excited about this new challenge as I will have the opportunity to help shape and grow an entire company!  So, if you are looking for a good IT consulting company in the Edmonton area, feel free to drop me a line and I’m sure we can help you out!

    If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


    EraserU3 technology is a really awesome way to use your USB drive. It provides menus and the ability to install software quickly and easily on your USB drive.

    But, (You knew there was one coming, didn’t you!) what if you want to use your USB drive as a simple file transport? Or you work in a locked down environment that will not allow the U3 software to complete its job? Now what?

    I found myself in this situation last week when my boss asked me for a USB drive to take some work home with him. I was rather embarrassed when he came back to me thinking that I gave him a drive infected with a virus!

    Fortunately, it is a relatively easy process to remove the U3 software. Simply download the U3 uninstaller and run it against your USB drive.

    Caution! You will need to move all of your data off the USB drive before running the uninstaller because it will reformat your drive and all of your data will be lost! Also, you will not be able to reinstall the U3 software if you change your mind later!

    If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?


    Now fixing a BWM is easier than ever:

    If you found this post useful, why don't you buy me a cup of coffee to show your gratitude?

    Next Page »
    Pages (83): [1] 2 3 4 » ... Last »