Recovering Partitions with TestDiskThursday, July 2. 2009
[Editor's note: Chris 'Xenon' Hanson told me of his experience with a disk corruption and some recovery and forensics tools. Rather than writing it up as a third-hand recollection, I asked Chris to write it up. The following entry is by guest contributor Chris Hanson. I only added hyperlinks, subheadings, and a few minor edits.]
Recently I had to recover a Dell Vostro 1500 series laptop that had inexplicably become unbootable. The circumstances behind the failure and the recovery are very enlightening, and I thought I would share. This account rather lacks in images and screengrabs because all of the interesting work was done in a bare-bones Linux text-mode environment where screengrabs were not practical. The Good Old DaysLet's start in the beginning. This laptop was purchased in December 2007 as a replacement for a Toshiba Satellite laptop that had itself failed after many long years of diligent service. This Satellite series apparently had a manufacturing defect wherein the NVidia graphics chipset (actually, probably the video RAM it used) would eventually develop a failure in a solder joint leading to memory corruption. (It is interesting that even today NVidia is dealing with failures of chipset solder joints.) Under a graphical OS like Windows or Linux this corruption can quickly crash the system. I typically use a product called Acronis TrueImage (I own the version 9 of the business-grade product line) to do my Windows backups. Acronis is more than a file-backup tool, it can back up and restore the complete contents of the drive including all boot data. Cleverly, it can restore to a dissimilar-sized drive and still make everything work. Even more impressively, with the Universal Restore add-on, it can restore to a completely different hardware platform (different CPU, memory, disk, network, graphics, etc) and trick Windows into detecting and installing new drivers to create a functioning system. While this is relatively trivial under Linux, it is quite remarkable under Windows, and TrueImage Universal Restore actually works. Fortunately, I was able to make a good backup of the failing Satellite system and repurposed the Toshiba to run text-mode Linux as an Asterisk VOIP server. TrueImage restored the Windows installation (OS, applications and data) to the new Dell's hard drive, completely overwriting all partitions and data originally put there by Dell. <dramatic foreshadowing>Or, so I believed.</dramatic foreshadowing> Death By ButtonFast forward a year and a half later. The Dell laptop has been running perfectly. Then, one day while it was going to sleep to be transported from work to home, one of the odd "media" buttons above the keyboard is accidentally bumped and all Hades breaks loose. Some weird media player program appears onscreen and promptly complains about not being able to read the hard drive. Now, the machine won't boot -- it keeps trying to boot the media player, and fails. Windows is nowhere to be found. Enter the SystemRescueCD (SRCD for short). I cannot say enough good about SRCD. I've used various version of it for years. Essentially a bootable Linux LiveCD built from Gentoo, it provides a staggering array of disk and computer recovery software that run straight from CD. From the always-handy 'dd' tool to NTFS filesystem-access, partition tools, memory test tools and Windows registry and password editors, there's very few failures you can't fix with it. It's a great forensics tool, capable of imaging a hard drive to a backup medium and picking through the wreckage of filesystems to recover anything still intact. After booting SRCD, I checked the partition table with sfdisk -l /dev/sdaThe results weren't promising. A single Windows FAT32 partition occupied 2.5Gb at the end of the 160Gb drive, named MEDIADIRECT and containing what appeared to be a Windows XP Embedded installation. The rest of the drive was apparently unused. How did this happen? And how did this weird little partition survive TrueImage repaving everything? Apparently, Dell uses the ATA Host Protected Area to hide and protect a part of the hard drive. TrueImage bought into the lie, and happily consumed all of the hard drive except this hidden partition. There is some info online about how MediaDirect utilizes the drive. While some of the info on that page doesn't exactly agree with what I found on my hard disk, the general overview is correct. Some searching led to this topic on the always-helpful NotebookReview Forums. Someone else had had the same problem. Now I knew what MediaDirect was, but what had gone wrong? I dumped the first 512 bytes of the drive to a temp file in the RAMDisk, and listed it with hexdump: dd if=/dev/sda of=~/MBR.bin bs=512 count=1 I can't show you the contents of it because I had no way to screengrab it. You can refer to this great page about MBRs. I see that my partitions should be at hex offset 1be. And, sure enough, I see a partition there -- it's the MEDIADIRECT partition. Hopefully my missing NTFS partition is still there, it's just deleted and I can mark it as not deleted. Let's see what is in partition slot #2 at 1ce. Err, nothing. Nothing at all. The three remaining partition slots are completely zeroed out. Ugh. Some further research leads me to reconstruct what probably happened. When Dell's special flavor of Windows is running some software probably intercepts the event generated by the MediaDirect button, handles it (by launching Windows Media Player) and informs the BIOS that the event has been handled. In the absence of this acknowledgment, the BIOS apparently assumes Windows is not running and takes over the system to launch the minimalistic embedded WinXP media player. However, the way that this is done is of some concern. As best as I can reconstruct from the wreckage, the BIOS takes over when the MediaDirect button is pushed, rewrites the partition table and reboots the computer. This is scary stuff. I'm not clear on whether the BIOS intentionally wipes out the original partitions, or if it accidentally did so, not expecting the configuration put there by the TrueImage restore. Either way, the NTFS partition could not be found in any of the partition table entries. Gone. Various indications are that MediaDirect somehow restores the Windows partition after the MediaDirect player successfully boots, but it was not booting ok and I had no idea what it restored from, or whether it would look anything like what my NTFS entry had looked like. It was apparent that MediaDirect hadn't maliciously obliterated my actual partition, it had just stepped on the partition table entry for it. 16 little, critical, bytes. Getting Back UpNow, I had a backup of the laptop, but it was over a month old, and I didn't relish losing more recent data. All I really needed from the backup was 512 bytes of MBR. Actually, only 16 of those 512 bytes. But to get them back I'd have to do a full restore, because TrueImage's backups aren't readable by anything other than TrueImage, and all it knows how to do is a full restore. I worked out that I could use DD to backup the drive as-is, TrueImage to restore the month-old backup, dd to capture the 512-byte MBR, dd to restore the as-is backup, and then dd to stick the proper MBR back in. That's a LOT of disk IO, risk and headache just to get back 16 bytes. There had to be a better way. The first thing to do was to use dd to completely image the drive to a flat file stored on my external USB hard drive so I can alway get back to this point if I make things even worse. Now, how should I actually fix things? I could try just creating an NTFS partition in the empty space. Since various Microsoft OSes and hardware OEMs have historically used a variety of round-up techniques to decide exactly where a partition should begin and end, there's a good chance that the partition does NOT exactly start and end on the borders of the available space. And the only way to tell if I have the sector range right is to try mounting the partition and see what happens -- which could damage the data when NTFS tries to "fix" what it thinks is a problem, this is very risky. "But then, in the midst of my preparation for hara-kiri, it came to me." -Chris Knight (Val Kilmer), Real Genius I happened to be browsing my friends' Facebook pages while killing time and avoiding what seemed like an inevitable day of backing up and restoring. Remarkably, my friend Bob H. had a note on his page about how he'd recently used a great disk tool called Hiren's BootCD. Being in a mood for disk repair tools I started poking around the page and noticed it described "TestDisk 6.11.3 Tool to check and undelete partition." Hmmm. VERY interesting. I checked out the TestDisk web page. TestDisk is "designed to help recover lost partitions", and can recognize NTFS partitions (among DOZENS of others). This sounds just about perfect. In theory, it should be possible to to examine the filesystem metadata blocks in the empty space, and infer where the partition should have started and ended in order for those blocks to end up where they did. It turns out that TestDisk is already on SysRescueCD, so I fired it up to see what it could do. It gave me some cautionary warnings, and then offered to walk me through recovering my partition(s). Cautiously, I instructed it to do so, and it began scanning the hard drive. Only a few minutes later, it announced that it had found a complete NTFS partition and offered to restore it to the partition table. Holding my breath, I gave it the go-ahead, and then exited TestDisk. I test-mounted the NTFS partition under SysRescueCD's NTFS-for-Linux filesystem, instructing it to mount read-only. And then, I listed the directory. Everything was there. Perfectly intact. I quickly backed up the MBR to my USB backup drive, and rebooted to see if Windows would start up. Astonishingly, it booted, and even detected the intact hibernation file, resuming from hibernate right where the machine had been with all applications still running and data right where it left off. 20/20 HindsightNow for the post-mortem. First, Dell's MediaDirect boot technique is disastrously irresponsible. Rewriting an MBR partition table is hackish at best and dangerous at worst. The Internet is clogged with accounts of people who have had their Dell computer rendered unusable by MediaDirect foul-ups. Even worse, it appears to not be possible to disable the MediaDirect button's functionality in the BIOS. Hiding the MEDIADIRECT partition in the HPA is not a really good idea either. The one saving grace in this whole story is the amazing capability of SysRescueCD and TestDisk. It's remarkable that such quality tools are created by smart folks, WHO GIVE IT AWAY FOR FREE. Shortly after making a fresh backup of the newly-repaired laptop, I sent a 25 Euro donation to the author of TestDisk. That amount is trivial compared to how much effort I could have spent trying to recover from this failure. The irony of using Linux to repair Windows' own disasters is not lost on me. UnexplainedMonday, June 29. 2009
There are some things that just cannot be easily explained without calling someone a liar. For example, what happened to Neda Agha-Soltan?
There are two many conflicting stores. Someone must be lying. Considering that Iranian government representatives (ambassadors, clerics, and government-controlled media) change their story every other day, I'm going to have to side with the video footage and flood of independent witness reports: rooftop sniper by pro-government militia with a government cover-up. Sunnyside UpAnd speaking of Iranian-run media... Today's Tehran Times has a picture on their front page that I just cannot explain. ![]() Here's the picture: ![]() This version of the picture is too small and too low quality to apply luminance gradient, error level analysis, or other complex analysis algorithms. All results would be inconclusive. The only tools I'm left with are "observation" and "measurement". Here's the problem: where's the sun? The sun should only come in through one window. The picture has the sun in three windows. The central cameraman only has one shadow. Drawing a line from the shadow to the person goes straight to the middle window's sun. If those were spotlights and not the sun, then he should have three shadows. The Ayatollah (guy sitting down on the right) only has one shadow, and it only aligns with the right-most window. Another problem is that the cameraman has a very long shadow, but none of the people on the floor have long shadows. Measuring from the camera-stand itself (floor to top of tripod), an object that is 30 pixels tall should have a shadow that is 21 pixels long. The sitting audience are about 30 pixels tall, but they don't have long shadows. Even the people right behind the cameraman are missing long shadows. I really don't know how this could be possible, unless the image is spliced. Perhaps there is a higher quality version available elsewhere that does not have this problem... Then again, my mom thinks that this is because the Ayatollah is the "Sign of God" and can make the sun do whatever he wants. It is also worth noting that this picture is not attributed to Getty Images, Reuters, AP, AFP, or any other image company that tries to provide undoctored images. No attribution is given, so that implies that it came from the Tehran Times Political Desk. Breaking RulesI mentioned in an earlier blog that I had broken one of my rules about image analysis. A friend recently informed me that my findings just came out. MUFON is the Mutual UFO Network. This month's MUFON Journal includes some of my image analysis applied to a couple of alleged UFO photos. When I was first asked to evaluate them, I was very hesitant... UFO "true believers" are crazy with bias. They want to believe so strongly that UFOs are real that they will ignore facts that show some photos are fake. I was seriously concerned. It is very difficult to say that an image is real -- usually the results are inconclusive. If I determined that the images "could not be identified as fake", then I would be called a fraud by anti-UFO people, and the UFO people would call this a confirmation. ('Cannot identify as fake' is not the same as 'can prove it is real' or 'beyond a reasonable doubt'.) In contrast, if I found that they were fake, then the true believers would claim that the government got to me. Fortunately, Richard Thieme (who will be speaking at Defcon 17) and the MUFON International Director, James Carrion, understood and addressed my concerns. I was provided the pictures and absolutely no background information. The only question I was asked: "Have these pictures been digitally manipulated?" My initial reply was that these were some of the best forgeries that I have ever seen. I then detailed my findings, much of which was included in the MUFON Journal's article. (I understand that MUFON membership includes a copy of the Journal.) Full disclosure: I was not provided any compensation for this work -- not even a cup of coffee. This work was strictly a donation on my behalf and it was not influenced by any person or government or anything else. Finally, this was a one-time donation. Don't expect me to break my rules for other people with suspicious photos.
Posted by Dr. Neal Krawetz
in Forensics, Image Analysis, Mass Media, Politics
at
09:59
| Comment (1)
Stop InterferingThursday, June 25. 2009
There is a phrase that has been popping up in the media for the last few weeks. "Stop interfering." The accusation has come from Iran and North Korea, and has been directed at the United States, UK, and most European nations.
If you believe the Western media, then our only interference has been on reporting actual events and not the fiction that the Iranian and North Korean governments keep spouting. However, neither country has actually specified the type of interference... Maybe the interference really does exist. TwinsIf you look at the timeline of events, there are a number of interesting similarities between North Korea and Iran. And the alignment of events is far too coincidental.
Common GroundNorth Korea and Iran have much more in common than just media manipulations, oppressive governments, hostility toward neighboring countries, and voter fraud... Iran always wanted nuclear weapons. Eventually they made an offer: they will give oil to any countries that helps them achieve this goal. In the 1980's, North Korea stepped up. Guess who is a major oil provider to North Korea? You got it: Iran. For example, in October 2006, North Korea demonstrated nuclear capabilities by doing a test explosion. By early 2007, the oil began to ship from Iran to North Korea. 2007 was also when North Korea shut down one of their nuclear reactors and Iran increased their uranium refinement. (Anyone want to guess where Iran got the parts from? I'm guessing a closed-down facility from North Korea.) Just to make sure this is clear: North Korea wanted oil, Iran wanted nuclear capabilities. In October 2006, North Korea demonstrated a working facility. In Feb 2007 they closed the facility, and sent the parts to Iran (April 2007). In return, Iran began shipping lots of oil to North Korea in early 2007. But it did not start there... North Korea needed help making missiles. Who helped them? Iran. According to a 2003 report from the LA Times: North Korean military scientists recently were monitored entering Iranian nuclear facilities. They are assisting in the design of a nuclear warhead, according to people inside Iran and foreign intelligence officials. So many North Koreans are working on nuclear and missile projects in Iran that a resort on the Caspian coast is set aside for their exclusive use. And which countries keep telling the US, UK, and EU to "Stop interfering"? North Korea and Iran. Can you hear me now?So what is this interference? The US, UK, and other EU nations have taken a stance to police the waters. As sanctions are levied against North Korea, it becomes more difficult to transfer anything between North Korea and Iran. Adding to their concern, the United States, UK, and EU have amassed a significant number of troops in Iraq and Afghanistan. If you look on a map, then you will see that this effectively surrounds Iran. They cannot easily ship over the water, and secretive land-based shipments between Iran and North Korea are almost certain to be intercepted. "We're fighting terrorists..." uh, yeah, that's one reason to be there. Are we interfering with North Korea and Iran's ability to work together and work secretively? Yes. Should we continue? Definitely. Together, they have managed to share weapon technologies and are increasing their threats against neighboring nations. Both nations are rapidly progressing beyond saber rattling toward all-out-war. Finally, neither North Korea nor Iran give specifics about how we are interfering. For example, Ahmadinejad recently told the US to "stop meddling" in their affairs. The claim is that we are interfering with their election protests. However, they don't specifically say how we are interfering. I believe this is because they don't want to admit that we are hindering their abilities to construct nuclear missiles and attack their enemies. Considering that both countries are actively testing missiles and North Korea keeps testing nuclear explosions, I kind of think that they are planning for the post-development phase. Think about it: first you make the weapons, then you use the weapons to remove all interference. Singing a new iTuneSaturday, June 20. 2009
Rumors circulated last January about Apple's CEO, Steve Jobs. Following complications from his pancreatic cancer treatment, he considered a liver transplant. Well, today the news is reporting that he had a liver transplant.
Being a big fan of Apple, I have to ask: where can I get an iLiver? ![]() UnobstructedThe human liver is one of the most complicated organs in the body. It is more critical than the heart, kidneys, or even the brain. We have artificial hearts, dialysis to offset damaged kidneys, and even machines to keep a body alive when the brain is dead -- but until now, we have not had anything that can replace the liver. God bless Apple for the iLiver. The iLiver performs all of the basic functions: breaking down fats, creating amino acids, urea, and glycogen, and even filtering blood. However, the iLiver does much more... Veni Vidi Vici: iCame, iSaw, iConqueredApple has always been on the forefront of medical research. And while they have not yet released a formal statement about the iLiver (due out after Thanksgiving), it is believed to follow Steve Jobs' view on other essential peripherals. The iLiver is smaller and much more energy efficient than a standard liver. It is a green device -- capable of being passed to other people when it is no longer needed. And most importantly, it has fewer buttons. Steve Jobs hates buttons. The iLiver interconnects with the host body, but also includes five USB 3.0 connectors (codename 'Liver Spots'), a 3G wireless interface, and is Bluetooth enabled. Currently running the much-anticipated iBody 3.0 operating system, the iLiver is expected to be fully compatible with iPhone 3.0 and iTouch applications. Apple Inc. (AAPL) is also rumored to be venturing into other HCI systems. An iKidney and iBladder are reportedly in the works. Each component operates independently or can interface as an entire system. The company is even considering changing their slogan from "Think different" to "An Apple a day". Another TsunamiThursday, June 18. 2009
The Internet Storm Center periodically mentions about fraudulent domains. Basically, right after a major event, scammers will register domain names related to the event. "There was a hurricane? Quick! Register domain names!" It is not just that it might happen, it is certain that it will happen.
Similarly, major events are associated with doctored images. Even though Iran has cracked down on mass media coverage, I have been waiting for the doctored images to arrive. Well, they're slowly trickling out. A Few Drops Form A FloodIran has barred the mass media from reporting on the situation in Iran. Most reports of the post-election rallies are from citizens with cell phones and digital cameras. They take the pictures and post them -- with little time for any image modification. So far, this flood of visuals seems clean and not modified. In contrast, the Iranian government and government-run media are taking their time to release images. The delay means that they have time to modify images. The DailyKos reported on one doctored image that appeared in the government-run newspaper. ![]() People in the background were replicated in order to hide the edge of the crowd. In effect, they hid the true size of the crowd. However, there is another problem with this image: it is undated. It was released in the media to show that there are ongoing post-election rallies for the incumbent Ahmadinejad as well as for challenger Mousavi. Up until this point, videos and footage had only shown pro-Moussavi rallies and not any for Ahmadinejad. But there's a problem... As I mentioned when Iran released doctored missile photos: they didn't just modify photos. They modified old photos. Their 2008 missile launch was supported by photos from 2006. I did not just expect doctored images from the Iranian government; I expected doctored images from old photos! And I wasn't disappointed. Here's the original: ![]() The timestamp in the image's meta data matches the date from the open directory at the government-run MEHR news: Monday, June 08, 2009. That is BEFORE the election. They didn't just doctor a picture, they doctored an old picture. To date, I have seen no photos of any post-election pro-Ahmadinejad rallies. Although there are reports of pro-Ahmadinejad rallies, they mainly come from the government-run media and do not include photos that can be dated or collaborated with non-government photos. Consider the number of citizen photos that are coming out, one would think that someone would have captured at least one picture of a pro- rally... Rewriting HistoryAhmadinejad has a long history of rewriting history. For example, he is believed to have been a key hostage taker during the US embassy hostage crisis in 1979. Of course, Ahmadinejad has denied the association. I'll let you decide whether the 1979 hostage taker looks like today's Ahmadinejad... ![]() Then there was the conflicting reports around a boating incident in the Strait of Hormuz. Although the US has acted questionably, the Iranians supported their contradictory claims by releasing footage from a totally different incident. And then there is his denial of the holocaust, claim that there are no gays in Iran (even though they keep killing the ones they find), and more... With this established track record, it certainly comes as no surprise that Ahmadinejad would claim to win the election. Regardless of how the population voted. A Reason to RiotThere are many reasons to question this election's outcome. First, it should have taken days to count all of the votes, but it only took hours to declare the winner. Second, presidential nominees normally win in their home districts. I mean, nobody expected Obama to win in Alaska -- Alaska went to Palin. Yet, Moussavi's own hometown allegedly went to Ahmadinejad. More interesting are reports of a suspicious death. Quoting the Guardian: The man who leaked the real election results from the Interior Ministry - the ones showing Ahmadinejad coming third - was killed in a suspicious car accident, according to unconfirmed reports, writes Saeed Kamali Dehghan in Tehran. This situation is definitely becoming a tsunami.
Posted by Dr. Neal Krawetz
in Image Analysis, Mass Media, Politics, Security
at
08:33
| Comments (2)
(Page 1 of 59, totaling 293 entries)
» next page
|
CalendarQuicksearchCategoriesSyndicate This Blog |
