Re: NTFS forensic analysis on Unix platform

From: Blake Frantz (blakeat_private)
Date: Wed Jul 25 2001 - 12:57:22 PDT

  • Next message: Everhart, Glenn (FUSA): "RE: NTFS forensic analysis on Unix platform"

    I have a linux floppy image that mounts NTFS partitions and allows the
    user to replace any password in the (non-syskeyed) SAM.  Purhaps this disk
    can provide some info on how to mount the NTFS partition.
    
    You can download it at:
    www.packethack.com/bd990404.zip
    
    -Blake
    
    ================================================================= 
    The Government, like diapers, should be replaced regularly, and
    often for the same reasons. 
    
    On Wed, 25 Jul 2001 mat_private wrote:
    
    >  Hi.
    > 
    >  I have taken 2 disk images from a compromised IIS system. 
    > These images are in NTFS format, and I was wondering if 
    > anyone knows of an open source tool which is capable of 
    > accessing these partitions. The Unix platform that I have 
    > available is OpenBSD; so I can't mount the NTFS partitions.
    > 
    >  In the past I've used tct; but unrm doesn't currently 
    > support ntfs filesystems.   
    > 
    >  Any advice would be greatly appreciated. 
    > 
    > thanks,
    > Marty. 
    > 
    > -----------------------------------------------------------------
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management 
    > and tracking system please see: http://aris.securityfocus.com
    > 
    > 
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Wed Jul 25 2001 - 13:44:29 PDT