Posted by Administrator
cover-image

MAC OSX .DS_Store Artifact

  • 10.4 Tiger extended .DS_Stroe use to include "Spotlight" comments
  • Similar to Desktop.ini and Shellbags in Windows
  • Shows folders accessed within Finder
  • Stores "Window view settings", "Icon position", "Sorting preferences", "Window sizes and positions", and other metadata
  • Files are created in the enclosing (parent) folder when viewed in "Icon", "List", or "Gallery" view, but NOT in "Column" view
  • Applies to Local, External and Network locations

Caveats

Full paths are not included

  • "Trash put back locations" are a noted exception (put back location path included)

Timestamp are not included

  • Parsing tools can drive some time-related information based upon "File system timestamps" for the .DS_Store files themselves

Data is volatile

  • When a file is deleted/removed, its associated records are removed
  • When a file is renamed, its associated records are renamed

Takeaways

  • Determine original name and path for files and folders in Trash
  • Show user interaction of files and folders via Finder

Resources

YouTube Video:

What's In .DS Store for You? - macOS Forensics

DSStoreParser:

https://github.com/nicoleibrahim/DSStoreParser

Mac Dumpster Diving – Identifying Deleted File References in the Trash (.DS_Store) Files – Part 1:

https://ponderthebits.com/2017/01/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-1/

Mac Dumpster Diving – Identifying Deleted File References in the Trash (.DS_Store) Files – Part 2:

https://ponderthebits.com/2017/02/mac-dumpster-diving-identifying-deleted-file-references-in-the-trash-ds_store-files-part-2/



Posted by Administrator

QtDesigner is part of QtCreator. To use QtDesigner:

  • Launch QtCreator, and from the menu bar (outside QtCreator), click on: File>New File or Project

  • You will be presented with a New File or Project dialog window. In the Files And Classes section, select Qt. In the middle pane, select QtDesigner Form. Then click on the Choose button in the lower right corner.

  • You will be presented with a QtDesigner Form dialog window. Then you can select Main Window or Dialog with Buttons Bottom, etc. Then click on the Continue button in the lower right corner.

  • In the Location dialog window, use a name like mainwindow1.ui, and for the path you might want to step aside and create a directory called forms, e.g. $ mkdir /Users/7stud/qt_projects/forms, then enter that as the path.

  • Enter any other details and click on Done. That will land you in QtCreator with the Design button selected (which I guess means you are in QtDesigner), and you will be able to drag and drop widgets onto your window.

  • To convert the .ui file to a .py file that you can import into your python program:

    $ pyuic5 mainwindow.ui -o mainwindow.py

    -o => output file (default is stdout)

    That command converts the .ui file mainwindow1.ui to a .py file named mainwindow1.py.

To re-open the file: File>Open File or Project. If you select a file with a .ui extension, it will be opened with QtCreator's Design button pre-selected, i.e. you will be inside QtDesigner.


Posted by Administrator
  1. Attach the media to a computer with Windows 95, 98, Me, NT, 2000, or XP and a full version of WinHex installed.

  2. Close any application that may write to the media.

  3. Run WinHex.

  4. Select Tools | Open Disk/Disk Editor from the menu (or press F9).

Image Title

  1. Select the media to clear. It must be listed as a physical disk. Click OK.

  2. Select Edit | Fill Disk Sectors from the menu.

Image Title

  1. Select either “Fill with ... hex values” and specify a byte value in hexadecimal notation (without the preceding “0x”) or “Fill with random bytes” and specify a range of allowed byte values in decimal notation (usually 0 to 255). Click OK.

Image Title

In case of large media, the program will warn you that changes will be written immediately to the disk. Remember, you are clearing the media, and any data will be lost. In case of small media like floppy disks, WinHex will buffer the changes and flush them only when closing the edit window, after prompting you to do so.

  1. A small window will display the progress and an ETA. You may abort at any time by pressing the ESC key or by closing that window.

  2. When complete, you may close the edit window and exit WinHex, or repeat the steps 6 and 7 for sanitization (more than one clearing procedure).


Posted by Administrator
Sub PasswordBreaker()
    'Breaks worksheet password protection.
    Dim i As Integer, j As Integer, k As Integer
    Dim l As Integer, m As Integer, n As Integer
    Dim i1 As Integer, i2 As Integer, i3 As Integer
    Dim i4 As Integer, i5 As Integer, i6 As Integer
    On Error Resume Next
    For i = 65 To 66: For j = 65 To 66: For k = 65 To 66
    For l = 65 To 66: For m = 65 To 66: For i1 = 65 To 66
    For i2 = 65 To 66: For i3 = 65 To 66: For i4 = 65 To 66
    For i5 = 65 To 66: For i6 = 65 To 66: For n = 32 To 126
        ActiveSheet.Unprotect Chr(i) & Chr(j) & Chr(k) & _
        Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & Chr(i3) & _
        Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
        If ActiveSheet.ProtectContents = False Then
            MsgBox "One usable password is " & Chr(i) & Chr(j) & _
            Chr(k) & Chr(l) & Chr(m) & Chr(i1) & Chr(i2) & _
            Chr(i3) & Chr(i4) & Chr(i5) & Chr(i6) & Chr(n)
            Exit Sub
        End If
        Next: Next: Next: Next: Next: Next
        Next: Next: Next: Next: Next: Next
End Sub

to unlock password protected workbooks:

Line 12, replace "ActiveSheet" with "ThisWorkbook"

Line 15, replace "ActiveSheet.ProtectContents" with "ThisWorkbook.ProtectStructure"


Posted by Administrator
  1. Installer script

    cd ~
    wget https://raw.githubusercontent.com/adafruit/Raspberry-Pi-Installer-Scripts/master/adafruit-pitft.sh
    chmod +x adafruit-pitft.sh
    sudo ./adafruit-pitft.sh
  2. PiTFT Selection Once you run it you will be presented with menus for configuration.

For the 2.4", 2.8" and 3.2" PiTFT with resistive touchscreen overlay select #1

Image Title

  1. PiTFT as Text Console If you want the PiTFT to act as a text console, select YES to "Would you like the console to appear on the PiTFT display" choose NO to boot into GUI.

  2. Reboot.

Reference: https://learn.adafruit.com/adafruit-pitft-28-inch-resistive-touchscreen-display-raspberry-pi?view=all

PS.

When 2.8" touch screen installed, the display driver will override these settings, so that 320×480 resolution is being used instead, both by X11 and RealVNC. By switching RealVNC into virtual mode, it is possible to start a virtual desktop at a higher resolution:

pi@raspberrypi:~ $ vncserver-virtual

Image description