Re: decoding konq_history
"Nick Newman" <[email protected]> Sun, 18 Mar 2007 18:39:06 +0000
| Newsgroups | gmane.org.user-groups.linux.morlug |
|---|---|
| Message-ID | <[email protected]> |
--===============1761710166== Content-Type: multipart/alternative; boundary="----=_Part_88102_6048320.1174243146453" ------=_Part_88102_6048320.1174243146453 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline This isn't for homework and there wasn't anyone one my box... I work for a company that puts on computer forensics classes all over the country, and we're currently developing a Linux Forensics class. I'm trying to find an easy way to process Konqueror artifacts (mainly konq_history, most of the others are in plain-text) as part of the training program we're going to put out in June. The methods we teach have to be as simple as possible because the people we teach often have jobs that aren't primarily computer forensics. Work doesn't afford much time to code, so this should be interesting... thanks for your help. On 3/18/07, Michael Bond <[email protected]> wrote: > > > To make sure i understand the problem. > > 1) You will have some sort of disk image that you are going to mount on > your local file system? > 2) You have to look at konq_hist to see where the 'bad guy' visited > 3) This is for ... which class? > > While morlug is a great resource for questions like this, it sounds like > this is for homework. As such, i really don't think anyone should (or will) > provide a direct answer for you. What dave riggs suggested is correct: > > The first link provides this (click the link :-P ) > http://lists.kde.org/?l=kfm-devel&m=106867941008409&w=2 > > Basically, read the documentation and write a script that reads in the > file (as binary data) and converts it to plain text. > > There are a good number of references on the internet to handle the task > in the language of your choosing. Personally I'd do it in perl or python, > both handle this type of task very well. > > If this is NOT for a class of some sort and you actually had a 'bad guy' > on your box, i suggest talking with one of the security experts on the > list. > > Mike. > [email protected] > > > On Mar 17, 2007, at 8:55 PM, Nick Newman wrote: > > Thanks for the quick response... I found that link earlier, but it won't > work for what I'm trying to do (forensic analysis of a Linux box). I'm > going to have an image of a Linux OS and will have to analyze konq_history > to see where the bad guy went and at what time he went there. Any other > ideas? > > On 3/18/07, David A. Riggs <[email protected]> wrote: > > > > On 3/17/07, Nick Newman <[email protected]> wrote: > > > I'm trying to find a way to decode the binary konq_history file, which > > > stores the history for Konqueror. Is there any easy way (preferrably > > via > > > some program) to convert that file to plain text? > > > > > > > Type "konq_history" into Google, hit "I'm feeling lucky"... seriously. > > > > - DR > > > > -- > > David A. Riggs < [email protected]> > > _______________________________________________ > > Morlug mailing list > > [email protected] > > http://mailman.morlug.org/mailman/listinfo/morlug > > > > > > -- > "Love all, trust a few, do wrong to none." -- William Shakespeare > _______________________________________________ > Morlug mailing list > [email protected] > http://mailman.morlug.org/mailman/listinfo/morlug > > > > > > > > > _______________________________________________ > Morlug mailing list > [email protected] > http://mailman.morlug.org/mailman/listinfo/morlug > > -- "Love all, trust a few, do wrong to none." -- William Shakespeare ------=_Part_88102_6048320.1174243146453 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline This isn't for homework and there wasn't anyone one my box... I work for a company that puts on computer forensics classes all over the country, and we're currently developing a Linux Forensics class. I'm trying to find an easy way to process Konqueror artifacts (mainly konq_history, most of the others are in plain-text) as part of the training program we're going to put out in June. The methods we teach have to be as simple as possible because the people we teach often have jobs that aren't primarily computer forensics. Work doesn't afford much time to code, so this should be interesting... thanks for your help. <br><br><div><span class="gmail_quote">On 3/18/07, <b class="gmail_sendername">Michael Bond</b> <<a href="mailto:[email protected]">[email protected]</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <div style=""><div><br></div><div>To make sure i understand the problem.</div><div><br></div><div>1) You will have some sort of disk image that you are going to mount on your local file system?</div><div>2) You have to look at konq_hist to see where the 'bad guy' visited </div><div>3) This is for ... which class?</div><div><br></div><div>While morlug is a great resource for questions like this, it sounds like this is for homework. As such, i really don't think anyone should (or will) provide a direct answer for you. What dave riggs suggested is correct: </div><div><br></div><div>The first link provides this (click the link :-P )</div><div><a href="http://lists.kde.org/?l=kfm-devel&m=106867941008409&w=2" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> http://lists.kde.org/?l=kfm-devel&m=106867941008409&w=2</a></div><div><br></div><div>Basically, read the documentation and write a script that reads in the file (as binary data) and converts it to plain text. </div> <div><br></div><div>There are a good number of references on the internet to handle the task in the language of your choosing. Personally I'd do it in perl or python, both handle this type of task very well. </div><div> <br></div><div>If this is NOT for a class of some sort and you actually had a 'bad guy' on your box, i suggest talking with one of the security experts on the list. </div><div><br></div><div>Mike.</div><div><a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> [email protected]</a></div><div><span class="e" id="q_11163b5db453e69b_1"><div><br></div><br><div><div>On Mar 17, 2007, at 8:55 PM, Nick Newman wrote:</div><br><blockquote type="cite">Thanks for the quick response... I found that link earlier, but it won't work for what I'm trying to do (forensic analysis of a Linux box). I'm going to have an image of a Linux OS and will have to analyze konq_history to see where the bad guy went and at what time he went there. Any other ideas? <br><br><div><span class="gmail_quote">On 3/18/07, <b class="gmail_sendername">David A. Riggs</b> <<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">[email protected] </a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> On 3/17/07, Nick Newman <<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> [email protected]</a>> wrote:<br>> I'm trying to find a way to decode the binary konq_history file, which<br>> stores the history for Konqueror. Is there any easy way (preferrably via <br>> some program) to convert that file to plain text? <br>><br><br>Type "konq_history" into Google, hit "I'm feeling lucky"... seriously.<br><br>- DR<br><br>--<br>David A. Riggs <<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> [email protected]</a>><br>_______________________________________________<br>Morlug mailing list<br><a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> [email protected]</a><br><a href="http://mailman.morlug.org/mailman/listinfo/morlug" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> http://mailman.morlug.org/mailman/listinfo/morlug</a><br> </blockquote></div><br><br clear="all"><br>-- <br>"Love all, trust a few, do wrong to none." -- William Shakespeare<div style="margin: 0px;">_______________________________________________</div><div style="margin: 0px;"> Morlug mailing list</div><div style="margin: 0px;"><a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">[email protected]</a></div><div style="margin: 0px;"> <a href="http://mailman.morlug.org/mailman/listinfo/morlug" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://mailman.morlug.org/mailman/listinfo/morlug</a></div> </blockquote></div><br><div> <span style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"> <span style="border-collapse: separate; border-spacing: 0px; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px;"> <div><br></div><div><br></div><div><br></div><br></span></span> </div><br></span></div></div><br>_______________________________________________<br>Morlug mailing list<br><a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:[email protected]"> [email protected]</a><br><a onclick="return top.js.OpenExtLink(window,event,this)" href="http://mailman.morlug.org/mailman/listinfo/morlug" target="_blank">http://mailman.morlug.org/mailman/listinfo/morlug</a><br> <br></blockquote></div><br><br clear="all"><br>-- <br>"Love all, trust a few, do wrong to none." -- William Shakespeare ------=_Part_88102_6048320.1174243146453-- --===============1761710166== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Morlug mailing list [email protected] http://mailman.morlug.org/mailman/listinfo/morlug --===============1761710166==--