Posted: December 30th, 2011 | Author: admin | Filed under: Linux | No Comments »
Find all files from current directory and subdirectories
find . -name ‘*.doc’ -print
Result
report.doc
somedoc.doc
Finding files by date: http://www.cyberciti.biz/faq/howto-finding-files-by-date/
Posted: December 30th, 2011 | Author: admin | Filed under: Linux, Uncategorized, Windows | Tags: recovery | No Comments »
The tools I use for computer forensics.
Windows
-
Recuva – Excellent at recovering data from Windows partitions and free to boot.
-
UFS Explorer – Not free, but is able to recover from linux partitions (Recuva is better for FAT/NTFS)
-
explore2fs – Access linux partitions from Windows. Free.
-
HFSExplorer – Access Mac partitions from Windows
Linux
- Hiren’s Boot CD – Contains an impressive lineup of programs for computer forensics, but its legal status is often debated.
- Trinity Rescue Kit – A live distro with backup programs, Midnight Commander, testdisk, shell and other good stuff. Legal!
Posted: March 27th, 2011 | Author: admin | Filed under: Linux, QNap | Tags: qnap linux harddisk standby activity sleep | No Comments »
It is possible to configure the harddisks to spin down after a period of inactivity, but if one or more processes keep reading and writing from the disks, that will prevent them from entering standby mode.
To find out which processes are causing disk activity, the following script is very useful:
blkdevMonitor.sh
The script works like this:
- A standby signal is sent to the disk.
- Wait until a process wakes up the disk and then prints out name of that process.
- Repeat.
The following link contains a list of daemons and configurations known to cause random disk activity: Standby Mode FAQ
Older versions of Squeezebox Server caused lots of disk activity, but fortunately that has been resolved in version 7.5.1.
What is jdb2 and flush?
Sometimes the processes “jbd2″ and “flush” are waking up the harddisk. As I understand, these processes are responsible for doing delayed writes to the disk in order to optimize performance. In other words, they are writing to the disk on behalf of other processes which makes it difficult to find the culprit(s). In my case, it was the samba daemon accessing the disk. As long as a PC or media streamer on your network has an open view on any of your samba shares, it will cause the disks to wake up.
Posted: January 31st, 2011 | Author: admin | Filed under: Linux, QNap | Tags: ext3 linux format partition fdisk df lsusb dmesg usb drive | 1 Comment »
Plug the USB stick into the Qnap. Then in a terminal, as root, do an lsusb to confirm that the USB drive has been recognised.

To find out what device name it has been assigned, do a dmesg | tail. This will print the latest lines from the kernel log, which should contain information about the inserted USB drive:

fdisk -l, which shows all connected drives, can also be used to find the right device name. The USB drive can be recognised by its size. In this case, it is a 2 GB one:

If the USB drive is already formatted with e.g. NTFS, it has probably been mounted automatically, in which case it should be unmounted. You can check this with the df command:

Once we know the name of the drive and it is unmounted, we can create a new linux partition using fdisk:
- Do an fdisk /dev/sdv
- type d to delete any existing partitions.
- Type n to create a new partition.
- Make it primary and first
- Go with the defaults when prompted for start and end cylinder
- Press t to change the filesystem to linux (number 83)
- Type w to write the changes to the disk and exit
Finally, format the partition with the ext3 filesystem:
mke2fs -j /dev/sdv1

Now the partion is formatted and it can be mounted again:
mount /dev/sdv1
The USB drive is now ready for use
Posted: January 16th, 2011 | Author: admin | Filed under: Linux, QNap | Tags: daemon, init.d, Linux, QNap, service | No Comments »
Daemon services, or just daemons, are started at boot time. They are roughly equivalent to services in the Windows world.
To see which daemons are available on a system, do an
ls -l /etc/init.d/
Every script in that directory represents a daemon, which can be started, restarted and stopped manually using the following syntax:
/etc/init.d/<daemon name> start | restart | stop
If, for example, I wanted to restart an nzb-get daemon due to changes in its configuration files, I would type
/etc/init.d/nzb-get.sh restart
After issuing the command, the daemon will usually print some lines to the terminal indicating what it is doing, e.g.: ”Starting NZB-Get Daemon” or “Shutting Down“.
If you want to make sure whether a daemon is running or not, you can grep for its name in the list of running processes. If I wanted to see if the nzb-get daemon was really started, I could do the following grep:
ps -aux | grep nzb
If the daemon is running, this will produce a result like:
8148 admin 2456 S /opt/bin/nzbget –daemon
8355 admin 564 S grep nzb
The first line is the daemon. Notice the “–daemon” at the end of the line. The second line is the grep process we just ran to find the daemon.