My web wanderings

Electronic Crime Scene Investigation: A Guide for First Responders

Computers and other electronic devices are being used increasingly to commit, enable, or support crimes against persons, organizations, or property. The “Electronic Crime Scene Investigation: A Guide for First Responders” guide (NCJ 187736) is intended for use by law enforcement and other responders who have the responsibility for protecting an electronic crime scene and for the recognition, collection, and preservation of electronic evidence. The document is not all-inclusive. Rather, it deals with the most common situations encountered with electronic evidence.

The document is from 2001, and a lot has changed in the last three years. But it seems to still be a pretty good foundation to learn from.

Happy reading!

From Korby Parnell’s WebLog:

“One of the most frequently asked questions about VSS is: ‘I can’t run Analyze on a weekly basis as recommended because inevitably, there’s at least one user who forgets to checkin their files on Friday afternoon. Is there any way to disconnect users from a database?’ The short answer is a qualified ‘no’. VSS provides no way to forcibly disconnect users from a database. The long answer is YES, but you have to do it in Windows. My team uses the following PERL script“

I was going to post every article I found worth while but there are so many I am just going to list them in no particular order.

Enterprise Performance Analysis
Enterprise Instrumentation Framework (EIF) - This is similar to the Event system we designed at Homestore.
MSDN-TV: Monitoring ASP.NET Applications
High resolution timer
ASP.NET Performance Monitoring, and When to Alert Administrators
Monitoring in .NET Distributed Application Design (Building Distributed Applications)
FoodMovers: Building Distributed Applications using Microsoft Visual Studio .NET
   Section 6: Going Live: Instrumentation, Testing, and Deployment
Exception Management Architecture Guide
Performance Monitoring Provider
Performance Monitoring

9-part Windows-to-Linux roadmap

Microsoft SQL Web Data Administrator Microsoft SQL Web Data Administrator The Web Data Administrator enables you to easily manage your SQL data, wherever you are.

I should preface this with I share Brad’s Musings on MS Office. I to have switched most of my office functions to Open Office or Star Office. Star office is a little more polished but you have to pay to play. But it is well worth the $80.

F#%K YOU, Microsoft Office

I’m using Office XP inside a Virtual PC. It has spontaneously complained that there has been — and I quote — “a significant change in your machine configuration”. Inside an unchanging Virtual PC.

Now it won’t let me proceed to make new documents, or save documents, until it’s re-activated.

It won’t re-activate without the original CD-ROM.

I simply cannot believe how much customer abuse Microsoft is heaping on people. WOULD THE DUMB ASS WHO MADE THIS DECISION LIKE TO GO HUNTING WITH ME? I’LL GIVE YOU A 10 MINUTE HEAD START.

I suppose it goes without saying that I’m downloading Open Office right now.

Encryption I’m trying to store encrypted credit card data in my database. I need to get some of these notes down just in case. Some basic concepts: Digest Authentication is a process that takes a body of text and turns it into a number. The number, referred to as a hash, cannot be turned back into the text, but the text will always return the same number when run through the digest authentication algorithm. This is basically a type of one-way encryption, and it’s typically used for authenticating users with passwords: The password you type in is turned into a hash, and stored with a saved hash value. Doing things this way, the password isn’t stored anywhere, so nobody can find your password. There are some weaknesses to this (particularly so-called “Dictionary Attacks” and using very weak hashing algorithms like the original Windows NT LANMAN hashes). Examples of digest authentication are things like MD5 and SHA. In order to get two-way encryption, basically to encrypt a body of text, you need to have reversability. Digest authentication isn’t reversible, you can’t get the input text from the output hash. So you need some reversible scheme. One way would be to use XOR, the Exclusive OR function. It’s reversible, but you need something to XOR your text with. You could use the password hash, but since you store that it would be avaialble to anyone with access to that storage, and you don’t necessarily want that. So what you can do is take the password hash, concatenate the cleartext password onto it, and create a hash from that. Since the password isn’t stored, the hash can’t be derived from anything on the server. So you can take that hash, feed it and the text to be encrypted into XOR somehow and come out with a reversibly-encrypted value. Reasonably secure, tre spiff. XOR is so fast it’s pretty much free, so you’re not even chewing up a lot of CPU. The problem is that if you use this to do credit card numbers, you’ve got a problem. Specifically, if you have a backorder situation, you’ll need to be able to charge the credit card at a later time (you don’t want to charge until you ship, just in case the manufacturer can’t get the item to you). So this isn’t really a good idea for credit card storage. The problem is that what IS a good idea for credit card storage is using a master hash for all the credit card numbers. That’s effective, you can pull stuff on demand….but where do you put the master key? I mean, if you store it in the database and somebody makes off with a backup, they’ve got all your credit card numbers. Or if somebody manages to get an admin account on your system (these are windows systems we’re talking about) then they’ve got instant access to all of your credit card numbers. More research pending…

Checkout this cool Calendar app for pocketpc.

MySQL: Building User Interfaces

Craig Maloney writes “If you are a Windows programmer looking to create or move your stand-alone database applications away from Microsoft-specific tools such as Visual Basic, Visual C++, Access or SQL Server, MySQL: Building User Interfaces is written just for you.” Read on for the rest of Craig’s review.

SecurityFocus has a three part article about using Nessus to improve security. definitely worth a read.

Part 1, Part 2, Part 3

Jason found this nice little script to list files in a directory. I have been looking for something like this for ASP/.Net for a while.

They have some other intresting scripts I want to look at.

Many security-related tasks can be tedious—and, therefore, overlooked. Using these 10 scripts can make your life easier, while simultaneously locking down your network.

This workspace is the working area for the Patterns & Practices team project on performance & scalability