Re: NTFS forensic analysis on Unix platform

From: Kris Carlier (rootat_private)
Date: Wed Jul 25 2001 - 16:15:52 PDT

  • Next message: Security Technology: "RE: in-house computer forensics"

    Blake,
    
    > I have a linux floppy image that mounts NTFS partitions and allows the
    > user to replace any password in the (non-syskeyed) SAM.  Purhaps this disk
    > can provide some info on how to mount the NTFS partition.
    > 
    > You can download it at:
    > www.packethack.com/bd990404.zip
    
    it may be coincidental, but from the looks of it, I'd say this is Petter
    Nordahl's bootdisk, but a very old one. Check out home.eunet.no/~pnordahl/
    
    kr=
    
                       \\\___///
                      \\  - -  //
                       (  @ @  )
     +---------------oOOo-(_)-oOOo-------------+
     |        kris carlier - krisat_private    |
     |   Freedom of speech has been suspended  |
     |          [RESUME] [OK] [CANCEL]         |
     | KC62-RIPE         SMS: +32-475-61.43.05 |
     +------------------------Oooo-------------+
                      oooO   (   )
                     (   )    ) /
                      \ (    (_/
                       \_)
    
    "In 1555, Nostradamus wrote: 'Come the millennium, month 12, in the home of
    greatest power, the village idiot will come forth to be acclaimed the
    leader.'"
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Jul 26 2001 - 08:56:55 PDT