Happy Birthday Ovie..........

Within the next few days it will be Ovie Carroll's Birthday. So that everyone can wish him a happy birthday I have set up a special e-mail account that will forward to him all your birthday wishes if you would like to send him a wish. The email address is happy_birthday_ovie@redwolfcomputerforensics.com. I will leave this up for about 1 1/2 weeks so everyone can wish Ovie a happy birthday.

I wont tell you how old he is but here are some general statistics from that time period.

World Population: 3.276 billion
US Population: 191,888,791
Life expectancy: 70.2 years
Violent Crime Rate (per 1,000): 23.9
Property Crime Rate (per 1,000): 22.0
Homicide Rate (per 100,000): 5.1
US GDP (1998 dollars): $663 billion
Federal spending: $118.53 billion
Federal debt: $316.1 billion
Consumer Price Index: 31
Unemployment: 5.7%
Cost of a first-class stamp: $0.05
Cost of a new home: $20,500.00
Cost of a new car: $
Cost of a first-class stamp: $0.05
Cost of a gallon of regular gas: $0.30
Cost of a dozen eggs: $0.54
Cost of a gallon of Milk: $0.95


Once again that email address is happy_birthday_ovie@RedWolfComputerForensics.com

Happy Birthday Ovie!

Thumbcache Version 2

If anyone has been to one of Ovie Carroll's recent presentations on Vista you will probably have heard mention of this program. It was also mentioned during my interview on cyperspeak. This is a rewrite to the program that was written for this blog entry. This program will read either a directory where the thumbcache_*.db files are or the individual thumbcache files, if you happen to pull the thumbcache_*.db files out make sure you include the thumbcache_idx.db file, this will add a date/timestamp to the reports for each picture extracted. This program will not only read the thumbcache and export the files but it will also create a nice/professional report to pass along to someone. You can also copy the whole directory and burn it to a CD and the reports will still display everything correctly.

The program an be found here . This program is a little different as I have started playing with the NSIS installer. The installer will ask you to input your name, agency name and a location for your organization's logo. This information is used for the reports to give that professional look. If you do not fill the information in then they will be a few blank spots on the reports.

As Always Questions/Comments/Suggestions/Etc....

Dumpster Diving with Ovie.....

On the Oct 15 Cyberspeak Podcast Ovie Carroll talked about Vista Recycle bin forensics. Based on Ovie's chat I have created a program that will read the $I files and create a simple report. The report consists of the $I file name, the actual filename with directory, the date/time the file was deleted and the file size. I have also added the functionality to copy the $R (actual data file that was deleted) to the actual name into a directory specified by you.

So what does the prorgam do? Once you fire up the gui you need to provide a filename for the database that is created that will store the data that is read. Provide a direcotry where the $I files are, if you want to copy the $R files to there original names then they need to be in the same directory. Optionally you need to provide an output directory where you want to write out the deleted files to with there actual names. Once that is done then press the buttons and watch it go to work. When you are ready to run the report you can either sort the data in ascending or descending order based on the deletion date and show the report in either excel or your favorite web browser.

If you want to see the gory details the code is provided. As always this script can be run on OS's other then Windows (the report piece will have to be modified some).

The programs can be found here. As always Questions/Comments/Improvements let me know.

Thumbs Up To Ovie......

On the Sept 23 podcast of Cyberspeak Ovie Carroll talked about the thumbs cache that is new in Windows Vista. In response I have created a perl script with a autoit gui front end that will parse all 4 of the thumbcache files.

The base program is based on the sigs.pl script originally written by Harlan Carvey. What the perl script does is open the specified thumbscache files and then scans for file header signatures. Once it finds a jpg, png or bmp file header it then backs up and reads what I will call the file header record of that image file. In this record is the size and internal name of the file. I have not figured out how it gets that particular name but if someone knows please let all of us know. The thumbcache_32 and 96 files appear to only contain bmp files while the thumbcache_256 and 1024 contain png and jpg's. For all the gory details see the perl code.

Since the thumbcache files I had were very limited this is about as much as I know. As for the gui just pick the file you want to parse, input the directory with a "\" as the end where the thumbcache files are and input a directory to write all the images to and click on the parse button and watch it go.

Now since this does not use any windows specific perl modules there is no reason that you cannot run it on Linux or a Mac. The code and executable can be found here.

Thanks to Ovie for the idea for this program. Ovie and Bret keep up the great work on the podcast.

As always questions/comments/thoughts/problems let me know. My eyes and ears are always looking for great new projects.