I have been spending so much time with the Tor browser over the past months that I have forgotten just how seamlessly it uses a complex network of global servers, and encryption to provide a near perfect level of online anonymity. The Tor browser is extremely effective in providing near 100% anonymity that if not for one little flaw, it would be perfect, and I found that flaw.
The flaw is the user. Yes, every physical device and software application has the same flaw, but with Tor, it is a flaw that can completely negate using Tor for anonymity with misuse. Something as simple as a user not updating the Tor browser when prompted in bold print is enough to break anonymity. The Tor browser can only do so much to warn users to update the browser...
On one hand, criminals using the Tor browser who are lazy, too busy, or not accepting the danger of using outdated Tor browsers run the risk of getting busted. On the other hand, legitimate users, such as those living under oppressive governments, can be discovered and imprisoned (or worse!) for exercising speech online. Both situations generally require the user to be the weak link.
http://news.google.com Thu, 01 Oct 2015 02:46:49 GMT...
I’ve been waiting until I received the hard copy of this book to write the review. I had the fortune of being the tech editor for this book and enjoyed every minute of it. Although I do not have an ongoing financial interest in this book, I do have a vested personal interest based on the reasons Harlan Carvey lays out in many chapters. I’ll get to my personal interest later in this review. Also, Harlan has a post on updated book contents here: http://regripper.wordpress.com/2014/04/14/regripper-download-2/
Without reading any reviews, those analysts who buy Harlan’s books will keep buying his books with the full expectation of having a well-written (as in easy-to-read) book on Windows OS forensics. There is no need to read any further in this review if you fit in this category. This is Harlan’s new book. That is all you really need to know. But if you just want my opinion, read on…
The topics in the 4th Edition of WFA are all eye-catching. Volume shadow copies, file analysis, registry, malware, timelines, tracking user activity, and more. Every topic detailed in all the chapters, is relevant to everyone that touches a Windows system to examine. The difference between Harlan’s books and others is the guidance given. For example, rather than reading a discourse on some technology, Harlan gives practical advice, suggestions, and real-life stories that relate to the points in the book. Since we have all made mistake (or will make mistakes, or have made mistakes but just don’t know it yet), having guidance that reduces mistakes in the way of stories and plain talk is well worthwhile to read.
The book has too much information to be covered in a review. There is more information on accessing volume shadow copies using several different methods than I want to review. The same can be said for file analysis, registry analysis, timelines, and every other topic. Harlan gives several options to accomplish the same task, using different software. Although I wrote a book on one software (X-Ways Practitioners Guide), I obviously use more than just one software. Any forensic book, other than a manual or software guide, that does not give options with various types of software does not give the reader options to solve problems.
Another facet of Harlan’s book is his never-ending harping of asking everyone to ‘share information’. That sentence may sound negative, but truthfully, I don’t know how Harlan has the energy to push the sharing of information for so long. The book is sprinkled with this tone and I echo the importance of sharing information. I did my best to keep up with Harlan’s book as I tech edited it, working his suggestions. Some of the methods he wrote were new to me, which I would not have found on my own without happening upon the method in a blog..maybe....
I will be publishing an X-Ways Forensics Online Training Course on June 30, 2014. The course is based off the X-Ways Practitioner's Guide, the X-Ways manual, and a decade of experience using X-Ways...it is not the official X-Ways training course, but it also does not come with the price tag of the official course. From Monday, the X-Ways course will be $195 but I will publish a discount code good for two weeks (through July 14) for 25% off.
I'll send out a reminder on June 30 through twitter and the XWF blog, so follow the blog or twitter account to catch the discount code.
The manner in which I made the X-Ways course is so that you can follow along with XWF in learning how to work a case with X-Ways Forensics. The course describes the options and buttons in XWF, but also shows how to simply work a case. There are literally so many features in X-Ways, that without training, you will be missing about 50% of what you should be doing. I found that even the most current version of the X-Ways manual does not list features in XWF...lots of information to keep up with, tons of features to consider, easy to miss something that you should not miss for such a powerful forensic tool.
If you want to be notified of the coupon code, be sure to follow the X-Ways blog at http://xwaysforensics.wordpress.com/ or the twitter account at https://twitter.com/XWaysGuide.
I also have just released an online course on the Windows Forensic Environment (WinFE). I have videos of most build methods, tips and tricks, pro's and con's, and aspects of WinFE that you may find important. I also included every bit of downloadable swag in the course too (batch files, wallpaper, scripts, etc...).
All in all, this is probably the best source of WinFE you will find. I encourage you to share it and use it, after all, this is a free tool and this course is free. If anyone has suggestions on making the course better, let me know and I can try to squeeze in some improvements.
[caption id="attachment_1231" align="aligncenter" width="700"] http://courses.dfironlinetraining.com/windows-forensic-environment
I was right. This is cool.
Using Autopsy on WinFE Lite worked as expected; however, I wanted to test it with a WinBuilder build of WinFE to address limitations found on WinFE Lite (notably, the inability to view videos or inside zip files).
In short, the WinBuilder build allowed viewing of videos and accessing zip files with Autopsy. There were a few other customizations that I made for appearance and ease of use that you may find helpful in presenting training on WinFE (if you do that) or in creating your own WinFE for onsite preview/triage.
Basically, with Autopsy, any first responder or parole supervisor can triage/preview an evidence machine, onsite, without cost of software or hardware. You just need a CD, DVD, or USB with WinFE and Autopsy. For the first responders who are not forensic examiners, a WinFE boot disc/USB can be made with Autopsy clearly presented on the desktop and start menu. I would suggest that other forensic tools be included in the event they may be needed by a forensic analyst. An example would be a first responder finding evidence on a machine during a triage/preview and the machine needs to be imaged. Either the first responder can image the machine or preferably, a trained person should be called to image the machine. Having the apps pre-installed eliminates the need to reboot the machine to another build of WinFE, or plugging in additional drives with programs, and so forth.
In order to get you in gear with the potential of a completely free WinFE and software (you need a license for Windows to build it…but otherwise, it’s all free), I’ve posted the steps below. Before you ask for help with WinBuilder, go to www.reboot.pro and read the help forums. There is as much documentation you need for directions on how to download and run WinBuilder along with as many scripts (added features) as you could ever need....
Update November 14, 2014
Unfortunately there are so few updates nowadays to WinFE, that this blog is woefully neglected...on a positive note, since WinFE practically needs no updates, there is hardly a need to keep up on WinFE once you have mastered building it.
The best and most current source of all-things-WinFE is from a free online course at http://courses.dfironlinetraining.com/windows-forensic-environment so other than taking the course, this blog will not have additional information building WinFE.
The course includes downloads and links to downloads to build every publicly known version and build type of WinFE, from the basic WinFE, WinFE Lite, WTE WinFE, Mini-WinFE, and WinBuilder WinFE.
The WinFE wordpress blog will be used only for sporadic WinFE updates and related information since WinFE has practically reached the best it can be at current software standards (Windows 8). The only posts that may be original from here on out would be case examples, but that quickly grows old (I booted a machine to WinFE and imaged it...). A few instances are very neat, like imaging a Surface Pro, and for those interesting cases, I'll post them as I come across them or am sent information about them.
At its foundation, WinFE is a strong forensic OS platform, built on the latest Windows operating system, which can run most types of forensic software. That's about it. Simple, but amazingly effective at a forensic boot platform. Since it is so very simple, the updates to the WinFE blog become less and less. Therefore, the free webinar course covers everything you need to learn about WinFE along with every download needed, plus tips on building, using, and testifying to the use of WinFE.
After you view the course and build a few WinFEs, you'll see that WinFE is only a forensic boot OS. But you will also see that because it is a Windows boot OS, you can do so many things with it that you can not do with a Linux forensic OS or with a hardware writeblocker. That is the beauty of WinFE. Simple. Ingenious. Hard to improve upon (at this point...).
You have my permission to use the WinFE course and its materials in a manner that benefits WinFE at no cost. That means you can use information from the course to teach WinFE at conferences or any training session. WinFE is free (technically, you need a Windows OS license...but otherwise its free), and I've made the course free as well. When teaching or writing about WinFE related to the source and you choose to attribute to the source, that's nice of you, but not necessary if you don't want.
Take a run at the WinFE course. Watch all the videos or only the videos of interest. They are broken down by build types and how-to videos. The most important benefit you can get out of the course (other than learning how to build/use WInFE) is getting some formalized training in front of you about WinFE. It's one thing to spend hours (days?) figuring out something but quite another when you can get the meat-and-potatoes of what you need to know in the shortest period of time. I'd reckon that even if you attend a presentation on WinFE, you will get so much more out of the online course that you won't regret the time spent.
I've also said a few times, that once you build and use a WinFE, you will regret not having done so years earlier. Don't forget, WinFE has been around since 2008...it works even better now than back then.
Hashbrown program 64 bit version only http://1drv.ms/1tLsNnG updated October 10 2014