Mashed Articles

Any operating system that contains the letters B, S and D usually conjures images of geeky elitism, arcane interfaces and the undead world of UNIX. Despite its similarity, this is an image Linux has largely been able to shake off, thanks to its friendly graphical installers and configuration tools. But BSDs can offer a unique insight into what has made Linux popular, as well as an opportunity to hone your command-line and trouble shooting skills in a world that might be getting too easy. And while you do need a little technical confidence to get any BSD system up and running, it’s not half as difficult as it first appears.

FreeBSD is not as demonic as its logo might suggest. Honest.

FreeBSD is a the most popular implementation of version 4.4 of the Berkeley Software Distribution. This was the original BSD, a version of UNIX that was developed between the late-70s and the mid-90s and used a famously liberal licence. This licence has meant that anyone can use, copy and redistribute and re-implement its code and APIs. Which is exactly what FreeBSD attempts to do, alongside other projects like OpenBSD and NetBSD. In turn, there are many projects like Apple’s OS X that build upon the foundations in FreeBSD, all thanks to the liberal licences of the original.

Step 1: Prologue

There are several important differences between FreeBSD and Linux, but the most fundamental is the kernel. The term ‘Linux’ is most often used to refer to the entire operating system, from the boot code and drivers to the desktop and the applications. We’d call Ubuntu, Fedora and OpenSUSE different versions of Linux, for instance. But this definition isn’t accurate. ‘Linux’ should only really refer to the kernel – the chunk of code at the heart of the system that deals with hardware, networking, drivers, storage, CPU and process management, and the BSD kernel is entirely different.

The Linux kernel that was originally developed by Linus Torvalds, and it’s still the only part of the whole operating system he has control over. The remainder of what makes a complete operating system, the windowing environment, the desktops and the applications, are pulled from open source project that are mostly using one of the the GNU Public Licences. Hence, the official name for the entire Linux operating system is really GNU/Linux to show that there are two parts of the whole project. Which is why replacing the kernel isn’t a trivial operation.

Don’t be scared of text mode. It’s part of Linux’s legacy, and serves a very useful purpose.

Any new kernel needs to be broadly compatible with Linux so that the remainder of the software stack can be ported without too much difficulty. Fortunately, both FreeBSD and Linux are UNIX-alike, which means there are many similarities, and the result is that with a standard installation, you’ll find many of the tools you’re already familiar with, albeit in a different configuration.

Many system administrators feel FreeBSD is has been a more stable choice for servers over the years, and that it can out-perform its cousin on certain tasks. It’s also a great choice if you want to run a server on limited hardware, as the requirements for a BSD-based system are often less than for the Linux equivalent. FreeBSD, for example, lists its minimum requirements as a 486 CPU with 24MB RAM, which is quite staggering in today’s world of terabytes and quad core processors. FreeBSD is also a i386-based platform. There are ports to other processors, but the project’s focus has always been compatibility with Intel’s standard architecture, and as a result, could be better suited to the majority of machines that parts of the Linux kernel.

Step 2: Installation

While there are Live CD versions of FreeBSD, the traditional install disc is still the most common medium for getting hold of the latest version. But you’ll need to steel yourself against its antiquated installation mechanism.

When you boot your machine with the disc in the drive, the first thing you’ll see is the black and white ASCII art of the install menu. You won’t see any other graphical embellishment until you’re able to boot successfully into a working desktop. For most installs, you’ll need to choose option 1 from the menu, but if you’re using an older machine, you may want to try 2 (with ACPI disabled) to avoid any potential problems.

Unlike trial Linux installation packages like Wubi, installing BSD has a tendency to be destructive. Make sure you’re not going to obliterate anything important before continuing.

You’ll then have to wait a few moments while various kernel messages scroll by before you’ll see the text-based installation and configuration screen. If you’ve used Debian, this kind of text installer will feel familiar. There’s no linearity to the install process. You can move backwards and forwards through the various options, and continue to make adjustments to the installation until you quit the installer and restart the system.

For a basic, working environment, you will need to do at least the following. Select the second option in the menu to initiate a ‘Standard Install’ and read the information on the screen that follows. The next page displays ‘fdisk’, the disk partitioning and formatting tool. Press F1 for documentation, but if you’re using your entire hard drive for this installation, press ‘a’ to select everything, followed by ‘q’ to apply the changes. This will delete everything currently on the drive, so be careful.

The next page will ask if you want to install a boot loader, which is the menu that lets you choose between whatever operating systems you have installed. Choose the second option (BootMGR), and on the following page, you need to create the various partitions used by FreeBSD using the same fdisk-like interface we’ve just seen.

Once again, if you’re using an entire drive for the installation, you can just press ‘a’ to let the installer create the most appropriate array of partitions followed by ‘q’ to make the changes permanent.

The next page will ask you to choose a distribution. Unlike a Linux distribution, FreeBSD uses the term to refer to the default selection of packages that are to be installed. Select ‘Custom’ and add ‘base’ and ‘kernels > GENERIC’ to your installation.

This will give you enough package to get a working system, and we’ll need to add the desktop environment at a later stage. Return to the ‘Exit’ option at the top of the list and press space to jump into the package installation routine.

Step 3: Post-Install

After all the preliminary configuration has completed, you’ll be asked whether you want to configure any Ethernet or SLIP/PPP devices. Select ‘Yes’ if you are connecting to the internet through your machine’s ethernet port, and you should see your adaptor listed in the top of thew connections list. Choose the adaptor, say no to IPV6, say yes to DHCP and skip through the configuration page to the OK button. Say ‘no’ to your machine being a network gateway,’no’ to enabling any inetd services or running SSH, FTP and NFS server and clients, and don’t edit the console settings. You can safely setup a timezone for your machine and enable the PS2 mouse emulation if you’re using one.

Don’t worry too much about your initial selection of packages. You can easily add more later.

Say ‘Yes’ to the next question, and you’ll now be looking at the package manager. This is where you choose what applications you want to be installed on top of the default option we chose earlier, and there are thousands of packages to choose between. For a simple setup, jump into the ‘x11’ menu and select the ‘kde4-4.3.1′ package. It’s exact name will depend on the version of FreeBSD you’re playing with. If you’re not a fan of Gnome, you could also choose ‘gnome2-2’ from the same list of packages. Selecting either will also mark their dependencies for installation. You also need to select xorg-7, and any other packages you know you’re going to need.

When you’re ready to go, jump back to the top package list, select ‘Install’ and press space. You’ll need to wait a while for all the packages to install. The next step is to create a user account. You can do this by saying ‘Yes’ to the option, then selecting ‘Add User’, and entering a user name in the page that follows. Select OK to make the change permanent and exit from the users and groups menu. You’ll then be asked for the system manager’s password, and you’ll need to type this twice.

After that, you can say ‘No’ to the post-install configuration request and wait for your machine to reboot. You’re now at the point where you should have a basic, working installation, and you can quit from the installation menu and restart your system.

Step 4: Configuration

When your machine re-appears, you’ll be greeted by the sombre monochrome of the command line. Login as ‘root’ with your system manager’s password. For both Gnome and KDE, you need to add the following two lines to the ‘/etc/rc.conf’ configuration file:

dbus_enable="YES"
hald_enable="YES"

Unfortunately, you’re going to need to use the ‘vi’ text editor. Type ‘vi /etc/rc.conf’ to load the file. Press ‘i’ to enter insert mode, move to a new line and type the following. Press escape to exit insert mode, followed by ‘:wq’ (without quotes) to save the changes and quit the editor. Next type ‘reboot’ to restart your system.

FreeBSD doesn’t come with a desktop activated by default, but it’s simple enough to change.

When you get back to the login screen, enter your user account details this time, and when you get dropped back to the command line, type ‘vi .xinitrc’ and add the following line to the file:

exec /usr/local/kde4/bin/startkde4

This is telling your system that when the X.org graphical system starts, you want KDE to be used as your desktop environment. Save and exit vi.

Step 5: Launch Desktop

Usually, at this point, you need to create an ‘xorg.conf’ file to define the display properties for your machine. But recent releases of the X server are able to create a working configuration without any further editing. Which means typing ‘startx’ is all you need to do to launch a graphical environment running KDE. If this doesn’t work, then you will need to create create a working /etc/X11/xorg.conf file.

But with FreeBSD 8, it’s more likely that you are now looking at KDE running through its Akanadi porting routines as it builds up a configuration for your desktop. After a couple of minutes, this will leave you with a KDE desktop running on-top of FreeBSD, and you’ve just earned another trophy for your awards cabinet.

At long last: a GUI! And one of the more stable interfaces you’ll find. Here’s hoping BSD serves you well.

This is exactly the same KDE you’ll find on Linux, and you’ll be hard pressed to find any difference between the way it works on FreeBSD and the way it works with Kubuntu. It’s only when it comes to system configuration that you’ll notice because FreeBSD doesn’t have any graphical configuration tools, which means if you need to change anything, you’ve got to be prepared to go back to the command line. But that’s another story.

See also: PC-BSD 8.0

If you’ve followed the main text to install a shiny new version of FreeBSD, you might have noticed that the install mechanism really wasn’t all that shiny or new. It reality, it feels ancient. But this doesn’t mean that the operating system has been languishing unloved and undeveloped, it just means that making the installer easier to use is low on the priority list.

Fortunately, this being open source, demand for a better way of doing things has led to several alternatives, the best of which is PC-BSD, which you’ll find at www.pcbsd.org. It does several impressive things. Firstly, it replaces the tepid monochrome installer of FreeBSD with a graphical application much-more in-line with its Linux counterparts. It will also automatically install and configure a recent version of the KDE desktop, which should mean you can get productive with a FreeBSD system as quickly as possible, without touching the command line, and there’s a wonderful wiki full of helpful documentation.

This means you can install PC-BSD by placing the disc in the drive, rebooting your machine, answer the questions that appear and wait for the operating system to install. You won’t even need to worry about manually partitioning your drive unless you want to create a custom configuration.

Another important difference is that it PC-BSD doesn’t use the same package management as FreeBSD, although you can still get to it if you need to. Instead, package are available as single files with the ‘.pbi’ file extension, which can then me installed with a simple click. It’s more like how packages are handled on OS X, and is far better than the weird world of dependencies you find on Linux.

Linux is blessed with a variety of methods for accessing, expanding and building dynamic, scalable storage solutions. And they’re not just for industry experts either – even everyday Linux users can get access to a great deal of functionality by sharing and accessing data across a network.

Set up iSCSI and your data will stream from your PC like a magical rainbow. Perhaps. If you’re very lucky.

But there’s a new generation of solutions that can increase performance, offer more features and improve security – one of which is iSCSI. As its name implies, iSCSI is a version of the SCSI protocol, which is responsible for shuffling data between various SCSI devices. The key difference with iSCSI is that instead of transporting data across local cables and buses, the ‘i’ takes that data across the internet or your local network, attaching remote storage devices to your local system. It’s perfect for storage area networks (SANs) in particular, and you’ll find network administrators in enterprises of all sizes singing the praises of iSCSI’s ability to combine big-business fibre channel commands with generic networking hardware, saving their departments thousands of pounds in both hardware and infrastructure costs. iSCSI is also a great general-purpose remote storage solution that could easily replace the NFS protocol.

Understanding iSCSI

You can now find iSCSI in many network-attached storage (NAS) devices for the home and even standard Linux installations. This is because it’s a great storage protocol for an expanding network. It might be hard work to master, but you can build a working configuration with relative ease. The great advantage that iSCSI has over some of the alternatives is that drives are exported as block devices, just as blocks of data would be transported over an old SCSI cable. This means that, to the Linux kernel, these drives are handled exactly like local block devices. This makes it perfect for connecting the storage area of a database to the client application or, more recently, the virtual storage devices used by VMware and VirtualBox virtual machines. It’s also ideal if you want to run a machine without any local storage – traditionally the domain of NFS.

Use ‘apt-get install iscsitarget’ to add the appropriate packages to your installation.

Before getting started, your first step should be to familiarise yourself with some of the concepts that are used by iSCSI. These appear to take their names from the Terminator films, with the two most important being the Initiator and the Target. The Initiator is the iSCSI equivalent of the client. It’s the machine you want to have access to the remote data – the one that’s running the applications, or your desktop. The Target is the place the Initiator grabs the data from – another machine running the iSCSI server software and managing the requests to and from the storage medium. You’ll often find NAS drives running the Target server, for example, and you’ll only need to run the Initiator on your local machine in order to access the Target drive.

Set up the Target

It’s possible to share a large variety of different storage types over iSCSI, but the easiest to configure are entire drives. iSCSI connects devices at the block level, which means the job of partitioning and formatting can be left to the Initiator rather than the machine that’s attached directly to the hard drive. On our system, the drive we used was listed as /dev/sdb, and we’ll stick with this example throughout this tutorial. The system drive is normally /dev/sda. To find out what yours is, type fdisk -l on the command line for an overview of what’s connected to your system.

Edit the configuration file in nano. You’ll need to add a line which ensures iSCSI is switched on.

On the Target machine, you first need to install the ‘iscsitarget’ package. You can do this either from the Synaptic package manager or by typing sudo apt-get install iscsitarget on the command line. This will also install several configuration files, and the first of these that we need to look at is ‘/etc/default/iscsitarget’. You can type sudo nano followed by the path to the file name to edit it on the command line, or use your favourite desktop editor if you prefer. We only need to make a single edit here – making sure ‘ISCSITARGET_ENABLE=true’ is the only line in the file. Nano users need to press [Ctrl]+[X], then [Y] to save the changes.

Edit configuration files

The next file we need to edit is ‘/etc/ietd.conf’, which you’ll need to open in an editor. This document contains a working configuration, with lines using the # symbol designated as comments and therefore out of action.

The first line we need to edit defines what’s known as the iSCSI qualified name, or IQN for short. Just search for Target, followed by iqn. As with pages on the net, this IQN name has to be unique to your installation, and it takes the form of ‘iqn’, followed by the year and month, then a reversed version of your domain name. This is then followed by a colon and a reference to whatever you’re going to call the target storage device. This can be anything you like. Here’s what we chose:

iqn.2010-01.com.example:storage.disk2

Next, we need to define the drive that’s going to be shared over iSCSI. Remove the # symbol from the line starting with ‘Lun’ and modify it to read Lun 0 Path=/dev/sdb,Type=fileio. You need to change ‘/dev/sdb’ to the location of the drive that you’ve decided to share. Next, uncomment the Alias line at the bottom of the current section and save the file.

You’ll need to do some deeper editing to the ‘/etc/ietd.conf’ file.

You may have noticed that there are two lines available for a username and password, but we’re going to leave these untouched for now because we’re running our iSCSI device over a trusted network. You can always come back to this point and change the configuration after you’ve got the basic connection working, if you think that you need to.

To enable the device to be shared, open ‘/etc/initiators.allow’ and add iqn.2010-01.com.example:storage.disk2 ALL. When you get the connection working, you’ll need to change ‘ALL’ to the IP address of the machines allowed to access your iSCSI device, but for now we’re trying to remove all obstacles that could stop us getting the connection working. Start the Target server by typing sudo /etc/init.d/iscsitarget start.

Set up the Initiator

It’s now the turn of the other machine, the Initiator. To begin, you need to install the ‘open-iscsi’ package. Once that’s done, open the ‘/etc/iscsi/iscsid.conf’ configuration file and look for the line starting with ‘node.startup’. Change the default value of ‘manual’ to automatic, save the file and restart the service by typing sudo /etc/init.d/open-iscsi restart.

Make sure you change the node startup option to ‘manual’.

Almost everything is now configured and ready to go. Our next step is to probe the Target machine to see what storage services it offers, hopefully listing our drive in the process. Type iscsiadm -m discovery -t st -p, followed by the IP address of the Target. You can find this by typing ipconfig on the Target machine. If everything is set up correctly, you should see the IQN of your drive as output to the iscsiadm. This is the output we received:

iscsiadm -m discovery -t st -p 192.168.1.61
192.168.1.61:3260,1 iqn.2010-01.com.example:storage.disk2

Now you know that the Target machine is correctly configured and that iSCSI can see the remote storage device, you need to type iscsiadm -m node. This will automatically create configuration files within /var/lib/iscsi/nodes for the storage unit on your local machine, which will allow the Initiator to mount the device automatically when the service is restarted. You may need to do this manually by typing sudo /etc/init.d/open-iscsi restart.

The remote drive should now be mounted locally. The best way to check is to type fdisk -l to list all the storage devices attached to your machine. The iSCSI drive should be part of the output, but you won’t see any indication that it’s being connected over a network. That’s the great advantage of using iSCSI.

Mount the drive

iSCSI passes the block information, so you need to format the remote drive from the Initiator machine before it can be used. This process is exactly the same as partitioning and formatting any other drive on your system. You could use fdisk on the command line, for example, or you could take the easy route and use a graphical partitioning tool like GParted, which you can install through your distro’s package manager.

After launching GParted, you first need to select the remote drive from the dropdown list in the top-right of the main window. As with fdisk, the iSCSI drive looks exactly like a local drive, so you need to take special care to select the correct device. You can lose data from other drives permanently with GParted, so proceed with caution.

If you’re hooked up to your target drive you should be able to treat it like any locally connected module – including partitioning it.

With the remote drive selected, click on the large grey area in the middle of the window marked ‘unallocated’. This is the unpartitioned area on your remote drive. Click on ‘New’. By default GParted will use the entire disk, but you’re free to subdivide the remote drive in exactly the same way you would a local one if you prefer. Leave ‘Primary Partition’ selected, then select ‘ext4’ as the filesystem and give your drive a meaningful label before clicking ‘Add’. Click on ‘Apply’ to make the changes to the remote drive, and then simply sit back and wait while the formatting process finishes.

Now that the drive is correctly formatted and partitioned, it’s time to mount it onto the local filesystem so you can start reading and writing data to it. You can use the ‘mount’ command to attach the drive just as you would any other, but there’s one small difference that you have to consider whenever you use multiple iSCSI devices – they might not always have the same /dev path. The solution is to navigate to the device using the /dev/disk/by-path/ nodes, so you can be sure you’re getting the same disk every time.

If you type ls /dev/disk/by-path, for example, you can easily see which devices are using the IQN address. In our example, we mounted the remote drive onto the local /mnt/iscsi folder with the following commands:

mkdir /mnt/iscsi
mount /dev/disk/by-path/ip-192.168.1.61\:3260-iscsi-iqn.2010-01.com.example\:storage.disk2-lun-0-part1 /mnt/iscsi

You can now read and write files to the /mnt/iscsi mount point, and these are passed directly to the remote drive just as if they were connected using an extremely long SCSI cable.

iSCSI on NAS boxes

Two of the trickiest parts of using iSCSI are finding the hardware and configuring the Target machine, but luckily there may be another option if you have a Linux-based network-attached storage box. Many of these will offer up a chunk of the storage inside the box over an iSCSI connection, and you can usually activate and configure this facility with just a couple of clicks. Some of these will let multiple Initiators access a single target and enable you to add CHAP password authentication. Then it’s simply a case of running the iSCSI discovery procedure on your Initiator hardware. If you’ve chosen to use a password and username, you’ll need to run the ‘iscsiadm’ command on the Initiator to add those values to the configuration file for that Target. The command takes the following format:

iscsiadm -m node --targetname IQN --portal IP AND PORT OF TARGET --op=update --name node.session.auth.

You need to run this three times, changing the end parameters each time. With the first execution, add authmethod –value=CHAP to the authentication check. For the second, add username –value=username to specify the username for the connection, and for the third execution add password –value=password to specify the password.

Create a virtual hard drive

Many more technical distributions, such as Fedora, use logical volume management (LVM) for local storage and filesystems. One of the advantages of LVM is that you can shrink, expand and create partitions on the fly from the pool of storage on your machine. Logical volumes can be used for all sorts of tasks. Virtual machines often use them to keep data from the main system, and they’re handy if you enjoy playing with filesystems. They’re also useful if you want to try iSCSI, because you don’t need to have a spare hard drive – you just need the space within your logical volume pool.

The key to adding new virtual drives is the ‘lvcreate’ command. We used the following command to create a 10GB logical volume: lvcreate -L10G -n vdrive vg. This creates a volume called ‘vdrive’ in a volume group called ‘vg’. You’ll need to take a look in your /dev directory to discover the name of the logical volume group used by your installation. After creating the drive, it appears in the /dev volume tree just like any other device and you can share it across the iSCSI connection like a real hard drive.

Even without LVM, there are other options for dynamically shared storage. You could create an image file, for example, by typing dd if=/dev/zero of=/mnt/iscsi.img bs=1024k count=1000. The ‘count’ value is the size of the image, while ‘/mnt/iscsi.img’ is the file that’s created. You can use that path as the source for the iSCSI Target on the ‘Lun 0’ line in the ‘/etc/ietd.conf’ configuration file, and use it like a real partition.

Virtualisation

iSCSI is commonly used by cloud applications and the world of virtualisation. This is so you can access the same hard drive data regardless of where the virtual machine is running. If you’re in the market for a major, enterprise-grade virtualisation solution that uses iSCSI, take a look at VMware’s ESXi solution, which is available for free from www.vmware.com.

Boot options

If you want the Target iSCSI device to be available each time you boot the Initiator machine, you will need to add the remote device to the ‘/etc/fstab’ file. The quickest way to do this is to copy another line in the file and change the parameters to suit the iSCSI device. Make sure the path uses the ‘by-name’ format so that you can be sure you get the same drive at each boot.

If you think you have the skills to match Graveyard Shift Supervisor with the Las Vegas Police Department Catherine Willows then read on.

The super-sleuth detectives in TV show CSI have some very nifty tools to help solve crimes. But the need to keep things interesting and wrap the show up in an hour means the technology used in each episode bears little resemblance to the work of real forensic experts. Or does it? When it comes to computer forensics, today’s tools are becoming more advanced, leaving fewer places to hide information. This tension between fact and fiction took on a whole new dimension when Microsoft’s police-only forensic toolkit was leaked on the internet. Reports say that it has more in common with CSI than The Bill.

We’re going to show you how to mimic Microsoft’s offering using open-source software to unlock Windows accounts, investigate suspicious activity, see any file on a Windows disk and even peruse files that others believe have been permanently deleted.

Forensic toolkit

During November 2009, it was announced that someone had leaked Microsoft’s secret crime-fighting software online. Described as a collection of programs linked by a sophisticated script, hackers and other cybercriminals had been dying to get their hands on it for some time. Now it’s reportedly available to anyone brave enough to download and install it.

The Computer Online Forensic Evidence Extractor (or COFEE for short) has been available to police forces since at least summer 2007, and is designed to gather forensic evidence at crime scenes and during raids from the still-running PCs of suspects and victims. COFEE reportedly takes the average police officer about 10 minutes to master, and comes supplied on a bootable USB pen drive. It enables trained officers to gather evidence from a running system without the need to call in cybercrime specialists, thereby speeding up investigations.

The USB drive itself is said to contain a package of about 150 forensic programs that enable an investigator to record sensitive information like internet history files and complete practical tasks like deleting Windows passwords. It also enables them to upload the recorded data for further analysis. By April 2008, it was reportedly in use by over 2,000 law enforcement officers throughout 15 countries.

At the time of the leak, Microsoft claimed that COFEE was nothing more than a collection of commercially available programs brought together in a single handy package, which it makes available free of charge (if hitherto secretly) to help combat computer crime.

If that’s true, then is it also possible to create your own version of COFEE using free, open- source software that will grant you complete access to a Windows computer? The answer is a resounding yes, but we must stress that using what you’re about to learn for malicious purposes on a computer you don’t own isn’t big and it’s certainly not clever.

Don’t use the following information to try to hack other people’s computers or networks. Without the in-depth knowledge required to cover your tracks, you’ll be caught and will probably face prosecution. If you hack computer systems in the US and get caught, you should be prepared to undergo a one-sided extradition process and go through a judicial system that will put you on a par with hardened terrorists before forcing you to serve a long prison sentence. There are plenty of commercial computer forensics systems around these days, but many of them cost serious money or are only available to the police. However, the open source community has a solution in the form of a special Linux distribution called Backtrack 4.

Introducing Backtrack 4

Backtrack 4 is based on a stripped-down version of Ubuntu Linux, which is a popular choice for home users because of its ease of installation and use. The makers of Backtrack 4 have stacked the application with special security and forensics tools. These make it extremely useful to network security specialists and police forces, as well as anyone interested in knowing exactly what’s happening on their own networks and any second-hand machines they’ve bought.

Backtrack contains a formidable array of hacking tools.

Despite being Linux-based, Backtrack will grant you complete access to data stored on computers running any version of Microsoft Windows. That’s because Windows isn’t running when Backtrack is booted from a DVD or USB pen drive. Linux can read Windows disks, but it doesn’t obey the file permissions, so the machine’s hard disk simply seems to contain a lot of files waiting to be accessed.

As well as booting and running directly from a DVD as a Live CD installation that never installs on your computer, you can also install Backtrack on a hard disk as the only operating system, or next to an existing Windows installation. If you plan to install Backtrack on a USB pen, you’ll need one with a minimum 2GB capacity. This booting option brings Backtrack closer to Microsoft’s COFEE than any other option.

First, you need to download the Backtrack 4 ISO file, which is just under 1.6GB. You can download it from the Backtrack site directly or click the ‘Torrent’ link on the same page. There are multiple sources from which you can leech parts of the file in parallel, so in practice it’s faster to download the ISO as a torrent. Click here to download the Vuze BitTorrent client, after which you can just click the ‘Torrent’ button on the BackTrack site’s download page.

Once the ISO has downloaded, use it to make a bootable DVD. We’ve listed a free and easy-to- use CD/DVD package capable of making bootable disks in the Resources section. When that’s done, test your work by ensuring your BIOS is set to boot from CD/DVD before attempting to boot from your hard disk, then insert the DVD and reboot the PC. Select the option to boot with a screen resolution of 1,024 x 768. When Backtrack has booted, you’ll see a command line. To start a desktop environment, enter the command startx and press [Enter]. After a few seconds, the standard KDE desktop will start.

Don’t be put off by the command line that appears when you first boot up.

Find your way around

Backtrack is loaded with all the obscure little utilities used by professional security consultants. Many of them are fiddly command-line programs, but a lot have graphical front ends that make them simple to use.

Hover your mouse over the icons on the menu bar at the bottom of the desktop and KDE will tell you the name of each one. We’ll use the names that appear when you do this to make thing easy to identify here.

The network interface cards are designed for network security work, and are disabled by default when you boot up Backtrack. This is because if anyone (or anything) is listening to network traffic, the last thing you want to do is announce your presence by requesting an IP address over DHCP.

To enable networking, click the black Konsole icon to open a terminal window, then enter the following command: /etc/init.d/networking start. After a moment or two, during which lots of verbiage scrolls up the screen, open Firefox (the icon is next to the terminal on the menu bar) and enter www.google.com as a URL. You should see the world’s favourite search engine appear.

Much like the Start button in Windows, the left-hand icon on the menu bar brings up the installed programs and system configuration options. This is called the K menu and is organised into subject areas. The one we’re most interested in is the first: ‘Backtrack’. Click on this and you’ll see a submenu containing categories of hacking programs, with which Backtrack has been preloaded. Clicking one of these reveals nested subcategories right down to individual programs.

Map the neighbourhood

Let’s begin by scanning the local network for hosts (another name for networked computers). Starting from the K menu, select ‘Backtrack | Network Mapping | Identify Live Hosts | Autoscan’. A wizard will appear. Click ‘Forward’ and you’ll be asked for the name of a network to scan. Leave this as ‘Local network’ and click ‘Forward’ again. The next screen asks where the network is located. We’re scanning the local network, so accept the default of it being connected to your computer by clicking ‘Forward’ once more.

Next, select the default network adaptor. This will usually be called ‘eth0’. If you don’t see any adaptors in the pulldown menu, it’s because you didn’t start networking earlier. Close Autoscan, start networking and run Autoscan again. Click ‘Forward’ one last time to confirm what you’ve asked Autoscan to do, then maximise the user interface that appears so you can see everything. Autoscan now contacts every possible IP address on the local subnet to see if there’s a machine connected to it. If there is, it adds an entry to the left-hand pane. Notice that in some cases, Autoscan can even tell you the username that’s logged in.

When you select a host, Autoscan will attempt to gain more information about it for you. A wizard will also appear, asking you to add it to the Autoscan online database. Cancel this. You can go between tabs between the interface’s right-hand panes to display a summary of the machine, detailed information or an inventory.

Autoscan works by sending a stream of specially crafted packets to each host in turn. These are designed to return information about the running system and can give away a surprising amount of information. Autoscan is a useful tool for detecting whether your neighbours are leeching your Wi-Fi, for example. If you don’t recognise a host, it’s probably an intruder – so up your security!

Wipe passwords

Logging into a Windows system is easy using Backtrack, even if you don’t know any of the usernames or passwords that have been set up. That’s because you can use a utility bundled with Backtrack to remove the password on any Windows account, including administrator accounts. This is possible because of a file called the SAM (Security Access Manager), which is normally locked by the Windows kernel so that no one else can read it. This is modifiable while Windows isn’t running.

First, we need to find out where the system’s hard disk resides in Linux. To do this, click the Konqueror icon on the desktop menu bar. This will open the Konqueror desktop browser. Click the ‘Storage media’ link. If you don’t see anything right away, press [F5] to refresh the view. Among the media that Backtrack knows about on your system, you’ll see your hard disk. Click this and you’ll see the folders in C:\, which is useful if you need to copy, add or modify files without logging into Windows directly.

Now select the Home icon on the Konqueror toolbar (the one that’s shaped like a house) and click the blue ‘up’ arrow next to it. Click the Media folder, and then the ‘Hard disk’ icon again. The location bar will change to give the name we must use to access the disk. It’ll be something like ‘/media/disk’.

Now, from the Start menu, select ‘Backtrack | Privilege Escalation | Password Attacks | Chntpw’. ‘Chntpw’ stands for ‘Change NT Passwords’ and it works on all versions of Windows. When you run the command, a terminal window opens. You can ignore the verbiage on the screen and enter the following command: chntpw -i /media/disk/Windows/System32/config/SAM. The capitalisations are very important here – ‘chntpw’ is all lowercase. If your Windows partition is called something other than ‘disk’, put its name in place of this in the command. Press [Enter] and a text-based menu will appear. Select ‘Option one’ and press [Enter] again. This gives you a list of the Windows user accounts. Type the name of the account you want to change (taking care to use the correct case for each letter) and then press [Enter].

Using the Chntpw utility to wipe a user’s password enables you to log into that account unhindered.

Chntpw displays lots of details about the account and gives you a number of options. Select ‘Option one’ and the password will be removed from the account. To exit, type ! and press [Enter], then press [Q] and hit [Enter] again. Chntpw will ask if you want to write the hive files. You do, so press [Y] followed by [Enter].

If you now reboot into Windows, you’ll be able to log into the account you’ve changed without being prompted to enter a password.

Recovering deleted files

Many people believe that when they delete a file and then empty the Recycle Bin, it’s gone for good – but this isn’t the case. Windows, like all modern domestic OSes, simply marks the sectors on the disk occupied by the deleted file as available for future reuse. It would be inefficient to overwrite the data those sectors contain until new data is ready to be stored. In the meantime, the old file is still there, available to be read by anyone with access to a file recovery utility.

Backtrack contains several such applications. Among the easier to use is PhotoRec, which is capable of scanning a hard disk and recovering a comprehensive list of all files marked as deleted. In fact, it can recover far more than just files deleted by users, including temporary files left over from when the operating system was installed. This means it’s a good idea to have a spare USB pen drive handy to store the recovered files for later perusal, because they can easily run into the thousands. To get going, insert the drive and run Konqueror. Click ‘Storage media’ and then select your USB pen drive to ensure that Backtrack is aware of it. You can leave Konqueror open and check the scan’s progress later.

Now run PhotoRec by navigating to ‘Backtrack | Digital Forensics | Forensic Analysis’ and then selecting ‘PhotoRec’.

The program itself runs on the command line, but it’s menu-driven, making it easier to use. When PhotoRec runs, it first presents you with a list of the hard disk partitions on the computer. In the case of a Windows-only machine, there’ll probably be only one large one. However, in some Windows 7 installations, there may be a second, small partition that the system uses to store recovery data. Use the up and down arrow keys to select the main partition, then press [Enter] to continue.

PhotoRec can understand a large number of partition table types and will automatically identify the one used on your disk, so accept the default on the next screen by pressing [Enter] again.

The next screen enables you to specify the file types to recover. Use the left and right arrow keys to highlight ‘File Opt’ at the bottom of the screen. Next, press [Enter]. The resultant display will give you a long list of all the recognised types. If you only want to recover one file type (JPG, for example), press [S] to deselect everything, then scroll down to the relevant type and press [Space]. You can use the [Page up] and [Page down] keys to navigate through the list more quickly.

 

Once you’re happy with your file type selections, press [Enter] and select the filesystem you want to scan. Use the left and right arrow keys to select the ‘Search’ option, then press [Enter]. This presents you with a choice of filesystem types. For a Windows filesystem, make sure you select ‘Other’, then press [Enter]. On the next screen, select ‘Free’ to ensure that the program only scans disk sectors that are marked as free space. Press [Enter] again to continue.

You’ll now be asked where to store the recovered files. The default is the directory ‘/usr/local/bin’, which is on the boot media. Press the left arrow key three times to get back to the root directory, then press the down arrow key repeatedly to navigate to the media directory. When you reach it, press [Enter] to see the media connected to the system. One of the devices you find should be the USB pen drive you inserted and navigated to in Konqueror just a moment ago. Select this and press [Enter] again. Finally, press [Y] to begin recovering deleted files.

The extraction process can take quite a while, depending on how much free space there is to scan on the disk and the number of file types you’ve specified. As the scan progresses, the number of files of each type will increase. PhotoRec creates a long list of subfolders in which it stores all the files it’s recovered. By perusing these, you may be able to locate some interesting or even incriminating pictures and other documents.