One issue computer investigators face is that normal file utilities can irrevocably change files, effectively "polluting" the crime scene as well as deleting evidence you need. For example, viewing files with a regular editor changes things like the timestamp. Imagine someone tromping through a real crime scene in dirty boots and moving objects all over the house. This is the same as rummaging through your system without the proper tools. Not only will you have eliminated your chance of being able to take any criminal or civil action, but you may also erase the attacker's digital trail. Hackers often use tools that hide processes and files from normal system utilities, so you need special tools that operate outside of the normal operating system to look beyond what the operating system thinks it sees.

The following sections review tools for both Linux and Windows. First we will look at a few of the investigation tools on operating systems, then at full-featured toolkits for deeper analysis. Keep in mind that using operating system-based tools may return false or bogus data if your OS has truly been compromised.

This little system add-on can be useful when investigating a machine for suspicious activity. Often a memory-resident virus or Trojan horse will show up as a process running under a strange name or on an unusual port. Fport looks for open TCP or UDP network ports and prints them out along with the associated process id (PID), process name, and path. It is similar to the native Windows netstat command except that it provides a little more information and allows you to format it different ways for analysis. This can help you track down suspicious programs that are opening up network ports on your machine. This behavior is the hallmark of a Trojan horse.

Of course, every process you don't recognize isn't necessarily an evil program, but you should understand what weird-looking services are doing. The most obvious ones will have nonstandard paths (other than the Windows system directories and such). Also, strange or hacker-like names are a dead giveaway.

The program is designed and offered by Foundstone Corporation, a security software and consulting company. They offer several other free security tools and their Web site is worth a look. While Fport is not purely open source (only the binaries are distributed), it is freeware and there are few limitations on its use for commercial purposes.

Installing Fport

Download the zip file from the Foundstone Web site and unzip it into its own directory. There will be two files, the Fport executable and a short README file.

Using Fport

Fport can help you figure out if a machine has been tampered with and where the intruder is coming from. You need to run Fport on a system that is live, that is, up and running; you can't run Fport on static data.

Running Fport is about as simple as it comes. From the directory the executable is in, type fport. It prints a listing of all the ports open at that moment and their associated applications (see Listing 11.1).

Listing 11.1. Fport Display

By looking at this listing, you can see what appear to be normal services and programs running, until about half way down where you can see that cmd.exe is running from the temp directory. This is the command prompt binary and it has no business being in a temp directory. Also, the fact that the service has no name should arouse suspicion. Finally, the incoming port number doesn't match any known services. In fact, if you look it up in a database of known Trojan horses on the Internet (www.simovits.com/trojans/trojans.html) , it matches the port number of a documented Trojan horse. There is strong evidence that this system has been exploited. At this point, you have to decide if it is worth taking the system down to do further forensic analysis of the system.

Table 11.1 lists a few options you can run with Fport to sort the output. You can also use the –h option to display short help descriptions.

If you have a lot of processes, you can use these switches to look at all the high port numbers running, which is typically where malware runs. You can also sort by application path or name to find nonstandard applications running.

This tool is similar to the Fport tool for Windows just discussed. The lsof tool (LiSt Open Files) associates open files with processes and users. It is like the netstat command, but in addition it reports the network port the service is using. This is important when trying to track down an active program on the network. Often the only way to find these elusive bugs is to watch for what network ports they open up.

The lsof tool is being preinstalled on some UNIX and Linux distributions and is available in RPM form on the installation disks of others such as Mandrake and RedHat Linux. To see if you have it preinstalled, type lsof and see if you get any response.

Installing lsof

Guild Meister 2 Full Better Version Better Page

: Users frequently report poor English translations that can make tutorials and menus difficult to understand.

Collect rare materials from high-level monsters to forge specialized, named artifacts.

The table below provides a powerful and direct comparison:

Assign trusted guild members to automatically run trade caravans between established outposts. 3. Strategic Real-Time Combat

Each class also has . Thatâ€™s 30+ unique builds. guild meister 2 full version better

Here is why upgrading to the full version of Meister 2 delivers a vastly superior experience. Expanded Guild Management Systems

Don't wait any longer to take your guild management to the next level. Sign up for Guild Meister 2 full version today and experience the benefits of streamlined guild management, improved communication, and increased efficiency. With its comprehensive features, user-friendly interface, and cost-effective pricing, Guild Meister 2 full version is the ultimate solution for any guild looking to succeed.

The most obvious limitation of the demo version is the hard level cap and abrupt ending.

The developer released a modding toolkit exclusively for full version owners. On the Steam and official forums, full version users share: : Users frequently report poor English translations that

If your capital turns negative, you lose the ability to expand facilities. Risk vs. Reward: Exploration now uses an Activity Record

: Discover hidden breakable walls and secret rooms containing ultimate weapons and developers' Easter eggs that were entirely omitted from the trial build. Feature Comparison: Demo vs. Full Version Demo / Trial Version Full Premium Version Stage Access Introductory levels only Complete castle map fully open Boss Encounters 1â€“2 introductory bosses Full roster of multi-phase bosses Skill Unlocks Basic combos and low-tier magic Maximum level cap and full skill tree Gear & Loot Standard starting equipment Rare artifacts and hidden weapon sets Bonus Modes Boss Rush, Hardcore Mode, and Secrets Final Verdict: Is It Worth It?

Build specialized rooms like the Alchemistâ€™s Laboratory, Blacksmith Forge, and Training Grounds to passively buff your roster.

: You must manage adventurer wages and system maintenance costs. If your capital becomes negative, you cannot expand facilities. Are you tired of mediocre guild management tools

The full version opens the door to high-stakes cooperative PvE (Player vs. Environment) and PvP (Player vs. Player) content that defines the true Meister 2 experience.

In Guild Meister 2, your guild hall is your base of operations. The premium edition turns this mechanic from a simple menu into a thriving stronghold.

Are you tired of mediocre guild management tools that fail to deliver on their promises? Look no further than Guild Meister 2, the ultimate solution for managing your guild with ease and efficiency. In this article, we'll explore the features and benefits of Guild Meister 2 full version and why it's the better choice for guild leaders and members alike.

Without the full campaign, Guild Meister 2 feels like a demo. With it, you experience a complete heroâ€™s journey for your guild.

Using lsof

The lsof program has many uses, and has extensive man pages and several README files for the different applications. However, this section concentrates only on a few specific commands that are useful for forensic research.

If you want to see all of the open files on your system at any given moment and the processes associated with them, type:

The -n option tells lsof not to attempt to do a DNS record on any IP addresses connecting to your machine. This speeds up the process considerably. The output will look something like Listing 11.2

Listing 11.2. lsof –n output

The connections in this listing look normal. The connection via the rwho service might give you pause. You would want to make sure that a valid user on your system is using this command legitimately. If this account belonged to a nontechnical secretary type, you might want to investigate this further.

You can also use lsof to look for a specific file. If you want to see if anyone was accessing your password file, you could use the following command:

Replace path/filename with the specific path and filename you are interested in, in this case, /etc/passwd. You have to give lsof the whole path for it to find the file.

Another way to use lsof is to have it list all the open socket files. This shows if there is a server listening that you don't know about. The format of this command is:

This produces output similar to Listing 11.3. You can see all the programs you are running, including sshd and nessusd, which are the daemons for Nessus and SSH. You can even see the individual connections to these services. It looks like someone is using the Nessus server at the moment. Checking the IP address, you can see that it is an internal user. In fact, it is your own machine! So there is nothing to worry about this time.

Listing 11.3. lsof –i Output

You can specify a particular IP address or host to look for by putting an @ (at sign) and the address after the -i switch. For example:

shows any connections coming from within your network, assuming your internal network is 192.168.1.0/24.

Forensic Analysis Tools

Fport: A Process Identification Tool for Windows