Tester Jobs Requirements (VIDEO GAME)

Using grep to Unearth Old Windows User Names 7 30 08

Identifying Deleted User Accounts in Windows

I was recently presented with three laptop computers suspected as stolen. My task was to identify the owners. I chose to use a Linux forensic boot disk (one that would not automatically mount the partitions) to conduct the examination to avoid disassembling the computers to access the hard disk drives.

It became apparent on the first computer that the original user account(s) were deleted. There was a major discrepancy between the single user account (in one of the suspects names) and in the installation date of the Windows Vista OS.

After studying Internet Explorer index.dat files recently, I decided to target deleted index.dat content. IE index.dat files contain the usernames of the active user browsing the web with Internet Explorer, as well as some local file system activities. I used the following command from the Linux terminal to fish for old user account names:

$ tr [:cntrl:] < /dev/sda | grep -abE --colour=auto (((:[0-9]{16,16}|Visited):[[:space:]])|Cookie:).+@

The command, broken down, does the following:

1. tr [:cntrl:] - translates control characters to line feeds to keep the grep memory buffer from exhausting.
2. < /dev/sda - feeds the raw data from device sda (the laptop hard disk) into the translate command. The device may be substituted with any file, such as a raw disk image.
3. | grep -abE --colour=auto (((:[0-9]{16,16}|Visited):[[:space:]])|Cookie:).+@ finds the Internet Explorer cookie and history index.dat data that contains user names. The The hits are in color to help them stand out and the results can be redirected to a text file by appending the command with "> grep.results.txt". Broken down further:

• grep -abE : a=treat binary as text; b=show byte offset; E=treat as extended regular expression
• --colour=auto : show regex matches in color
• (((:[0-9]{16,16}|Visited):[[:space:]])|Cookie:).+@ : Match expressions ":<16>: @" or "Visited: @" or "Cookie:@" where is any name of one character or more.

Example of Command Output:

254468840::2007052620070527: user@:Host: cis.cuesta.edu
286125672:Cookie:user@www.ibm.com/rc
161464680:Visited: user@http://encarta.msn.com/proscribed.html

The rest of the story

I analyzed the hits and observed user names inconsistent with those in the Vista /USERS directory. Further examination of the new user names showed they existed previous to the current user account (as determined from the index.dat date code), and urls for the users MySpace page. The newly discovered user was contacted through his MySpace page and identified the computer as stolen in June, 2007.

This a simplified discussion of the full process, which included examining the file system to determine existing users using The Sleuthkit. The purpose of the article is to demonstrate how grep can be used from a boot CD or USB device to locate Windows artifacts that show deleted accounts that can be used to identify the account holders.

In this case. the hard disk drive being examined was never mounted. Grep searches can be directed against unallocated sectors through a similar process which I will discuss at a later time.

download file now

As much as I’ve really enjoyed my time with Manhunter: San Francisco, I have little doubt that the PISSED rating system is not going to be all that kind to it. In fact, I imagine the result will be quite similar to that of Manhunter: New York, since the majority of pros and cons of the first game returned for the second. Let’s see if the improved story and more logical puzzle solutions can push it up past 50!

Puzzles and Solvability
I gave Manhunter: New York a 6 for this category. The sequel uses the exact same puzzle formula as the first one, so it’s tempting to give it the same. However, I just feel that they worked a lot better this time around! I can’t be certain whether it has more to do with me knowing what to look for after my previous experience, but I found the puzzle solutions to be much more logical this time. The ambiguity of the plot meant that I really had to use my brain, and sometimes puzzles took days to solve, but in the end it was logical deduction that got me there. I felt a huge sense of achievement with these successes, much greater than Ive had when solving standard inventory or branching dialogue based puzzles. My biggest complaint for New York was how difficult it was to figure out the suspect’s names, but they were less obtuse in San Francisco. I’m therefore upping the rating to a 7
Rating: 7


Interface and Inventory
Well, nothing has changed between the two Manhunter games. There is still no real mouse support, and moving the cursor around with the keys is slow and frustrating, particularly given how much pixel hunting is required. I still feel exactly the same about the MAD interface too. I really love the concept and thoroughly enjoyed watching the tracker recordings and then visiting the locations in person, but having to watch the full recording to its completion before being able to restart, and having no way to jump to a certain part of it, is irritating. It was even worse in the sequel because each recording was much more complicated and longer. The arcade game sections are hardly worth mentioning as the controls are so simplistic (the drilling vehicle one was infuriating though), and the inventory is pretty stock standard too. I only came across one bug, which occurred during the lava flow map section towards the end (one of the slaves and one of the robots kept appearing off the map, yet I could still move them). I’m sticking with the same 3 I gave the first game.
Rating: 3


Story and Setting
I’m really torn on this one. On the one hand, I was totally captivated by the story in Manhunter: San Francisco. I really liked how it drip fed me information, with new revelations were consistently thrown into the mix. Answers to long held questions were revealed at regular intervals, pushing things along while making the player work for it. However, when I step away and have an actual look at it, I realise that the above feelings have a lot more to do with the game design than the story itself. The fact is I can’t really confidently piece together what even occurred throughout the game, and the majority of the character’s motivations are very unclear. I have so many important questions that remain unanswered, and the failure of the Murry’s to wrap up the story in a third game means I’ll never know the answers. Still, I have to give points somewhere for the amount of enjoyment I got from this game, so I’m going to give it a generous 6.
Rating: 6


Sound and Graphics
Once again, there is very little change between the two Manhunters for this category. There is still an impressive amount of effort and detail put into the game’s visual design, but its effect is dramatically decreased by the very average implementation. The bright colours clash with the game’s overall tone and the animated sequences are fairly laughable. The sound is even worse, and I got to a point where I simply couldn’t listen to the PC speaker quality sound effects and music. I gave the first game a generous 4, but given that much of the sequel’s graphics and sound were lifted from the first one, and the extra year that has passed between them makes it more noticeably horrible than before, I have to punish Manhunter: San Francisco further by giving it a 3.
Rating: 3


Environment and Atmosphere
The Murry’s trips to the actual San Francisco landmarks paid off, and I actually looked up the real locations on Wikipedia a few times while playing, just to see how well they virtually imitated them. Moving from location to location on the overhead map also really helped to make me feel like I was exploring a large area, filled with hidden horrors and dark secrets. The city has the same suppressed yet rebellious feel to it that pervaded New York, and there was a surprising amount of gore in the game that added to the atmosphere. As mentioned before though, the low quality and overly bright graphics don’t help on this front, nor does the silly nature of some of the occurrences and messages. Overall, I think it was the puzzles, the story, and the atmosphere that kept me coming back to Manhunter 2, so I have no issue with using fairly high numbers for those categories.
Rating: 6


Dialogue and Acting
No-one speaks in the Manhunter series. I’m not even sure whether there was any explanation for that during the first game, but I guess it’s all part of the repressed society scenario. It does make this category challenging to rate, and the only aspects I can consider are the various letters and documents I collected and the Murry’s messages that popped up from time to time (mostly when I died). These were mostly of the cryptic variety and in that way I guess they were quite clever, but they were also conveyed in the same toddler poetry style, with an attempted humour that was only half successful. It was 4 before, so it’s 4 again!
Rating: 4

• Genre Support Award – 5 CAPs – For commenting about an adventure game sale on GOG
• Genre Support Award – 5 CAPs – For commenting about a new adventure game sale on GOG
• Genre Support Award – 20 CAPs – For commenting about a BIG new adventure game sale on Steam
• Gay Disco Award – 10 CAPs – Seriously guys! I really was very curious!
• April Fools Award – 10 CAPs – For fighting giant robots on top of a zeppelin
• Resident Artist Award – 50 CAPs – For completing the artwork for the new PISSED rating characters
• Sponsor Award - 20 CAPs - For sponsoring the blog with free games
• Batman Award – 5 CAPs – Adam West
• LucasArts Closure Award – 10 CAPs – For giving us all the bad news...or is it good news?
• KickstartVenture Award – 10 CAPs – For telling us all about Infamy’s latest venture
• Ransom Stark Award – 20 CAPs – For solving my CyberNET riddle
• Screenshot Screw-Up Award – 5 CAPs – For spotting my screenshot anomaly
• What’s Your Story Award – 20 CAPs – For answering the What’s Your Story questionnaire
• What’s Your Story Award – 20 CAPs – For answering the What’s Your Story questionnaire
• Minor Assistance Award – 5 CAPs – For letting me know that the path through the warehouse is actually in the recording
• Abominable Snowman Award – 10 CAPs – For picking up my reference to both of our childhoods
• Knowledge Award – 10 CAPs – Because he knows that I don’t know, but I really wanted to know what he knows
• Screenshot Assistance Award – 10 CAPs – For letting me know about the “handy” bug in DOSBox 0.74
• Genre Support Award – 5 CAPs – For commenting about an adventure game sale on GOG
• Minor Assistance Award – 5 CAPs – For “reminding” me that I could target other suspects, but I figured it out myself eventually
Failed Bet Award - -10 CAPs – For betting I wouldn’t be able to figure out Tad Timov’s name, but I did
Companion Award – 10 CAPs – For playing along with me
• Failed Bet Award - -10 CAPs – For betting I’d need assistance with the pipe puzzle (which I nearly did)
• Clairvoyant Award - 10 CAPs - For predicting the score I would give the game