We've tried that product in testing, but we ended up purchasing this
product (DDChanger):

http://www.helperapps.com/index.php?option=com_content&task=view&id=1&It

emid=34

We were trying to convert boot from SAN Intel blades to VMWare servers
running on an AMD Opteron VMWare ESX box. It was a lot

[ more ]  [ reply ]

I thought that files times on NTFS volumes were always stored as UTC? At
least, that's what I read:
http://msdn2.microsoft.com/en-us/library/ms724290.aspx

Windows being able to display the time as a local time I would expect to
be purely a FileTimeToLocalFileTime() call away.

Jamie Gordon

-----

[ more ]  [ reply ]

The DFRWS 2007 File Carving Challenge has been posted:

http://www.dfrws.org/2007/challenge/

Submissions are Due July 9, 2007.

This years challenge builds upon last years and adds more file types
and scenarios. File carving is the process of extracting files from
data using file type specific

[ more ]  [ reply ]

ADFSL 2007 Conference on Digital Forensics, Security and Law
VENUE: Arlington, Virginia USA on April 18-20, 2007
KEYNOTE: Jim Christy, Director of the Defense Cyber Crime Institute

The ADFSL 2007 Conference on Digital Forensics, Security and Law will be held in Arlington, Virginia USA on April 18-

[ more ]  [ reply ]

AMCIS 2007 Colorado: http://www.biz.colostate.edu/amcis07/
TRACK: Security & Privacy
MINI-TRACK: Digital Forensics and its Role in Security, Law and
Accounting
DATES: August 9-12, 2007
LOCATION: Keystone, Colorado, USA
------------------------------------------------------------------------

-
Papers

[ more ]  [ reply ]

Dear colleagues:

Information on the fourth issue of the Journal of Digital Forensics,
Security and Law (JDFSL) is now available as follows:

Volume 1 Number 4, 2006
Published: December 31, 2006
ISSN: 1558-7215 (print)
ISSN: 1558-7223 (online)
Journal Website: http://www.jdfsl.org
Issue Abstracts:

[ more ]  [ reply ]

Dear Kush,

Are you already try the good tool "procget" on Linux box?
procget can save contents for fornsic use.

Regards,

Hiroaki Kondo
Security Consultant in Japan.
hackman a venus.dti.ne.jp

[ more ]  [ reply ]

Hello everybody,
a while ago, while analysing some files inside HDDs with the NTFS file system I came
across something odd: the day time of the files written into the disks by Windows Xp was in
GMT format even though the bios time was set on the local time (which in my case is CEST).

I noticed that

[ more ]  [ reply ]

IS there any method to take mirror copy of /proc with all sym link and hard link over the network. Condition is it should not write on hard disk. Particular method should send data on the fly to remote machine. Thanks in advance

Thanks & Regards,

Kush Wadhwa - RHCE, CEH
Security Analyst - NII Con

[ more ]  [ reply ]

Hi all!

The Journal of Digital Foresnic Practice (JDFL) is still alive and well, and we are actively seeking papers from practitioners. This call asks for papers by 2/28 for the next issue but we are always seeking material. Please consider writing -- and feel free to contact me with questions or q

[ more ]  [ reply ]

Hi all,

Back in June 2006 I wrote about caching issues when PhysicalMemory is
used for memory dumping
<http://ntsecurity.nu/onmymind/2006/2006-06-01.html>. PhysicalMemory is
not the only option for memory dumping from User Mode though. There is a
system call named NtSystemDebugControl which has

[ more ]  [ reply ]

An updated conference and training list is available at the following
url:
http://www.forensicswiki.org/wiki/Upcoming_events

Dave B.

--------------------------------------------------------------------
David W. Baker bakerd (at) mitre (dot) org [email concealed]
Lead Information Systems E

[ more ]  [ reply ]

Call for Papers

The 7th Annual Digital Forensic Research Workshop (DFRWS 2007)
August 13-15, 2007

Omni William Penn Hotel
Pittsburgh, PA, USA
www.dfrws.org
df

[ more ]  [ reply ]

Hi,

For those who asked, we are still processing the submissions for CanSecWest
and the call closed, please stand by. The paper selections are back from the
reviewers for EUSecWest, in London on March 1-2.

In absolutely random order:

Threats against and protection of Microsoft's internal network

[ more ]  [ reply ]

Dear Colleagues,

this is the final Call for Papers for DIMVA 2007, the Fourth GI
International Conference on Detection of Intrusions & Malware, and
Vulnerability Assessment; which will be held in Lucerne,
Switzerland, on July 12-13, 2007.

Paper submission is now open at http://www.dimva.org/dimva

[ more ]  [ reply ]

Thanks much for the suggestions, which have included:

Recovery programs, such as Zero Assumption Recovery;
Suggesting imaging the card and working with the image;
Powered vs. passive USB, low speed mode;
Try it in the original device (camera);
Place SD card in the freezer;
Heating the foil runs to

[ more ]  [ reply ]

Just an idea for an alternative way of getting the chip off.

I have not performed this kind of thing for forensics but have removed
surface mount chips from pc boards occasionally.
The most sucessful, for me, is to get a exacto razor knife and slowly
cut the pins from the board. The solder is soft

[ more ]  [ reply ]

If logging is to be enabled via either through JetDirect (which
basically just turns the printer into a Print Server) which can be setup
to log to a computer using the syslog protocol (usually the UDP = User
Datagram Protocol and possibly TCP/IP as well) configured by the
JetAdmin software installed

[ more ]  [ reply ]

It sounds like, since there is physical damage, the PCBA (Printed
Circuit Board Assembly) contacts aren't making good connections anymore.
Your intermittence at getting it to read every now and then sort of
maybe says that the file system is still in tact and therefore may not
need recovered by soft

[ more ]  [ reply ]

I would recommend ZAR - Zero Assumption Recovery. We've used it both
for HDD's and SD cards and it's worked very well for both.

http://www.z-a-recovery.com/digital-image-recovery.htm

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
On Behalf Of

[ more ]  [ reply ]