공장장과 함께하는 디지털 포렌식 이야기

현재 EnCase 6의 Case Process EnScript 중 Windows Initialize Case(WIC)가 Windows 7을 제대로 지원하지 않고 있습니다.

곧 나올 EnCase7에서는 해결될지 어떨지 모르지만 암튼 불편하죠.

해당 EnScript를 약간 수정하면 Windows7에서도 WIC가 돌아갑니다.

아직 EnCase 내부에서 Windows 7을 처리하는 루틴이 제대로 되어 있지 않아서 일단 Vista인 것처럼 속이는 방법을 쓰는 우회방법입니다.

일단

\EnCase 6\Enscript\Include 폴더에 있는

GSI_Reg_InitializeCaseUtilityLib 을 수정해야 합니다.
SnapshotClass::OperatingSystems GetOSVersion() { return OsVersion; }
요렇게 되어 있는 내용을
SnapshotClass::OperatingSystems GetOSVersion() { SnapshotClass::OperatingSystems os = OsVersion; if(OsVersion == SnapshotClass::WINDOWS7) { os = SnapshotClass::WINDOWSVISTA; } return os; }
요렇게 바꾸어 주시면 됩니다.

그다음, 같은 폴더에 있는

GSI_SweepCaseLib 파일의 내용 중에서
if (buffer.Contains("6.0")) { return SnapshotClass::WINDOWSVISTA; }
요렇게 되어 있는 내용을 찾은 후 그 아래에
if (buffer.Contains("6.1")) { return SnapshotClass::WINDOWS7; }
요 내용을 추가해 주시면 됩니다.

Thanks Adam ;-)

@ECHO OFF
TITLE Sysinternals Updater
ECHO Sysintenals Updater
ECHO Written by: Jason Faulkner
ECHO SysadminGeek.com
ECHO.
ECHO.
SETLOCAL ENABLEDELAYEDEXPANSION
SET SysInternalsTools="%Temp%\SysInternalsTools.tmp.txt"
SET CurrentTasks="%Temp%\CurrentTasks.tmp.txt"
SET StartWhenFinished="%Temp%\StartWhenFinished.tmp.txt"
ECHO Detected directory: %~dp0
%~d0
CD %~p0
ECHO.
ECHO.
ECHO Downloading current tool list...
SET LiveShare=\\live.sysinternals.com\tools
START /MIN %LiveShare%
DIR %LiveShare% /B > %SysInternalsTools%
TASKLIST > %CurrentTasks%
ECHO ;Terminated tools > %StartWhenFinished%
ECHO.
ECHO Updating installed SysInternals tools
FOR /F %%A IN ('DIR /B') DO (
 FOR /F "usebackq" %%B IN (%SysInternalsTools%) DO (
  IF /I [%%A]==[%%B] (
   ECHO Updating %%A
   FOR /F "usebackq" %%C IN (%CurrentTasks%) DO (
    IF /I [%%A]==[%%C] (
     ECHO %%C is currently running, killing process - queue restart
     ECHO %%C >> %StartWhenFinished%
     TASKKILL /IM %%A /T /F
    )
   )
   XCOPY %LiveShare%\%%B %%A /Y
   ECHO.
  )
 )
)
ECHO.
ECHO Resuming killed tasks
FOR /F "usebackq skip=1" %%A IN (%StartWhenFinished%) DO (
 ECHO Starting %%A
 START "Sysinternals Tool" "%%A"
)
IF EXIST %SysInternalsTools% DEL %SysInternalsTools%
IF EXIST %CurrentTasks% DEL %CurrentTasks%
IF EXIST %StartWhenFinished% DEL %StartWhenFinished%
ENDLOCAL
ECHO.
PAUSE

접기

Sysinternals_Updater.bat

접기

접기

접기

IM Solo 4가 ICS 홈페이지에 업데이트되었습니다.

이전다음

0123

.: Extreme Speed: Captures, authenticates and sanitizes at full UDMA-6 Speed (exceeding 7GB/m*) * With Newest, Fastest SAS Drives

.: Multiple "Suspect" Side Connections: 2 SATA/SAS connections and 1 USB 2.0 connection. Unit features built-in support for imaging of a RAID drive pair (0,1,JBOD).
Optional Drive Adapters will allow imaging of IDE drives, 1.8", 2.5" ZIF, and proprietary interface/Laptop drives, and Micro Media Cards including Compact Flash, Memory Sticks, SD, Micro SD, MultiMedia cards, etc.
Cross Copy support allows user to image any "Suspect" Drive interface to any "Evidence" Drive Interface.
All "Suspect" Drive connections are permanently write-protected at all times to prevent changing of "Suspect" Data (cannot be disabled)

.: Multiple "Evidence" Side Connections: 2 SATA/SAS connections and 2 USB 2.0 connections. Optional Drive Adapters will allow imaging to many other drive formats including external RAID devices.

.: Multiple Operational Modes: Captures "Suspect" drives to one "Evidence" Drive (Single Copy Mode), Captures "Suspect" drive to two "Evidence" drives (Multi Copy Mode), Captures two "Suspect" Drives to two "Evidence Drives (Parallel Copy), Drive Wiping and Sanitization, Drive Hashing (SHA-1, SHA-256), Captures "Suspect" Data from Networked Storage and any attached Network Share. All processes are done simultaneously with no speed degradation.

.: Multiple Imaging Formats: 100% Copy (bit-by-bit), Linux DD images (industry standard) on a single "Evidence" Hard Drive or USB storage device. User can define the seize of the Linux DD segments. IQ Copy, captures the actual "data only" greatly reducing the time needed to make a non-forensic copy. Support of E01 files coming soon.

.: 'On the fly" Drive Image Encryption: Built-in DiskCypher technology allows the full encryption (AES 256) of Forensic Images. The process is done without speed degradation during the acquisition process.

.: Windows XP Operating System: Solo-4 runs on the highly stable and proven Windows XP Operating System. Unit can be customizable for individual organization needs upon request.

.: Drive Spanning: Solo-4 allows for the imaging from one large "Suspect" Drive to multiple smaller "Evidence" Drives.

.: Linux DD Restore: Restore a previously captured DD Image to a fully bootable 100% working copy.

.: Drive Wiping: Supports single pass or full DoD Sanitization.

.: Multiple Hash Verifications: SHA-1, SHA-256, MD-5

.: Intuitive Easy to use Interface: 8" Full Color, user friendly touch screen.

.: Captures Suspect Data from Network Storage: Solo-4 forensically captures "Suspect" Data from Networked drives and folders using 1 Gigabit Ethernet Connection.

.: Uploads "Suspect" Images to Network Storage: Solo-4 forensically uploads "Suspect" Data Images to Networked Storage Area using 1 Gigabit Ethernet Connection for the purpose of processing and archiving forensic images.

.: Preview "Suspect" Data directly on the unit: Preview active files on the "Suspect" Drive utilizing a built-in file viewer.

.: Drive Lock Functionality for use with a Forensic WorkStation: Utilizing the "Suspect" "always on" write protection, Solo-4 can be used attached to a Forensic Work Station via USB connection to allow the preview, capture or analysis of "Suspect" Data in a safe environment.

.: USB Card Reader Support: Supports Micro Media Formats (Compact Flash, memory sticks, SD, Micro SD, etc.) expanding the option of types of "suspect" Media that can be captured.

너무 좋아보이는데요... Isn't it too good to be true yet?

우선 Torrent 파일을 이용해 다운 받을 수 있습니다.

Hiren_s_BootCD_v10.0.torrent

변경사항은 다음과 같습니다. +는 추가, -는 제외된 항목입니다.
---------------------------------------- Hiren's BootCD 10.0 ---------------------------------------- +InfraRecorder 0.50 -ExpressBurn +TestDisk for windows +PhotoRec for windows +Virtual Floppy Drive 2.1 +HxD 1.7.7.0 +FastCopy 1.99r4 +Angry IP Scanner 2.21 +TCPView 2.54 +OpenedFilesView 1.40 +ProcessActivityView 1.10 +RegScanner 1.77 +USBDeview 1.42 +Streams 1.56 +RemoveWGA 1.2 +RRT - Remove Restrictions Tool 3.0 Intel Matrix Storage Driver iastore.sys 8.9.0.1023 (Minixp) PE Network Manager 0.45 (Minixp) Security Tab (Minixp) Pointsec Filter driver (Minixp) Double Driver 2.1 GetDataBack 4.0 EASEUS Partition Master 4.0.1 TrueCrypt 6.2a HDD Regenerator 1.71 Recuva 1.29.429 Unstoppable Copier 4.2 IsMyLcdOK (Monitor Test) 1.02 Samsung The Drive Diagnostic Utility (ESTOOL) 3.00g IBM/Hitachi Drive Fitness Test 4.15 HDD Scan 3.2 System Analyser 5.3w Astra 5.43 HWiNFO 5.3.0 CPU Identification utility 1.17 PC Wizard 2009.1.90 SIW 2009-07-28 CPU-Z 1.52 ProduKey 1.36 Wireless Key View 1.27 Content Advisor Password Remover 1.01 MessenPass 1.26 CCleaner 2.23.993 CurrPorts 1.66 Autoruns 9.53 Ultimate Windows Tweaker 2.0 Xp-AntiSpy 3.97.4 beta ShellExView 1.40 Kaspersky Virus Removal Tool 7.0.0.290 (2908) Malwarebytes' Anti-Malware 1.40 (2908) SpywareBlaster 4.2 (2908) SmitFraudFix 2.423 PCI 32 Sniffer 1.4 (2908) PCI and AGP info Tool (2908) Unknown Devices 1.2 (2908) ComboFix (2908) Spybot - Search & Destroy 1.6.2 (2908) SuperAntispyware 4.27 (2908) www.hiren.info/bootcd ISO MD5: d81669070c5d1a0c4b2a4daac0ef1cab