$ ifconfig
-- pipebench is not installed
$ cat usbkey.dd | netcat -l -p 2000 -q 1
$ netcat 158.227.207.196 2000 > usbkey.dd
$ cat /proc/partitions
$ sudo -i
$ lshw | more
$ more /proc/meminfo
$ more /proc/cpuinfo
$ dmesg | more
$ lshw | more
$ hdparm -i /dev/hdx
/dev/hdx: No such file or directory
$ hdparm -i /dev/hda
/dev/hdx: No such file or directory
-- Needed first to check with lshw
$ hdparm -i /dev/sda | more
$ hdparm -I /dev/sda | more
$ sudo -i
$ apt-get install sleuthkit
$ disk_stat /dev/sda
$ scsiinfo
$ apt-get install scsitools
$ scsiinfo -s /dev/sda
$ lshw > keyinfo.txt
$ md5sum /dev/sda
$ md5sum usbkey.dd
9580e6bb7d6750ad34e31719129fdcc2  usbkey.dd
$ sha1sum usbkey.dd
5f12c42fdb5ea1b9d507636029d303a8f48ed847  usbkey.dd
$ fdisk -lu usbkey.dd
...
$ sfdisk -luS usbkey.dd
...
... sectores de 512 bytes, ...
... Principio
...    51
$ mmls usbkey.dd
$ disktype
$ apt-get install disktype
$ disktype usbkey.dd

$ mkdir /mnt/forensic
$ mount usbkey.dd /mnt/forensic -o loop,offset=$((51*512)) -r
$ mount
$ find /mnt/forensic/ -type f | wc -l
$ df -h /mnt/forensic/
$ strings         usbkey.dd | egrep            -i -f keywords.txt
$ strings -td     usbkey.dd | egrep            -i -f keywords.txt
$ strings -tx     usbkey.dd | egrep            -i -f keywords.txt
$ strings -td     usbkey.dd | egrep    --color -i -f keywords.txt
$ strings -tx     usbkey.dd | egrep    --color -i -f keywords.txt
$ strings -tx     usbkey.dd | egrep -5 --color -i -f keywords.txt
$ strings -td -el usbkey.dd | egrep    --color -i -f keywords.txt
$ strings -td -eb usbkey.dd | egrep    --color -i -f keywords.txt
$ glark
$ apt-get install glark
$ strings -td usbkey.dd | glark -N -i -f keywords.txt
$ strings -td usbkey.dd | egrep -i -f keywords.txt > address.txt

$ dd if=usbkey.dd skip=$((15393432/512)) count=1 | strings
$ ifind -o 51 -d $((15393432/512)) usbkey.dd
$ istat -o 51 usbkey.dd 1397 | less
$ istat -o 51 usbkey.dd 1397-128-4 | less
$ istat -o 51 usbkey.dd 1397 | egrep ^Name:

$ ifind -o 51 -d $((26619086/512)) usbkey.dd 
$ istat -o 51 usbkey.dd 1469 | less
...
Allocated File
...
Name: ThePrince.txt
...
Allocated Size: 0       Actual Size: 0

$ ifind -o 51 -d $((39473367/512)) usbkey.dd 
$ istat -o 51 usbkey.dd 1476-128-4 | less
...
Not Allocated File
...
Name: In_Search_of_the_Castaways_by_Jules_Verne.doc

$ istat -o 51 usbkey.dd 1476-128-4 | egrep ^Name
Name: In_Search_of_the_Castaways_by_Jules_Verne.doc

$ ifind -o 51 -d $((41624592/512)) usbkey.dd
2-128-1
$ istat -o 51 usbkey.dd 2-128-1 | more
...
Flags: Hidden, System
Name: $LogFile
...
$ find /mnt/forensic/ -iname "wolves*"

$ wvText
$ apt-get install wv
$ wvText Wolves_of_the_sea.doc /tmp/wolves.txt
$ apt-get install links
$ apt-get install elinks
$ apt-get install lynx
$ cd "/mnt/forensic/Documents and Settings/Rackham/My Documents"
$ wvText Wolves_of_the_Sea.doc /tmp/wolves.txt
$ wvSummary Wolves_of_the_Sea.doc | more
$ wvVersion Wolves_of_the_Sea.doc
$ find /mnt/forensic/ -iname "*.doc" -exec wvVersion '{}' \; | egrep -v "Encrypted: No"
$ zcat fccu-docprop-0.2.tar.gz | tar xvs 
$ cd fccu-docprop-0.2
$ cat INSTALL
$ apt-get install libgsf-1 libgsf-1-dev
$ apt-cache search libgsf-1
$ apt-get install libgsf-bin libgsf-1-114 libgsf-1-common libgsf-1-dev
$ make install
$ apt-get install pkg-config
$ make install
$ ls -l /usr/bin/fccu-docprop
$ cd "/mnt/forensic/Documents and Settings/Rackham/My Documents"
$ fccu-docprop Wolves_of_the_Sea.doc 2> /dev/null
$ find /mnt/forensic/ -iname in_search\*
# strings 65544bytes-doc.txt | egrep -i --color -f ~/keywords.txt 
$ dls /dev/loop0 > /tmp/unallocated.dd
$ strings /tmp/unallocated.dd | egrep -i -f ~/keywords.txt --color
-- To know next free loop device
$ losetup -f
$ dls -s /dev/loop0 > /tmp/slackspace.dd
$ strings /tmp/slackspace.dd | egrep -i -f ~/keywords.txt --color

