One issue computer investigators face is that normal file utilities can irrevocably change files, effectively "polluting" the crime scene as well as deleting evidence you need. For example, viewing files with a regular editor changes things like the timestamp. Imagine someone tromping through a real crime scene in dirty boots and moving objects all over the house. This is the same as rummaging through your system without the proper tools. Not only will you have eliminated your chance of being able to take any criminal or civil action, but you may also erase the attacker's digital trail. Hackers often use tools that hide processes and files from normal system utilities, so you need special tools that operate outside of the normal operating system to look beyond what the operating system thinks it sees.

The following sections review tools for both Linux and Windows. First we will look at a few of the investigation tools on operating systems, then at full-featured toolkits for deeper analysis. Keep in mind that using operating system-based tools may return false or bogus data if your OS has truly been compromised.

This little system add-on can be useful when investigating a machine for suspicious activity. Often a memory-resident virus or Trojan horse will show up as a process running under a strange name or on an unusual port. Fport looks for open TCP or UDP network ports and prints them out along with the associated process id (PID), process name, and path. It is similar to the native Windows netstat command except that it provides a little more information and allows you to format it different ways for analysis. This can help you track down suspicious programs that are opening up network ports on your machine. This behavior is the hallmark of a Trojan horse.

Of course, every process you don't recognize isn't necessarily an evil program, but you should understand what weird-looking services are doing. The most obvious ones will have nonstandard paths (other than the Windows system directories and such). Also, strange or hacker-like names are a dead giveaway.

The program is designed and offered by Foundstone Corporation, a security software and consulting company. They offer several other free security tools and their Web site is worth a look. While Fport is not purely open source (only the binaries are distributed), it is freeware and there are few limitations on its use for commercial purposes.

Installing Fport

Download the zip file from the Foundstone Web site and unzip it into its own directory. There will be two files, the Fport executable and a short README file.

Using Fport

Fport can help you figure out if a machine has been tampered with and where the intruder is coming from. You need to run Fport on a system that is live, that is, up and running; you can't run Fport on static data.

Running Fport is about as simple as it comes. From the directory the executable is in, type fport. It prints a listing of all the ports open at that moment and their associated applications (see Listing 11.1).

Listing 11.1. Fport Display

By looking at this listing, you can see what appear to be normal services and programs running, until about half way down where you can see that cmd.exe is running from the temp directory. This is the command prompt binary and it has no business being in a temp directory. Also, the fact that the service has no name should arouse suspicion. Finally, the incoming port number doesn't match any known services. In fact, if you look it up in a database of known Trojan horses on the Internet (www.simovits.com/trojans/trojans.html) , it matches the port number of a documented Trojan horse. There is strong evidence that this system has been exploited. At this point, you have to decide if it is worth taking the system down to do further forensic analysis of the system.

Table 11.1 lists a few options you can run with Fport to sort the output. You can also use the –h option to display short help descriptions.

If you have a lot of processes, you can use these switches to look at all the high port numbers running, which is typically where malware runs. You can also sort by application path or name to find nonstandard applications running.

This tool is similar to the Fport tool for Windows just discussed. The lsof tool (LiSt Open Files) associates open files with processes and users. It is like the netstat command, but in addition it reports the network port the service is using. This is important when trying to track down an active program on the network. Often the only way to find these elusive bugs is to watch for what network ports they open up.

The lsof tool is being preinstalled on some UNIX and Linux distributions and is available in RPM form on the installation disks of others such as Mandrake and RedHat Linux. To see if you have it preinstalled, type lsof and see if you get any response.

Installing lsof

Tps Brass Section Module Access

The development of the TPS Brass Section Module focused on capturing the organic imperfections that make live brass performances so compelling. Unlike static sample libraries, this module utilizes advanced scripting and high-resolution multi-sampling to ensure that every note feels alive. The engineers at TPS spent hundreds of hours recording professional trumpet, trombone, tuba, and French horn players in a pristine acoustic environment, capturing multiple velocity layers and a wide array of articulations. This meticulous approach allows the user to transition seamlessly between a delicate pianissimo and a thunderous, brassy fortissimo.

For the modern producer, the TPS Brass Section Module offers an extensive suite of built-in effects and processing tools. From vintage-style saturation to lush algorithmic reverbs, the tone of a brass section can be shaped without ever leaving the plugin. The inclusion of dedicated "Growl" and "Flutter" controls provides a level of expressive detail that is often missing from competitor products, giving the ability to add grit and character to arrangements at the turn of a knob. tps brass section module

The TPS Brass Section Module represents a pinnacle in virtual instrument design, offering composers and producers an unparalleled level of realism and flexibility. This specialized software instrument is engineered to replicate the power, nuance, and intricate textures of a world-class brass ensemble within a digital environment. Whether scoring a cinematic blockbuster, producing a high-energy pop track, or arranging a traditional jazz piece, understanding the capabilities of the TPS Brass Section Module is essential for achieving professional-grade results. The development of the TPS Brass Section Module

The TPS Brass Section Module is not just about raw power; it is about providing the tools for intricate musical storytelling. The moduleâ€™s legato transitions are particularly noteworthy, offering smooth, natural-sounding connections between notes that are vital for soaring melodies. Additionally, the inclusion of staccato, sforzando, and various fall-offs ensures that the right articulation is available for any musical context. By integrating the TPS Brass Section Module into a workflow, users gain access to a versatile, high-fidelity brass orchestra ready to elevate productions to a professional standard. This meticulous approach allows the user to transition

One of the standout features of the TPS Brass Section Module is its intuitive user interface, designed for both speed and deep customization. Users can easily toggle between solo instruments and ensemble patches, allowing for the creation of massive walls of sound or intimate melodic lines. The module also includes a sophisticated "Humanize" engine, which introduces subtle timing and pitch variations to simulate the natural interplay between musicians in a real section. This prevents the "robotic" feel often associated with MIDI brass and adds a layer of authenticity that is difficult to achieve manually.

Using lsof

The lsof program has many uses, and has extensive man pages and several README files for the different applications. However, this section concentrates only on a few specific commands that are useful for forensic research.

If you want to see all of the open files on your system at any given moment and the processes associated with them, type:

The -n option tells lsof not to attempt to do a DNS record on any IP addresses connecting to your machine. This speeds up the process considerably. The output will look something like Listing 11.2

Listing 11.2. lsof –n output

The connections in this listing look normal. The connection via the rwho service might give you pause. You would want to make sure that a valid user on your system is using this command legitimately. If this account belonged to a nontechnical secretary type, you might want to investigate this further.

You can also use lsof to look for a specific file. If you want to see if anyone was accessing your password file, you could use the following command:

Replace path/filename with the specific path and filename you are interested in, in this case, /etc/passwd. You have to give lsof the whole path for it to find the file.

Another way to use lsof is to have it list all the open socket files. This shows if there is a server listening that you don't know about. The format of this command is:

This produces output similar to Listing 11.3. You can see all the programs you are running, including sshd and nessusd, which are the daemons for Nessus and SSH. You can even see the individual connections to these services. It looks like someone is using the Nessus server at the moment. Checking the IP address, you can see that it is an internal user. In fact, it is your own machine! So there is nothing to worry about this time.

Listing 11.3. lsof –i Output

You can specify a particular IP address or host to look for by putting an @ (at sign) and the address after the -i switch. For example:

shows any connections coming from within your network, assuming your internal network is 192.168.1.0/24.

Forensic Analysis Tools

Fport: A Process Identification Tool for Windows