Note: This is mainly for website updates and the occasional link. Most of my personal updates are done on my Google+ page.
Subnmitted the final, hard-bound copies of my thesis yesterday. Research website updated accordingly: New files: 4-page summary of my honours work: http://research.dylanleigh.net/zfs-timeline-forensics/dleigh-honours-4pg-summary.pdf Full, final thesis (11/175 pages): http://research.dylanleigh.net/zfs-timeline-forensics/dleigh-final-honours-thesis-ZFS-Timeline.pdf Updated: Research homepage: http://research.dylanleigh.net/ Bibliographies: http://research.dylanleigh.net/research.dylanleigh.bib http://dylanleigh.net/portfolio/dylanleigh.bib -----==========----- Also, I now have a GitHub, with the source to the ZFS/ZDB Parsers, Rastatodo and my Minetest mods now hosted there: https://github.com/dylanleigh https://github.com/dylanleigh/zfs-zdb-plaso https://github.com/dylanleigh/rastodo https://github.com/dylanleigh/dl-minetest -----==========----- PS: Also fixed the .plan php so the https links above get converted. Strage I haven't noticed this bug before, I should link to more secure pages...
Someone just pointed out to me the top Google hit for "Yallara" isn't the Wiki page on the animal, or the server itself: http://yallara.cs.rmit.edu.au/~dleigh/ Awesome. On the other hand, Yallara is going to be killed in a month or so, which is the opposite of awesome. :(
My article on developing and using the ZFS/ZDB Plaso Parsers has been published in Digital Forensics Magazine, Issue 20. The article is available here (subscribers only): http://digitalforensicsmagazine.com/index.php?option=com_content&view=article&id=949 The parsers themselves are on my research site; the readme includes all the installation and usage instructions: http://research.dylanleigh.net/zfs-timeline-forensics/plaso-zdb/ -----==========----- Also, fixed a minor bug in rastodo this morning: http://www.dylanleigh.net/software/rastodo/
I'm back in Austraila. Ottowa is awesome. More to come. Belatedly, I should mention that the slides, paper and quick command reference from by BSDCan 2014 presentation, "Forensic Timestamp Analysis of ZFS" are available on BSDCan and my research site: http://research.dylanleigh.net/ http://www.bsdcan.org/2014/schedule/events/464.en.html -----==========----- Also, this morning I had to create another USB stick with ZFS, and forgot all the useful properties from last time, so I've written them up in a new notes page for ZFS: http://www.dylanleigh.net/notes/zfs.html
Tonight I managed to reformat and reinstall an old system which can't boot off CD or USB, using a variation of this technique. If the existing but outdated OS can boot - copy the kernel and boot image to the hard disk, use the old GRUB bootloader to load them, and install the rest over the network: http://www.howtoforge.com/install-linux-without-burning-an-iso\ -to-cd-dvd-use-the-iso-downloaded-to-your-hard-drive