293 reputation
27
bio website aryehleib.com
location
age
visits member for 3 years, 9 months
seen yesterday

Dec
16
revised Properly power down SSD during shutdown
Additional information (darn! another bad question!)
Dec
15
answered Why am I getting inconsistent IP values from icanhazip.com or curlmyip.com?
Dec
15
revised Properly power down SSD during shutdown
better wording
Dec
14
comment How to really easily save all tagged attachments in mutt?
Fantastic! Too bad I can upvote only once. What's really great about this solution is it works for multiple messages as well. Just tag 'em and ;|.
Dec
14
asked Properly power down SSD during shutdown
Sep
10
comment How to acquire image of disk on Linux computer?
It's all a question of what kind of suspect this is. Maybe you can't trust the controller on the disk either. At that point, you have to remove the physical storage media out and put it into a known environment to read it. But of course most investigators can't do that on the premises.
Sep
10
comment How to acquire image of disk on Linux computer?
yes, but as you pointed out, the live system may be programmed to destroy/modify sensitive data on the disk if it detects an attempt to retrieve the key.
Sep
10
revised A secure way to confine FTP login users to a single directory
added a better answer
Sep
10
comment How to acquire image of disk on Linux computer?
Regarding encryption, you've described a bit of a catch-22. We can't trust the live OS, but we need it for the keys. Also, if we do anything short of powering the OS down, we compromise the disk. The use for a write blocker would be if you could insert it between the suspect's hardware and the drive while the OS is still live.
Sep
10
comment How to acquire image of disk on Linux computer?
As André Daniel notes (in second linked question), a normal linux system won't write to an unmounted drive, so the write blocker seems unnecessary once the investigator connects the drive to trusted equipment.
Sep
10
comment How to acquire image of disk on Linux computer?
You ought to get a copy of the whole disk. In a simple case, kpartx can be used to access the partitions, so #1 is not really a concern. In a more difficult case, there might be hidden encrypted partitions and/or a modified boot system.
Sep
7
revised A secure way to confine FTP login users to a single directory
better phrasing for intent
Sep
7
revised A secure way to confine FTP login users to a single directory
additional information
Sep
4
answered A secure way to confine FTP login users to a single directory
Aug
21
awarded  Scholar
Aug
21
accepted Where is core group defined on coreos?
Aug
21
comment Where is core group defined on coreos?
Thanks. That demystifies a bit of the magic.
Aug
21
awarded  Commentator
Aug
21
comment Where is core group defined on coreos?
/etc/nsswitch.conf is a symbolic link to /usr/share/baselayout/nsswitch.conf. There's a line in there that reads group: files usrfiles but I don't see where the meaning of usrfiles is defined.
Aug
21
comment Keyboard shortcut for horizontal scrolling
@Ramesh The op there wants to alter the behavior of the scroll wheel on his mouse. I don't want to use the mouse at all, just the keyboard.