Notifications
Clear all

Cygwin help !!!!!

8 Posts
5 Users
0 Reactions
879 Views
(@kimani)
Active Member
Joined: 13 years ago
Posts: 5
Topic starter  

Hi y'all

I'm working on a project doing software exploration and I'm needing to use Cygwin to search and analyze index.dat files found in Internet Explorer.
I have downloaded and installed Cygwin, done numerous searches on how to use including from the author but i don't seem to be getting anywhere.
I was wondering if there is anyone in-house who can offer some insight on how to go about it.
Thanks
Kim


   
Quote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 

II have downloaded and installed Cygwin, done numerous searches on how to use including from the author but i don't seem to be getting anywhere.

Cygwin is a Linux-look alike platform. If you are planning to use standard Unix/Linux tools, you need to be familiar with them. That means some degree of proficiency in Linux. If you don't have that, that's probably where you need to start.

If you are planning to use some other tool, please tell us which.


   
ReplyQuote
(@kimani)
Active Member
Joined: 13 years ago
Posts: 5
Topic starter  

Athulin - Thank you for responding. I am not acquainted with Linux at all. My main problem though is being able to interpret the following usage directions as provided by the author.
Also, I am running Cygwin off Windows.

Usage

pasco [options] <filename>
-d Undelete Activity Records
-t Field Delimiter (TAB by default)

Example Usage
[kjonespasco/bin]% ./pasco index.dat > index.txt

Every time i have run this commands i have ended up with no results. If anyone has any pointers i would appreciate.

Kim


   
ReplyQuote
(@alastairfay)
Eminent Member
Joined: 14 years ago
Posts: 36
 

Can you access the data in question from within Cygwin? Can you access any Windows files?

If you have zero knowledge of Linux, then…. well, good luck. Best tip I can offer is…. learn how to use a Linux shell.

Instead of Cygwin, perhaps look at installing WUBI - https://help.ubuntu.com/community/Wubi

It's very easy to 'mount' the Windows partiton (on the same disk Ubuntu is installed on) within Linux for data analysis.

Cygwin sounds like an unnecessary hill to climb.

EDIT Use this website as a starting point! http//tldp.org/LDP/intro-linux/html/


   
ReplyQuote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 

I am not acquainted with Linux at all.

That is a very great handicap, if you are going to use a Unix tool. Are you sure you're going the right way?

I would really suggest you use an environment that you are familiar with instead. Alternatively,
go through some kind of beginner's guide to Linux first. Any analyst need to understand the environment and the tools before a decent job can be done.

If you are learning, it's another matter, but as you haven't said anything about that, I conclude you are up the proverbial creek and hoping that Cygwin and pasco are as simple and obvious to use as a canoe.

Example Usage
[kjonespasco/bin]% ./pasco index.dat > index.txt

Every time i have run this commands i have ended up with no results.

If you did not have a pasco.exe binary, you would see an error message to that effect. If there was no index.dat file in your current directory, pasco would also give you an error message. Either on the console, or in the index.txt file. But as you are not saying anything about error messages, I can only guess there is nothing in the index.dat file for pasco to extract. (You haven't overwritten it?)

Do you have any windows browser history tool that you know and trust that you can use to double-check that?


   
ReplyQuote
(@kimani)
Active Member
Joined: 13 years ago
Posts: 5
Topic starter  

Thank you athulin and alastairfay for your input.

The Software Exploration project ( Pasco v1.0) im working on is for my university course. I guess athulin is right about being up the creek without a paddle hoping that Pasco and Cygwin work magic. I am indeed meant to be exploring new forensics software and i guess they all dont work simple magic like EnCase and FTK . I have a lot to learn.

I was following the instructions given on the website below and thought it would be a simple move.

http//www.mcafee.com/us/downloads/free-tools/pasco.aspx

Thanks for your input though..

Kim


   
ReplyQuote
(@pragmatopian)
Estimable Member
Joined: 16 years ago
Posts: 154
 

A good introduction to Linux for Digital Forensic practitioners can be found here

http//linuxleo.com/


   
ReplyQuote
 tg92
(@tg92)
Active Member
Joined: 15 years ago
Posts: 13
 

Hi,

Maybe i'm misunderstanding something but it seems that the tool you try to use is a windows executabe…no needs for cygwin.

There is a Linux version of Pasco but the link you give point to the Windows Version. There is a "cygwin1.dll" in the folder that contains all that you need…

So
- unzip the tool
- cd "folder_containing_pasco.exe"

then from cmd.exe

.\pasco "full_path_to_index.dat" > "path_to_output_file"

Hope that helps.

Thierry


   
ReplyQuote
Share: