 use this as a bookmark container for the projects /for a quick references of the entries.
This symbol is used to add the contents in custom image which will be in AD1 format and contents added can be seen in Custom content sources.
In the above figure you can see the other multiple options available in file menu from capture memory we can capture the contents of your memory that is ram and contents of page file.
From Obtain Protected files we can get the restricted registry content files from the machine when a machine is in running state, by which we can actually look into multiple options available for a user for example SAM file can be used to get the key for passwords, SYSTEM file for the user accounts and their counts and many more. check my next post for more details on this files.
Detect EFS Encryyption actually shows you the encrypted files in the imaged loaded / in the disk.
I don’t think i need to explain this 🙂 from the figure you can get the details.
To preview the data in which mode you can select the option here and you can observe the data in the white space available below file list dialog.
All the options which are explained in File menu is just simply arranged here in this tool box.
View Files:The white space which can be seen below the File list where the preview is available for the image.
If we select Physical drive, next dialog would be similar to the above fig, drop down contains all the connected devices.User have to select the devices according to his requirement.
by selecting any of the image types from the above options it will direct you to examiner details from their it asks you for the image destination,name, fragment size,compression and its encryption, encryption technique will change according to the image type.
The new option which is added in FTK 3 version is Image mounting these all are the supported image types which we can mount and use for analysis and recovery.
if we check the context menu of the contents with in the evidence we can observe the export option and adding the specific selection to content image.
when we check the context menu of files in the file list, here also it is same as evidence tree from where you can retrieve single files and its details like mac times, hash values and other.After selecting the file you can check properties tab for more details regarding the file. Hex Value interpreter by selecting the text from view files tab you can check the hex content in decimal. You can change the mode of view by selecting options in Mode.
Where to download AIR?
How to install AIR?
Some of these packages you can get with Sharutils. It can be downloaded it from (http://packages.debian.org/lenny/sharutils) according to your architecture.
It first checks for Perl updated version and downloads it and then starts AIR installation. After completion you will be given a message “All Done”. If you face any problem in installing AIR please check whether you installed libx11-dev and xutils-dev packages. If not please install them then again run AIR installation.
To access AIR, sudo air in terminal.
Importance of AIR and How is it different from other?
How to Use AIR?
We can set a source (a disk / a file) as a target and a destination (A disk / a location to store the image).The source can be a disk to copy the disk contents to another disk / image and vice versa with block size mentioned. We can use multiple options available within the tool like compression, hashing, verification and others.
Compression is a technique which is used to compress the data while imaging to store it with in a minimum space, but this is not recommended unless and until it’s necessary. This tool supports the major compression techniques as bzip2, gzip, tar and others.
Hashing is a technique to ensure the data integrity with in the image, by selecting the hashing technique it will calculate the hash value for you and generates it in the status windows which can be exported in csv / txt format.
To know whether the data is properly imaged / copied we can use verification, to verify the contents we need to select Yes under the verify option.
We can split the image in to pieces if we need to store it in different location one reason to do this can be lack of disk space.
In connected devices we can select the source and destination as CD / HD / Writing zeros to the disk this is mainly done to wipe the Disk for restricting the data recovery but in some cases recovery can be done.Net is to take the image over network internet / intranet we can do this by specifying specific target ip with port number (This has to be explored more as I didn’t used in deep yet).
To start any process you selected click on start, and same for stop. You can observe the status in status windows with Hash values, process of completion.
Encase is a Commercial tool so i don’t want go into it anyway, its little bit tricky and easy if your thorough with the windows apps.
It requires a very unusual mind to undertake the analysis of the obvious. Alfred North Whitehead.
As a ClubHack team member, I am proud to announce ClubHack 2011. I am working with ClubHack team since 1.5 successful years in this journey I met with some really good information security gurus and my colleagues as a continuation this year we got Mr. Richard Stiennon as a Keynote speaker. We have some more good items programmed in our schedule.
Another great partnership of ClubHack is with National Security Database, Jointly developed by the Government of India and ISAC, a non-profit scientific foundation, the National Security Database (NSD) was conceived after the horrific 2008 Mumbai attacks as a proactive action to Identify the most credible and valuable Information Security professionals in India who work to protect the National Critical Infrastructure and cyber space of the country.
Captain America.......Where to start?

I have some extra cash and wanted to pick up a CA book or two. Not knowing any of the backstory at all, where should I be looking? Marvel Now? I was suggested to start at Vol 5 which I believe is the Brubaker stuff...is this the sweet spot to start at or are there other suggestions?

EDI: suggestions so far

* Man out of Time
* Vol 5 (Ed Brubaker)

* Marvel Now - not suggested right off the bat



edit 2: stopped into the shop and looked for Winter Soldier and no dice. So off to Comixology I went for now. If its good ill still want the hard cover.Edinburgh is a true gem. For me not being too much of a city person, the culture and history dotted along these cobblestone streets swept me off my feet as soon as I arrived and I instantly fell in love with this city. Edinburgh offers a little something for everyone: coffee lovers, art lovers, culture lovers, history buffs, outdoor lovers, the whole shebang, which makes this the perfect place to start your adventure around Scotland and before you head out to the Scottish Highlands. If you only have 3 days in Edinburgh, or if you’re heading here for a short weekend break, this itinerary is going to take you through the gems of the city, incredible coffee spots, vegan eateries, and some offbeat places outside the city that you won’t want to miss. This itinerary is completely malleable, so you can swap different days and activities to fit in with your preferences, but I have curated it into specific locations for each day so that you’re not hopscotching around, but rather spending days in different areas of the city so that you can maximize your time and save a bit of money. If that wasn’t enough, I also made a map of everything mentioned on this itinerary so that you can save it to your google drive and always have access to any of the locations and stops along the route so you stay on track and have a visual!
This three-day Edinburgh itinerary is for anyone looking to maximize their time exploring Scotland’s capital and see all the highlights and more during your stay here.
Headed To Edinburgh? Check out my other resources for the city!
I think the best way to immerse yourself in a city is by walking through all of the intricate architecture and seeing what small corners you can find amongst the hustle and bustle. I spent a couple of days wandering around Edinburgh and I still found new cafes and shops to stop into that I had missed before. If you want to save a bit of money on taxis or ubers, this is a great way to get around and experience the city.
If you need to get to the other side of the city or somewhere that is a bit too far of a walk, a bus is a cheap, and great, option for getting from point a to point b. You can purchase day passes, single tickets, and view all your different options on the Lothian Bus Website. If you’re buying a ticket as you board, make sure you have the exact amount since the drivers aren’t able to give you change.
This is the most expensive way to get around Edinburgh, and really any city, considering walking is free and the bus is only a few dollars. I took a few Ubers while I was around the city and I found them to be very convenient for meeting up with people and getting home after a long day. They’re everywhere, so you won’t have trouble finding one if you need one.
Three days in Edinburgh is just enough time to dip your toe into what this city has to offer. The cobblestone streets, pubs, and culture will have you wrapped up into Scottish History before you know it. There are tons of iconic spots in