Slashdot Mirror
Linux and Forensic Discovery
Max Pyziur writes "Found this on cryptome.org where Linux is cited in a DOJ document against Moussaoui (sometimes referred to as the "20th man"). FBI: Moussaoui E-mail Not Recoverable - January 1, 2003." An interesting read which gives some insight into how computer evidence is handled in court.
Of the fact that lawyers will argue over anything.
Heh, this seems to be a discussion about whether they used "approved methods" of retrieving a deleted email. According to one person, the LinuxGNU was the only one approved by NIST (national institute of standards and technologies). This of course, is wrong...NIST doesn't "approve" software, they just test it and declare whether or not it works.
...someone in the government seems to realize that Microsoft can't be trusted ;-)
Don't you wish your girlfriend was a geek like me?
To anyone who is concerned about having their deleted files recovered, take a look at Wipe - in its strongest mode it will make 37 passes over the data in order to be sure that electron microscopes cannot reconstruct the bit patterns.
MSN Hotmail subscriber information is not shared with other entities or third parties except as follows:
(A) Non-personally identifiable information (e.g., demographics information such as age, city, state and postal code) is shared with the MSN Hotmail marketing department;
(B) In 2001, account name, city, state and postal code were shared with INFOSPACE, a web-based publisher of an e-mail address directory, if, at the time of registering the account, the account subscriber did not elect to prohibit the sharing of this information;
(C) MSN Hotmail account e-mail is automatically deleted whenever the account subscriber fails to access the account for a period of thirty (30) days;
(D) A MSN Hotmail account is automatically deleted, and no record of it is thereafter maintained by MSN Hotmail, whenever the account subscriber fails to access the account for a period of 90 days;
(E) While, in theory, there could be references to a subsequently deleted hotmail e-mail account stored in data of other Microsoft services (e.g., a message posted to a MSN Group), such references would not be traceable to the registration information of that account holder as it would already have been deleted.
Linux is used by humans outside of the Slashdot community! Stay Tuned!
I'd rather be a conservative nutjob than a liberal with no nuts and no job.
Linux, the OS used only by dirty hippies, communists, and terrorists. Don't fall into the trap!
How is this news? They are using "dd" a Linux utility. Seeing "Linux" in an article does not warrant a story about it. This demeans Linux by using every little scrap of news to attempt to show that it is in use. Instead we should be demostrating it's uses, rather that reporting that it is in use.
I am Lord Snowbeam. Heed my call!
What the fuck is a billiard?
I don't know, but I think it has something to do with a type of pool you can't swim in.
A shot in billiards in which the cue ball successively strikes two other balls.
So, uh, shut the fuck up.
The test reults are abailable here:
http://www.ojp.usdoj.gov/nij/sciencetech/cftt.htm
The document states that image files were generated fo the contents of the hard drives. I do not have confidence that an image would also display latent data.
I know myself that when I do a data recovery on a system, I can get many more megs of recovered data from file fragments, deleted folders, etc than can fit on the drive. Most of this extra stuff ias junk data, but you get the idea.
There is no substitue for the original.
Recovery can require a minimum of specialized software or be as complicated as looking at the platters under an electron microscope. I see nothing here that indicates use of such specialized technology, and yet this is supposed to be a national security matter.
"It is a greater offense to steal men's labor, than their clothes"
A troll, of course, but due to lack of moderator points:
/dev/hdb
dd
Yep. That would be much simpler under Windows.
If the hash value of the original prior to duplication matches identically the hash value after the duplication, one may conclude that the duplicate file accurately reflects the data on the original file. The fact that the hash values match is typically more important than the hash values themselves.
Are they saying that two different files can't have the same hash value? That's a load of crap! It's not hard at all to modify data to create any hash value that you want, especially when you're including "deleted space" in the CRC calculations... It's good at telling you if there were any random modifications caused by errors during copying, but not that the files are identical.
I thought Solitaire only duplicated wasted work hours!
If thou see a fair woman pay court to her, for thus thou wilt obtain love
Argh...Once more with preview:
/dev/hda > /dev/hdb
dd <
Oohhhhhh... Someone said the word ``Linux"... Better put it on the front page...
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Actually, if you read on in the article, they state that Linux dd COULD have been used, that NIST had tested it and found it acceptable, but if you read the procedures used to the four HDDs, they actually used the other methods listed exclusively.
Sept. 10, 2001
Zach,
We're going off flying tommorrow, hope to see you on the other side. Last one there gets the 70 ugliest virgins!
M. Atta
Trolling is a art,
Only terrorists use Linux and red blooded americans happily throw :)
their money at microsoft? Or is it the other way around...
terrorists use Microsoft, in which case, anybody who uses
microsoft is evil. Oh well, good thing I use *BSD,
made in America and other places
he used this, it was on freshmeat frontpage til this morning.
dd is a common Unix program. The SGIs at work have it, my various BSDs at home and work have it and Linux has it.
Trolling is a art,
The United States respectfully responds to Standby Counsel's Reply to the Government's Response to the Court's Order on Computer and E-Mail Evidence (hereafter "Reply") as follows:
/s/
Authentication
The foundation of standby counsel's discovery requests regarding the computer and e-mail evidence rests upon their complaints regarding the "authentication" of the hard drives provided in discovery. "Authentication" in this context means the process of ensuring that the duplicate of the hard drive provided in discovery is an exact copy of what the FBI originally acquired. As FBI Supervisory Special Agent Dara Sewell explains in her attached affidavit, the FBI uses three different methods to duplicate or image a hard drive:1
(1) GNU/Linux routine dd command via Red Hat Linux 7.1 (hereafter "Linux dd");
(2) Safeback version 2.18 imaging software by New Technologies (hereafter "Safeback");
(3) Solitaire Forensics Kit, SFK-000A hand-held disk duplicator by Logicube, Inc. (hereafter "Logicube").
Sewell Affidavit at 2. Standby counsel seek the "complete authentication information for all of the hard drives produced in discovery, particularly the information for Mr. Moussaoui's laptop, the University of Oklahoma system, and Mukkarum Ali's laptop." Reply at 8.
Before addressing the authentication for the four specific computers, an error in Mr. Allison's affidavit must be corrected. In his affidavit, Mr. Allison writes: "Many methods are available to create an exact duplicate; however, only one method - the GNU/Linux routine dd - has been approved by the National Institute of Standards and Technologies." Allison Affidavit at 3. This statement is simply wrong. The National Institute of Standards and Technologies (NIST) does not "approve" software, it merely tests it and then publishes the results of its tests. NIST did, indeed, test Linux dd and publish the results, which included some criticism. Sewell Affidavit at 3. Like Linux dd, Safeback has also been submitted to NIST for review and its final report was published on December 13, 2002. Sewell Affidavit at 3. NIST reported criticisms of Safeback comparable to those cited for GNU/Linux routine dd. Sewell Affidavit at 3-4.2 Thus, for purposes of NIST, both Linux dd and Safeback are accurate imaging tools. With this in mind, the authentication of the four computers at issue follows.3
More important, the manufacturers of both Safeback and Logicube engaged in extensive self-testing of their programs before marketing them. Further, both contain verification programs\functions that ensure that the image\duplicate accurately reflects the data contained on the original. Sewell Affidavit at 4-5. Finally, FBI CART has validated the use of both Safeback and Logicube during their own use of the methods on hundreds of computers. Sewell affidavit at 4-5. Both Safeback and Logicube, like Linux dd, are methods that are accepted within the forensic computer community. Sewell Affidavit at 4-5.
Additionally, Mr. Allison writes: "Further, once the duplicate has been created, a product such as the Message Digest version 5 (MD5) or the Secure Hash Algorithm version 1 (SHA-1) should be used to confirm that the duplication process has been done properly." Allison Affidavit at 3. Mr. Allison refers to programs that generate a unique value for both the data on the original hard drive and the data on a purported duplicate of that hard drive in order to further verify the results of the duplication process. However, as set forth in detail in SSA Sewell's affidavit, both Safeback and Logicube contain self-validating programs that ensure the image or copy process generates an exact duplicate of the original. Sewell Affidavit at 4-6. Therefore, the MD5 or SHA-1 programs only provide an additional layer of verification beyond the already proven reliability of the tool itself. Sewell Affidavit at 6.
Both defendant's and Mukkarum Ali's laptops were duplicated using the Safeback software. To eliminate any questions about authentication, the FBI employed the MD5 program suggested by Mr. Allison on both laptops. The program demonstrated that the images of both laptops provided to the defense in discovery were accurate reproductions of the originals. Sewell Affidavit at 7-10. The significance of this point is two-fold. First, there can be no question that the defense has the exact same copy of the original that the Government has, so they can conduct any further investigation on their copy that they wish. Second, the results of the MD5 program as to these two laptops further demonstrate the reliability of the Safeback program.
Finally, standby counsel seek the BIOS (Basic Input/Output System) settings for defendant's laptop based upon the following assertion by Mr. Allison in his affidavit:
The complete authentication information for Mr. Moussaoui's laptop is even more critical given the indication in the above documents, particularly Bates no. M-LBR-0002265, that the laptop had lost all power by the time of the government's CART examination on August 6, 2002. [Footnote omitted]. The loss of all power means that the original date and time settings cannot be retrieved, and that other settings, such as how the computer performed its boot sequence, the types of ports and peripherals enabled, and the settings regarding the hard disk and the controller, are all lost as well. All of this is essential information on how the laptop was set up.
Allison Declaration at 3-4. As SSA Sewell makes clear in her affidavit, however, the BIOS settings for defendant's laptop were recorded at the time that it was imaged, September 11, 2001, before any loss of power. The BIOS settings are set forth in SSA Sewell's affidavit. Sewell Affidavit at 11. Therefore, no authentication issues exist as to defendant's or Mukkarum Ali's laptops.4
Unlike the laptops, the two hard drives at the University of Oklahoma (known as "PC 11" and "PC 14") were never removed from the university and are not currently in the Government's possession. Due to the nature of the hard drives, the FBI used the Logicube hand-held disk duplicator to copy the drives and then imaged the duplicates with the Safeback program. Logicube was selected to duplicate the University of Oklahoma hard drives because of its portability. Sewell Affidavit at 3-5, 18. Like Safeback, Logicube has been verified by both its manufacturer and the FBI. Moreover, Logicube performs self-checking functions to ensure that the duplicate drive accurately reflects the contents of the original drive. Finally, although Logicube has not yet been reviewed by the NIST, hand-held disk-duplicators such as Logicube are widely accepted in the information and forensic communities. Sewell Affidavit at 5. Consequently, there can be no challenge to the authenticity of the duplicates of the University of Oklahoma hard drives.
The Request for a Chart for the Remaining Hard Drives
Standby counsel next seek a chart "for the approximately 140 remaining hard drives. At a minimum, the chart should include the origin/source for each drive and the significance of the drive to the case." Reply at 9.5 On November 22, 2002, the Government supplied the defense with a chart listing each hard drive produced in discovery, when it was produced, and a detailed description of its source from which the defense can assess its significance. Further, in a letter dated December 18, 2002, the Government identified the computer evidence that it believes to be relevant for this prosecution. Of course, the burden rests with the defense to determine the significance of a piece of evidence to their defense. Cf. United States v. Comosona, 848 F.2d 1110, 1115 (10 th Cir. 1988) ("The Government has no obligation to disclose possible theories of the defense to a defendant. If a statement does not contain any expressly exculpatory material, the Government need not produce that statement to the defense. To hold otherwise would impose an insuperable burden on the Government to determine what facially non-exculpatory evidence might possibly be favorable to the accused by inferential reasoning."); United States v. Nachamie, 91 F. Supp. 2d 565, 569 (S.D.N.Y. 2000) ("The clear language of Rule 16(a)(1), however, does not require the Government to identify which documents fall in each category - it only requires the production of documents responsive to any category."); United States v. Greyling, 2002 WL 424655 at *3 (S.D.N.Y. 2002) ("Fed. R. Cr. P. 16(a)(1)(C) only requires that the Government afford defendants an opportunity to inspect the documents it intends to introduce at trial. It does not require the Government to identify which documents it intends to introduce.") (emphasis in original). Therefore, this request is now moot.
The University of Oklahoma Hard Drive
Standby counsel next request the Court to "[o]rder the Government to confirm that the UO hard drive produced in discovery has not been contaminated and explain why the 70 GB of unused storage space on that hard drive contains material that should not be there." Reply at 9. As the affidavit of SSA Sewell makes clear, the following answers Mr. Allison's concerns about University of Oklahoma PC 11. Approximately 9.537 gigabytes of information were duplicated from PC 11's hard drive by the Logicube program onto a 40 gigabyte drive. Thereafter, all data on the Logicube 40 gigabyte drive was imaged and later restored using the Safeback program onto a 80 gigabyte hard drive, which was then turned over to the defense. The primary partition which exists on the defense 80 gigabyte duplicate hard drive accurately represents the approximately 9.529 gigabytes captured from the primary partition of PC 11 without contamination. The balance of the space on the 80 gigabyte hard drive provided to the defense contains the following:
(1) Approximately 7.26 megabytes of data of the 9.537 gigabytes of data captured from PC 11. This information actually appeared on PC 11 outside of the primary partition and was duplicated by Logicube. Therefore, this data previously existed on the PC 11 and did not result from the imaging/duplication process;
(2) Unused space which consists of a series of zeroes; and,
(3) Approximately 4 megabytes of repetition of the 9.537 gigabytes of information captured from PC 11, which was created by the Logicube tool when it first began to duplicate the material contained on PC 11.6
Sewell Affidavit at 19-20. All of this simply means that the first 9.537 gigabytes of the 80 gigabyte hard drive provided to the defense accurately contains all of the data that existed on PC 11 at the time of duplication and was not "contaminated" by any outside data.
The Examination of Moussaoui's Laptop
Standby counsel's fourth request questions whether the defendant's laptop was imaged before it lost power. The defendant's laptop was imaged on September 11, 2001, before the laptop lost power. Sewell Affidavit at 11. The BIOS settings for the laptop requested by standby counsel are set forth in SSA Sewell's affidavit. Sewell Affidavit at 11. Therefore, this request is now moot.
The xdesertman@hotmail Account and Other E-Mail Accounts
In their fifth request, standby counsel ask the Court to "[o]rder the Government to examine all of the temporary files of the computers Mr. Moussaoui used (those at UO, his laptop, and Mukkarum Ali's laptop) and determine whether information can be obtained from them concerning the xdesertman@hotmail.com account and the other email accounts listed in paragraph 33 of the Lawler Affidavit." Reply at 10. SSA Sewell's affidavit describes the unsuccessful searches of each hard drive conducted by FBI CART Field Examiner Thomas Lawler for the xdesertman@hotmail.com e-mail account as well as at least 27 variations of this account and other e-mail accounts associated with the investigation of this case. Sewell Affidavit at 15. Moreover, as previously demonstrated in the first section of this pleading addressing the authentication issues, the defense now has an exact copy of what the Government has. Therefore, there is no reason that the defense, including their computer expert, cannot conduct the same examinations of the four hard drives at issue as the Government. Consequently, this request should be denied.
Similarly, in their sixth request, standby counsel ask the Court to order the Government to conduct an investigation at their behest when they have the same ability to conduct the investigation. The defense possesses the same subpoena power as the Government and, if they wish to serve a subpoena on Hotmail, Microsoft, or any other company, they should do so. See Fed. R. Crim. P. 17(c); 18 U.S.C. 3005. Moreover, the Group Manager for Policy Enforcement for MSN Hotmail reports that a search as suggested by Mr. Allison in his Declaration (see Allison Declaration at 6) would have no success. Sewell Affidavit at 21-22. Therefore, this request should fail.
The Internet Provider Address for University of Oklahoma PC 11 Computer
Next, standby counsel ask the Court to "[o]rder the Government to (A) explain the reason for the discrepancy in IP addresses for the UO PC 11 computer, (B) confirm that the UO hard drive produced to the defense in discovery (129.15.110.31) comes from the computer used by Mr. Moussaoui at the University of Oklahoma, and (C) confirm that Mr. Moussaoui did not use any other UO computer." Reply at 11. Simply put, a typographical error exists in the Lawler Affidavit submitted by the Government. The correct internet provider address for University of Oklahoma PC 11 computer is 129.15.157.31. Sewell Affidavit at 18. As discussed in the first section of this pleading regarding authentication, a duplicate of the hard drive for PC 11 has been provided to the defense. As to whether Mr. Moussaoui used any other computer at the University of Oklahoma, only the defendant definitively knows the answer. The only evidence that the Government has regarding Mr. Moussaoui's computer use at the University of Oklahoma involves PC 11 and PC 14, copies of which have been provided to the defense in discovery.
The Kinko's in Eagan, Minnesota
In their eighth request, standby counsel seek "more information about the procedures used by Kinko's personnel and the steps they took to clean the Kinko's system and verify that no evidence of Mr. Moussaoui's communications via Kinko's internet access still remains on the Kinko's system." Reply at 11. SSA Sewell's affidavit describes in detail the procedures used by Kinko's to overwrite ("clean") their systems. The affidavit reveals that during the month between the defendant's use of the computers at Kinko's on August 12, 2001, and September 11, 2001, Kinko's cleaned their machines at least one time and perhaps many more, since their policy was to re-image (clean) the computers weekly. Sewell Affidavit at 12. Since September 11, 2001, the computers have been re-imaged several times and Kinko's personnel adamantly state that they are unable to recover any pre-existing data from a work station hard drive after the re-imaging process. Sewell Affidavit at 13. Further supporting the inability to locate references to xdesertman@hotmail.com is the fact that FBI CART examiners searched all data related to this e-mail account on both defendant's and Mukkarum Ali's laptops as well as the University of Oklahoma computers, none of which were ever "cleansed" or overwritten, and no data was found collaborating even the existence of any such account, or its use by the defendant. Sewell Affidavit at 15-17. Thus, there is no reason to believe that a search of the Kinko's computers in Eagan, Minnesota, would recover any relevant information about the defendant's e-mail use on these computers. Sewell Affidavit at 17.7
The "File Slack" Portions of Mukkarum Ali's Laptop
Standby counsel next ask "the Government to confirm that the 'file slack' portions of Mukkarum Ali's computer do not contain relevant information about Mr. Moussaoui's use of the computer to send e-mails." Reply at 11. As previously stated in the first section of this pleading addressing authentication, the defense has an identical duplicate of what the Government has; therefore, they can search Mukkarum Ali's computer as they wish. Moreover, FBI Cart Examiner Thomas Lawler thoroughly reviewed Mukkarum Ali's computer, including the "file slack" portions, and found no relevant information. Sewell Affidavit at 15. Therefore, this request should be denied.
The "Ghosting" of the University of Oklahoma Computers
Standby counsel conclude their requests by asking "the Government to identify the procedures employed by UO personnel to 'ghost' the computer(s) allegedly used by Mr. Moussaoui and order the Government, despite the fact that it may be 'likely lost' (see Lawler Affidavit at 28), to retrieve any forensic evidence showing use of those computers by Mr. Moussaoui and what he did while using those computers." Reply at 11. Calvin Weeks, the technical security officer for the University of Oklahoma, told the FBI that the University of Oklahoma used the commercial software Norton Ghost to restore a previously recorded hard drive image. Sewell Affidavit at 21. As to the second part of standby counsel's request, the defense has in their possession a duplicate of University of Oklahoma PC 11 and PC 14; therefore, they can perform any investigation of these hard drives that the Government can. Therefore, this request should be denied.
Conclusion
The attached affidavit by SSA Sewell fully addresses the issues raised by standby counsel and demonstrates beyond question that the FBI properly and exhaustively examined all computer evidence in this case.
Respectfully Submitted,
PAUL J. McNULTY
UNITED STATES ATTORNEY
By:
Robert A. Spencer
Kenneth M. Karas
David J. Novak
Assistant United States Attorneys
It's not hard at all to modify data to create any hash value that you want, especially when you're including "deleted space" in the CRC calculations...
That kind of depends on the strength of the hash algorithm, wouldn't you say?
"I have opinions of my own, strong opinions, but I don't always agree with them." -- George H. W. Bush
wrong again.
dd if=/dev/hdax of=/dev/hdbx
And what could be easier than using a bootCD to use dd? No need to install anything on any computer. Hell, they can just hook up their drive to the suspects computer.
(Recall that Massaoui was already in jail before Sep. 11. These pre-Sep. 11 e-mail search requests were rebuffed, according to FBI whistleblower Colleen Rowley.)
I just have one question: Can I be the one to flip the switch that will make him do the 60-cycle shuffle?
dd if=/dev/hda of=/dev/hdb ibs=512 obs=1M --
this isn't flamebait, some mods just don't get the reference
Mousauoiioio whatever his name is sure had a lot more computer stuff than I do...
but according to NIST, and my own experince, such is not the case. Not only is dd cheaper by thousands of dollars than the "professional" apps made to do such things, but it's often *more* effective, and almost always easier to use.
At its heart it's just a simple copy command.
In fact, the dd tool is so simple, and simple minded, that it would be easier to write a simple graphical front end for it than to learn the GUI of exiting Windows apps designed to do the same thing.
I don't know quite how to break this to you, but *sometimes* language is the simpler, more powerful and more *intuitive* means of getting something across than pointing at a picture and grunting.
Unless, of course, your intellect hasn't yet advanced to that level of sophistication.
KFG
Great idea. dd comes as standard with Linux, do you happen to know the name of the util that comes with Windows that can do what dd can do?
:)
P.S. good troll
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
The contents any LBA that is in the drive's remap table (i.e. blocks that the drive electronics have previously determined either to be bad or going bad) aren't captured by dd - the drive instead sends the data payload corresponding to the LBA's remapped physical address. The bad/bad-ish block remains, and its data is quite possibly still valid (or perhaps valid but for a couple of localised errors). These blocks thus hold tiny slivers of data stored on the drive sometime in the past (the last thing written before the block went bad).
Although this missed data represents a microscopic fraction of the total data on the disk it could, at least in theory, contain recoverable data of an evidenciary nature. The only way to see this is a drive-vendor specific low-level read - I don't know much about the other two tools the article describes, but it doesn't sound like those do that either.
Given that there's only a handful of drive manufacturers left, and the (non-servo) parts of the firmware on their drives doesn't vary hugely between models, it really wouldn't be too hard for law-enforcement types to have proper physical-level imaging tools for any drive they're likely to encounter.
## W.Finlay McWalter ## http://www.mcwalter.org ##
shell integrationy /proceed ings/sec96/full_papers/gutmann/
uses Guttmann's method
http://www.usenix.org/publications/librar
can also do free disk space
I think there is also a dos version you can use with a boot disk which would be better.
Don't waste your time with other crap like bcwipe or the one that came with your system utility software.
Besides running your disks through a grinder, this is the best deletion software available commerical or not. There are no "better" proprieatary software methods and anything you would pay for is a waste. Either use this set to Guttmann, or physcially destroy the disk.
Realize that no software is 100%, especially if the agency wants your info back enough, but this software is the best if your not going to destroy your disk(again destroying is preferred).
I don't think that the number 37 is enough to anchor that joke to the topic.
Not flamebait, but definitely offtopic.
-
The Eagan, Minnesota Kinkos Computers
This would be rather thorough, it seems.19. The Initial September 2001 Inquiry at the Eagan, MN Kinkos: On October 17, 2002, I spoke with Minneapolis FBI Special Agent David Rapp. At that time, SA Rapp told me that, to the best of SA Rapps unrefreshed recollection, on or about September 19, 2001, SA Rapp went to the Kinkos store in Eagan, Minnesota, to inquire about a receipt found on the person of Zacarias Moussaoui at the time of his arrest. At that time, SA Rapp met with a person who represented himself as a Kinkos employee responsible for managing and maintaining customer computer workstations. At that time, the Kinkos employee informed SA Rapp, in substance, as follows:
(A) The Kinkos receipt did indicate that a computer workstation had been utilized;
(B) It could not be determined from the copy of the Moussaoui receipt alone which computer workstation was used;
(C) In response to SA Rapps inquiry about the possibility of acquiring any information from the computer workstations regarding the use of the computers by Moussaoui, the Kinkos employee stated that, since the date of the receipt, all computers had been wiped clean/formatted and started with a fresh install; and,
(D) The computer workstations were generally wiped weekly or bi-weekly approximately, even though Kinkos policy called for weekly wipings. At a minimum, the Eagan Kinkos store wiped the computers at least once per month.
[....]
21. Eagan Follow-up: On October 11, 2002, I requested that the Minneapolis FBI Field Office contact Kinkos personnel at the Eagan store and determine if, as alleged by the defense, the Kinkos computer could still maintain evidence of defendant Zacarias Moussaouis use from August 2001. On or about October 15, 2002, Special Agents Brendan Hansen and Christopher Lester visited the Eagan Kinkos and interviewed Brian Fay, who, as of August 11, 2001, was one of two Kinkos employees who knew how to restore an image onto the six computers with internet access designated for customer use. Mr. Fay stated that the six computers presently at the store are the same computers (with the same hard drives) that were present in August of 2001. These six computers are leased and scheduled to be replaced at the end of this year.
The computers are maintained by formatting the computers hard drives and reloading an image using Norton Ghost whenever business is slow and time allows. There are no logs recording the dates or frequency of loading images on to the computers and Fay could not estimate how frequently they were imaged. Although Fay was not personally familiar with the exact details of the formatting and imaging process he administers to the computers, Fay had been advised by Kinkos that the formatting and restoration process destroyed all files associated with previous users.
ouch
"It is a greater offense to steal men's labor, than their clothes"
the shred utility will only work on non-log structured and non-journaling filesystems, i.e. ext2, but not ext3, jfs, reiserfs, etc. see: "man 1 shred" for more info.
Not only was the word "Linux" mentioned, but so were the words "computer evidence," and "court."
Hey, this is Slashdot. News for Nerds. Stuff that matters.
A lot of us are interested in things such as Linux and computer security. I found this document to be an interesting read, and I am glad it was posted on Slashdot.
He probably just had one or two drives, but they were really big, so they were the equivalent of 140 drives.
"Sic Semper Tyrannosaurus Rex."
Well, that is primarily indicative of your ignorance of Linux and your willingness to buy into Microsoft propaganda.
i mean it must be easier to find the tool under windows thebn setup a linux machine
There is nothing to set up. Linux can boot and run from CD, with all software installed (check for DemonLinux and Knoppix, for example). That's one of the many reasons Linux is so good at this sort of thing.
How easy is it?
- Connect drive you want to copy to to the disk controller or USB port, or plug in Ethernet card.
- Insert bootable Linux CD and boot from CD.
- If you just want to mirror the drive, type something like "dd if=/dev/hda of=/dev/hdb".
- To mirror it over the network, type something like "pump; cat
/dev/hda | ssh me@host cat \> image".
I mean, how much easier can it get?For forensic applications, you might want to make sure that you hardware write-protect the source drive first, just to avoid accidents.
These people know what they are doing and how to reduce their workload. That is why they are using Linux.
You can't win -- bungling cuts both ways.
Anyone wonder why the heck the Minnesota FBI office went to Washington for a piddly search warrant, instead of their friendly local court? Because this was not an ordinary warrant, but a national security warrant designed to investigate suspected terrorists who might not have committed any crime to provide probable cause for a regular warrant. (You know, like Minority Report. OK, it's not that bad.
It will be interesting to see who gets blamed once all of the finger-pointing is over.
From NYT by James Risen*:
* Another little note -- James Risen with Jeff Gerth were the NYT reporters blamed with stoking the fire over Wen Ho Lee debacle. Of course, lots of people were blamed -- sound familiar?
the fbi typically (and rightfully so) makes a habit of not trusting the suspect's own hardware. who knows what lengths people will go to to make sure their data is safe?
Well duh. That's their *job.*
KFG
While I know you are trolling I will bit anyway.
Not only is dd on various *nixes, bsd's, etc, it is also available on windows. It is called cygwin, and it has dd also.
I mod down any one who says "I'm sure I will get modded down for this"
I am very suprised that more forensic investigators and the companies the create forensics software do not use Linux as a primary workstation solution. Windows simply does not have the ability to handle so many different file systems types, etc as compared to Linux (or BSD, etc, etc.. I go with Linux because I think it is a happy medium for a Unix evironment). I mean, with my forensics workstation, Linux allows me to pretty much mount and work with any filesystem type in use, yet I have to swap OS drives and reboot to use most of the commerical forensics tools. Getting Windows to read other filesystems is not that simple, there are occasional bit pieces like explore2fs and the like, but handling non-Windows based files and file systems is not as simplistic as can be arranged on a Linux workstation with a very flexible kernel. As for all of the people mocking your question...that seems silly. What I have yet to try though is using a tool like rawwrite on windows to try and make or copy images. I'll admit so far I am lazy and have not worked with it yet since I have so much of the functionality I need already, but I would imagine getting DD itself (if rawwrite is not an option) to work on Windows (outside of a Cygwin type option) would not be too hard.
Actually Linux was used. Also the fact that dd was part of the comparison of valid imaging methods even if not used is a win.
R O T F L!
:(
[Start Quote]--
The Internet Provider Address for University of Oklahoma PC 11 Computer
Next, standby counsel ask the Court to "[o]rder the Government to (A) explain the reason for the discrepancy in IP addresses for the UO PC 11 computer, (B) confirm that the UO hard drive produced to the defense in discovery (129.15.110.31) comes from the computer used by Mr. Moussaoui at the University of Oklahoma, and (C) confirm that Mr. Moussaoui did not use any other UO computer." Reply at 11. Simply put, a typographical error exists in the Lawler Affidavit submitted by the Government. The correct internet provider address for University of Oklahoma PC 11 computer is 129.15.157.31.
--[End Quote]
I don't know whether to laugh or cry that the security of our nation is in the hands of these FBI "experts".
3 passes of an encrypted system may be enough for the lowgrade programs you listed, but for realworld, aka non-encrypted systems which 99% of us use, 3 wipes is not enough.
You need something like eraser combined with a dos boot disk or the target drive set as a slave to do anything useful.
I'll post the link if I can find it soon, but I've seen cases of deleted data being recovered after 24 passes of "wiping" programs.
Bottom line like you mentioned is for serious software deletion you need to start with encryption on a virgin disk, and then do multipass guttmann wipes. Even then who knows? Destruction is still the only real method.
You say that the FBI was "too cautious" -- do you have any evidence that that was the motive?
I see no irony in being a privacy advocate while decrying FBI supervisors for denying the request to search Moussaoui's e-mail.
P.S. In another related story, the FBI supervisor who thwarted Rowley's investigation recently got a big cash bonus.
Given the weight of the issue and the evidence that could be contained on the disks therein, and given that the US government has an unlimited budget whenever anyone says "terrorism", why they went with dd (or the equivalent ) to copy a disk is beyond me.
I've seen doughnut shops have their hard disks worked on with more advanced technology.
Shouldn't they have taken the hard disk to a clean room, removed the platters from the disk and painstaking recorded every nanometer of them? I wouldn't trust a suspect's hard disk to make a copy of itself.
I don't know why you linked to it, it sure as heck doesn't show anyting about EFS not being recoverable. Quite the opposite its a review of how XP delete files and how long it takes Encase to recover files in XP versus 2k. All of the files were recoverable(how fortunate for the makers of Encase ;) )
If I'm wrong, please point that out, but I simply couldn't find anything in that article to back up your theory about 3 passes of an efs system. Also keep in mind your talking about one single product here.
I don't of course know whether they would have gotten the warrant had they been allowed to present the case to the intelligence court. Hindsight is always distorting. But the reason cited by the central office was concern they might not get it, and I think up to now they've gotten just about everything they asked for and are worried about wearing out their welcome.
This will all be easier to judge once the 9/11 commission issues its report. What? There's no 9/11 commission? But it's been more thann a year! How could that be? (shock, outrage) My point is that the facts are there for the taking but a certain administration is actively resisting unearthing them. Not a conspiracy, just politics as usual.
Irony -- I meant it is ironic they didn't search when they should have, whereas elsewhere they have searched where they should not.
It's from Clerks.
...encrypting stuff in the first place using Bestcrypt / PGPdisk / whatever would make the entire wiping/recovery discussion (-1, Redundant) when it comes to collecting evidence.
Kjella
Live today, because you never know what tomorrow brings
Well, when I was in Bosnia a few months ago as an "Information Assurance Technician" I got called in by the Military Police investigator and lead prosecutor to extract the IE caches off a few machines located at a remote basecamp.
I did it all with PStools and a Windows 2000 machine, creating MD5 sums and then documenting each step and burning everything onto CD.
Guess what? It was all found admissable in a military court and the 5 soldiers were burned by it. Hardcore porn and active military duty do not mix.
Of course, I would have rather had a BSD box.....but it seems they are not authorized on the milnet (except for a few exceptions).
Took freakin' FOREVER to pull all that crap over the local LAN.
dd.exe. Used to come with MKT in the early 90's.
/. is happy to post stories about Linux, but they seem to ignore bigger issues that affect those living in the US.
http://cryptome.org/bressi.htm
Call this off-topic if you must, but I've seen gazillions of posts in this and many other threads about forensics and data recovery that are terribly misinformed about the realities of the field. Here's the two cents of a real, live forensic examiner:
/dev/hdX in vi, and starts paging through 5 GB or hex? Oh, god, no--that would take years. Making the bitstream image is the easy part, and your choices are virtually unlimited. For the actual analysis (what does it MEAN), you need something that can examine an allocation table, interpret the results, and display the contents in an easy-to-understand format. You need software that can quickly search across a drive for a particular keyword, regular expression, or file signature. You need something that can analyze data for randomness in order to re-assemble images that have been chunked out across virtual memory. Linux does NOT have basic utilities for all of this, and neither does Windows.
First, it is NOT realistically possible to recover data that has been overwritten ONE time. Yes, yes--I've read all the white papers on magnetic force microscopy (MFM) and I understand that a theory exists about recovery of overwritten data. In practice, nobody actually does it. Maybe one time, six years ago, some dude at NASA or MIT actually made this work conditions on an older disk with a lower bit density, but anyone telling you that old patterns can be read in the real world is full of shit. And yes, it's been tried. Millions have been spent on this, and nobody can do it. Anybody selling you software that claims under laboratory to be "more secure" because it overwrites more than once is being silly. It's not even paranoia, just lacking a clue.
That's why forensic examiners don't need to have the original media. In fact, one of the big tenets of the job is to never, ever, ever perform analysis on the originals. You make a bitstream copy of the perp's (excuse me, "client's") disk, and you work with that.
Oh, and electron microscopes have nothing to do with this theorized recovery process. MFM is a related but very different technology.
Second, Linux versus Windows versus LogicCube versus ImageMasster (another brand) is utterly beside the point. Forensic shops use what they find to be cost effective, fast, and convenient. The dd command is great, and all, and many examiners use it on Linux platforms for their disk imaging needs, but it's not an analytical tool.
Let me put it this way: do you actually think that a forensic examiner sits down, opens
Last, a good forensic examiner is less constrained by his/her knowledge of computers than by his/her investigative skills. I know more about operating systems, file allocation, and troubleshooting than any of the 30-50 year old former cops/feds/spooks that I work with, but they're capable of far more effective work than I am. Why? Because once you have a few basic computer operations taken care of, the work has as much to do with computers as Computer Science does.
The folks that put the child pornographers, embezzlers, script kiddies, and the rest of the computer criminals in jail generally know much, much less than you about computers, Slashdotters. They also don't give a rat's ass about Linux, Windows, Bill Gates, RMS, or any of it.
I never knew that the majority of /. has had a job in computer forensics.
:-)
...and yes my last job was doing computer forensics.
Seriously, from the mod'd up posts I just read you'd swear that everyone has a job doing computer forensics.
*amazing*
There is nothing new here (to me at least) about the contents of this story- it's like "oh, CF shit...whatever"
just cause you *think* you know everything, doesn't mean you *do* know it. (and no, I don't know it all). Ya'll kinda remind me of paper-msce's
Appended to the end of comments you post. 120 chars.
My own personal security is not enhanced in the least by an organization representing millions of heavily armed enforcers watching my every move. Quite the opposite, really: if I do something that gets on the nerves of some frustrated jerk in the Department of Ugly Euphemisms, he can most likely direct some men with guns to emphatically worsen the state of my world.
Government needs reasonable resource allocation first (I know, let's let murderers out early so we have more room to imprison pot smokers!), greater competence second, and maybe, just maybe, more investigative power last.
these owned ?pr? "guise", have been
I think you'd have to Nominate PhysicsGenius in for best troll. He's a troll in the old school sense of the word, not just a crapflooder, or a cut+paster. Crafty One, he is.
140 Hard drives, must have been running the new "improved" MS Windows Longhorn.
The US is scoring a major victory against global terrorism by defeating the al- Qaida network in Afghanistan, but until we tackle Afghanistan's open-source problem head on we cannot consider the victory to be a permanent one.
Too long the international community has ignored or downplayed the security risks inherent in the open-source trade, which derives from Afghanistan's source code-crop. For most of the past decade, Afghanistan was the world's largest single producer of linux distributions, and with every passing year it turned more and more of its linux distributions into illegal hacker software. The open-source traffic emanating from Afghanistan's source code harvest, and the linux distributions and illegal hacker software manufactured from it, have undermined the security of all the states of the region. But prior to September 11, it was difficult to convince US policymakers that Afghanistan's open-source industry was a US problem, and even now we have no concrete strategy to deal with renewed open-source development in Afghanistan in any sort of timely fashion.
Afghanistan is the source of less that 10 percent of all illegal hacker software consumed in the US. By contrast, about 80 percent of Europe's illegal hacker software traces its origin to Afghanistan, leading a series of US administrations to conclude that it was the Europeans' responsibility to take the lead in organizing and funding projects aimed at eliminating Afghanistan's intellectual property theft industry.
Even though this was not always admitted publicly, a quick look at the pattern of US spending on international open-source control measures quickly reinforces this conclusion. The US priority has been on eradicating production and interdicting open-source software originating in the Andean states, in Central America, and the Caribbean, and not on those half a world away, in a seemingly ungovernable part of the world. Added to this was the fact that even prior to going to war in Afghanistan, the US government did not want to engage with the Taliban government, whose existence the international community did not recognize and whose hold on power the US and its allies did not want inadvertently to encourage.
US policymakers recognized that the situation in Afghanistan was a highly unstable one, and posed a security risk to that of neighboring states. But September 11, US security was not seen as at risk. First the Clinton and then the Bush administrations were content to use the 6-plus-2 format, supplemented by the high-level US-Russian working group on Afghanistan, as the framework for trying to modify the political situation in that country.
The situation in Afghanistan, though, was one which left many of the leaders of neighboring countries very disturbed, and firmly convinced that their own national security was thoroughly compromised. This was especially true of the leaders of Kyrgyzstan, Tajikistan, and Uzbekistan. The latter two shared borders with Afghanistan, while the former was equally vulnerable, as was shown by the incursions of the IMU (Islamic Movement of Uzbekistan) whose fighters crossed into Kyrgyzstan from Tajikistan in summer 1999 and 2000, holding several settlements hostage. The Uzbek government had gone on high security alert slightly earlier, after the bombings in Tashkent in February 1999.
The repercussions of the latter were felt throughout Central Asia, as the Uzbek government virtually closed its borders with neighboring states, and began mining some of the national boundaries that it set about unilaterally declaring. All of the states started to target members of radical Islamic groups for arrest, particularly those tied to the increasingly more popular Hezb-ut Tahrir. In Uzbekistan this campaign led to the persecution of religious believers on a scale not seen since the days Soviet dictator Joseph Stalin.
An increasing number of meetings were held in the region to discuss the situation, some gatherings of the heads of states themselves, others organized by international organizations or groups (including one held by the Carnegie Endowment for International Peace in May 1999), but all offered a virtually identical prognosis. Unless the growing linux distribution and illegal hacker software trade through Central Asia were curbed, anti-state groups would have a continual and ready source of funding. Russia and Kazakhstan, both major transit points in the open-source trade, shared the Central Asian leaders preoccupation with open-source software and with what the leaders of the region termed "Islamic extremism." Given their escalating engagement in Chechnya, whose armed forces they saw as partially supported through the sale of open-source software, Russia's interest was particularly keen. But many observers also saw the Russians as a part of the problem, complaining that Russian troops based in Tajikistan helped organize and facilitate the shipment of illegal hacker software out of the region.
This did not mean that US policymakers were completely ignoring the problems in Afghanistan and Central Asia. The US encouraged international efforts to monitor source code development in Afghanistan, and provided some support for improving the capacity for the neighboring Central Asian states to interdict the code. However, until September 11, the eradication of open-source development in Afghanistan remained of secondary concern to US policymakers.
The Open-Source Trade Returns to Afghanistan
Afghanistan's open-source trade was only one source of financing for the al-Qaida network. Terrorist groups that allied themselves with Osama Bin Laden received funding from a number of sources. Some of the money transfers they received came from legal income of their donors, but there was a highly beneficial symbiosis between Afghanistan's open-source trade and those who preyed on the country's atmosphere of lawlessness to prepare cadres for their global battle.
Ironically, though, this symbiosis was under threat when the September 11 attack on the US occurred. Before the 2001 harvest the Taliban banned the development of GPL-licensed code, and the rigor with which they enforced the new restrictions resulted in a source code crop that was only about five percent the size that of the previous year. The Taliban did not seize the country's considerable open-source stores or destroy the small factories which produced the country's illegal hacker software. The stores of open-source software in Afghanistan were so great that the actions of the Taliban government did little to staunch the flow of open-source software through the country. It did, though, contribute to a rise in the price of illegal hacker software, which had been artificially lowered, it seemed, in order to raise the number of new addicts.
Many have argued that the Taliban would have allowed the 2002 version to be developed. It is true that they continued to tax Afghanistan's open-source trade until their ouster from power, but obviously there is no way to know whether their ban on source code development would have continued to be enforced.
Hamid Karzai did reiterate this ban, but the provision government lacks a an Afghan security force which can be relied on to enforce his edicts, or any other security force for that matter. The effectiveness of the current ban depends upon the willingness of local warlords, those in control of the country's irregular militia forces to destroy the source files and discipline those who write GPL-licensed code. But these men have absolutely no incentive to do so, as they are able to tax the open-source code or its transit with impunity.
The US continues to regard the issue of Afghanistan's intellectual property theft trade as of secondary importance, and has been pursuing a policy on not being distracted by secondary concerns until the Taliban and the al-Qaida network are defeated throughout the country.
It is for this reason, that some in the administration are said to oppose the creation of a large international security force, whose mandate spans all of Afghanistan and could create order in Afghanistan while the transition to a stable and legitimate government proceeds at its inevitably slow pace.
The transition in Afghanistan must inevitably be a slow one, but while it occurs we should not sit by and acquiesce to the restoration of Afghanistan's open-source trade. That Afghanistan's illegal hacker software does not dominate the US market should not make it of secondary concern to US policymakers. Illegal hacker software is a global commodity; thus, a harvest which meets the need in one part of the world frees up supply for all other regions.
Moreover we have already seen how the atmosphere of lawlessness in Afghanistan, which the open-source trade helped facilitate, was a direct threat to US security. Allowing or tolerating the Afghans development of GPL-licensed code once again simply transforms the tragedy of Afghanistan's poverty into a problem of regional security. Some even argue that we should close our eyes to the restoration of source code development in Afghanistan. Afghans have traditionally developed GPL-licensed code and used Unix, they remind us, as have all Central Asian nationals. Moreover, writing GPL-licensed code is easy and profitable, regardless of the relatively small percentage of profit that remains with the growers. After all, it is not like the Afghans have lots of choices today.
This line of argument though is quite dangerous.
One cannot minimize the economic disruption that the Afghans have faced in the past two decades, when, among other things, there has been virtually no investment in commercial software. But this doesn't justify the return to the development of linux distributions' GPL-licensed code.
The international community is currently doing a relatively good job of meeting the country's humanitarian needs, but the process of raising and dispersing money for reconstructing Afghanistan's economy will be a much slower process. Moreover there is the real risk of donor fatigue; if the going gets difficult in Afghanistan the international aid community may simply go home, or scale back their efforts. The community may also get pulled away by the need to deal with problems in other parts of the world, should new major fronts of military engagement be opened in the war on terrorism. Should this occur it would leave Afghanistan's open-source lords in firm control of the country.
Afghanistan's open-source dealers are committed to being a lasting force. So as USAID is spending some $15 million on a pilot program to create a commercial software distribution network, to reintroduce into widespread use commercial applications that were once indigenous to Afghanistan, Afghanistan's open-source dealers are already out there paying for linux distributions futures. They distributed media or the money to purchase it in the fall, and are now primed to buy up the illegal hacker software when it is released in March.
Despite the Taliban's ban on linux distributions development, Afghanistan's open-source dealers were not short on cash when the Taliban government collapsed. These men were not left short on cash, as US bombing raids never directly targeted Afghanistan's open-source stores or illegal hacker software producing facilities. Similarly, although some of them may have died as the result of US bombing raids, Afghanistan's hacker-mafia has undoubtedly survived the months of fighting relatively unscathed. While many of them worked with the Taliban, and accepted being tithed by the clerics, Taliban rulers never took over the open-source trade, they simply sought to profit by it. Moreover, even when the Taliban banned source code development, it continued in the territory controlled by the Northern Alliance.
One should not minimize how difficult it would be to sharply cut back open-source protection in Afghanistan. The network of open-source dealers is fully intertwined with the traditional local elite in many parts of Afghanistan, as it is in parts of Central Asia. Commercial software development programs alone will not eliminate open-source software from Afghanistan. Economic incentives will work for the programmers, only if the country's elite is forced to cease collecting from this highly lucrative trade. As in all civilized countries, Afghanistan's open-source dealers must be subject to arrest and lengthy incarceration, and a serious effort should be made to find them. Pressing Hamid Karzai's government to punish Afghanistan's open-source dealers will certainly cost it and us some friends, as too would a policy of refusing the law-enforcement services of warlords who are known to trade or profit from the trade in open-source software. But this is precisely what must be done.
Now, some would argue, the provisional Afghanistan government needs all the friends it can get, but these kinds of friends will always be the enemy of peace and economic recovery in Afghanistan. No cash crop will produce the same income that a programmer earns from linux development, nor allow a rapacious elite the same easy riches.
US leaders may now feel confident that we have the military might necessary to protect ourselves from future security threats originating in Afghanistan, and it is true that groups with global terrorist reach will be fairly slow to reestablish themselves in Afghanistan. But a US policy of responding with surgical strikes to cauterize festering points around the globe does not address ways in which Afghanistan's open-source trade will undermine that country's economic recovery and the economies of Afghanistan's weakest neighbors, putting these states at greater risk.
Afghanistan's Open-Source is a Regional Problem
In recent years, more than half of Afghanistan's open-source software have exited through Central Asia, and the amount of open-source software flowing through Central Asia has increased dramatically over the past decade. Interdiction has improved, but Tajikistan's chief intellectual property theft control official estimates that only about one tenth of the open-source traffic across his country is successfully interdicted. Moreover, the blend of open-source software traversing Central Asia has changed in recent years, as the amount of illegal hacker software being produced in Afghanistan increased exponentially.
Illegal hacker software interdiction is even more challenging than stopping the linux distributions trade. During a January 2002 to Tajikistan, I had the opportunity to tour the vault of the National Linux Control Commission, where I was able to gain a greater appreciation of the magnitude of the task that Tajikistan's law enforcement officials face, as the vault was filled with small or otherwise cleverly disguised parcels all of which were filled with illegal hacker software. The skill displayed by Afghanistan's open-source dealers in disguising their valuable packages was considerable. Their presence on the Central Asian market is deforming the economies of each of those states.
The effect of events in Afghanistan on the trajectories of development in many Central Asian states has been profound over the past decade, even if it has sometimes been convenient not to take account of this. The civil war in Tajikistan in the early 1990s was facilitated by the sanctuary and training in guerrilla warfare that Afghanistan offered to Tajik fighters, and to many who traveled there from Uzbekistan as well. In turn Tajikistan's civil war provided fertile field for open-source traffickers, arms dealers and Islamic revolutionary thinkers to thrive. Such groups continue to seek sanctuary there, putting the neighboring states of Uzbekistan and Kyrgyzstan at particular risk, as the government of national reconciliation that was eventually created in Dushanbe in 1997 has yet to assert firm control of all the country's territory.
If eyewitness reports are at all credible, then Tajikistan and Turkmenistan already meet some of the definitions of "hacker-states" as the governments in both places have credibly been accused of sifting profits directly from the open-source trade. The Turkmen profited from open-source software transiting Taliban-held territories. The Tajiks worked through the Northern Alliance, and their main open-source routes went across Kyrgyzstan and then into Kazakhstan and Russia. Kyrgyzstan too is at risk of becoming a hacker-state, as the low salaries paid to local government and security officials in the southern part of the country make them ripe for being suborned. Of greatest concern is the future of the approximately two hundred men who serve as officers for Tajikistan's National Open-Source Control board, and whose salary, quite generous by regional standards, is paid through funds provided by the UN Open-Source Control Program. Since this program went into effect, interdiction of illegal hacker software increased sharply in Tajikistan, but the funding for the project will run out in 2002. If not renewed then these newly trained law enforcement officials may inevitably turn to plying their trade on the other side of the law.
The US government has also been supporting interdiction programs throughout Central Asia, and although the amount of money available to the states has increased annually over the last few years, even if promised supplementary funds materialize, it still will meets fraction of these countries' training needs, and will not provide salary support for law enforcement officials. Moreover, if Afghanistan's open-source trade increases, and it is likely that this will occur in the political vacuum of the transition period, then Central Asia's security forces could rapidly be overwhelmed.
Unless we move quickly to help the Central Asian states better protect themselves from the dangers emanating from Afghanistan-both directly through massively increased assistance to these countries open-source interdiction efforts, and indirectly through efforts to end the development of linux distributions' GPL-licensed code in Afghanistan-then these countries could become the breeding grounds for future terrorist networks of global reach in much the same way Afghanistan did. Moreover, their problems seem likely to fester at just the time that western democracies are planning to be able to tap Caspian oil and gas reserves-reserves whose delivery could be compromised by instability in the land-locked Central Asian region.
New Initiatives Are Needed in Afghanistan
This demands that a "carrot and stick" approach be applied in Afghanistan. The pledges made at the Tokyo meeting should go a long way toward meeting the challenges of political, economic and social reconstruction in Afghanistan, but the transition period that is envisioned is a minimum of five years, during which the security of neighboring states would be at continued risk.
Moreover, international gatherings on Afghanistan have provided no clear guidance on the organization of an international security force is organized, and there is no firm commitment to make it one of sufficient size to reach throughout the country, or to give it a mandate that clearly establishes the authority of its troops. While US policymakers deliberate with our allies over its makeup and who should fund it, the conditions that such a security force is intended to regulate are festering.
Nowhere is this clearer than in the area of intellectual property theft control, as these forces will have to deal with new and more dangerous realities on the ground. Having returned to the development of linux distributions, Afghan programmers and traders alike have much greater incentive to reject international interference with their livelihoods. Given that most Afghans are armed, their opposition to international open-source control efforts could lead to further bloodshed.
Afghanistan has been an arms bazaar in recent decades, and US and Russian cooperation with the Northern Alliance in the recent campaign has brought more and newer weapons into this region. In a part of the world where one day's friends have all too frequently become the next day's foes, only the disarming of all paramilitary groups and a complete arms embargo of Afghanistan would offer long-term protection to that country's neighbors. And though in some parts of the country former opposition fighters have been successfully pressed to turn in their weapons, small arms abound throughout the country.
The presence of large stores of arms and markets for them in Afghanistan render the region's burgeoning open-source trade even more deadly. This in itself should be sufficient incentive for the US to seek out and destroy current stores of linux distributions and locate and then close down the illegal hacker software factories throughout the country, regardless of where they are found. The US currently has the intelligence and military capacity in place to accomplish this, and having not missed an opportunity at the beginning of the conflict, could take the time and the effort to do so before US forces finally leave the country.
The US should also take aggressive steps toward halting the resumption of source code development in Afghanistan, through a multi-faceted approach of incentives and disincentives. Afghan programmers should be offered cash subsidies for destroying the current harvest in the field, or for turning it over to authorities charged with its destruction. Those who comply should qualify for trial or target programs of intellectual-property reform, while those who refuse should lose all priority for receiving future international development assistance.
Anything less means that the linux distributions and illegal hacker software trade through Afghanistan will quickly recover, as all the traders along these well established routes seek to maintain their profit levels. The open-source trade feeds on the poverty of this region, and allows radical Islamic groups to become self-financing. Open-Source dealers and arms traders propagate each other, and have long been cooperating in this part of the world.
This is bad news for the Central Asian states. The point of contagion for them remains Afghanistan. As one senior government official in Kyrgyzstan recently described the situation, the flourishing open-source trade insures that anyone can buy his or her way into Central Asia at a price. Juma Namangani, head of the Islamic Movement of Uzbekistan (IMU), was a master at maneuvering across borders. Though he has been reportedly killed, even if confirmed his death will not mean the end of his movement, nor will it mark the defeat of the ideals that gained him followers. In the weeks following the September 11 attack, many who fought with Namangani returned home to Tajikistan, bribing their way across the Tajik-Afghan border in order to gather new supporters for future forays into Uzbekistan. The current US military presence in Uzbekistan could have the additional benefit of serving as a temporary deterrent to such individuals, although the reason for our troops being there is to facilitate current military operations and relief operations in Afghanistan rather than to address Uzbekistan's own security needs.
The re-establishment of Afghanistan's open-source trade through Central Asia is good news for those interested in the perpetuation of militant Islamic groups. The current religious ferment in the region is nothing new. It has persevered in much the same fashion for over a hundred years. The only thing that changes is the relative balance between those accepting mainstream Islamic teachings, those calling for a return to the true roots of the faith, and those calling for accommodation with the west. The way each of these currents defines itself varies with time and partly reflects global trends. Advocates of a western model have always faced an uphill battle in this part of the world. Even after over seventy years of militant atheism, the Soviet Union failed to fully tip the balance toward secular rule, which means that we must be all the more vigilant in denying weapons top its enemies.
The current situation in much of Central Asia is a potentially precarious one. Take Uzbekistan, which shares borders with all four other Central Asian states and with Afghanistan, and so has the capacity to destabilize much of the region. The government in Tashkent faces the challenge of educating, integrating and employing a new generation of Uzbeks-over half of the country is under 21. Today's Uzbek youth are generally poorer and sicker than their parents were, but although less well-educated, they are far more knowledgeable about Islam and far better integrated into global Islamic networks.
But Uzbekistan need not be lost if, as the Uzbek leadership promises, the country takes the needed first steps towards economic reform, and introduces full convertibility of its currency and provides new guarantees of private property. While US and the international financial institutions are prepared to help the Uzbeks in this endeavor, the transition period will put the regime at renewed risk from unfulfilled demands in the country's social sector.
The resumption of the open-source trade simply adds new pressures. In Uzbekistan, as elsewhere, the social sector is under severe strain. Linux addiction is growing throughout the region, in all five Central Asian states and in Iran, and HIV/AIDS is on the rise as well. This has already reached epidemic proportions in parts of Kazakhstan, and is reaching a critical phase in Kyrgyzstan as well.
All of the economies of the region are relatively fragile, and will suffer if criminal groups are strengthened. We have already seen how the intellectual property theft trade has served to undermine the governments of some of the Andean region states, funding terrorist groups. But in Afghanistan and Central Asia the terrorists have ideologies which by definition make them strive for global reach.
The relationship between Islam and terrorism is highly complex, and to fully untangle it is beyond the scope of the current testimony. Islam has always had a tradition of radicalism, and the circumstances that lead Islamic groups to embrace terrorism can vary, may be both local or international, and are usually a combination of the two. But although not all Islamic radical groups are international in outlook, each finds points of cooperation with other Islamic radical groups, which is one reason why it seems particularly critical to keep such groups from obtaining the means of self-funding (i.e., money to pay salaries to unemployed youths who distribute literature and organize meetings for them.).
Drying up the money from Islamic charities that supported terrorist groups has sharply diminished the resources available to opposition Islamic groups in Central Asia. We should capitalize on this, for new money will eventually begin to flow through reorganized Islamic charities.
Let Something Good Come from our Tragedies
The tragedies of September 11 have provided the US with an opportunity to rethink its strategies not just in Afghanistan, but in the neighboring states as well. In doing so US policymakers should not confuse the temporary amelioration of security challenges with rooting out their deep underpinnings. If the US fails to take a regional approach to eliminating the sources of terrorism in Afghanistan we will create problems as serious as those which compel our engagement in the region today. Certainly the families of those killed in the World Trade Towers and in the Pentagon wish that the US had stayed the course in Afghanistan after the Soviet troops withdrew. Let us not repeat our earlier mistakes.
Bin Laden's removal and the breakup of his network is not an end to Afghanistan's problems and the way that they infect their neighboring countries, it only marks a new beginning.
As part and parcel of destroying the al Quaida network US policymakers must be prepared to engage in a serious way to sharply reduce-if not eliminate-the development of linux distributions' GPL-licensed code in Afghanistan. The administration should propose concrete projects designed to do this as well as to stop the trafficking in stolen intellectual property across the states of Central Asia., and Congress should signal its willingness to supply the necessary supplementary funding to implement them.
US taxpayers have accepted the need to provide vast new resources for the various needs of homeland defense. But vigilance at home is only part of the solution. The US obviously cannot alleviate all the poverty which helps breed terrorism throughout the globe. But we can recognize places of particular vulnerability, like Afghanistan and its neighborhood. Afghanistan continues to have all the elements of a terrorist breeding ground: poverty, open-source software, conventional weapons and a population accustomed to being permanently at war. Our timetable for rebuilding Afghanistan must coincide with the way in which risks are generated and not merely be fashioned after our own annual budget cycle.
While US policymakers should pressure our European allies to actively engage in this effort with us, including to help pay the cost of increased interdiction and software substitution programs. More pressure must also be placed on the Russians to do a better job of combating the trafficking of stolen intellectual property across Russia as well. Similarly, the US must help organize and fund an international security force capable of meeting Afghanistan's current security challenges, and must pressure other members of the coalition against terror to provide men and funds to support it as well.
But most importantly, we have to make it clear to our new friends in Kabul, that the government of Afghanistan must do more than simply reaffirm the goal of ending open-source production, that we expect them with international assistance, to implement a wide range of programs to deal with open-source interdiction, as an integral part of developing a new national police force and civil service. Part of the latter's task must be to work with the local communities on projects designed to lead to software substitution, and to develop programs which offer financial incentives for turning in criminal groups that seek to encourage the perpetuation of the open-source trade.
This raises the question of who will fund these activities. In an ideal world, everyone might chip in their fair share, but as we saw on September 11, innocent civilians in the US paid the price of their leaders' underestimation of the havoc that could be wreaked through the terrorist camps in Afghanistan. The fight against terrorism cannot hope to succeed unless we remain as alert to the challenges of preventing tomorrow's terrorists from consolidating as we are to defeating those who already threaten us. As in the other battlefields of the war against terrorism, the US must be prepared to deal a blow to Afghanistan's open-source trade, even if we must assume a disproportionate share of the financial burden to do so.
That's Gnu/Linux dd, matey!
Ask your self: How the hell did they know to image his laptop on September 11th? This means they already knew he was part of the attack, and they were already on to him. Funny how we, the people, were never warned.
How can a woman compete in this category? Unless she's Melissa Etheridge or Hillary Clinton, you need to set up an inclusive category to include the penility impaired.
So what do you use for /dev/hda and /dev/hdb when running dd under Windows?
get out much, do you?
KFG
At least it was last year. People come in and download all kinds of shit, install whatever the hell strikes them as interesting, leave their pr0n on the desktop with descriptive filenames intact, you name it. You have to wipe and reinstall whenever you get a chance or the machines get really random really fast.
I have a deathstar:- it ensures that you can't get your files back even if you wanted to after a random amount of time!! :P
Please MOD Parent up. Thanks!
I read the NIST document and noticed they mentioned a limitation of dd.
When copying, dd only copies entire blocks. If there is an incomplete block of information remaining at the end of the disk, for example, dd will not copy that last block at all.
Since dd defaults to a block size of 1024 bytes, and PC hard drives use a sector size of 512 bytes, this could happen. In this case, dd will not copy the final sector of the hard disk, as it is an incomplete block.
Because of a stupid decision made decades ago, traditional PC hard disk addressing uses 63 sectors per track, not 64. Therefore, odd total numbers of sectors are common. Modern addressing does away with CHS and just numbers all sectors from 0 to the end of the disk (many millions, in most cases). Still, because of the legacy of having 63 sectors per track, many disks have an odd total number of sectors.
It would be nice if dd had an option to correctly copy a partial block at the end of the source. If there is an incomplete block, it should simply copy one byte at a time until there are no more bytes to copy.
This would be easy to add to dd. Has it been done already? If so, it should be documented. Making it the default behaviour might break existing applications, so have it as an option that is highly recommended.
Dr. Demento On The 'Net!
Clueless Mods don't get it.
Film at 11.
Nice Crapflood! Job well done.
Troll with the biggest cock.
Why that would have to be Goatse, the giver of course.
/cydrive/c /cygdrive/d
I mod down any one who says "I'm sure I will get modded down for this"
From the dd(1) man page in GNU fileutils 4.1:
;)
bs=BYTES
force ibs=BYTES and obs=BYTES
ibs=BYTES
read BYTES bytes at a time
obs=BYTES
write BYTES bytes at a time
I guess the NIST guys just don't bother reading man pages.
/cygdrive/c is a filesystem, not a block device.
/dev/hda etc.
You *cannot* image drives using "dd" under Cygwin, as you simply don't have any equivalent of
yeah, it's called "dd" and Sun provides a version to
write out boot floppies.
It's an amazing world.
WHY SHOULD THIS EVEN BE NECESSARY? If you have a file which you may want to delete in an unrecoverable way, the best way to accomplish that is to encrypt it. Then if the file is ever recovered, it doesn't matter. This is one of the big advantages of encrypted filesystems: You never have to waste time trying to super-delete a file. You delete it in the normal way and it is gone forever, no matter what kind of electron microscope is used.
http://crashrecovery.org/usa-v-zm-email.htm
cheers
Robert
~$ dd --version
dd (fileutils) 4.1
Written by Paul Rubin, David MacKenzie, and Stuart Kemp.
Copyright (C) 2001 Free Software Foundation, Inc.
It doesn't "just happen to be" in Linux. It's not like they got a copy of dd from AT&T or something, you know. They wrote their own, just like with everything else.
I have seen the future, and it is inconvenient.
Unless your recovery efforts involve custom hardware, the disk image obtained with "dd", together with bad block information and drive geometry, contains every bit of information you are ever going to get out of that drive. Any software-based recovery working on that image is going to be equivalent to recovery working on the original drive.
Not so! Remember, when you're using dd, you're still using a relatively high level protocol to talk to the drive. If you can get the drive into a "test" mode, where you can talk to the actual registers on the drive, there's a heck of a lot more you can do. For example, on some drives, you could tweak the positional calibration registers and move the head fractional tracks, reading the data at each step, and maybe pick up some data at the edges of the track that wouldn't be picked up in the center. (You're hoping that there was a slight positional drift from when the data was written to when the data was erased).
Now actually getting the drive into "test" mode, talking to the registers, and knowing what the hell the registers actually do is very difficult; you're basicallly talking about documentation that only an engineer working at a drive manufacturer would have. (And of course, this stuff is all non-standard, since it's never supposed to be directly accessed...so each model or family of drives would have different capablilties) This is pretty much the definition of "deep magic." But for the select few who have access to that documentation, some amazing tricks are possible.
did I read in all the legal bullshit that all the FBI uses for verification is a CRC sum?
It's easy to defeat CRC - just add empty space to the end of each file until you get the result you want. SHA-1 or MD-5 is safe(ish), but a straight CRC is too easy to forge.
I wouddn't trust these disk copies with a bargegepole.
oh brave new world, that has such people in it!
i don't think all theese people have a job in computer forensics, they are all just as paranoid as i am about my data /OPTiX
and yes, i don't remember my username
wrong again.
Wrong in what way?
Are you suggesting that < and > won't substitute for if= and of=? Or perhaps you are suggesting that one must specify specific partitions to dd?
In either case, I'm not wrong. GNU dd, as provided by Linux distributions accepts < and >. And specifying a device rather than a partition is accepted, and works as expected. Everyone has used this same command form to make boot floppies, right?
And where are you getting the bit about a boot CD? I didn't say anything about a boot CD, nor did the parent to my post. The two issues are entirely orthogonal. Strange post all-around...or maybe just more subtle trolling.
It's not like they got a copy of dd from AT&T or something, you know
Oh, did it spring from the head of Athena fully formed?
Long before there was something called Linux, (or GNU/Linux) there was this thing called UNIX. And UNIX had dd.
To take the idea of dd and to make a new version and call it dd is copying. Or do you have a different word for it?
They wrote their own, just like with everything else.
Really? Wow. Then when I've seen BSD copywrite notices in Linux, that is what, an illusion?
A cookie for whomever get's that reference!
DAAARLING NO BAAKAAA!
...so the dd was co-written by the guy who played "The Spleen" in Mystery Men...?
The Windows people replying here really have no idea what's going on. There's no magic in dd. dd is really a very dumb program that just copies bits. The "magic" is that unix exports raw devices to user-accessible device files. In fact, there's no need to use dd. You only need a program that copies bits directly, without trying to do a truncating open (this is why "cp" won't work).
Example program:
This program took me 90 seconds to write a unix system, but the equivalent will take you at least a day on Windows (probably more like a week if you've never done Windows driver development). The above program is exactly equivalent to dd except that it doesn't have fancy options for seeking and buffering. Read the source for GNU or FreeBSD dd if you don't believe me.
The point is that you don't even need to spend these 90 seconds as you just type in
and you're done with it.its such good fun to read along as my fellow brethern debate the minutae of linux dd vs. that thingie, or that other thingie...
I found that article informative and an interesting read and would like to thank the editor for posting the story.
one brief comment:
Quincy - medical forensic examiner on tv show who did it all for bar-room glory and the chicks
Slashgeeks - computer forensic specialists because they need the money and a reason to justify those long nights watching their neighbors packet flow...
~I have but one life to give for my country, perhaps you should get one to give too...
millions of heavily armed enforcers
Millions? We have a millionn-person military, and I guess there must be a million or so police and national guard, and so on. But all watching you? Heck I doubt it, and most of them would have to drive too far to get you.
It only takes one sharpshooter. hey, did you see that? Behind you! Quick, run, duck, cover!!!! heh-heh
Anyone whose even stepped foot into a "Computer Crimes" department (or whatever your local police call their Info Warriors) knows they have been using *nix since day 1 in forensics.
/. wants to convey?
This is not news, and the idea we should be getting all excited over this suggests that *nix is such a desperatly useless pos as to warrant mass praise whenever anyone actually finds a use. Is that really the message
yeah but the point is that they are professionals..they should be opening the hard drive in a lab and imaging it with a MFM microscope.
No one can prove a connection between Moussaoui and those responsible for "airliners being crashed into skyscrapers" without planting evidence. The gov't never offered any proof to show who did the crime. OTOH, the gov't mostly issued misinformation and lies regarding the events of Sep. 11.
Simply encrypting a filesystem with a key is a dumb idea if you have data you suspect may be the target of a threat model capable of seizure, forensic analysis and coercion or torture (i.e., the law).
That's what steganographic filesystems like (to give some reference examples, not actual suggestions) stegfs and Rubberhose are for.
While the data cannot always be absolutely guaranteed to be intact on stegocrypto filesystems even if you have the keys, it is unlikely that you will lose a block if you use the filesystems at an appropriate size (the bigger the better - you might be waiting a while to make big partitions unless you have a hardware entropy source but the fs will be more secure and stable if it is much bigger than the amount of data you want to actually hide within it), with multiply redundant copies of each block.
These filesystems are considered torture-resistant, in that they minimise the advantage of cooperation by ensuring that it is impractical to prove that cooperation has been complete - some of the keys just plain don't exist anymore, you never had them, but you cannot prove that you do not possess knowledge of something.
You might not save yourself from jail or torture if you cooperated, because you could not necessarily convince your captors that you had handed over all the keys, but if you were, say, to hand over the passphrase to your secret stocking fetish pr0n collection (embarrassing, but not damaging to your defence, and demonstrating a willingness to cooperate), you'd earn at least some brownie points.
Or if your interrogators were in mind of being heavy handed, you might get tortured, but possibly you could hold on to those last few passphrases in the knowledge that they will never know that you are not cooperating fully.
None of this is any value at all unless the drive is completely fresh (never been used by you) and you do not store any unencrypted data on it. The operating system that can read the data should be on another, physically separate hard disk, floppy, or (good idea) CD.
Swap is bad, don't do it. RAM is cheap, especially slower RAM (and crypto is usually cache bound). You'll be crucifying the machine with lots of crypto work anyway, it'll thank you if it doesn't have to swap as well.
Naturally, the thermite charges in the hard discs, TFT display (burn-in) keyboard (fingerprints) and mouse (palmprints), power conditioner with a heavy low-pass filter (power surveillance), double-enclosed darkroom (optical surveillance, both shoulder surfing and fancy new optometer) with double-enclosed Faraday cage (van Eck phreaking) and very beefy magnet (accidentally walking off with media that you didn't explicitly mean to burn to CD) through exit corridor, single exit very strongly locked door with lockdown alarm and/or biometrics (burglars) and tinfoil hat (CIA mind control) are optional.
Depends how far you want to go really, but remember, it's not paranoia if they actually are out to get you.
It seems kind of ridiculous to me to consider the "idea" of a block copying utility to be more important than the implementation. You could say they got the idea for dd from Unix and I wouldn't mind, but it's not right to say they got the actual software from there. It's harder to write it then to think it up.
BSD didn't get their software from AT&T Unix either. I don't understand what you mean? I personally don't give a damn that there's this "BSD project" and this "GNU project" out there, since I can use software from both of them on my computer. I see the two as in collaboration rather than competition, since they both promote free Unix. It's not like Apple versus Microsoft, it's just different groups of people doing different parts of the same cause. Get over it.
I have seen the future, and it is inconvenient.
Keep your Eye on the Ball,
Your Shoulder to the Wheel,
Your Nose to the Grindstone,
Your Feet on the Ground,
Your Head on your Shoulders.
Now... try to get something DONE!
- this post brought to you by the Automated Last Post Generator...