±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36620
New Yesterday: 3 Visitors: 86

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Mandiant First Response

Discussion of computer forensics employment and career issues.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

iruiper
Senior Member
 

Mandiant First Response

Post Posted: Jun 12, 06 16:07

I have just found this program for First Response analysis, and after reading about its features, it really surprised me to know that it is completely free!! However, I'm having quite a trouble in deploying the Agent part for network analysis. Have anyone faced this problem too?

The concrete errors obtained when trying to set the agent into "listen mode" are the following:

First Response Agent 1.1.0.63 Running as [my_machine_name]
System.Exception: Exception decrypting. Decryption failed. Key not valid for use in specified state.

at FirstResponse.Foundation.DataProtector.Decrypt(Byte[] cipherText, Byte[] entropy)
at FirstResponse.Foundation.DataProtector.Unprotect(Stream input, Byte[] entropy)
Object[] {creds.xml.protected, FirstResponseAgent}
Exception decrypting. Decryption failed. Key not valid for use in specified state.

System.Exception: Exception decrypting. Decryption failed. Key not valid for use in specified state.

at FirstResponse.Foundation.DataProtector.Decrypt(Byte[] cipherText, Byte[] entropy)
at FirstResponse.Foundation.DataProtector.Unprotect(Stream input, Byte[] entropy)
at FirstResponse.Foundation.ProtectedStoreCredential.Decrypt(String path)
at FirstResponse.Foundation.ProtectedStoreCredential..ctor(String domain, String path)
at FirstResponse.FirstResponseAgentSession..ctor(FirstResponseAgentSettings settings)
System.Exception: Exception decrypting. Decryption failed. Key not valid for use in specified state.

at FirstResponse.Foundation.DataProtector.Decrypt(Byte[] cipherText, Byte[] entropy)
at FirstResponse.Foundation.DataProtector.Unprotect(Stream input, Byte[] entropy)
at FirstResponse.Foundation.ProtectedStoreCredential.Decrypt(String path)
at FirstResponse.Foundation.ProtectedStoreCredential..ctor(String domain, String path)
at FirstResponse.FirstResponseAgentSession..ctor(FirstResponseAgentSettings settings)
at FirstResponse.FirstResponseAgentApp.RunDaemon(Arguments arguments)
at FirstResponse.FirstResponseAgentApp.Start(Arguments arguments)
at FirstResponse.FirstResponseAgentApp.Start(String[] args)


Any help would be fantastic!  
 
  

keydet89
Senior Member
 

Re: Mandiant First Response

Post Posted: Jun 13, 06 00:44

Looking at the web site, the .Net framework is required. Beyond that, it would probably be better to contact the folks who wrote the tool...particularly if there *is* a problem with their product, so they can correct it.

Harlan  
 
  

mtpepe
Newbie
 

Re: Mandiant First Response

Post Posted: Jun 28, 06 20:20

Hello iruiper,

If you haven't already found a solution for your issue, you may want to post it over at forums.mandiant.com. Our devs keep an eye on that board and are typically quick to respond to issues that arise with our software. I'd help you directly myself, but I suspect that they will be able to answer your question faster. Smile

-- Matt  
 

Page 1 of 1