576 reputation
1613
bio website
location
age
visits member for 4 years, 5 months
seen Mar 25 at 1:20

Mar
4
asked Signing-milter / SMIME - how are this email signed incorrectly?
Feb
16
awarded  Famous Question
Jan
28
awarded  Custodian
Jan
28
reviewed No Action Needed How to Power on a Computer remotely?
Jan
2
comment How does windows 7 know that it should not swap in data from a previous boot?
I knew the security purpose of the CPFAS key. I just wondered how it could know. I tought real memory Always was assumed to be empty at boot, since the memory loses it data at poweroff. But now I understand, in other Words, a table of unused and used pages are stored in real memory, like a FAT table, and this then applies for both pagefile and physical memory.
Jan
2
accepted How does windows 7 know that it should not swap in data from a previous boot?
Jan
2
asked How does windows 7 know that it should not swap in data from a previous boot?
Dec
9
answered USB ports fail to recognize on wake
Dec
9
asked How can I have Postfix add a header to all outgoing mail based on command?
Dec
6
answered Hard drive shows 0 MB and fails to boot, but works after booting from a live CD and rebooting
Dec
1
comment How I mount an image on linux in fake read-only mode?
It must be on block level since the system which reside on the image is a windows system. Thus the image also needs to contain a bootloader since a PXE client fire up on diskless Machines and boot Windows 7 via iSCSI. Thus, forget file level systems. It must be either a raw image file (have tried with xmount with no success currently) or a (virtual or real) block device. Also, the server does restart very rarely, so /tmp does not get cleaned.
Nov
30
comment Why are write blockers needed when there is mount with read-only?
JakeGould: Yes, but you need to assume the worst when analyzing a drive. Thats why even keyboards and such "harmless" hardware are seized and not only the PC in question, because who knows if a encryption key is hidden inside the keyboard? So basically, a investigator can be forced to set up the PC in the precisely the same way as it was seized, but at the forensic's office, and then booted live, but with a write blocker present.
Nov
30
comment Why are write blockers needed when there is mount with read-only?
Normally you both use a write blocker to make a image of it. Then you boot the system if needed, to gather evidence which is only accessible "online" (while the suspect OS is booted). In most cases, its enough with simple offline-analysis, but sometimes, online-analysis is needed in ADDITION to the offline-analysis. Normally you work with the image, but sometimes the trap software could use drive-IDs to prevent further access is a copy is booted, then you basically need to boot online with a write blocker. It all depends why you are forensically investigating the drive in question.
Nov
30
awarded  Good Answer
Nov
29
comment Apple TouchID allowing more than one fingerprint?
And it depends on fingerprint controller. In some access controllers, the algoritm make the profile "stricter" for each touch when you enroll, and some fingerprint controllers make the profile less strict for each touch. According to OP, he was able to access with both thumbs after making a Composite profile, so the fingerprint controller is with very high degree of the more "user friendly" type which make the profile less strict for each touch (rather allowing in one unauthorized than locking out the real owner).
Nov
29
comment Apple TouchID allowing more than one fingerprint?
It could also be the opposite, eg when a Composite thumbprint is made, the fingerprint controller will try to create a profile with a low FRR for 2 completely different fingerprint, which will cause that profile to have a extremely high FAR. Eg, theres a higher chance a unauthorized person could just use his own finger to unlock OP's iPhone.
Nov
29
revised Why are write blockers needed when there is mount with read-only?
added 283 characters in body
Nov
29
answered Why are write blockers needed when there is mount with read-only?
Nov
29
comment How I mount an image on linux in fake read-only mode?
This is the solution I have today, by using dmsetup along with a snapshot of about 1mb that is cleaned each reboot of the iSCSI initiator (eg a bootscript on the initiator tells the server to start the cleaning process on the target machine). But sometimes the cleaning process hangs indefinitely, causing the initiator to be stuck in a bootloop. I would rather get rid of the cleaning process completely, and instead discard any Changes immediately.
Nov
29
revised How I mount an image on linux in fake read-only mode?
added 253 characters in body