Resetting Password on Macintosh that is using OS X

If you will do a forensic investigate a Macintosh that is running OS X and you need to access a program on a booted forensic copy of the subject’s drive,and if you do not known the password. Follow the steps  below;

 If you have any version of the Macintosh OS X boot CD or DVD, place that in the examination system and hold

down the C key to boot from the CD/DVD drive.Then the system asks if you want to install/reinstall OS X, choose the Password Reset Utility from the drop-down menus at the top of the screen. You will be shown a list of users and you can pick one or all of them and change the password of the accounts to something you know.

 

Resource: The Official CHFI Study Guide (Exam 312-49) for Computer Hacking Forensic Investigators  Copyright © 2007 by Elsevier, Inc.

Read more...

There was an error uploading the file Symantec DLP

If you are getting "There was an error uploading the file" while trying to upgrade your DLP to newer version from Systems-->Overview-->Upgrade menu by using .jar file try the steps below. It's worked for me.

1) Create a folder named enforceupgrade under c:\Vontu\Protect\Updates
2) Extract the jar file by using winrar or winzip into this folder.
3) Run the start_upgrade_wizard.bat
4) Wait approximately 60 seconds for Tomcat to initialize properly
5) Open web browser and go to the URL https://yourenforceipadderss:8300
6) Log in by using administrator credentials and start the upgrade process.
Read more...

Enable Syslogging on Vmware ESX 3.5

To log events from an ESX host to a remote syslog server:

1. Log in to the ESX host as root using an SSH client.
2. Open the /etc/syslog.conf file using a text editor.
3. Add this entry at the end of the file:
   *.* @
   For example:
   *.* @192.168.10.1
   

           to open file "vi  /etc/syslog.conf"
           add line
           press esc
           type :wq and press enter
           type service syslog restart  press enter
Read more...

Enable Syslogging on ESXi 4.x

Connect to your ESXi host by using Vsphere Client.

1) Open Configuration Tab and choose Advanced Settings under the Software part from left.
2)Find syslog from the tree view. Enter your syslog server IP number and port number to the right pane.
3) Connect your ESXi host by using SSH and login as root
4) type "ps | grep syslog"  press enter without quotas. Note the PID number
5) type "kill -HUP PIDNumber"  press enter.
6) Your host will begin to send syslog messages to your syslog server




Read more...

Enable SSH on ESXi 4x

) At the console of the ESXi host, press ALT-F1 to access the console window.
2) Enter unsupported in the console and then press Enter. You will not see the text you type in.
3) If you typed in unsupported correctly, you will see the Tech Support Mode warning and a password prompt. Enter the password for the root login.
4) You should then see the prompt of ~ #. Edit the file inetd.conf (enter the command vi /etc/inetd.conf).
5) Find the lines that begins with #ssh and remove the #. Then save the file. If you're new to using vi, then move the cursor down to #ssh line and then press the Insert key. Move the cursor over one space and then hit backspace to delete the #. Then press ESC and type in :wq to save the file and exit vi. If you make a mistake, you can press the ESC key and then type it :q! to quit vi without saving the file.

Note: there are two lines for SSH with ESXi 4.x now - one for regular IP and the other for IPv6. You should the line appropriate to the protocol you'll use to access your host.


6) Once you've closed the vi editor, you can either restart the host or restart the inetd process. To restart inetd run ps | grep inetd to determine the process ID for the inetd process. The output of the command will be something like 4399 4399 busybox inetd, and the process ID is 4399. Then run kill -HUP (kill -HUP 4399) and you'll then be able to access the host via SSH.
Read more...

SYMANTEC VONTU "TableSpace is almost full"

To enter SQLPlus, open a command prompt on the machine with Oracle installed.

 1. Enter "sqlplus /nolog" followed by enter.
 2. To login, type the command: connect sys/password@protect as sysdba

 [where password is the current protect password to the database]

 3. Check how many LOB0*.DBF files you files you have in the \ORACLE\ORADATA\PROTECT\ directory where '*' denotes the number of that file.

 So you will need to add another file with the name/number incremented by 1 so if you have 3 already you will need to add a the next one called LOB04.DBF like so:

  ALTER TABLESPACE "LOB_TABLESPACE"
  ADD
  DATAFILE 'D:\ORACLE\ORADATA\PROTECT\LOB04.DBF' SIZE 138240K
  REUSE AUTOEXTEND
  ON NEXT 10240K MAXSIZE 32767M;

 You should get a result of "Tablespace altered" if successful.
 Type Exit; to logout.
Read more...

Photo or Image Forensic "type of camera used to take the image"

You can free software named Xnview to view which device was used to take photo, which software(photoshop etc.) or which scanner used to convert it to digital format ?

XnView provides a listing of directories in the left pane, and shows what images are in a particular directory in the upper-right pane.When you select an image, it appears in the lower Preview pane. In addition to this, clicking on the Properties tab will display information on a particular image, including its file format, timestamps, size,compression used, and other attributes. By clicking on the EXIF tab, you can display extra information, which could include the type of camera used to take the image, the exposure, the date the picture was taken, and other facts.
Read more...