273 reputation
27
bio website aryehleib.com
location
age
visits member for 3 years, 7 months
seen Sep 30 at 11:02

Sep
10
comment How to acquire image of disk on Linux computer?
It's all a question of what kind of suspect this is. Maybe you can't trust the controller on the disk either. At that point, you have to remove the physical storage media out and put it into a known environment to read it. But of course most investigators can't do that on the premises.
Sep
10
comment How to acquire image of disk on Linux computer?
yes, but as you pointed out, the live system may be programmed to destroy/modify sensitive data on the disk if it detects an attempt to retrieve the key.
Sep
10
revised A secure way to confine FTP login users to a single directory
added a better answer
Sep
10
comment How to acquire image of disk on Linux computer?
Regarding encryption, you've described a bit of a catch-22. We can't trust the live OS, but we need it for the keys. Also, if we do anything short of powering the OS down, we compromise the disk. The use for a write blocker would be if you could insert it between the suspect's hardware and the drive while the OS is still live.
Sep
10
comment How to acquire image of disk on Linux computer?
As André Daniel notes (in second linked question), a normal linux system won't write to an unmounted drive, so the write blocker seems unnecessary once the investigator connects the drive to trusted equipment.
Sep
10
comment How to acquire image of disk on Linux computer?
You ought to get a copy of the whole disk. In a simple case, kpartx can be used to access the partitions, so #1 is not really a concern. In a more difficult case, there might be hidden encrypted partitions and/or a modified boot system.
Sep
7
revised A secure way to confine FTP login users to a single directory
better phrasing for intent
Sep
7
revised A secure way to confine FTP login users to a single directory
additional information
Sep
4
answered A secure way to confine FTP login users to a single directory
Aug
21
awarded  Scholar
Aug
21
accepted Where is core group defined on coreos?
Aug
21
comment Where is core group defined on coreos?
Thanks. That demystifies a bit of the magic.
Aug
21
awarded  Commentator
Aug
21
comment Where is core group defined on coreos?
/etc/nsswitch.conf is a symbolic link to /usr/share/baselayout/nsswitch.conf. There's a line in there that reads group: files usrfiles but I don't see where the meaning of usrfiles is defined.
Aug
21
comment Keyboard shortcut for horizontal scrolling
@Ramesh The op there wants to alter the behavior of the scroll wheel on his mouse. I don't want to use the mouse at all, just the keyboard.
Aug
20
awarded  Student
Aug
20
asked Keyboard shortcut for horizontal scrolling
Aug
18
comment Where is core group defined on coreos?
Your answer to question 2. "How can I change the uid/gid?" is clear: "don't, just create a new user/group." But you haven't answered question 1. "How does CoreOS get its information about users and groups?" Maybe they should really be two separate questions.
Aug
18
comment Where is core group defined on coreos?
CoreOS really does seem to know more than what's listed in /etc/group as you can see from the output of id. I confirmed that getgrgid(500) returns a pointer to struct describing the core group.
Aug
17
answered Where is core group defined on coreos?