Showing posts with label Software Windows. Show all posts
Showing posts with label Software Windows. Show all posts

Nov 30, 2009

When cofee becomes cofree

Focus of the post : Microsoft Cofee (Computer Online Forensic Evidence Extractor) leaked on the internet.





Microsoft Cofee leaks onto the web - Inquirer - The software is free to police forces around the world and helps access details about crimes such as identity theft, online fraud, child pornography and illegal filesharing before criminals can wipe the information.

It's reportedly illegal for unauthorised people to download and use the software"


"This enables the officer to take advantage of the same common digital forensics tools used by experts to gather important volatile evidence, while doing little more than simply inserting a USB device into the computer," said Microsoft



Any guess's where did i spot the news and file  ??

illmob.org -  0wned by William Genovese (aka illwill - who was arrested by FBI in a setup for selling the publicly available  part of windows 2000 source code already available on the internet!! to an agent posing as a n00b )


Microsoft gives Interpol free COFEE

Update:
There are two versions of the same file floating on the internet . The 15Mb msi package will give the error "The parameter is incorrect". So look for the fixed package on google.


Jan 9, 2009

Before You Format Your Windows PC - Everything You Need to Backup

Focus of the post:- Checklist before you format your widows PC.Here are things you need to remember before you format your Windows PC.Every now and then i come across people crying after a fresh windows install.For some of my friends a windows reinstall is a monthly job and for some who use computers as dvd players its a yearly job. It depends on how much you use your windows,the more you use it the more it wears out.

Before you press Enter,Scroll down


1. Firefox Data   

All personal information including bookmards,passwords,browsing history,extensions,etc that needs to be backed up is placed in the firefox profile folder.Path of the profile folder:- "C:\Documents and Settings\Username\Application Data\Mozilla\Firefox\Profiles\profile folder"  or simply goto Run and type "%appdata%/mozilla".Descriptions of all the files under the profile folder can be found here.
  • Bookmark Backup
1. Backup your Bookmarks manually in HTML(merge while restore) and JSON(replace while restore) formats 


2. In Firefox 2 and lower versions bookmarks were stored in the file "bookmarks.html" located in the profile folder.In Firefox 3,bookmarks and browsing history are stored "places.sqlite" instead of bookmarks.html.
  • Backup your Complete Profile Folder located in C:\Documents and Settings\Profile Name\Application Data\Mozilla Firefox\Profile
  • Backup your History and Bookmarks by manually copying places.sqlite from the Firefox Profile Folder.Backup cookies by copying cookies.sqlite from the Firefox Profile Folder.
  • Backup the complete Extensions folder in profile folder to restore your extensions later on.
  • Backup username,passwords and never save exceptions stored in sigons3.txt(Encrypted)  and key3.db(Encryption Key) or alternatively use Password Exporter Extension to restore username and passwords.signons3.txt is useless without key3.db.
  • You can also use Mozbackup(compatible with other Mozilla Products)  or the FEBE extension(not the best option) to restore stuff.
  • Foxmarks extension can be used to synchronize bookmarks and passwords across different computers.Google browser sync was better but its dead.Comparison of browser synchronizers.



Personally i use the built-in Mozilla Profile Manager to create separate profiles in a safe location on the harddisk.Edit the firefox shortcut to "C:\Program Files\Mozilla Firefox 3\Firefox.exe" -p to activate Profile Manager.

How to backup Firefox 3 settings under Linux
 
2. BitTorrent Data and Settings
  • Settings and Resume Data - Backup up the entire contents of folder %AppData%/utorrent
  • .Torrent Files - Stored in %AppData%/utorrent by default or your custom folder set through Options>>Pref>>Directories>>Store .Torrents in or Move .torrents for finished jobs to:(for seeding)
  • Default Download Location - C:\Documents and Settings\Profile Name\My Documents\Downloads

    uTorrent FAQS:-
    • How can I use µTorrent on a USB key or other removable drive?
    Simply copy settings.dat (located in %AppData%\uTorrent ) to the same folder as uTorrent.exe, and you're done.
    • How can I share my torrents between user profiles / make µTorrent run self-contained in one directory? 
    Simply copy the entire contents of %AppData%\uTorrent into the same folder as utorrent.exe. Alternatively, create a blank file named settings.dat in the same folder as utorrent.exe, if you'd like to start out fresh (no settings/torrents). If using it in a multi-user environment, this folder should be accessible and writeable by all users so they can share settings and resume data.

    3. Flashget
    • Save completed and uncompleted downloads(.jc!) from default location C:\Downloads.
    • Download and Resume - Settings for downloading and resuming later are saved in default.jcd database.Make sure you backup the database before reinstallion.
    Save the download database

    4.Google Desktop - In earlier GD versions default Index location was "C:\Documents and Settings\%USERNAME%\Local Settings\Application Data\Google\Google Desktop".The index location can be only be changed by editing the registry.In latest versions - Google Desktop 5.1+ the files are indexed in the partition with the most available free space.Google hasnt updated its GD help.
    • Exit GD and copy your index files to a safe location.
    • After reinstallation change registry keys as in the screenshot.
    • Suggest features for google desktop here and dont forget to click on Change Index Location under Improve control over indexing. 
    Backup index - Google Help

    TweakGDS - TweakGDS is a useful GD plugin which allows you to change index location and include/exclude partitions for indexing.

    5.GAME SAVED FILES -  Most of the games create save files inside their installed directories but some of them spit save files outside their installed directories.
    "C:\Documents and Settings\All Users\Application Data\NFS Underground" - Hidden Folder
    "C:\Documents and Settings\ProfileName\Local Settings\Application Data\NFS Underground 2" - Hidden Folder
    "C:\Documents and Settings\ProfileName\My Documents\NFS Most Wanted"
    "C:\Documents and Settings\ProfileName\My Documents\NFS Carbon"

    6.GAME REGISTRY KEYS - Most OpenGL games continue to run after a clean install because they store the cd key information inside the installed directories.Few of the games stores cd-key info and other settings inside the registry and wont run after a fresh windows install.You must manually backup the registry keys by going >>Run>>Regedit.exe>>Find>>Game Name.If you backup few of the registry keys.Restore *.reg files after a fresh install.
    Error Message after fresh install
    Save Registry Keys
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Unreal Technology]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Unreal Technology\Installed Apps]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Unreal Technology\Installed Apps\UT2004]
    "Folder"="I:\\GAMES\\UT 2004"
    "Version"="3186"
    "CDKey"="Your Pirated CD-KEY HERE"
    "ADMIN_RIGHTS"="You need to run this program as an administrator, not as a guest or limited user account."
    "NO_DISC"="No disc in drive. Please insert the disc labeled 'Unreal Tournament 2004 Play Disc' to continue."
    "NO_DRIVE"="No CD-ROM or DVD-ROM drive detected."
    "TITLEBAR"="Unreal Tournament 2004"
    "WRONG_DISC"="Wrong disc in drive. Please insert the disc labeled 'Unreal Tournament 2004 Play Disc' to continue."
    "YEAR"="2004"
    Resultant UT2004.reg
    7. Rainlendar
    • Use the Backup and Restore feature  to backup all your calendars and Rainlender files in zip format.Multiple calendars will be copied in the zip archive.This is similar to Google Calendars "Export My Calendar" feature.By default rainlender files are created in C:\Documents and Settings\ProfileName\.rainlendar2.The default calendar (default.ics) is created in the same folder.Change the location of the default calendar to a secure location on the harddisk.
     Change the default calendar location and Backup all the calendars and settings using the backup option
    • Use the File>>Export feature to backup up all or a particular event and task.
    • If you are using multiple calendars (separate for office,personal,etc) then backup them indiviually in iCalendar format using the Export feature.
      •  Can I install Rainlendar2 to a USB memory?
      Yes, you can. If you use the Windows version the installer can do this automatically for you. You can also just copy everything in the Rainlendar's folder to the USB memory and create an empty text file called rainlendar2.ini in the same folder where the executable is. This will make Rainlendar2 to use it's own folder for the settings and it will also store all the events and tasks to the same folder too.
      • Where is all the data stored?
      By default the settings files and the events/tasks are stored in a folder called .rainlendar2 inside your home folder. The location depends on your operating system.Windows XP: C:\Documents and Settings\[yourname]\.rainlendar2.Windows Vista: C:\Users\[yourname]\.rainlendar2\rainlendar2.ini.Linux: ~/.rainlendar2 or ~/.config/.rainlendar2.Mac OS X: ~/.rainlendar2.You can change the location of the ics-file where the events and tasks are stored from Options->Calendars.If you want to store the settings somewhere else you can start Rainlendar2 with -c [path] command line parameter (the [path] defines the path to the settings).You can also move the rainlendar2.ini file to the same folder where the executable is located. This makes Rainlendar to use it's own folder to store all the settings which is useful e.g. if you have installed the application to a USB memory.

      8. Windows XP Activation Data - Follow the instructions here or here. 

      9.Wireless Settings - Since most of the things in the post holds true for Vista. So here is a tool to backup wireless settings in WheezeTa.It is "Handy small program, that knows to backup and restore all wireless networks setting from your computer. For some reason, there is no way to do it by using regular Windows Vista tools. This feature is extremely useful, when you have to reinstall your computer or use the same settings of wireless networks for different machines.In order to use the program, all you have to do is to run it once. The program generate small file, can be handled and transfered in diskette. Later if you'll run this generated file, all settings of wireless networks will be restored on target machine".You may also like Vista Battery Saver from the same blog.


      10.Miscellaneous  - Desktop Data , My Documents Data,Shortcuts on desktop,Fonts,Saved Passwords ,CD-key  of windows,office.


      11.Google Chrome - When i started writing this post on 22nd Sep08 i used only firefox but now when i am completing it i use chrome for 40% of my surfing(when feed reading on google reader).All this while i have been busy with exams.Most of the older people (above 30yrs) to whom i introduced firefox and tabbed browsing never used firefox but they continued with IE.But  when i met them(doctors,uncles...) recently they switched to chrome on their own!!
      12. Driver Backup - If you are proud owner of extinct hardwares or branded PCs make sure you backup them with the following softwares to avoid getting into trouble latter.A month ago when my friend formatted his Compaq Presario, the drivers downloaded from the website didnt even work.
      • DriverBackup! - "Fast and user-friendly free tool for drivers's backup, restoration and removal with command line options, automatic restoration from CD\DVD and path formatting. DriverBackup! includes also an interactive command line builder." Its opensource , portable and you can easily select between devices with OEM(devices with a Microsoft driver),Third parts(devices with a third part driver),Digital signature(devices with a digital signature (“WHQL”) only),Full portability(devices that are totally compatible with backup and restore)drivers.
      • DriverMax   - "is a new tool that allows you to download the latest driver updates for your computer. No more searching for rare drivers on discs or on the web or inserting one installation CD after the other. Just create a free account, log in, and start downloading the updates that you need."
      13.Evernotes Database - Writing a diary has always been a funny thing to me but after i met evernote i started writing a diary.Subject notes,Ideas,Blogs,Word Meanings,Lessons learnt in life,To-Dos...are all present in my evernote database.The evernote database is the most precious thing on my harddisk.
      • Database Location:- C:\Program Files\Evernote3\Databases3\AccountName.exb or
      • Simply install Evernotes Portable version :- In Menus >> Application

      14.Windows Updates - 5 Ways To Update Your Windows Operating System


      15.Email Client Data -  "Amic Email Backup is a handy software tool for Microsoft Windows based PCs designed to create backup copy of your email database. Amic Email Backup can save emails, address book, settings, mail and news accounts, message rules, blocked senders lists and signatures to a single, compact, compressed backup file that can be easily restored when necessary.Most computer users do not have anything else to backup except their email, as all other files can be restored from original software CDs if a virus or hdd crash make the computer unusable."  Download  


      16.Anti-Virus Definitions - If you use the auto-update feature and dont download the definitions manually you will loose the latest definitions after a clean format.
      • Kaspersky Updates
      K8 - C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP8\Bases
      K7 - C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Bases
      • Kaspersky Settings - Application settings can also be backed up >>Settings>>Protection
      • Symantec Definitions can be backed up with the help of Update Locator .The Update Locator finds Symantec virus definitions and copies them onto the Desktop into a folder called Update Locator Virus Definitions. This allows you to copy them to another location for use on another computer.


      17.Backup Network (broadband) Settings - The windows way has been described here but the simplest way is to use the following commands:-

      To backup your network settings:-
      netsh interface dump > settings.txt
      To restore your network settings:-
      netsh exec settings.txt


      This will backup everything(IP address,DNS servers,etc).The configuration file is made in c:\Documents and Settings\Username\filename.ext.Backup the file before a reinstall and restore it to the same location after a clean format before running the restore command.Very useful if you have to use the same settings on many computers.


      Solutions to the above problem :- 

      1. Files and Settings Transfer Wizard - C:\windows\system32\usmt\migwiz.exe.(Start > All Programs > Accessories > System Tools ).You can choose to back up files and settings or only files/settings.Under the settings tab you can select :- Accessibilty,CMD Prompt Settings,Display Properties ,IE Settings,Network Printers and Drives,Windows Media Playar,Taskbar,etc. It is a convenient way to backup small settings.
        2. Change Program Files Directory - By default all the programs are installed in C:\Program Files.You never know how many programs you will install so it is always recommended to change the default location of program files to a separate partition.Many programs continue to run after fresh windows reinstallation.I personally use a separate 12GB partition for Program Files.If you use multiple copies of Windows XP(for Gaming,Net,etc) then you can set a common Program Files Folder which will also save you the pain of installing essential applications across multiple copies of Windows XP and save disk space.
        Windows Registry Editor Version 5.00
        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion]
        "ProgramFilesDir"="F:\\"
        "CommonFilesDir"="F:\\Common Files"
        "ProgramFilesDir (x86)"="F:\\Program Files (x86)"



        3.Change Location of My Documents Folder - In the Start Menu >> Right Click My Documents >> Properties >> Target.More here.


        4.Changing Location of Documents and Settings Folder - Move your Documents and Settings folder from the default location to a safe place.If you get the access denied error while copying then skip "LoggedOnUserName\Application Data\Microsoft " folder.Make registry settings as described here, here  or  here(complete)  .After making the necessary changes logoff and login again.

        Typing "%UserProfile%" in run will now open the new location.In linux you can assign /home to a separate partition.

        Frustrated with Windows ??
        Try Ubuntu

        5.Make an Image of your Windows Partition - You can make an image of your windows partition after installing all the system drivers,tweaking,activation and essential softwares with Acronis True Image or Norton Ghost.When something goes wrong you can restore windows from the image. 



        In case if i missed something then please add-up in the comments section and let me know if you found it useful.

        Aug 15, 2008

        Some Useful Data Recovery Tips

        Focus of the post:- Share my data recovery experience


        • Case I - Software Fault
        One fine day i was just reading about NTFS partition in the OS Dinasaur book by Galvin[out of the 3 writers this is the easiest name to pronounce] for my endsem exams.I just read the line the cluster size[allocation unit] is configured when an NTFS partiton is formatted.I remembered the default cluster size was 4096 bytes,reading the book i decided to test what other cluster sizes are available."NTFS does not deal with individual sectors of a disk but instead uses clusters as the unit of disk allocation.A cluster is number of disk sectors that is a power of 2.The cluster size is configured when an NTFS file system is formatted.The default cluster size is the sector size for voulmes upto 512MB[that is 512bytes],1KB for volumes upto 1GB,2KB for voulmes upto 2GB, and 4KB for larger volumes.This cluster size is much smaller than that for the 16-bit FAT file system,and the small size reduces the amount of internal fragmentation."[OS Principles,find more here and here].Before you make some opinion about me i must tell you that i am 100% adept with partitions and partitioning.I had 3 primary partitions and 9 logical drives in the extended partition.The last two logical drives were empty for linux distros so i deleted the last drive.As soon as i clicked on "delete logical drive" the system just restarted.After the reboot i found that i had lost 3 logical drives,one of the lost logical drives had 213GB of data.The berserk WDM utility  showed 1348GB of unallocated space more than the harddisk itself!!!.I cursed the Windows Disk Management utility, it reminded one of my friends talks,he used acronis disk director for partitioning and he lost one of his paritions in a similar way.I figured out the cause for this erratic behaviour - Never mix partitioning process with different utilites.This is a rare case and the whole data recovery process costed me at least 15marks but fortunately i got a short note question on NTFS in exams for 5 marks.I tested many data reovery utilites to recover 100% (213 GB of data).This isnt a detailed review of recovery softwares but contains a important word about each one of them.

        Data recovery softwares have different modes depending on how you lost your data:-Format Recovery,Deleted Reovery(accidental file deletion),RAW Recovery(last resort),etc.Make sure you choose the correct one.

        Ontrack Easy Recovery
        I trusted this software the most.Initially the soft didnt recognize the filenames and folder structure.But after i converted the unallocated space into NTFS volume it recognized the data and folder structure(i didnt format it).Formatting the unallocated space would have made the data recovery more difficult.After going to Advanced Data Recovery>>Select Partition>>Advanced Options:-Select partition type(NTFS),Advanced Scan,>>Select Use MFT if you havent formatted the partition.Specifying this info the software immediately recognized my old NTFS volume.The software reovered 80% of my data.The software failed to recover saved web pages that were recoverd by file scavenger.

        PC-Inspector file Recovery
        Good old freeware with dirty Interface.Few audio and video files were corrupted while recovering!!.But the same files were recovered correctly by File Scavenger.The software did recover gigs of webpages but most of them were corrupted.Dont forget to spend a little time with the software interface.

        File Scavenger v3.2
        File Scavenger is an expert with NTFS partitions.It recovered 5gigs of documents and web pages which Ontrack and PC Inspector failed to recover.Except file scavenger no other utility was able to recover 100% of my data.It can recover data from even RAID arrays.

        R-Studio
        Lost file names and folder structure.Poor performance.

        Acronis Recovery Expert bundled with Disk Director Suite
        Initially i was looking for a utility that could undelete a partition but Active@ Partition Recovery just failed to work.I tested Acronis at last and laughed on myself.One click and everything was restored back to normal!!!.The partition was undeleted in just one click.I verified the integrity of files and everything was untouched.What a fool i have been all this time testing the capabilites of the recovery softwares.

        Here are few utilites that failed to recover a single BIT of data
        Active @ Partition Recovery
        0&0 Disk Recovery v4.1 and bunch of other lesser known utils downloaded from the internet

        Lessons learnt:-
        Backup your data regularly.
        NeverAvoid mixing partitioning process with different utilites like Acronis Disk Director,Partiton Magic and Windows Disk Management.
        Pack your PC during exams.

        Do's and Donts in case you loose a partition
        • Try to recover the partition with data recovery softwares that can undelete a partiton.Most of the data recovery softwares lack this mode so go for a dedicated one like Acronis Recovery Expert or DiskInternals Partition Recovery.This will save you the pain of scanning the whole file system and saving individual files.
        • Never format the partiton with a different or same file system in case you have a damaged file system or corrupt partition table
        • If the data recovery software doesnt pick up your lost drive then try to allocate the unallocated space and dont forget to check the "Do not format this partition" tab.
        • Case II - Some HDD fault
        If you broke your IDE HDD's pin or managed to burn your HDD's DMA chip then HDD will be detected in BIOS but Windows wont load(you wont be able to reinstall either).I came across two hard disks of such fault.One of which was my own Seagate 7200.7 80GB IDE HDD[3 years ago] with broken pin and another was a SATA WD 250GB disk given to me by bro's friend  for data reovery[20 days back].Initially it looked to me some OS DMA fault or virus work but the problem was with HDD itself. I tried Acronis bootable DD CD,Hitachi's DFT,Seagate SeaTool,reinstalling windows but you will get an error everywhere.I wasnt surprised on the Linux Boot as i recovered by data three years back with a KNOPPIX Live CD.This time i used Ubuntu.If you have the faulty drive installed,Windows wont even load from a working drive with the working HDD installed as primary!.Linux will take a long time to boot and even a 1GB file will take hours to copy.
        Lesson learnt:- Never loose hope.

        • Case III - Human Fault
        I remember i was  struck with a data disaster 6 years ago when i was new with computers.At that time i was resizing my 12Gb partition to 15GB[secnodary partition] with Partition Magic,frustated by the long process i just pressed the reset button.Windows ME on the primary partition worked fine.Each bit of data was precious to me in the dialup age.I  used a utility called Drive Rescue by Alexander Grau to to recover the data .Its discontinued and it had the same interface as the new PC Inspector File Recovery by Convar.
        Lessons learnt:-Always be patient.

        Data Recovery using Linux

        Recover data from Windows partitions using Linux -  [Download here]

        The pdf "Recovering Data from Windows Systems by Using Linux" is short and precise, teaches the stuff quickly published by the Open Source Software Lab at Microsoft..Basically it teaches how to create images of partitions.Dont forget to read the comments at the original page.There are specialized linux distro's for forensic analysis and data recovery too like F.I.R.E.

        HowtoGeek:Use Ubuntu Live CD to Backup Files from Your Dead Windows Computer
        Darknet:Complete list of linux distro's for forensic analysis,data recovery and security

        Dont forget to post your comments,questions and suggestions.

        Jul 4, 2008

        Firefox lovers set Guinness World Record - Series of events

        Focus of the post:-Series of events
        • Mozilla started a campaign on May 28 to set a Guinness World Record for the most number of software downloads in 24 hours with its Firefox 3 browser.Firefox community was asked to pledge to download the browser on the download day.
        • GOAL(Mozilla FAQ):Do we have to reach a specific number of downloads in order to set the record? This is the first record attempt of its kind so there is no set number. We'd really like to out do the number of Firefox 2 downloads on its launch day, which was 1.6 million. Let's shoot for 5 million--the sky is the limit!.
        Mozilla enthusiasts worldwide drove more than 1.7 million pledges to download Firefox 3 on Download Day, hosted regional download “fests,”and informed more than 43 million people through hosting Download Day affiliate buttons online.

        Firefox community email
        • The Mozilla servers were down for few hours on the download day.Read the minute by minute status update on CNET."Thanks to overwhelming demand we’ve passed through 14,000 downloads a minute! This will put us well into the tens of millions of downloads in a 24 hour period if we can sustain it. Each download is about 7MB so that’s around 13 Gigabits/s of just download traffic. Not too shabby!",the Mozilla site said.
        The download day started on June 17,2008 17:00 UTC/GMT - 22:30 IST.->>
        Firefox community email
        • Five hours after the release of Firefox 3,a security firm DV Labs/TippingPoint reported a critical vulnerability to Mozilla affecting affecting Firefox 3.0 as well as prior versions of Firefox 2.0.x. The vulnerability could allow an attacker to execute arbitrary code on visiting a malicious link.The same firm recently published an advisory related to Motorola RAZR JPG Processing Stack Overflow Vulnerability.The advisory will only be published once the vulnerability is patched by Mozilla.
        • At their busiest, the servers were handling more than 9,000 downloads per minute. Within five hours the number of downloads for version 3.0 exceeded the 1.6 million mark set by Firefox 2.0 in October 2006.
        • India download count too low @ 489,889 downloads for the download day.US @7,734,930;China @721,524;Iran @535,796;North Korea @000





            Firefox community email
            World Record Confirmed by Guinness on July 3,2008(Press Release):--->>"We did it! We set a Guinness World Record.Thanks to the support of the always amazing Mozilla community, we now hold a Guinness World Record for the most software downloaded in 24 hours. From 18:16 UTC on June 17, 2008 to 18:16 UTC on June 18, 2008, 8,002,530 people downloaded Firefox 3 and are now enjoying a safer, smarter and better Web"
            Mozilla FAQ about the validity of the record:-

            What does Mozilla have to provide Guinness to validate the record? We will provide the following:

            1. Signed statements of authentication from our judges showing that we've followed the rules and confirming our numbers.
            2. Video footage and photographs of our community members hosting Download Fests. Take pictures!!
            3. Download logs for a sample size of our downloads. We will internally host 10% of the downloads, retaining all of the logs for these downloads, and will use this as our sample set to extrapolate the actual download number and percentage of completed downloads.





            Firefox 3