Many of these open source packages have commercial add-ons that you can use to enhance the network security. These paid add-ons are usually enhanced versions of the free/open source elements of the servers. (FYI: Companies in the open source field make their money by providing paid support contracts for the free products)

Regardless of the solution you choose, you will want a local or remote computer support person who can effectively leverage the available solutions in your environment. With the open source solutions available today, you can secure your network with little or no recurring cost. This is true with a home or business. Although, as a business network there are probably some add-ons such as company support and commercial anti-virus that you may want to consider adding to the system. The cost of these add-ons if very reasonable though and will help support your open source solutions so they stay around.

I will quickly run through a few of the options in this field, but first, I will define a few terms for the newbies in the group:

Linux of GNU/Linux is an open source user interface sitting on top of the Linux kernal. Linux has grown to be every bit as user friendly as Windows or Mac. ( I believe it is actually better than them both today.)

BSD- is another open source operating system. It is especially known for having very tight security.

Server- A server is basically a central computer responsible for handling network wide functions in an organization or organization sub-group. (or a home now days)

Firewall- Is an appliance device or an specialized server that is controlling traffic going in and out of the network to the internet as a whole.

GUI- Graphic User Interface. This is all the pretty windows you drag around and click now days. It is what is commonly thought of as an operating system by the average person today. Think what you see when you open a Windows XP desktop.

Untangle Firewall-

Untangle is an open source firewall/gateway solution that has paid add-on’s and support. It is the product that I personally use to protect my business network. It is known for having a very pretty user interface–very “Windows-esque”. Their Graphic User Interface (GUI) resembles a rack of servers like you would see in a server room. ( When I look at the graphic rack, I think about the thousands of dollars I would be spending on a rack of hardware for the same purpose.) Their package of solutions for securing (and accelerating) your network spans almost anything that you can think of needing. It works great for intrusion detection, web filtering, captive portal, virus blocking, and handling DHCP/DNS functions. Each of these individual pieces is configurable through an convienient GUI. All in one excellent easy to use platform.

PFsense-

PFsense is based on BSD. BSD is well known for its security as an operating system. This makes BSD a great platform for a firewall/ gateway solution. PFsense has long had the reputation for being a gateway for the super techy user. PFsense actually does have a very useable GUI. There are not as many easy to use features as untangle, so it would require a more skilled user to administer. There is paid support offered. It is pricey however, starting at $600 dollars for 5 hours.

ClearOS-

ClearOS is an open source distribution that focuses on being an all around server for your network. ClearOS doesn’t just handle the security aspects for your network, but it is designed to handle the duties of file server, web server, and mail server. This package has a network of providers trained in implementing there solution. There is also direct support from the company. This distribution is a great contender to replace a Windows Small Business Server.

Amahi-

Amahi is a Linux server based on Fedora. (Fedora is the open test bed for Red Hat Linux) This server is open source. They have done a great job of pulling together a lot of the features that a small office would need in a server. There product manages files, calendars, backups, disk pooling, wiki’s, database management, and disk monitoring. They also include DHCP, DNS, and VPN capabilities. These later capabilities are probably fine for home user, but for the high security environment I would stick with a firewall speciality distribution.

Amahi is also able to easily plug-in additional functionality. Although, not tons of Apps there is a nice assortment. These are nice one click install of additional functions. Of course being Linux and specifically Fedora based you can add further functionality through RPM packages.

This has been a few ideas to get you started in an affordable and secure fashion. I love open source!

For the small practice, cost is no doubt a large factor. Many of the players in the field charge $500 to $1000 dollars per month to secure you data. This is not a reasonable cost for a small practice in my opinion.

In my work with setting up sites for some of these professionals, here are the solutions that I have combined with great effectiveness. I have used LuxSci secure email and forms. In order to maintain HIPAA compliance, I have used Gazzang to encrypt the MySQL databases which allows the data to be encrypted at rest. Of course I am using the tried and true SSL encryption to encrypt the data in transit.

The negative to this approach is it is not a “do-it-yourself” security approach for the average doctor or lawyer. It is going to require you to have a skilled web administrator on board. To be totally effective it is going to require securing computers that you use to access the data.

LuxSci is company that provides a host of services. The two biggest for lawyers and doctors is their email and secure form products. These two pieces are easily (for a skilled web admin) customized for your domain and business needs. Their secure email solution is to the end-user just a different webmail program. All the magic of securing your email happens in the background. LuxSci also has the ability deliver the email securely to mobile devices.

Something that really stood out for me about LuxSci is their customer service. They go above and beyond to make their solution work for you. While securing some very large and complex pdf forms for one counseling practice, I ran into some errors in their form submission environment. This isn’t a negative on them at all, this was some pretty non-standard stuff. They immediately starting working on the issue. It was a problem that required some back end recoding of how the software actually handles data. They were able to very quickly find the bug and fix the code.

If you have done a lot of work around software and hosted web services, you know how unique this ability has become. There are so many platforms out in the market place that are redeploying the code of others and can’t really fix core problems. This company can fix it. I have had other occasions to need their support for issues and I can’t say enough positive things about their customer service.

Gazzang EzNcrypt is the solution I use to encrypt my MySql database. What this solution does is break out specific tables out of your MySQL database that need to be encrypted. These tables are then encrypted utilizing a key on their servers (or yours alternatively). This encryption is transparent to the software needing to access it. The ability to encrypt MySQL databases at rest fills a big piece in being able to use open source software to your needs while still maintaining high security and HIPAA compliance.

While installing the Gazzang solution in my environment, I hit a couple of snags from my own lack of understanding of all the details of the install. (Note that this is a command line install. –that means old fashioned DOS interface like we used in the early 90s. You will need a web admin to do this.) Gazzang was very responsive when I contacted them. In a very brief time I got email responses from one of the design team. He was quickly able to help me though the issues I was having.

I have had follow-up contacts with both of these businesses since I selected them for my needs. I can tell you that both companies are very customer service oriented. Both companies are striving fill a niche with a significant need at an affordable price. I truly wish both companies the best and rapid growth. As a note: I have not been compensated in any way by either company.

From their website: “The software helps you to find largest folders and files on your hard drive.  Get hard disk space consumption report grouped by file size, file types, ownership, file date and attributes.   Quickly drill down to folders consuming most of your hard disk space.”

As soon as the program launches, it asks you which drive you would like to analyze.  Once you pick the drive it quickly analyzes it.  It did my 500GB drive I chose in about 20 seconds.  The program then presents its main work interface.  The primary area is a row of tabs that lets you sort the files by different criteria.

DiskAnalyzer Pro Tabs

You can click any of those tabs to quickly sort/ group files by that criteria.    For instance, you can click file types to quickly see how much storage is being taken up by every file type on your drive (by extension).  Wondering why you have so many rich text files?  Just double click the “rtf” extension folder.  A new window opens called the “File Viewer and Explorer.”  This view list all the rtf files on the drive with the associated metadata.  To the left is a window to quickly sort further by any of the file attributes.  Date searching even has a handy pop-up calendar to assist in choosing the dates you need.  (Very useful when you are lost in programming, and lost your orientation to time and place!!)

File Explorer View

Double-Clicking any of the files in the file viewer will launch the associated program to view the file.  For some of the simpler file types there is the option to launch and internal pre-view within the application.

A very nice feature if you need to report to someone else what is where, is the ability to export an HTML or CSV report of files located.  This is very useful for quick inventories after a data recovery or computer forensics job.  The same can be done with computer forensics software, but it is more time consuming to set up.

I can also see it be very useful for network IT professionals trying to find out what or who is taking up all the space on the server!

Overall, I find this to be a very easy to use and cost-effective utility.

I accepted their offer to evaluate their service for use as back up servers for some of the commercial websites for which I am the system administrator.

To start with their interface is clunky and far from ready for actual commercial use.  It is confusing, lacks useability, help, and documentation.

There customer service was slow and largely unhelpful when I had issues.  They left me feeling that they thought I was stupid because I didn’t know every aspect of their system.

Worst of all is their billing.  They tell you that you are being billed for RAM hours used.  Well their gottcha trick is how they define your RAM hours.  Their claim is that a server that is turned off is using RAM hours.

Well we all know that the whole idea of “cloud” computing is to lower costs because the provider can use the actual physical hardware for another client when you do not have your server on.  Well GoGrid claims that your server is still using RAM when it is off.  If there is still RAM actually alloted to your off server, then that is not cloud computing.  It is FAR cheaper to use a traditional hosting provider than to  pay GoGrid for RAM on your server that is not even running!

I had to request my account to be closed multiple times, before they finally complied.  Requests to refund my money were never fulfilled.

The traditional hosting providers, such as Liquid Web, also provide FAR better customer support at a much lower price.  Liquid Web, for example, provides a much more polished interface for the user.  After this very unfortunate, and personally costly, experience with GoGrid;  I love Liquid Web even more than I did previously.

I hope this review saves other business owners and Tech workers from a costly mistake like mine.

I was happy to learn that the case agents, attorney, and jury were very happy with my testimony.  Everyone told me that I was very clear and did an excellent job of making highly technical material understandable.  Being technically accurate and at the same time understandable, I believe, is one of the greatest challenges to anyone testifying as a computer forensics expert.  Throughout my training I have always tried to ask myself, “How would I explain this to a jury?”

The entire case was a great experience from working with the U.S. Attorney, investigators, criminal defense attorney, and everyone else involved in this case.

I am proud and happy to have accomplished my goal of being recognized as an expert in state and federal court.  I look forward to continuing to learn in this field, and hope I have a long and successful career in it!

I had seriously considered buying a Kindle.  There is absolutely no way I will buy one now.  In my opinion, Amazon just killed their product.

Great move in bad economy Amazon!

Yesterday, in the Rhoden v Rhoden in the 8th Judicial Circuit of Florida I testified as an expert witness in “Computer Forensics and Cybercrime!” 

Since there is not a universally accepted gold standard in computer forensics certifications, testifying as an expert in court is about the only standard that indicates you have entered the top tier of the field. 

I very pleased to have accomplished a goal I set for myself in 2006.  Hopefully this is just the mid-point of great career in computer forensics.

The class is broken up into two segments, which you can purchase seperately.  The first three days is disigned specifically to teach the student how to use X-Ways Forensics.  The last two days is a file systems course.  Since the segments are very different, I will cover them individually.

X-Ways Forensics Course:

If you have read my previous blogs you know I was already a fan of X-Ways Forensics prior to attending the course.  I knew though that there had to be functionality I was missing out on having not attended the training.  I was right!  lol   I of course had learned a lot of the features through use and reading the manual.  There were areas that I had not really explored that I will probably use in every investigation. 

All students are provided with printed training material, digital copy of training material, a computer, and a copy of X-Ways to use during the course.

The class starts out with an overall tour of the user interface and how to navigate in X-Ways Forensics.  Mr. Fleischmann regularly demonstrates that there is multiple ways to do almost everything in X-Ways.  I gained an appreciation for the phrase: How many ways are there to  _______? “X-Ways”  You have to use the “X” to denote the number of ways to do a task because you can’t easily count them all! That is a bit of joke, but whether you prefer context menus, main menus, or keyboard shortcuts there is probably the choice of doing it your preferred way in X-Ways Forensics.  Additionally, along with all those normal ways there are often sorta hidden short-cuts built in to make common tasks faster.  Once you see theses, there location makes great sense.   But they are one on the kinda of things that are hard to pick up on in a manual, but easy to learn when you see someone do it.

While teaching, Mr. Fleischmann shows students through the tasks that he is performing.  After learning a series of features, Mr. Fleischmann has very well planned out exercises that the students execute on their own.  These are very good at reinforcing what you just learned.  After giving you time to practice, Mr. Fleischmann then leads you through the ideal solution to the exercise.

Mr. Fleischmann starts off each day of class with a review of what was learned the day before.  This is another great adult learning teaching method that reinforces learning. 

There were a wide variety of computer examiners in the course.  Everything from private to the biggest name federal LE agencies.  I did not hear one examiner that was not impressed with the software, Mr. Fleischmann, or the training.

File Systems:

The last two days of the five day course, are a class on file systems.  These two days are very fast paced.  If you don’t come into the class with some knowledge of file systems it is probably to fast to comprehend a lot.  That said, if you come in with some knowledge;  you will leave with a lot more.  Mr. Fleischmann has an amazing knowledge of file systems.  He moves through the MFT in NTFS very fluidly.  He explains all the ends and out.  I don’t mean the usual, “this is a journaling file system that maintain individual entries of each file and their location..”  Mr. Fleishman dives into the actual binary code in example after example, breaking down file entries.   Mr. Fleishman also breaks down and explains other important system files like the $logfile.  I have already used information in this portion of the class to find evidence in a couple cases I would have otherwise missed.

Mr. Fleischmann is nothing short of amazing as an instructor.  He is extremely punctual and efficient throughout the class.  There is not a moment of the course that is not well organized.  He is able to intelligently answer almost any computer question that comes up, no matter how trivial it may be. The course is definitely fast paced, though.  Get your rest, because you will need all your focus. 

This was certainly one of the best computer courses I have had the opportunity to attend.  I would highly recommend it to any computer examiner or data recovery technician!

This software has a whole lot of functionality and power “under the hood.”  I have used it in a few cases/recoveries so far. Its results have been most impressive.  For the readers information, my comparrison is to my other software such as Encase, X-ways, R-studio, and an assortment of other data recovery products that I have tested that are targeted at consumers and techs.  Encase and X-ways are obviously much more mature pieces of software with a great deal of emphasis on forensic features.  Most of the “data recovery” software targeted at the consumer market is not very powerful or versatile; and they milk their customers for every dime. (NTFS version, FAT version, CD-ROM version…on and on)  With most of the consumer data recovery products the end user is not getting much for their money in results or functionality.

With CNW Recovery there has been a total departure from the what is the “norm” in consumer data recovery software.  This software is a very powerful piece of data recovery software at reasonable cost.  Currently a 30-day license is only $19.99!  That is a super deal in the data recovery world.

The software actually functions at three different levels.  These descriptions are mine for the reader, not the software authors mind you.

Wizard mode:  This is where the average consumer would work.  The software opens up the a screen that scans your computer for currently existing media.  It asks you to choose what type of media you are working with.  You choose from floppy, hard drive, dd image, cd-rom, flash, DVD, Jazz, or Zip drive.  The software then walks the user through either an extraction of files or creating an image of the drive.  The wizard mode might be somewhat confusing to the computer novice, but if you just trust the software and go through the process it would result in good recovery work.

Manual Mode: The manual mode of the software allows the user to go directly to the various functions.  The major ones are Recover, Partition, Image, View, Properties, and Log.  The recovery mode is where most of the work will be done for data recovery.  This allows the user to use the File Table to recover files.  Partition allows the user to locate the partitions and file tables. Partition also includes the ability to do repair operations on these structures, although I haven’t had the opportunity to test that feature.  View allows the user to see the contents of the drive in a HEX editor sort of view. Properties displays fundamental information about the device.  The log actually provides a print out of all the file names recovered or mapped for recovery including the physical location, parent directory, parent directory location, short file name, and directory path.

This manual mode allows the skilled computer user to do alot of very powerful data recovery.  As far as data recovery work goes, it is very user friendly.

Expert mode:  Although not explicitly a “mode” I wanted to note this usefulness of the program.  Because of how robust the log is in displaying details about the files, if you understand all the data it is delivering the expert can actually jump directly into a hex editor and use the information to start manually carving out the data.

Forensic Edition: CNW is rapidly expanding the features in the forensic side of the software.  While the interface to the data is much different than something like X-ways, it is still very informative.  The logs and pop-ups while scanning the MFT allow a very granular view of the raw data the program in using. This provides for the investigator to have a more in-depth understanding of the data.  While it is not as much of a “point and click” interface, this is actually a good thing for when you are trying to manually validate findings, educate yourself, or prepare for courtroom presentation of the evidence.

Just a couple notes on what I have personally used the program to do with success.

I was able to use the software to carve out previously existing image and videos from an NTFS hard drive.  This resulted in very robust recovery of data.  I compared the recovered data to work done on the same drive with X-ways Forensics.  The recovered data was very consistent.

I used the software in a data recovery job that involved a hard drive with bad sectors, inconsistent reads, and a Master File Table (MFT) that would read very inconsistently due the errors the drive was having.  CNW Recovery was able to read the MFT and retain the MFT information.  I was then able to use CNW Recovery to gather the needed files from the sectors that they mapped to with the MFT.  The recovery was very robust and complete.

A neat feature of CNW Recovery is during recovery work its directory pane maps the directory structure of the drive you are working on, but also shows you the directory structure of the recovery you are working on.  This allows a quick reference to what has been recovered and what still needs to be recovered.

If at any point in using the program you are confused, you can go to the programs manual.  Regardless though, I highly recommend reading this manual if you are interested in data recovery.  The manual is a guide to the software, but CNW has done an awsome job of making their manual an education on data recovery also.  There is a lot of good information within the manual.  It is as beneficial a read as any computer forensic book I have ever purchased.

I can’t say enough positive things about this program, most especially at the current price point!!!  The author has shared with me that he will continue development on the software this year.  I expect the program to be truly amazing with the author’s continued enhancements!

If a consumer is looking for data recovery program, to try a do-it-yourself recovery of data this software would be my first choice.  It is so affordable it is certainly worth trying before seeking out professional data recovery help.

Many families right now are trying to do everything they can to manage their budget. I wanted to pass on some ideas to save a little on the tech side of things. What happens when the families computer has died? (Or has it?) What happens when you can’t afford that home high speed internet and cable any more?  The kids need to do homework, but don’t have Microsoft Office?  Here are some tips in no particular order.

My personal business, along with my “on-duty” time revolves around computers now days.  I am constantly either managing websites, recovering data, or preparing digital evidence for presentation in court.  So, I definitely deal with the ongoing issues of a tech budget.  Here are some ideas and solutions I have found.

1.  Is that old computer really dead?  Most people who come to me complaining about their old computer, aren’t actually complaining about the hardware.  They are complaining about it being ridiculously slow and acting “weird.”  Well this is a complaint about the software and OS (operating system).  Especially if you are running Microsoft Windows this is an inevitable fact of life for most people.  Is it possible to “clean-up” that old computer? Sure.  But, the more time effective thing, and what you will be happier with in the end, is backing up your data, then re-installing the OS.  (Notice I said “back-up.”  Yes, you should be able to do a repair install and not lose your data, but do you want to chance your wife being mad at you forever for losing all of the kids baby pictures?   Unfortunately, many people end up choosing the wrong options and trashing their data.)

Often times now, your manufacturer has a recovery partition that will do the whole reinstall for you, but again, back-up your data first.  To find out how to access the recovery partition, go to your manufacturer’s website.

Another option, if you are running old hardware and want to make it sing, is to install a a compact Linux distribution like Puppy Linux.  That is whole different article though.

2.  I can’t afford or don’t want to spend the money to have cable and high-speed internet any more.  Well, I faced that choice when I recently moved.  I knew there was this thing called digital TV out there now, and I remembered over the air TV when I was a kid with an analog TV—trying to pull in the signal from 70 miles away with rabbit ears and aluminum foil.  Well, I decided to give it a try anyway.  So, I cut the cable when I moved.

Going without cable was a bit of a withdrawal at first.  But, in a short time we adapted to watching all the broadcast digital TV, when we took the time.  The picture is crystal clear and there can be multiple channels “embedded” in what use to be one channel.  For instance there are three PBS channels.

Can’t stand to lose that show you love that is only on cable.  Well, you can download most of those shows through your high speed internet now.  Go check out “hulu.com” or “surfthechannel.com”  (SurftheChannel is a bunch of links to commercial-free TV that I am sure are copyright violations… for anyone who wants to go to China and look into it )

3.  If you need another computer in the house, buy it the smart way.  That is probably not running out to your local retailer.  Although, you might find a good deal on sale or clearance that way.  I would encourage you to check out “newegg.com” and “tigerdirect.com.”  With “newegg.com” especially look out for computers with the free shipping special.  That will save you around $50 dollars on the shipping.

When choosing the computer, be careful to choose one that meet the needs of what you really do with your computer.  If you are playing the latest games on your PC, then sure you need a pretty high end computer.  If you are like most of the population and you surf the internet, check email, and visit web pages… absolutely any PC you buy now will do that very well!!  Also, for a basic computer check out the one with the new Intel Atom processor that uses much less electricity.  After all, most of you already own the Xbox, Wii, or Playstation for games.

Be careful of the Microsoft add-on expenses though.  Getting Microsoft Office can set you back over half the cost of the computer.  There is this thing called “Open Office.” It is open source and completely free.  It will read and write in the Microsoft document formats.  They just released version three, which seems to be very comparable to Microsoft Office 2000.  A lot of people who have Office don’t like the new format anyways (Just ask my wife!).

4.  Depending on what you do on the internet, also consider if you need high-speed internet.  If you just occasionally check your email, or read a news story… good ole’ dial-up still exists and might work for you.  It is less than $10 dollars per month.

Stay tuned for more tech tips.  Hope they give you some ideas or help.