#RAR Webinar

[gauravlearningsolutions]

[lanorafranklyn-blog]

Mp3 Converter, CD Ripper, FLAC, Apple Lossless, WAV, AAC, AIFF. Repair Album Art, Asset UPnP

Prime 10 free Audio Converters: Suggest free audio converter to convert music information into different audio codecs. Click on on "Convert" to transform M4A files to AIFF format; alternatively, click on "Convert to One" to convert all files in record and mix to a single one AIFF file. Velocity may not be an necessary consideration if you must convert only a few files. Nonetheless, a fast converter software may save you hours if you have loads of information to convert, or find yourself changing information usually. Slow conversion speed is the largest draw back when using free converter software. A simple way to report out of your display screen in HD. Make video footage of any application, file on-line streaming video, webinars, even Skype calls, and save clips in all common codecs. Apple Lossless Encoder is kind of much like FLAC , producing larger information than AAC or MP3 however smaller than WAV. Usually an Apple Lossless file is round half the dimensions of an equal WAV file and greater than three times the scale of an equal AAC 256 kbps file. The M4A extension is just a container. Containers e.g. WAV can comprise several types of audio streams. It is extra common for aiff to m4a online consumers to use MPEG-four audio in an M4A container which is totally lossy. The kind of codec of selection if I used to be to use M4A is named Apple Lossless Audio Codec generally abbreviated ALAC. While not nearly as efficient as Monkey's Audio my sole choice of audio format, it is nonetheless lossless and to prove this, the checksums will surely match should you generated one for a WAV file earlier than compressing it then after decompressing the M4A file to another WAV file. Utilizing X Lossless Decoder generally abbreviated XLD, one can simply prove my statements each Actual Audio Copy and XLD generate checksums before optionally compressing to any format. M4A information are superior to MP3 when it comes to the scale of compression and audio high quality. The M4A file uses Apple's codec and resides inside the MPEG-4 container. The main benefit of M4A is that recordsdata are compressed however are lossless. This implies they are often decoded again to the unique high quality they were at the point of compression. One other good thing about M4A files are that do not carry any Digital Rights Administration (DRM) protection associated with other recordsdata meaning they are less restricted. There's no drawback in storing AAC files for hello-fi listening if you accept the slightly lowered quality (and, to be honest, excessive-price AAC is fairly good). In order for you precisely the identical quality as the original CD, although, it's essential to rip the CD on to an uncompressed PCM format (AIFF or WAV), or to a compressed file that is created utilizing a 'lossless' codec. Lossless codecs corresponding to FLAC or Apple Lossless (ALAC) take away 'redundancy' moderately than 'irrelevancy' and work a bit like the ZIP and RAR codecs for compressing computer files. They're not as environment friendly at area saving as AAC — usually only halving the file size, slightly than quartering it (or extra) — but on replay the audio is rebuilt completely as a bit-correct output that's an identical to the unique CD. I use ALAC in iTunes to retailer my ripped CDs for this very reason. Although there are free software program options, like iTunes, that may extract audio from a CD and convert it to smaller and extra manageable file measurement, we discovered by our testing process that you may spend lower than $40 on an excellent audio converter software program and future-proof your capability to collect, archive and http://www.audio-transcoder.com/how-to-convert-aiff-files-to-m4a share music effectively. We additionally acknowledge that you'll have a short lived have to convert a couple of information, so we examined the perfect free audio converters so we could suggest a product that will not introduce adware and spy ware in your laptop. Audio Interchange File Format (AIFF) is an audio file format commonplace used for storing sound data for personal computer systems and different digital audio units. The format was developed by Apple Inc. in 1988 based on Digital Arts' Interchange File Format (IFF, broadly used on Amiga techniques) and is mostly used on Apple Macintosh laptop systems.

AIFF MP3 Converter converts AIFF to MP3 and MP3 to AIFF. AIFF information typically finish with aaif,aiff,aifc, orafc extension. The converter focuses on AIFF file that supports nearly all codecs in AIFF specification, for example, a-Legislation, mu-Law, IEEE 754 float, ima4, gsm, gwvw, and so on. And The converter reads ID3 tag in AIFF file and transfers to output file when converting.iTunes can work properly to transform between compressed and uncompressed audio formats in addition to immediately play the audio file. The steps are as follows and the steps take instance by converting M4A saved in a folder or on a disk. You can even convert M4A already in your iTunes library to AIFF. Obtain and install program onto your pc. Right here is the main interface of AnyMP4 AIFF to WAV Converter software. After which, launch the AnyMP4 Video Converter on your computer.M4A files are a sort of audio file developed and popularised by Apple. Since 2007, music bought by the iTunes retailer has been in m4a format, due to this fact accounting for over 15 billions recordsdata worldwide. MP4 and M4A information are often confused, and the two are fairly similar, being each based mostly on the MPEG-4 codec. However, M4A is a file comprising solely of audio, whereas MP4 can also comprise video.

[winportables]

Screen Recorder Pro Portable is an excellent application that can be used to record videos from your computer screen (record Skype, games, webinars and much more), as well as to take screenshots of both the selected area and the entire window. Screen Recorder Pro Portable has a great set of all the necessary tools for professional screen capture. Screen Recorder Pro Portable allows you to capture a selected area of ​​the screen of arbitrary size. If you need to select a part of the screenshot or add text comments to it, then the program has drawing tools for this. They allow you to draw shapes, lines on the screenshot, and also overlay text. The program can immediately copy the created screenshot to the clipboard or upload it to the IceCream Apps server and provide a short direct link to it. With Screen Recorder Pro Portable, you can record high-quality videos with sound. You can adjust the volume level of the microphone and system sounds. The program maintains a history of all records. You can use keyboard shortcuts to use the program's functions. Program features: • Choose an area to create a video or screenshot directly on your computer screen with one click. ВЂ Draw, trace, show with arrows or write text in the future screenshot or video right during the shoot. • Quick access to all recorded videos from the screen or screenshots created. • Adjust the microphone volume and system sounds. • Save screenshot to clipboard to send via Skype or email. • It is up to you to decide whether to remove the mouse, disable the screen saver, hide the icons on the desktop, and so on. • Send a screenshot to the Icecream Apps server with one click to get a short link and send it to friends or partners. • Use hotkeys to control the video recording process from the screen and create screenshots. PRO versions: - Unlimited recording time - Change the output video format - WEBM, MKV, MP4 - Change the output video codec - MPEG4, H264, VP8 - Set timer recording - Installing your own watermark on video - Disable countdown before recording - Perpetual license for 2 computers - Commercial use Release year: 2021 Version: PRO 6.25 System: Windows® XP / Vista / 7/8 / 8.1 / 10 Interface language: Multilanguage- English included File size: 55.47 MB Format: Rar Execute as an administrator: There's no need

[niadeatewant]

Newblue titler pro sony vegas 13 無料ダウンロード.NewBlue Titler Pro 7

Newblue titler pro sony vegas 13 無料ダウンロード.NewBlueFX Video Essentials VI For Sony Vegas Pro 13 [ChingLiu] .rar __LINK__

                                                                          VEGAS Pro 14.NewBlueFX Video Essentials VI For Sony Vegas Pro 13 [ChingLiu] .rar __LINK__ on usreturce

    Running Vegas Pro MoBo is a 3 year old ASUS P8 ZV-Pro with 16 GB physical memory and a Intel Core iK GHz (Unlocked) CPU. The MoBo's onboard Intel HD Graphics drives two LG IPS displays. Nothing fancy or high performance there. NewBlue won't run, telling me: "Titler can't work due to low GPU capabilities" NewBlueFX Video Essentials VI for Sony Vegas Pro 13 [ChingLiu].rar · Myob Accounting V17 Full Chroma keying, garbage mattes, advanced image manipulation based on saturation, replacing one color with another are part of the Video Essentials VI tool set Titler Pro 6でロワーサードタイトル制作時、テキストの長さに合わせてシェイプの幅も調整する必要がありました。Titler Pro 7に搭載された新しい Object Followingを有効化することで、タイトルの長さに合わせてシェイプの幅を自動でフィットさせることができます。Price Range: ¥28, - ¥42,    

Newblue titler pro sony vegas 13 無料ダウンロード.価格.com - 『Vegas Pro 16と無料NewBlueFX Primeでスムーズトランジションを』 MAGIX VEGAS Pro 14 のクチコミ掲示板

Titler Pro 6でロワーサードタイトル制作時、テキストの長さに合わせてシェイプの幅も調整する必要がありました。Titler Pro 7に搭載された新しい Object Followingを有効化することで、タイトルの長さに合わせてシェイプの幅を自動でフィットさせることができます。Price Range: ¥28, - ¥42, ・Magix VEGAS Pro 10以降、 VEGAS Movie Studioシリーズ ・Adobe Premiere CC 以降 ・NewBlue Titler Pro 2以降 ・Avid Media Composer & Symphony 6以降 ・Apple Final Cut Pro X ・Grass Valley EDIUS 7, 8 & 9 ・Black Magic DaVinci Resolve 11以降  · The New Blue Fx Titler Pro gives you the ability to create professional looking Titles and Text for any video project. How to use New Blue Titler Pro with Sony Vegas Pro Forum         

 NewBlueFX Video Essentials VI For Sony Vegas Pro 13 [ChingLiu]. June 10th, E Share Embed Recast Subscribe Vegas Pro 11 or 12 came with NewBlueFX Titler P Well, "Activating" NewBlueFX Essentials VI was tricky.. Production Assistant v2. NewBlueFX Video Essentials VI for Sony Vegas Pro 13 [ChingLiu] Crysis Style Intro template for Sony Vegas pro 11 and 12 by NE. rar D-Link USB CCD Video Camera Driver for Supermicro - P4SPA working on NewBlueFX Video Essentials VI for Sony Vegas Pro 13 [ChingLiu].

Retail-EAT Full FL Studio Producer Edition v NewBlueFX Video Essentials VI for Sony Vegas Pro 13 [ChingLiu] setup free. Depending on Gas Turbine Theory - Saravanamuttoo Solution Manual for the drill pipe. Chroma keying, garbage mattes, advanced image manipulation based on saturation, replacing one color with another are part of the Video Essentials VI tool set..

NewBlueFX Video Essentials VI for Sony Vegas Pro 13 [ChingLiu] DeGun - NewBlue Stabilizer v1. Multilanguage-LAXiTY Free Download. newblue titler I upgraded my Movie Studio 13 to VEGAS Movie Studio 16 Suite and installed Replied by vkmast on topic New Blue FX items missing in VEGAS Movie Video Essentials VI for Windows, I have NewBlue VideoFX for Sony it works for SONY VEGAS, AFTER EFFECTS and ADOBE Click here to visit our frequently asked questions Newblue Totalfx 3.

NewBlueFX TotalFX 3. Keygen for Newblue Video Essentials VI for Vegas Pro XFORCE. Ipswitch WhatsUp Gold Premium V cara instal office pada windows xp..

NewBlue's Video Essentials VI delivers the goods. In the webinar, I showed how to do it using just the tools native to Sony Vegas Pro. Actions Jonathan Barrera transferred NewBlueFX Video Essentials VI For Sony Vegas Pro 13 [ChingLiu].

Jonathan Barrera changed description of NewBlueFX Video Essentials VI For Sony Vegas Pro 13 [ChingLiu]. Jonathan Barrera on NewBlueFX Video Essentials VI For Sony Vegas Pro 13 [ChingLiu]. Jonathan Barrera attached brebret. jpeg to NewBlueFX Video Essentials VI For Sony Vegas Pro 13 [ChingLiu].

Jonathan Barrera added NewBlueFX Video Essentials VI For Sony Vegas Pro 13 [ChingLiu].

[faiphofassing]

Ph n m m corel videostudio pro x6 full crack 無料ダウンロード.Corel Videostudio Pro X6 Full Crack Idm raftai

Ph n m m corel videostudio pro x6 full crack 無料ダウンロード.

                                                                          Recent Posts.Corel Videostudio Pro X6 Full Crack Idm [UPDATED] - Homes with Woofs!

    Corel VideoStudio Pro x6 crack can be used to add extra features in your movies and videos file. Corel Draw X6 Crack, Keygen Activator Latest Version Corel Draw X6 Crack is the fundamental tool to draw anything you want like the designs Leslie Riley on Corel Videostudio Pro X6 Full Crack Idm raftai. Corel VideoStudio Pro X6 Keygen Crack plus Serial key Free Download Full Version Corel VideoStudio Pro x6 Keygen is a world best tool for editing videos and . Corel Videostudio Pro X6 Full Crack Idm With just 1-click you can support a community project on an individual in need Corel Videostudio Pro X6 Full Crack Idm corel studio , corel studio download, corel studio x10, corel studio video download, corel studio paint, corel studio x7, corel studio motion 3d, corel studio free download, corel studio x7 full crack, corel studio x9    

Ph n m m corel videostudio pro x6 full crack 無料ダウンロード.Corel Videostudio Pro X6 Full Crack Idm

COREL VDEO STUDO X6 KURULUM VE CRACKLAMA COREL VDEO FULL NDR.. - 5 minCorel VideoStudio Pro X6 Keygen Activator Crack Download [Full Version]. 5 years ago14K . We just finished our crack for Corel VideoStudio Pro X6 (while Lucas keep Other features of Corel VideoStudio are: full support for DV. 29 Mei Corel VideoStudio Pro X6 Keygen Crack plus Serial key Free Download Full Version.. Feb 13, - 3 min - Uploaded by Mix VideoImo Number Please my  · This site was designed with website builder. Create your website today. Start Now         

 最終更新： bedgooreter 年01月29日 金 履歴. このページを編集する このページを元に新規ページを作成. Patshalaedu's Blog. トップページ ページ一覧 メンバー 編集. Download Corel Videostudio Pro X6 V Download Corel VideoStudio Pro X6 v T・i li畛・u ch動a ・動畛・ th畉・ ・畛・nh.

T畉・ v畛・ Corel VideoStudio Pro X6 v Download Corel VideoStudio Pro X6 Full Crack ・・ M畛・i nh畉・ corel videostudio pro x6 ultimate; corel moi nhat; keygen videostudio pro x6・ Fast and easy video-editing software! No matter what you shoot or what you shoot it with, Corel速 VideoStudio速 Pro X6 offers the tools you・ Corel VideoStudio Pro X6 Keygen Activator Crack Download [Full.

Corel VideoStudio Pro X6 v Revealer Keylogger Pro Edition Full Crack Mf with serial. with crack serial keygen. requiem for a dream full theme song mp3 free full download. Music Maker 17 v article that categorized Video by title Corel VideoStudio Pro X6 v This keygen works for these products: Corel Draw Graphics Suite X5・ what you shoot it with, Corel速 VideoStudio速 Pro X6 offers the tools you need corel video studio 12・ Fast and easy video-editing software.

Ulead Video Studio 11 Plus Full Version Free Download. SecurityCam 1. To down T畉・ v畛・ Corel VideoStudio Pro X6 v Corel Videostudio Pro X6 Crack graphisoft archicad 15 webinars office home and Making videos For even more Corel VideoStudio Pro X6 Keygen inspiration,・ Corel Video Studio Pro X6 v Download: Part rar Crack zip Size: 1.

To connect with Afghan Tech, join Facebook today.. Full Crack. Corel VideoStudio Pro cung c畉・ m畛・t b畛・ t鱈nh n・ng m畛・ r畛・ng v・ kh叩 ti畛・n d畛・g.. Corel VideoStudio Pro cung c畉・ m畛・t b畛・ t鱈nh n・ng m畛・ r畛・ng v・ kh叩 ti畛・n・ B・i vi畉・ "corel videostudio pro x6 full crack keygen".

Corel VideoStudio Pro X6. Ph畉・ m畛・m. T畉・ b・i vi畉・ m畛・i Download Corel Video Studio Pro X6 v Corel VideoStudio Pro cung c畉・ m畛・t b畛・ t鱈nh n・ng m畛・・ Corel VideoStudio Pro X7 Keygen And Serial Number Full Download pro x6 full crack. このページを編集する このページを元に新規ページを作成 添付する 添付ファイル一覧（0） 印刷する. トップページ ページ1? アイテム アイテム アイテム. 今日: 昨日: アクセス解析ページへ. スマートフォン版で見る Wiki管理人へ連絡 ｜ Patshalaedu's Blog ｜ powered by Seesaa Wiki. Seesaa Wiki トップページへ. 利用規約 をご確認のうえご記入下さい.

[coolladydot]

Toolkit-uri și webinare pentru combaterea violenței și urii | Prevenirea și combaterea radicalizării

Toolkit-uri și webinare pentru combaterea violenței și urii | Prevenirea și combaterea radicalizării

Suntem tot mai împovărați de griji. Timpul parcă și-a accelerat cursul, iar problemele nu se mai opresc să apară în viața noastră. Concentrați pe nemulțumirile cotidiene, devenim mai individualiști și, totodată, mai singuri și nefericiți. Aud tot mai des că „lumea s-a înrăit”, iar dacă e să deschid televizorul (ceea ce fac foarte rar) observ un grad ridicat de violență: violență în familie, pe…

[valleanenowe-music]

[Remember to add “async” by Ryuichi Sakamoto]

[Also “Operation: Doomsday” and “Mm.. Food” by MF Doom]

(embarrassing list of) Albums on phone:

James Ferraro - Cold

Aphex Twin - Come To Daddy

James Ferraro - Composition Of The Sensibilities Of Melted Knowledge

Aphex Twin - Computer Controlled Acoustic Instruments pt2

James Ferraro - Condo Pets

James Ferraro - Cruisin’ The Nightbiker Strip 1977

Alias Conrad Coldwood - Crying Girls

Com Truise - Cyanide Sisters

Lindsheaven Virtual Plaza - Daily Night Euphoria

Kendrick Lamar - DAMN.

Giles Corey - Deconstructionist

Internet Club - Deluxe

Moby - Destroyed

David Bowie - Diamond Dogs

SunCoast Web Series - Digital Water

James Ferraro - Discovery

Annie Lennox - Diva

James Ferraro - Dreams

Internet Club - Dreams 3D

Aphex Twin - Drukqs

Nyetscape - E-scape

James Ferraro - Edward Flex Presents: Do You Believe In Hawaii?

James Ferraro - Edward Flex Presents: Maui Black Out / Liquid Bikini

Scatman John - Everybody Jam!

Moby - Everything Is Wrong

Com Truise - Fairlight

Andy Stott - Faith In Strangers

Internet Club - Final Tears

Famicom Fountains - First Class

Borden, Ferraro, Godin, Halo & Lopatin - FRKWYS Vol. 7

Com Truise - Galactic Melt

Memorex Dawn - Galleria

James Ferraro - Genie Head Gas In The Tower Of Dreams (Jesters Midnight Toys)

Flamingo Pudding - Geogacca

Local News - Ghost Broadcast

Giles Corey - Giles Corey

James Ferraro - God of London

Kendrick Lamar - good kid, m.A.A.d city

Oneohtrix Point Never - Good Time Original Motion Picture Soundtrack

James Ferraro - Hacker Track

James Ferraro - Heaven’s Gate

Sun Araw - Heavy Deeds

David Bowie - Heroes

Giles Corey - Hinterkaifeck

Disconscious - Hologram Plaza

Monument XIII - Honestly

Moby - Hotel

James Ferraro - Human Story 3

David Bowie - Hunky Dory

Earl Sweatshirt - I Don’t Like Shit, I Don’t Go Outside

James Ferraro - iAsia

Lindsheaven Virtual Plaza - In Construction

Com Truise - In Decay

Bebetune$ - Inhale C - 4 $$$$$

Moby - Innocents

Tim Hecker & Daniel Lopatin - Instrumental Tourist

James Ferraro - Jarvid 9: Flushpipe

James Ferraro - Jarvid 9: Gecko

James Ferraro - Jarvid 9: Kava Jar Race

Scatman John - John Larkin

M.I.A. - Kala

Hearken - Kithless

Knife City - Knife City

James Ferraro - Last American Hero / Adrenaline’s End

Moby - Last Night

Sun Araw - Leaves Like These

James Ferraro - Left Behind: Postremo Mundus Techno-Symposium

DJ Pie - Liquidation

James Ferraro - Live at Primavera Sound 2012

Giles Corey - Live In The Middle of Nowhere

David Bowie - Lodger

Moby - Long Ambients 1: Calm. Sleep.

David Bowie - Low

Sun Araw - Major Grotto

David Bowie - The Man Who Sold The World

James Ferraro - Marble Surf

M.I.A. - Matangi

Thayer - A Medley For Lonely Walks

Famicom Fountains - Mixtape

Moby - Moby

Internet Club - Modern Business Collection

Neil Cicierega - Mouth Moods

James Ferraro - Multitopia

Kanye West - My Beautiful Dark Twisted Fantasy

Internet Club - New Millenium Concepts

David Bowie - The Next Day

Ecco Unlimited - NHK Reminds You To Boost Your Signal

Datavision Ltd. - Nightwaves

Clarence Clarity - No Now

David Bowie - No Plan

Lindsheaven Virtual Plaza - Nordwrong

Lindsheaven Virtual Plaza - NTSC Memories

James Ferraro - NYC, HELL 3:00AM

Nyetscape - Nyetscape

Nyetscape - Nyetscape 2.0

Nyetscape - Nyetscape 3.0

Nyetscape - Nyetscape 4

Nyetscape - Nyetscape 5

Arecaceae - Observatory Cg II & III (Coconut Of Teotihuacan)

Danny Brown - Old

Sun Araw - On Patrol

R23X - OST (1).rar

R23X - OSV: Original Sound Version

90210 - P.O. Box 666

Nyetscape - Party kicks

Sun Araw - The Phynx

The Skaters - Physicalities Of The Sensibilities Of Ingrediential Strairways

James Ferraro - Pixarni

Moby - Play

Gary Numan - The Pleasure Principle

Famicom Fountains - Progman.Exe

Internet Club - Pure Trance

James Ferraro - Purple Gongs

Internet Club - Redefining The Workplace

Aphex Twin - Richard D. James Album

The Diamondstein - The Ridges

David Bowie - The Rise And Fall Of Ziggy Stardust And The Spiders From Mars

SkʞƧ - Round

David Bowie - Scary Monsters (and Super Creeps)

Scatman John - Scatman’s World

Aphex Twin - Selected Ambient works 85-92

Aphex Twin - Selected Ambient Works Volume II

Internet Club - The Sharper Image

Bodyguard - Silica Gel

K2 - Silicon Oasis

DJ Rozwell - Sludge Dredd

Snake Figures Fan - Snake Figures Fan

James Ferraro - Son of Dracula

James Ferraro - Star Digital Theatre: Movies For P.T. Cruisers

David Bowie - Station to Station

Sea of Dogs - Storm Memories

James Ferraro - Suki Girlz

James Ferraro - Sushi

Aphex Twin - Syro

Scatman John - Take Your Time

Gary Numan - Telekon

Moby - These Systems Are Failing

Sea of Dogs - Through The Fog And The Driftwood

Lindsheaven Virtual Plaza - Transversal Worldwide Shopping

Nyetscape - Trinity

Sick Animation - The Ultimate Party Collection Vol. 1

Internet Club - Underwater Mirage

Twistpillar - The Unity Plaza

Internet Club - Unregistered HyperCam 420

Internet Club - Vanishing Vision

Datavision Ltd. - Vector Tables

James Ferraro - Virtual Erase

Moby - Wait For Me

Lindsheaven Virtual Plaza - Watch Their Loneliness

Com Truise - Wave 1

Internet Club - Webinar

James Ferraro - Wild World

Aphex Twin - Windowlicker

Nyetscape - World Edit

Danny Brown - XXX

Aphex Twin - Xylem Tube

David Bowie - Young Americans

░▒▓新しいデラックスライフ▓▒░ - ▣世界から解放され▣

Pastel Lounge LLC -  夢想假期

Famicom Fountains - 砂漠のカメラレッスン

Albums I’ve had to skip: 

Ecco Unlimited - Liquid Nitrogen (My copy is in FLAC, will need to convert it eventually)

James Ferraro - Rerex 1 (Corrupted download)

James Ferraro - Rerex 2 (Corrupted download)

K2 - Chameleon Ballet (Corrupted download)

Albums I’ve had to skip because DoubleTwist will refuse to acknowledge the existence of certain tracks if they’re short enough and these albums have at least one short song that despite its length I would not like to experience the album without:

Internet Club - Beyond The Zone

James Ferraro - Body Fusion 1

James Ferraro - Body Fusion 2

Local News - Channel 8

Aphex Twin - Cheetah

this is gonna fuckin suck

[philearning]

Join with us today at 06:00 PM for a live Webinar on Writing a Textbook: Guidelines and Tips from Experienced Authors & Publisher’s Perspective.

Google Meeting Link: https://meet.google.com/jcy-eady-rar

YouTube live streaming link: https://youtu.be/-Xne5caWY3g

We hope to see you there!

#publishing #bookpublishing #indianauthors #webinar #atmnirbharbhar #vocalforlocal

[terabitweb]

Original Post from FireEye Author: William Ballenthin

By William Ballenthin & Jeff Hamm

On August 30, 2012, we presented a webinar on how to use INDX buffers to assist in an incident response investigation. During the Q&A portion of the webinar we received many questions; however, we were not able to answer all of them. We’re going to attempt to answer the remaining questions by posting a four part series on this blog. This series will address:

Part 1: Extracting an INDX Attribute

Part 2: The Internal Structures of a File Name Attribute

Part 3: A Step by Step Guide to Parse INDX

Part 4: The Internal Structures of an INDX Structure

Part 1: Extracting an INDX Record

An INDX buffer in the NTFS file system tracks the contents of a folder. INDX buffers can be resident in the $MFT (Master File Table) as an index root attribute (attribute type 0x90) or non-resident as an index allocation attribute (attribute 0xA0) (non-resident meaning that the content of the attribute is in the data area on the volume.)

INDX root attributes have a dynamic size in the MFT, so as the contents change, the size of the attributes change. When an INDX root attribute shrinks, the surrounding attributes shift and overwrite any old data. Therefore, it is not possible to recover slack entries from INDX root attributes. On the other hand, the file system driver allocates INDX allocation attributes in multiples of 4096, even though the records may only be 40 bytes. As file system activity adds and removes INDX records from an allocation attribute, old records may still be recoverable in the slack space found between the last valid entry and the end of the 4096 chunk. This is very interesting to a forensic investigator. Fortunately, many forensic tools support extracting the INDX allocation attributes from images of an NTFS file system.

Scenario

Let’s say that during your investigation you identified a directory of interest that you want to examine further. In the scenario we used during the webinar, we identified a directory as being of interest because we did a keyword search for “1.rar”. The results of the search indicated that the slack space of an INDX attribute contained the suspicious filename “1.rar”. The INDX attribute had the $MFT record number 49.

Before we can parse the data, we need to extract the valid index attribute’s content. Using various forensic tools, we are capable of this as demonstrated below.

The SleuthKit

We can use the SleuthKit tools to extract both the INDX root and allocation data. To extract the INDX attribute using the SleuthKit, the first step is to identify the $MFT record IDs for the attributes of the inode. We want the content of the index root attribute (attribute type 0x90 or 144d) and the index allocation attribute (attribute type 0xA0 or 160d).

To identify the attribute IDs, run the command:

istat -f ntfs ntfs.dd 49

The istat command returns inode information from the $MFT. In the command we are specifying the NTFS file system with the “-f” switch. The tool reads a raw image named “ntfs.dd” and locates record number 49. The result of our output (truncated) was as follows:

.... Attributes: Type: $STANDARD_INFORMATION (16-0) Name: Resident size: 72

…

Type: $I30 (144-6) Name: $I30 Resident size: 26

Type: $I30 (160-7) Name: $I30 Non-Resident size: 4096

The information returned for the attribute list includes the index root – $I30 (144-6) – and an index allocation – $I30 (160-7). The attribute identifier is the integer listed after the dash. Therefore, the index root attribute 144 has an identifier of 6, and the index allocation attribute 160 has an identifier of 7.

With this information, we can gather the content of the attributes with the SleuthKit commands:

icat -f ntfs ntfs.dd 49-144-6 > INDX_ROOT.bin

icat -f ntfs ntfs.dd 49-160-7 > INDX_ALLOCATION.bin

The icat command uses the NTFS module to identify the record (49) attribute (144-6 and 144-7), and outputs the attribute data into the respective files INDX_ROOT.bin and INDX_ALLOCATION.bin.

EnCase

We can use EnCase to extract the INDX allocation data. To use EnCase version 6.x to gather the content of the INDX buffers, in the explorer tree, right click the folder icon. The “Copy/UnErase…” option applied to a directory will copy the content of the INDX buffer as a binary file. Specify a location to save the file. Note that the “Copy Folders…” option will copy the directory and its contents and will NOT extract the INDX structure.

FTK

We can use the Forensic Toolkit (FTK) to extract the INDX allocation data. Using FTK or FTK Imager, the INDX allocation attributes appear in the file list pane. These have the name “$I30” because the stream name is identified as $I30 in the index root and index allocation attributes. To extract the content of an index attribute, in the explorer pane, highlight the folder. In the file list pane, right click the relevant $I30 file and choose the option to “export”. This will prompt you for a location to save the binary content.

Mandiant Intelligent Response®

The Mandiant Intelligent Response® (MIR) agent v.2.2 has the ability to extract INDX records natively. To generate a list of INDX buffers in MIR, run a RAW file audit. One of the options in the audit is to “Parse NTFS INDX Buffers”. You can run this recursively, or you can target specific directories. We recommend the latter because this option will generate numerous entries when done recursively.

To display a list of parsed INDX buffers, you can filter a file listing in MIR by choosing the “FileAttributes” are “like” “*INDX*”. The MIR agent recognizes “INDX” as an attribute because the files listed in the indices may or may not be deleted.

Results

Regardless of which method is used, your binary file should begin with the string “INDX” if you grabbed the correct data stream. You can verify the results quickly in a hex editor. Ensure that the first four bytes of the binary data is the string “INDX”.

Conclusion

This example demonstrates three ways to use various tools to extract INDX attribute content. Our next post will detail the internal structures of a file name attribute. A file name attribute will exist for each file tracked in a directory. These structures include the MACb (Modified, Accessed, Changed, and birth) times of a file and can be a valuable timeline source in an investigation.

#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: William Ballenthin Incident Response with NTFS INDX Buffers – Part 1: Extracting an INDX Attribute Original Post from FireEye Author: William Ballenthin By William Ballenthin & Jeff Hamm On August 30, 2012, we…

[crackinstaller]

IceCream Screen Recorder Pro 5.50 Full Crack

IceCream Screen Recorder Pro 5.50 Full Crack is the best screen capture tool that helps you capture anything on your screen like video files and screenshots. Its new version has new and modified features. You can use this application to create video tutorials, record your games, capture webcams and online videos. It also allows you to create screenshots. You can select any specific area of the screen that you want to capture.

It doesn’t take much time to capture screen shots and videos. Just select this area, just click the “Stop” button after recording and your video will be shared with what you want. “Capture video” gives you four to five different parameters, such as custom area, full screen, last area, area auto detection and mouse around. Ice Cream Screen Recorder Pro crack free download for the latest version.

Review IceCream Screen Recorder Pro

Capture screen activity as video files and screen shots. Click once and you will get screenshots and videos. Selecting the desired area is as simple as dragging. It supports popular formats for your screenshots, such as PNG, JPG. The graphical user interface is very friendly and easy, and even non-professional users can easily understand their working technology.

Just choose between capturing video and screenshots. It also allows you to draw anything during recording. You can also add your own video in the tutorial. It provides “zoom in” and “out” options. So, you can focus any part of your video.

IceCream Screen Recorder pro Crack is a free tool that records video clips from the desktop system and creates screenshots of any area on the screen. It offers a complete set of tools and access to professional options. In which you can capture screenshots of any part of the desktop, or we will record everything that happens on the monitor (HD) screen. This is an easy-to-use application that allows you to capture screen areas of any size and extra capacity to record video clips.

IceCream Screen Recorder pro Crack are the most famous applications on the market. Typically used for recording screens on desktop or laptop computers. Ice Cream Screen Recorder Cracker is an easy-to-use software to record video from your computer screen. It is the best software. You can easily record videos of your games, webinars, Skype, and other events on your computer. Using this application is very easy.

You can use this tool as needed. You can also use this software to record your computer’s full screen, You can also record some areas of the ice cream screen recorder crack easily on the screen. As you know, the CrackSoftPC team is always trying to provide you with the best software.

With the help of this program, you can also create screenshots of all windows and selected areas. It also helps you in your work. It provides you with the best user interface. Because it has many new and advanced features. Ice Cream Screen Recorder has a complete tool that requires professional video capture from the screen. You can also download the full version of the Bandicam Crack Plus Serial Key.

IceCream Screen Recorder Pro Free is an excellent and powerful screen recorder, this is the best software that lets you capture the screen. This can also be feasible, you get a screen capture or screenshot. Videos can also be shot using this app, this is an easy way to use social work files.

The software is also used for snapshots of specific areas of the screen or recording of any video file. You can also use this application to quickly and easily switch between the two modes. It also allows screen recordings, web video recordings, and is commonly used for social media such as Skype video calls.

IceCream Screen Recorder Pro 5.50 Full Crack + Serial Key

IceCream Screen Recorder pro Free Download-Easy to use program to record video from your computer screen (record game, Skype, webinar, etc.), and how to create screenshots of all windows, as well as selected areas. The app has a complete set of tools that require professional video capture from the screen. Screen loggers allow you to capture any screen size choice. If you need to assign a part of a screenshot or add a text comment to him, this program has a drawing tool.

IceCream Screen Recorder Pro Free Download k makes it easy to use programs to record video from your pc screen (Recording Diversion, skype, online courses, which is the most convenient top of the iceberg), and further how to make screenshots of all windows, and selected fields . Ice Cream Screen Recorder Pro There is a complete device association required for professional video traps from the monitor. Screen loggers allow you to grasp the determination of any screen length.

A screenshot of the challenge can be quickly copied to the clipboard, or transferred to the server frozen yoghurt package, and provides quick and direct connection to it. With the dessert display recorder, you can record special videos and sounds. It is feasible to change the receiver range and frame sound. The project continues with all past records. You can take advantage of risk factors with smooth process keys.

IceCream Screen Recorder Pro Free Easy to use program to record video from your computer screen (record game, Skype, webinar, etc.), and how to create screenshots of all windows, as well as selected areas. The app has a complete set of tools that require professional video capture from the screen.

Screen loggers allow you to capture any screen size choice. If you need to assign a part of a screenshot or add a text comment to him, this program has a drawing tool. They allow you to draw on screenshot shapes, lines, and text overlays.

Screenshots of the program can be immediately copied to the clipboard, or uploaded to the server ice cream application, and given a short direct link. With the Ice Cream Screen Recorder, you can record high quality video and sound. You can adjust the microphone volume and system sound. The program keeps a record of all records. Shortcuts can be used to use program features.

Features Of IceCream Screen Recorder Pro 5.50 Full Crack:

Easily select the screen area.

Drawing panel tools such as Draw, Outline, Text, Arrow.

Easy access to project history.

Add a watermark to make copyrights.

Add a camera to your recording as well.

HD video quality record file.

Customize the microphone volume.

The ability to zoom in and out to focus any part.

Save captured files and share them via Skype.

Make the cursor more visible.

Get Url from the server and share it.

This is an easy-to-use software or application to get screenshots and capture things from the screen.

It can be easily and comfortably used on PCs, phones, macs and tablets.

Not only can you get screenshots, but you can also capture something from the system’s screen.

The software can also be used to record video and online video calls.

Users can also use this application to create hotkeys and view videos and games in the window.

This is used in snapshot applications where users can easily draw one or more lines and add text to their work.

This can also help change the volume of the microphone and system sounds.

It supports all common video and image formats such as PNG, JPG, MP4, MKV, WEBM, MPEG4 and many others.

What’s New

Added new features AVI and MOV output formats

MKV output format has been deleted

Improved output audio compatibility

Small GUI changes and bug fixes

“Trimming Video” Fixes

News: Ice Cream Screen Recorder Pro 5 recently launched

New 5.02: HiDPI ‘Area Size’ Fixes

How to download and install Ice Cream Screen Recorder Pro 5.50

Download your Ice Cream Screen Recorder Pro 5.50 from this given link

Extrack the file with the help of file extractor or .rar extractor.

Now install the downloaded setup.

Now copy the patch file into the cracked folder in the installation folder.

Now restart the machine and enjoy the Cracked version of Ice Cream Screen Recorder Pro 5.50 Crack

The post IceCream Screen Recorder Pro 5.50 Full Crack appeared first on CrackInstaller.

from CrackInstaller https://ift.tt/2K8hqWF via IFTTT

[patentanwalt-reinert]

In der Suchmaschinenoptimierung macht es durchaus einen Unterschied, ob du und dein Shop Süßwaren oder Druckmaschinen an den Mann bringen möchten. Denn während du im ersten Fall nur eine Person davon überzeugen musst, ihre Diät zu vergessen und die leckere, handgemachte Schokolade zu bestellen, entscheiden über die Anschaffung neuer Druckplatten oft mehrere, wichtige Köpfe eines Unternehmens. Daher besteht die Herausforderung für SEO im B2B-Bereich die Produkte nicht nur auffindbar zu machen, sondern auch die Besonderheiten dieses langwierigen Kaufprozesses im Blick zu haben. Unterschiedlicher Kaufprozess verlangt unterschiedliche Ansprache B2C steht für Business-to-Consumer, sprich dein Unternehmen richtet sich mit seinen Produkten direkt an den Endverbraucher. In diese Kategorie fallen beispielsweise alle Shops, die Produkte des täglichen Bedarfs wie Lebensmittel, Hygieneartikel, Bekleidung oder Schuhe verkaufen. B2B hingegen steht für Business-to-Business, also Unternehmen verkaufen Produkte an andere Unternehmen. Dazu gehören zum Beispiel Shops für Werbeartikel, Stadtmöblierung, Ärztebedarf oder Praxiseinrichtung. Unterschiede im E-Commerce B2C – Unternehmen zum Endverbraucher * Große Zielgruppe * Individualentscheidung * Oft Impulskäufe * Eher einfache Produkte (geringer Erklärungsbedarf) * Hohe Anzahl an Verkäufen * Eher geringes Transaktionsvolumen B2B – Unternehmen zu Unternehmen * Fest definierte (kleine) Zielgruppe * (meist) Kollektiventscheidung * Lange Entscheidungswege * Eher komplexe Produkte (hoher Beratungsbedarf) * Geringe Anzahl an Verkäufen * Hoher Transaktionswert pro Verkauf Bei diesen beiden Zielgruppen (Endverbraucher vs. Unternehmen) unterscheiden sich vor allem der Kauf- und Entscheidungsprozess in wesentlichen Punkten und bedingen daher auch eine unterschiedliche Ansprache. So zielen klassische B2C-Produkte wie Freizeitbekleidung oder Wohnungseinrichtung auf einen eher unüberschaubaren Massenmarkt, der von einem hohen Verdrängungswettbewerb geprägt ist. Da können ein günstiger Preis, Rabattaktionen oder ein besonderes Alleinstellungsmerkmal für den entscheidenden Vorteil sorgen. Im B2B-Bereich hingegen spielen oft Qualität, Beratung und Vertrauen eine größere Rolle. Die Besonderheiten in der Keywordrecherche im B2B-Bereich Produkte im B2B-Bereich haben in absoluten Zahlen oft keine hohe Nachfrage, da sie nur einzelne Nischen besetzen und die Zielgruppe dementsprechend klein ist. Dafür sind sie ergiebiger in ihrem Transaktionsvolumen, da sie meist teurer sind als klassische B2C-Produkte. So suchen beispielsweise nur wenige Personen online nach Landmaschinen wie Traktoren, da in der Regel nur Landwirte, Agrarkonzerne oder Technikliebhaber als potenzielle Käufer infrage kommen. Der Kauf kommt seltener zustande. Wenn ein Landmaschinen-Shop jedoch einen Traktor verkauft, dann fällt die Gewinnmarge natürlich sehr viel höher aus als beim Verkauf von Schuhen. Was bedeutet das für die Keywordanalyse? Zunächst fallen die Suchvolumina oft sehr gering im Vergleich zum B2C-Bereich aus oder gehen gar gegen Null. Um wirklich die treffenden Begriffe zu finden, solltest du daher sowohl die Produkt- als auch die Kundensicht berücksichtigen. Frage deine Ingenieure nach den offiziellen sowie Trivialnamen. Auch lohnt es sich im Vertrieb nachzufragen, wie die Kunden die einzelnen Produkte bezeichnen. Eine Keywordrecherche hilft dabei, die gesammelten Begriffe zu priorisieren. Kleiner Tipp: Wenn zwei Keywords für ein und dasselbe Produkt ein ähnliches Suchvolumen aufweisen, kannst du auch zwei AdWords-Kampagnen schalten, um zu bestimmen, welches besser performt und schließlich für den Title und die URL verwendet werden sollte. Content Marketing im B2B ist möglich „Zu unseren Produkten lässt sich nichts schreiben.“ Diese oder ähnliche Aussagen hören wir oft, wenn wir unsere B2B-Kunden fragen, warum Sie keinen Corporate Blog betreiben oder sonstigen Content auf unterschiedlichen Plattformen verbreiten. Verschiedene Interviews und Gespräche mit dem Kunden führten dann oft zahlreiche Themen zutage, die durchaus in einem Unternehmensblog aufbereitet werden können. Wenn du nicht weißt, was deine Zielgruppe bewegt und interessiert, dann beantworte zunächst folgende Fragen: * Wer sind deine Kunden? * Wer ist am Entscheidungs- und Kaufprozess beteiligt? * Welche Probleme haben deine Kunden? * Kann dein Produkt diese Probleme lösen? * In welcher Form möchten deine Kunden solche Problemlösungen aufbereitet haben? Einen weiteren wichtigen Impuls bei der Themenfindung können dir Tools wie answerthepublic.com geben, die dir die zum Keyword passenden Nutzerfragen auflisten. So bekommst du schnell eine Idee davon, welche Probleme deine Kunden umtreiben. In deinem Blog oder aber auf anderen Plattformen kann sich dein Unternehmen dann als Experte positionieren, indem es diese Fragen aufgreift und darauf umfassend antwortet. B2B-Content, der tendenziell sehr gut funktioniert: * White Paper * Fallstudien * Webinare * eBooks * Videos * Blogposts * Infografiken Die Unterschiede beim Linkaufbau Wesentliche Unterschiede zwischen B2B- und B2C-SEO gibt es vor allem beim Linkaufbau. Denn die potenziellen Linkquellen im B2B-Bereich sind oft rar gesät. Es gibt vermutlich nicht viele Blogs, Foren oder Magazine, die sich beispielsweise mit Leiterplatten oder Dentaltechnik ausführlich auseinandersetzen. In solchen Fällen sind Lieferanten und Kooperationspartner die Ersten, die du ansprechen solltest. Dein nächster Blick sollte der Konkurrenz gelten. Auf welchen Plattformen sind deine Wettbewerber vertreten. Gibt es eine Chance, dass du dich auf den gleichen Seiten platzieren kannst? Denn bedenke, im B2B-Bereich musst du nicht tausende von Links auf deine wichtigsten Kategorie- und Produktseiten platzieren. Es reicht, wenn du einfach ein wenig mehr und bessere Backlinks als deine Konkurrenz, vorweisen kannst. Mögliche Linkgeber: * Kunden, Kooperationspartner & Lieferanten * Jobportale * Hochwertige Webkataloge, Branchen- und Stadtportale * (Online-)Fachzeitschriften & Blogs * PR-Portale * Lokale Medien (z.B. im Wirtschaftsteil der regionalen Zeitung) Pro-Tipp zum Brandbuilding: Vermeide unspezifische Produktnamen wie C140, sondern finde einen kreativen Namen, der dein Produkt auch für Laien greifbar macht. Das könnte so aussehen, dass ein Shop für Imkereibedarf seine Honigschleuder unter dem griffigeren Titel „fleißige Biene“ vertreibt. Dies kann Vorteile sowohl im Content Marketing als auch im Linkbuilding haben. B2B vs. B2C: Erfolg heißt nicht immer Verkauf Erfolg im B2B-Bereich heißt nicht immer gleich Verkauf. Denn der Entscheidungsprozess zum Kauf neuer Geräte oder Einrichtungen in Unternehmen kann sich über Wochen oder Monate hinziehen. Daher solltest du neben den getätigten Verkäufen, weitere Ziele formulieren und tracken. Diese können sein: * PDF-Downloads * Aufenthaltsdauer * Calltracking * Tracking des Kontaktformulars Zum Autor Herbert Buchhorn ist Geschäftsführer von Clicks Online Business und anerkannter Experte für Suchmaschinenoptimierung (SEO). Seit 2007 ist seine Online Marketing Agentur erfolgreich für Unternehmen aus unterschiedlichsten Branchen in ganz Deutschland tätig und verfügt neben dem Büro in Dresden auch über Filialen in Berlin und München. Er veröffentlicht Fachbeiträge zum Thema SEO & E-Commerce in verschiedenen Online- und Printmagazinen und hält regelmäßig Seminare rund um das Thema Online Marketing. Kennt Ihr schon unseren #StartupTicker? Der #StartupTicker berichtet tagtäglich blitzschnell über die deutsche Start-up-Szene. Schneller geht nicht! Mehr Startup-Substanz im Newsfeed – folgt ds auf Facebook Startup-Jobs: Auf der Suche nach einer neuen Herausforderung? In der unserer Jobbörse findet Ihr Stellenanzeigen von Startups und Unternehmen. Foto (oben): Shutterstock

[terabitweb]

Original Post from FireEye Author: William Ballenthin

By William Ballenthin & Jeff Hamm

On August 30, 2012, we presented a webinar on how to use INDX buffers to assist in an incident response investigation. During the Q&A portion of the webinar we received many questions; however, we were not able to answer all of them. We’re going to attempt to answer the remaining questions by posting a four part series on this blog. This series will address:

Part 1: Extracting an INDX Attribute

Part 2: The Internal Structures of a File Name Attribute

Part 3: A Step by Step Guide to Parse INDX

Part 4: The Internal Structures of an INDX Structure

Part 1: Extracting an INDX Record

An INDX buffer in the NTFS file system tracks the contents of a folder. INDX buffers can be resident in the $MFT (Master File Table) as an index root attribute (attribute type 0x90) or non-resident as an index allocation attribute (attribute 0xA0) (non-resident meaning that the content of the attribute is in the data area on the volume.)

INDX root attributes have a dynamic size in the MFT, so as the contents change, the size of the attributes change. When an INDX root attribute shrinks, the surrounding attributes shift and overwrite any old data. Therefore, it is not possible to recover slack entries from INDX root attributes. On the other hand, the file system driver allocates INDX allocation attributes in multiples of 4096, even though the records may only be 40 bytes. As file system activity adds and removes INDX records from an allocation attribute, old records may still be recoverable in the slack space found between the last valid entry and the end of the 4096 chunk. This is very interesting to a forensic investigator. Fortunately, many forensic tools support extracting the INDX allocation attributes from images of an NTFS file system.

Scenario

Let’s say that during your investigation you identified a directory of interest that you want to examine further. In the scenario we used during the webinar, we identified a directory as being of interest because we did a keyword search for “1.rar”. The results of the search indicated that the slack space of an INDX attribute contained the suspicious filename “1.rar”. The INDX attribute had the $MFT record number 49.

Before we can parse the data, we need to extract the valid index attribute’s content. Using various forensic tools, we are capable of this as demonstrated below.

The SleuthKit

We can use the SleuthKit tools to extract both the INDX root and allocation data. To extract the INDX attribute using the SleuthKit, the first step is to identify the $MFT record IDs for the attributes of the inode. We want the content of the index root attribute (attribute type 0x90 or 144d) and the index allocation attribute (attribute type 0xA0 or 160d).

To identify the attribute IDs, run the command:

istat -f ntfs ntfs.dd 49

The istat command returns inode information from the $MFT. In the command we are specifying the NTFS file system with the “-f” switch. The tool reads a raw image named “ntfs.dd” and locates record number 49. The result of our output (truncated) was as follows:

.... Attributes: Type: $STANDARD_INFORMATION (16-0) Name: Resident size: 72

…

Type: $I30 (144-6) Name: $I30 Resident size: 26

Type: $I30 (160-7) Name: $I30 Non-Resident size: 4096

The information returned for the attribute list includes the index root – $I30 (144-6) – and an index allocation – $I30 (160-7). The attribute identifier is the integer listed after the dash. Therefore, the index root attribute 144 has an identifier of 6, and the index allocation attribute 160 has an identifier of 7.

With this information, we can gather the content of the attributes with the SleuthKit commands:

icat -f ntfs ntfs.dd 49-144-6 > INDX_ROOT.bin

icat -f ntfs ntfs.dd 49-160-7 > INDX_ALLOCATION.bin

The icat command uses the NTFS module to identify the record (49) attribute (144-6 and 144-7), and outputs the attribute data into the respective files INDX_ROOT.bin and INDX_ALLOCATION.bin.

EnCase

We can use EnCase to extract the INDX allocation data. To use EnCase version 6.x to gather the content of the INDX buffers, in the explorer tree, right click the folder icon. The “Copy/UnErase…” option applied to a directory will copy the content of the INDX buffer as a binary file. Specify a location to save the file. Note that the “Copy Folders…” option will copy the directory and its contents and will NOT extract the INDX structure.

FTK

We can use the Forensic Toolkit (FTK) to extract the INDX allocation data. Using FTK or FTK Imager, the INDX allocation attributes appear in the file list pane. These have the name “$I30” because the stream name is identified as $I30 in the index root and index allocation attributes. To extract the content of an index attribute, in the explorer pane, highlight the folder. In the file list pane, right click the relevant $I30 file and choose the option to “export”. This will prompt you for a location to save the binary content.

Mandiant Intelligent Response®

The Mandiant Intelligent Response® (MIR) agent v.2.2 has the ability to extract INDX records natively. To generate a list of INDX buffers in MIR, run a RAW file audit. One of the options in the audit is to “Parse NTFS INDX Buffers”. You can run this recursively, or you can target specific directories. We recommend the latter because this option will generate numerous entries when done recursively.

To display a list of parsed INDX buffers, you can filter a file listing in MIR by choosing the “FileAttributes” are “like” “*INDX*”. The MIR agent recognizes “INDX” as an attribute because the files listed in the indices may or may not be deleted.

Results

Regardless of which method is used, your binary file should begin with the string “INDX” if you grabbed the correct data stream. You can verify the results quickly in a hex editor. Ensure that the first four bytes of the binary data is the string “INDX”.

Conclusion

This example demonstrates three ways to use various tools to extract INDX attribute content. Our next post will detail the internal structures of a file name attribute. A file name attribute will exist for each file tracked in a directory. These structures include the MACb (Modified, Accessed, Changed, and birth) times of a file and can be a valuable timeline source in an investigation.

#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: William Ballenthin Incident Response with NTFS INDX Buffers – Part 1: Extracting an INDX Attribute Original Post from FireEye Author: William Ballenthin By William Ballenthin & Jeff Hamm On August 30, 2012, we…

[terabitweb]

Original Post from FireEye Author: William Ballenthin

By William Ballenthin & Jeff Hamm

On August 30, 2012, we presented a webinar on how to use INDX buffers to assist in an incident response investigation. During the Q&A portion of the webinar we received many questions; however, we were not able to answer all of them. We’re going to attempt to answer the remaining questions by posting a four part series on this blog. This series will address:

Part 1: Extracting an INDX Attribute

Part 2: The Internal Structures of a File Name Attribute

Part 3: A Step by Step Guide to Parse INDX

Part 4: The Internal Structures of an INDX Structure

Part 1: Extracting an INDX Record

An INDX buffer in the NTFS file system tracks the contents of a folder. INDX buffers can be resident in the $MFT (Master File Table) as an index root attribute (attribute type 0x90) or non-resident as an index allocation attribute (attribute 0xA0) (non-resident meaning that the content of the attribute is in the data area on the volume.)

INDX root attributes have a dynamic size in the MFT, so as the contents change, the size of the attributes change. When an INDX root attribute shrinks, the surrounding attributes shift and overwrite any old data. Therefore, it is not possible to recover slack entries from INDX root attributes. On the other hand, the file system driver allocates INDX allocation attributes in multiples of 4096, even though the records may only be 40 bytes. As file system activity adds and removes INDX records from an allocation attribute, old records may still be recoverable in the slack space found between the last valid entry and the end of the 4096 chunk. This is very interesting to a forensic investigator. Fortunately, many forensic tools support extracting the INDX allocation attributes from images of an NTFS file system.

Scenario

Let’s say that during your investigation you identified a directory of interest that you want to examine further. In the scenario we used during the webinar, we identified a directory as being of interest because we did a keyword search for “1.rar”. The results of the search indicated that the slack space of an INDX attribute contained the suspicious filename “1.rar”. The INDX attribute had the $MFT record number 49.

Before we can parse the data, we need to extract the valid index attribute’s content. Using various forensic tools, we are capable of this as demonstrated below.

The SleuthKit

We can use the SleuthKit tools to extract both the INDX root and allocation data. To extract the INDX attribute using the SleuthKit, the first step is to identify the $MFT record IDs for the attributes of the inode. We want the content of the index root attribute (attribute type 0x90 or 144d) and the index allocation attribute (attribute type 0xA0 or 160d).

To identify the attribute IDs, run the command:

istat -f ntfs ntfs.dd 49

The istat command returns inode information from the $MFT. In the command we are specifying the NTFS file system with the “-f” switch. The tool reads a raw image named “ntfs.dd” and locates record number 49. The result of our output (truncated) was as follows:

.... Attributes: Type: $STANDARD_INFORMATION (16-0) Name: Resident size: 72

…

Type: $I30 (144-6) Name: $I30 Resident size: 26

Type: $I30 (160-7) Name: $I30 Non-Resident size: 4096

The information returned for the attribute list includes the index root – $I30 (144-6) – and an index allocation – $I30 (160-7). The attribute identifier is the integer listed after the dash. Therefore, the index root attribute 144 has an identifier of 6, and the index allocation attribute 160 has an identifier of 7.

With this information, we can gather the content of the attributes with the SleuthKit commands:

icat -f ntfs ntfs.dd 49-144-6 > INDX_ROOT.bin

icat -f ntfs ntfs.dd 49-160-7 > INDX_ALLOCATION.bin

The icat command uses the NTFS module to identify the record (49) attribute (144-6 and 144-7), and outputs the attribute data into the respective files INDX_ROOT.bin and INDX_ALLOCATION.bin.

EnCase

We can use EnCase to extract the INDX allocation data. To use EnCase version 6.x to gather the content of the INDX buffers, in the explorer tree, right click the folder icon. The “Copy/UnErase…” option applied to a directory will copy the content of the INDX buffer as a binary file. Specify a location to save the file. Note that the “Copy Folders…” option will copy the directory and its contents and will NOT extract the INDX structure.

FTK

We can use the Forensic Toolkit (FTK) to extract the INDX allocation data. Using FTK or FTK Imager, the INDX allocation attributes appear in the file list pane. These have the name “$I30” because the stream name is identified as $I30 in the index root and index allocation attributes. To extract the content of an index attribute, in the explorer pane, highlight the folder. In the file list pane, right click the relevant $I30 file and choose the option to “export”. This will prompt you for a location to save the binary content.

Mandiant Intelligent Response®

The Mandiant Intelligent Response® (MIR) agent v.2.2 has the ability to extract INDX records natively. To generate a list of INDX buffers in MIR, run a RAW file audit. One of the options in the audit is to “Parse NTFS INDX Buffers”. You can run this recursively, or you can target specific directories. We recommend the latter because this option will generate numerous entries when done recursively.

To display a list of parsed INDX buffers, you can filter a file listing in MIR by choosing the “FileAttributes” are “like” “*INDX*”. The MIR agent recognizes “INDX” as an attribute because the files listed in the indices may or may not be deleted.

Results

Regardless of which method is used, your binary file should begin with the string “INDX” if you grabbed the correct data stream. You can verify the results quickly in a hex editor. Ensure that the first four bytes of the binary data is the string “INDX”.

Conclusion

This example demonstrates three ways to use various tools to extract INDX attribute content. Our next post will detail the internal structures of a file name attribute. A file name attribute will exist for each file tracked in a directory. These structures include the MACb (Modified, Accessed, Changed, and birth) times of a file and can be a valuable timeline source in an investigation.

#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: William Ballenthin Incident Response with NTFS INDX Buffers – Part 1: Extracting an INDX Attribute Original Post from FireEye Author: William Ballenthin By William Ballenthin & Jeff Hamm On August 30, 2012, we…

[terabitweb]

Original Post from FireEye Author: William Ballenthin

By William Ballenthin & Jeff Hamm

On August 30, 2012, we presented a webinar on how to use INDX buffers to assist in an incident response investigation. During the Q&A portion of the webinar we received many questions; however, we were not able to answer all of them. We’re going to attempt to answer the remaining questions by posting a four part series on this blog. This series will address:

Part 1: Extracting an INDX Attribute

Part 2: The Internal Structures of a File Name Attribute

Part 3: A Step by Step Guide to Parse INDX

Part 4: The Internal Structures of an INDX Structure

Part 1: Extracting an INDX Record

An INDX buffer in the NTFS file system tracks the contents of a folder. INDX buffers can be resident in the $MFT (Master File Table) as an index root attribute (attribute type 0x90) or non-resident as an index allocation attribute (attribute 0xA0) (non-resident meaning that the content of the attribute is in the data area on the volume.)

INDX root attributes have a dynamic size in the MFT, so as the contents change, the size of the attributes change. When an INDX root attribute shrinks, the surrounding attributes shift and overwrite any old data. Therefore, it is not possible to recover slack entries from INDX root attributes. On the other hand, the file system driver allocates INDX allocation attributes in multiples of 4096, even though the records may only be 40 bytes. As file system activity adds and removes INDX records from an allocation attribute, old records may still be recoverable in the slack space found between the last valid entry and the end of the 4096 chunk. This is very interesting to a forensic investigator. Fortunately, many forensic tools support extracting the INDX allocation attributes from images of an NTFS file system.

Scenario

Let’s say that during your investigation you identified a directory of interest that you want to examine further. In the scenario we used during the webinar, we identified a directory as being of interest because we did a keyword search for “1.rar”. The results of the search indicated that the slack space of an INDX attribute contained the suspicious filename “1.rar”. The INDX attribute had the $MFT record number 49.

Before we can parse the data, we need to extract the valid index attribute’s content. Using various forensic tools, we are capable of this as demonstrated below.

The SleuthKit

We can use the SleuthKit tools to extract both the INDX root and allocation data. To extract the INDX attribute using the SleuthKit, the first step is to identify the $MFT record IDs for the attributes of the inode. We want the content of the index root attribute (attribute type 0x90 or 144d) and the index allocation attribute (attribute type 0xA0 or 160d).

To identify the attribute IDs, run the command:

istat -f ntfs ntfs.dd 49

The istat command returns inode information from the $MFT. In the command we are specifying the NTFS file system with the “-f” switch. The tool reads a raw image named “ntfs.dd” and locates record number 49. The result of our output (truncated) was as follows:

.... Attributes: Type: $STANDARD_INFORMATION (16-0) Name: Resident size: 72

…

Type: $I30 (144-6) Name: $I30 Resident size: 26

Type: $I30 (160-7) Name: $I30 Non-Resident size: 4096

The information returned for the attribute list includes the index root – $I30 (144-6) – and an index allocation – $I30 (160-7). The attribute identifier is the integer listed after the dash. Therefore, the index root attribute 144 has an identifier of 6, and the index allocation attribute 160 has an identifier of 7.

With this information, we can gather the content of the attributes with the SleuthKit commands:

icat -f ntfs ntfs.dd 49-144-6 > INDX_ROOT.bin

icat -f ntfs ntfs.dd 49-160-7 > INDX_ALLOCATION.bin

The icat command uses the NTFS module to identify the record (49) attribute (144-6 and 144-7), and outputs the attribute data into the respective files INDX_ROOT.bin and INDX_ALLOCATION.bin.

EnCase

We can use EnCase to extract the INDX allocation data. To use EnCase version 6.x to gather the content of the INDX buffers, in the explorer tree, right click the folder icon. The “Copy/UnErase…” option applied to a directory will copy the content of the INDX buffer as a binary file. Specify a location to save the file. Note that the “Copy Folders…” option will copy the directory and its contents and will NOT extract the INDX structure.

FTK

We can use the Forensic Toolkit (FTK) to extract the INDX allocation data. Using FTK or FTK Imager, the INDX allocation attributes appear in the file list pane. These have the name “$I30” because the stream name is identified as $I30 in the index root and index allocation attributes. To extract the content of an index attribute, in the explorer pane, highlight the folder. In the file list pane, right click the relevant $I30 file and choose the option to “export”. This will prompt you for a location to save the binary content.

Mandiant Intelligent Response®

The Mandiant Intelligent Response® (MIR) agent v.2.2 has the ability to extract INDX records natively. To generate a list of INDX buffers in MIR, run a RAW file audit. One of the options in the audit is to “Parse NTFS INDX Buffers”. You can run this recursively, or you can target specific directories. We recommend the latter because this option will generate numerous entries when done recursively.

To display a list of parsed INDX buffers, you can filter a file listing in MIR by choosing the “FileAttributes” are “like” “*INDX*”. The MIR agent recognizes “INDX” as an attribute because the files listed in the indices may or may not be deleted.

Results

Regardless of which method is used, your binary file should begin with the string “INDX” if you grabbed the correct data stream. You can verify the results quickly in a hex editor. Ensure that the first four bytes of the binary data is the string “INDX”.

Conclusion

This example demonstrates three ways to use various tools to extract INDX attribute content. Our next post will detail the internal structures of a file name attribute. A file name attribute will exist for each file tracked in a directory. These structures include the MACb (Modified, Accessed, Changed, and birth) times of a file and can be a valuable timeline source in an investigation.

#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: William Ballenthin Incident Response with NTFS INDX Buffers – Part 1: Extracting an INDX Attribute Original Post from FireEye Author: William Ballenthin By William Ballenthin & Jeff Hamm On August 30, 2012, we…

[terabitweb]

Original Post from FireEye Author: William Ballenthin

By William Ballenthin & Jeff Hamm

On August 30, 2012, we presented a webinar on how to use INDX buffers to assist in an incident response investigation. During the Q&A portion of the webinar we received many questions; however, we were not able to answer all of them. We’re going to attempt to answer the remaining questions by posting a four part series on this blog. This series will address:

Part 1: Extracting an INDX Attribute

Part 2: The Internal Structures of a File Name Attribute

Part 3: A Step by Step Guide to Parse INDX

Part 4: The Internal Structures of an INDX Structure

Part 1: Extracting an INDX Record

An INDX buffer in the NTFS file system tracks the contents of a folder. INDX buffers can be resident in the $MFT (Master File Table) as an index root attribute (attribute type 0x90) or non-resident as an index allocation attribute (attribute 0xA0) (non-resident meaning that the content of the attribute is in the data area on the volume.)

INDX root attributes have a dynamic size in the MFT, so as the contents change, the size of the attributes change. When an INDX root attribute shrinks, the surrounding attributes shift and overwrite any old data. Therefore, it is not possible to recover slack entries from INDX root attributes. On the other hand, the file system driver allocates INDX allocation attributes in multiples of 4096, even though the records may only be 40 bytes. As file system activity adds and removes INDX records from an allocation attribute, old records may still be recoverable in the slack space found between the last valid entry and the end of the 4096 chunk. This is very interesting to a forensic investigator. Fortunately, many forensic tools support extracting the INDX allocation attributes from images of an NTFS file system.

Scenario

Let’s say that during your investigation you identified a directory of interest that you want to examine further. In the scenario we used during the webinar, we identified a directory as being of interest because we did a keyword search for “1.rar”. The results of the search indicated that the slack space of an INDX attribute contained the suspicious filename “1.rar”. The INDX attribute had the $MFT record number 49.

Before we can parse the data, we need to extract the valid index attribute’s content. Using various forensic tools, we are capable of this as demonstrated below.

The SleuthKit

We can use the SleuthKit tools to extract both the INDX root and allocation data. To extract the INDX attribute using the SleuthKit, the first step is to identify the $MFT record IDs for the attributes of the inode. We want the content of the index root attribute (attribute type 0x90 or 144d) and the index allocation attribute (attribute type 0xA0 or 160d).

To identify the attribute IDs, run the command:

istat -f ntfs ntfs.dd 49

The istat command returns inode information from the $MFT. In the command we are specifying the NTFS file system with the “-f” switch. The tool reads a raw image named “ntfs.dd” and locates record number 49. The result of our output (truncated) was as follows:

.... Attributes: Type: $STANDARD_INFORMATION (16-0) Name: Resident size: 72

…

Type: $I30 (144-6) Name: $I30 Resident size: 26

Type: $I30 (160-7) Name: $I30 Non-Resident size: 4096

The information returned for the attribute list includes the index root – $I30 (144-6) – and an index allocation – $I30 (160-7). The attribute identifier is the integer listed after the dash. Therefore, the index root attribute 144 has an identifier of 6, and the index allocation attribute 160 has an identifier of 7.

With this information, we can gather the content of the attributes with the SleuthKit commands:

icat -f ntfs ntfs.dd 49-144-6 > INDX_ROOT.bin

icat -f ntfs ntfs.dd 49-160-7 > INDX_ALLOCATION.bin

The icat command uses the NTFS module to identify the record (49) attribute (144-6 and 144-7), and outputs the attribute data into the respective files INDX_ROOT.bin and INDX_ALLOCATION.bin.

EnCase

We can use EnCase to extract the INDX allocation data. To use EnCase version 6.x to gather the content of the INDX buffers, in the explorer tree, right click the folder icon. The “Copy/UnErase…” option applied to a directory will copy the content of the INDX buffer as a binary file. Specify a location to save the file. Note that the “Copy Folders…” option will copy the directory and its contents and will NOT extract the INDX structure.

FTK

We can use the Forensic Toolkit (FTK) to extract the INDX allocation data. Using FTK or FTK Imager, the INDX allocation attributes appear in the file list pane. These have the name “$I30” because the stream name is identified as $I30 in the index root and index allocation attributes. To extract the content of an index attribute, in the explorer pane, highlight the folder. In the file list pane, right click the relevant $I30 file and choose the option to “export”. This will prompt you for a location to save the binary content.

Mandiant Intelligent Response®

The Mandiant Intelligent Response® (MIR) agent v.2.2 has the ability to extract INDX records natively. To generate a list of INDX buffers in MIR, run a RAW file audit. One of the options in the audit is to “Parse NTFS INDX Buffers”. You can run this recursively, or you can target specific directories. We recommend the latter because this option will generate numerous entries when done recursively.

To display a list of parsed INDX buffers, you can filter a file listing in MIR by choosing the “FileAttributes” are “like” “*INDX*”. The MIR agent recognizes “INDX” as an attribute because the files listed in the indices may or may not be deleted.

Results

Regardless of which method is used, your binary file should begin with the string “INDX” if you grabbed the correct data stream. You can verify the results quickly in a hex editor. Ensure that the first four bytes of the binary data is the string “INDX”.

Conclusion

This example demonstrates three ways to use various tools to extract INDX attribute content. Our next post will detail the internal structures of a file name attribute. A file name attribute will exist for each file tracked in a directory. These structures include the MACb (Modified, Accessed, Changed, and birth) times of a file and can be a valuable timeline source in an investigation.

#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: William Ballenthin Incident Response with NTFS INDX Buffers – Part 1: Extracting an INDX Attribute Original Post from FireEye Author: William Ballenthin By William Ballenthin & Jeff Hamm On August 30, 2012, we…

[terabitweb]

Original Post from FireEye Author: William Ballenthin

By William Ballenthin & Jeff Hamm

On August 30, 2012, we presented a webinar on how to use INDX buffers to assist in an incident response investigation. During the Q&A portion of the webinar we received many questions; however, we were not able to answer all of them. We’re going to attempt to answer the remaining questions by posting a four part series on this blog. This series will address:

Part 1: Extracting an INDX Attribute

Part 2: The Internal Structures of a File Name Attribute

Part 3: A Step by Step Guide to Parse INDX

Part 4: The Internal Structures of an INDX Structure

Part 1: Extracting an INDX Record

An INDX buffer in the NTFS file system tracks the contents of a folder. INDX buffers can be resident in the $MFT (Master File Table) as an index root attribute (attribute type 0x90) or non-resident as an index allocation attribute (attribute 0xA0) (non-resident meaning that the content of the attribute is in the data area on the volume.)

INDX root attributes have a dynamic size in the MFT, so as the contents change, the size of the attributes change. When an INDX root attribute shrinks, the surrounding attributes shift and overwrite any old data. Therefore, it is not possible to recover slack entries from INDX root attributes. On the other hand, the file system driver allocates INDX allocation attributes in multiples of 4096, even though the records may only be 40 bytes. As file system activity adds and removes INDX records from an allocation attribute, old records may still be recoverable in the slack space found between the last valid entry and the end of the 4096 chunk. This is very interesting to a forensic investigator. Fortunately, many forensic tools support extracting the INDX allocation attributes from images of an NTFS file system.

Scenario

Let’s say that during your investigation you identified a directory of interest that you want to examine further. In the scenario we used during the webinar, we identified a directory as being of interest because we did a keyword search for “1.rar”. The results of the search indicated that the slack space of an INDX attribute contained the suspicious filename “1.rar”. The INDX attribute had the $MFT record number 49.

Before we can parse the data, we need to extract the valid index attribute’s content. Using various forensic tools, we are capable of this as demonstrated below.

The SleuthKit

We can use the SleuthKit tools to extract both the INDX root and allocation data. To extract the INDX attribute using the SleuthKit, the first step is to identify the $MFT record IDs for the attributes of the inode. We want the content of the index root attribute (attribute type 0x90 or 144d) and the index allocation attribute (attribute type 0xA0 or 160d).

To identify the attribute IDs, run the command:

istat -f ntfs ntfs.dd 49

The istat command returns inode information from the $MFT. In the command we are specifying the NTFS file system with the “-f” switch. The tool reads a raw image named “ntfs.dd” and locates record number 49. The result of our output (truncated) was as follows:

.... Attributes: Type: $STANDARD_INFORMATION (16-0) Name: Resident size: 72

…

Type: $I30 (144-6) Name: $I30 Resident size: 26

Type: $I30 (160-7) Name: $I30 Non-Resident size: 4096

The information returned for the attribute list includes the index root – $I30 (144-6) – and an index allocation – $I30 (160-7). The attribute identifier is the integer listed after the dash. Therefore, the index root attribute 144 has an identifier of 6, and the index allocation attribute 160 has an identifier of 7.

With this information, we can gather the content of the attributes with the SleuthKit commands:

icat -f ntfs ntfs.dd 49-144-6 > INDX_ROOT.bin

icat -f ntfs ntfs.dd 49-160-7 > INDX_ALLOCATION.bin

The icat command uses the NTFS module to identify the record (49) attribute (144-6 and 144-7), and outputs the attribute data into the respective files INDX_ROOT.bin and INDX_ALLOCATION.bin.

EnCase

We can use EnCase to extract the INDX allocation data. To use EnCase version 6.x to gather the content of the INDX buffers, in the explorer tree, right click the folder icon. The “Copy/UnErase…” option applied to a directory will copy the content of the INDX buffer as a binary file. Specify a location to save the file. Note that the “Copy Folders…” option will copy the directory and its contents and will NOT extract the INDX structure.

FTK

We can use the Forensic Toolkit (FTK) to extract the INDX allocation data. Using FTK or FTK Imager, the INDX allocation attributes appear in the file list pane. These have the name “$I30” because the stream name is identified as $I30 in the index root and index allocation attributes. To extract the content of an index attribute, in the explorer pane, highlight the folder. In the file list pane, right click the relevant $I30 file and choose the option to “export”. This will prompt you for a location to save the binary content.

Mandiant Intelligent Response®

The Mandiant Intelligent Response® (MIR) agent v.2.2 has the ability to extract INDX records natively. To generate a list of INDX buffers in MIR, run a RAW file audit. One of the options in the audit is to “Parse NTFS INDX Buffers”. You can run this recursively, or you can target specific directories. We recommend the latter because this option will generate numerous entries when done recursively.

To display a list of parsed INDX buffers, you can filter a file listing in MIR by choosing the “FileAttributes” are “like” “*INDX*”. The MIR agent recognizes “INDX” as an attribute because the files listed in the indices may or may not be deleted.

Results

Regardless of which method is used, your binary file should begin with the string “INDX” if you grabbed the correct data stream. You can verify the results quickly in a hex editor. Ensure that the first four bytes of the binary data is the string “INDX”.

Conclusion

This example demonstrates three ways to use various tools to extract INDX attribute content. Our next post will detail the internal structures of a file name attribute. A file name attribute will exist for each file tracked in a directory. These structures include the MACb (Modified, Accessed, Changed, and birth) times of a file and can be a valuable timeline source in an investigation.

#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: William Ballenthin Incident Response with NTFS INDX Buffers – Part 1: Extracting an INDX Attribute Original Post from FireEye Author: William Ballenthin By William Ballenthin & Jeff Hamm On August 30, 2012, we…