I'm not, that's okay. Okay, what I'd like to do is I'd like to get the slackers up here up into this portion of the chairs. I have got some t-shirts that I'm going to give away. We're going to do a Q&A session and hopefully we're going to have a little bit of fun with this. Everybody looks bored. It's not going to be as bad as you think. Mandatory personal anecdote. Okay, I'm in New Jersey right now. Yeah. So I'm on the plane, right? And we're getting ready to take off and I got two guys behind me and I got the cute girl next to him. And there's a guy over here that looks kind of goofy. And there's another girl next to him, right? So we're waiting to take off and I'm thinking these two don't know each other. These two don't know each other. We're headed to Vegas. There's all kinds of possibilities here, right?  That's when I knew that I had computer geeks behind me. True story. And somewhere I was hoping that there would be a guy here whose face would turn really red. But anyway, so they're behind me and they start talking geek speak. They start talking about XML and security and all this stuff, which like passed a certain point and get kind of tired of it. And then I got a surprise. You know, these guys are all in their 20s. They're clean cut. They seem really driven by what they're doing, which is typical for DEF CON, I think. And then they're going through resumes and the one guy looks at a resume and he says, this guy's got a lot of technical knowledge. And the other guy looks and he says, yeah, I interviewed him, but he doesn't have any business knowledge and he doesn't know what is of value and what is not. And that surprised me. That's what I look for now. I look for what things have value. I think we're in the midst of a change in the industry where we focus on what is a value rather than the mechanics of building things. So that's what our focus is going to be. It's going to be on keeping people employed through the industry because I personally don't believe that the shakeout is over yet. This is my other personal anecdote, which I decided was too egotistical. Why should you listen to me? I don't have a black t-shirt on, so maybe you shouldn't. What we're going to do is we're going to go through and we're going to hit three basic areas. We're going to lay out a couple simple business concepts, which are very common in MBA programs. They're common in large companies. We're going to lay those theories out. We're going to drive them down into a technical implementation that gives us concrete results that we can make decisions from.  We'll test it and we'll see. This is DEF CON. Maybe it won't be radical, maybe nobody will care. But there's some ideas that I think that people can play around with and they might be able to turn them into additional concrete implementations in companies, things like that. Okay, everybody watches the news, right? I took this a month ago and this is already out of date because there's already like a dozen more I could add on here. The layoffs are still going on, people are still being laid off left and right. Crash is not over yet. Historically, industrial revolutions like this have seen a shakeout of approximately 30% of the peak population of the leading technologies. What we've seen in IT right now is about a 15% shakeout. So personally, I think that you're looking at another wave that'll be equivalent to the last four years. How many people here have been laid off or out of work in the last five years? Yeah, and you know what? For every hand that's here, there's a guy that isn't here because he's not in the industry anymore, he got washed out. My goal here is to give people a little bit of knowledge so that they can make decisions that will keep them employed or it will let them make a decision to leave the industry now before they waste a lot of time on it. So either way, if that's the outcome here, I'm happy with either outcome. The time and effort that you put out to learn things is finite. If you learn something that has no value, you're fucked, right?  People are not going to pay you for it. Now, the skew here in DEF CON is a little bit different because you guys are in the security industry and I think you've got a substantially better chance of staying employed over the next four or five years than business. I think business, if you're in business software, I think you're going to be in trouble. IT market changes constantly, everybody knows that. What we're going to look at is we're going to try and focus on what kind of skills that we should be learning to stay employed. How many people know what a meme is? That's good. The first question I got asked when I walked in was what is a meme and I thought, oh my God, I should have put that up. A meme is an idea, it's a mind virus that passes through a population. Typically, if you want to be completely theoretical about it, it starts with a single person, that person talks to two more, those two people talk to four people, four people talk to eight, so it's typically an exponential function. It looks like an exponential function, a hyperbolic curve, until it reaches about the 50% mark of reaching the entire population and then, because you're getting people that already know it, you know, you're talking to people, oh yeah, I already know that, I already know that. It starts tapering down and you get a drop off as you reach market saturation. And that's typically known as an S curve. How many people know the concept of an S curve? Okay, that's good. Here's a picture of it. I start with a single point. It goes through a rapid run up, it reaches the 50% point, and then I reach market saturation. This is a fundamental concept that you can apply in a lot of different situations, a surprising number. And it's and it's simple, if it's a simple concept. Ultimately, this is our goal. We want to eliminate getting into new technologies when they're first introduced because there's a very high failure rate. I don't want to be here. I don't want to be in the high risk area. I don't want to be in the low reward area because that's a technology on its way out and I can't make any money in it. What I want to do is I want to identify an area as it's ramping up but I want to get it before it's at the 50% mark so I can make the most money off of it. Right here, I can make a decision that, yeah, this is probably going to stick around. This is probably going to be a viable technology and I can ride the highest part of the wave off which is the optimum profit point because other people are not paying attention and you're already in the market to sell your services in this. This is a simple concept. Does everybody grasp this? Can I get a show of hands where everybody thinks that this is important? The reason I care about an S curve is it has predictive power into the future. How many people are no calculus? Oh, there you go. So you know this already. As this is ramping up, my rate of change is constantly increasing and I can measure that by doing empirical analysis on certain things and I can see that the saturation is, or the propagation of the meme is rising. Once it reaches the 50% mark where roughly I have 50% of the people know the meme is already propagated, it changes. I reach the inflection point and the rate of change begins decreasing. So if I can measure the rate of change and see that it's increasing, I know that I'm still on the pre-50% mark. Afterwards, I know that I'm after the 50% mark. So this is really what we look for. Look for a rate of change. Okay, peak oil. How many know about peak oil? Oh my god, I'm, now I'm stunned. Okay, just as a quick overview, peak oil is the idea that oil resources are finite in the world and there was a guy named Hubert which in the 50s, he did basically an S-curve analysis at the rate at which they were finding oil drilling holes, you know, that they were making discoveries and he grafted on a chart and he was able to see that in the United States that peak oil production would occur around 1970 and he was, he was right within about a year and he predicted 15 to 20 years before it happened. This is all numbers off the top of my head so I didn't actually expect to talk about this. What is probably very likely going to happen over the next few years is you're going to see peak oil occur worldwide. There's a lot of talk about it. If you do a search on the internet, Google, peak oil, you'll get all kinds of information. Environmentalists have been talking about it for a long time. I'm not an environmentalist but I understand the concept of how Hubert did the analysis and I personally believe that this is very likely to happen. I think you're going to see peak oil happen within the next five years and that will, that's why you see oil prices being driven up. It's because there's a lot of guys like me sitting at companies like JPMorgan and they're doing the same analysis and they're saying peak oil is probably going to happen. We need to get our money into oil now and make money on that. Oil prices at $60, right? Everybody thinks it's speculation? I don't think so. This is why you care. You can make money or you can avoid losing money which is, depends on if you're risk-averse or not. Okay, I'm going to be another, this is another example of an S-curve. How many people know Harry Dent? Yeah, that's not surprising. Harry Dent wrote a book in 1989 which was called The Great Boom Ahead where he predicted that there would be a rapid IT boom which would essentially look like an S-curve and that's exactly what we saw from 1990 to 2000. We saw the entire information technology sector boom hugely beyond it what anybody imagined except Harry Dent did predict it. I don't buy a lot of his other theories. I do believe, he was right. I mean you can't deny that he was right about what he claimed. He made a second prediction in his book which is that there will be a subsequent wave of S-curve technologies which will build upon the infrastructure that was created in the first S-curve. That's where we're at right now. Okay, there's an infrastructure in place, there's networks everywhere, there's wireless networks, there's standards, there's TCP IP, all the all the acronyms, all those things. It's too hard for me to remember. But ultimately, if you want to be looking where you should be, you don't want to be here anymore. This is foundational stuff that's in place, that's standard, it's not interesting to work on. It's maintenance work and it doesn't pay a lot of money and that's why you see a lot of things being outsourced now. It's stuff that's duplicatable that we can send somewhere where there's a different kind of culture that adapts to those kind of things. What you want to be looking for is technologies that build on the existing infrastructure that was created in the last ten years. And I goofed up because I was going to give away a t-shirt if somebody told me what pico oil was and I blew it. OK. Mem minor. This is a little tool that I made, which I've been doing this for about 13 years, and basically it assumes that a frequency count, a word count on the internet is roughly equivalent to an S-curve growth of that technology. That's a big assumption I know. And how many math people do we have in here? Oh thank God. I don't have to worry about all the criticism. You get a ton of criticism. From my standpoint I'm very pragmatic. I don't want to sit down and do a lot of analysis about probability in this and that. I just want a tool, a rough cut tool that will give me a way to make a decision quickly and easily without having to do a lot of analysis and a lot of guessing and things like that. And that's what this does. In my mind I think of it as a data miner that anyone can implement and use in a small business and compete pretty well against large companies that have substantially more resources and better ideology, better methodology of how they do predictions. It's a simple little program. I'll go through and do it. I don't consider, does anybody want to see a demo of it? Do you need to see a Java code of it? But if I do it at the end I don't want to break out of this thing right now. But to me it seems it's really simple. It really is. It took me about four or five days to write it. Anybody could write it with basic programming knowledge. The key to it is the business concepts behind it and the application of those things. Okay. Here's an example of one of the first graphs that I ran after I built the tool. This is the first t-shirt question. Can anybody tell me what this pattern is? What's driving this pattern? That's true. Okay this is a graph made off the keyword of work but can you tell me why it's so rhythmic? People don't talk about work on Saturday and Sunday. It's exactly right so t-shirt. I don't want to take those home. Saturday, Sunday, Monday, Tuesday, Wednesday, Thursday, Friday. And look Wednesday really is the hump day. This is a small example that there really is data that you can extract out of the internet. I use Deja News right now because Deja News, I've used it for several years because it gives me a time history and I don't have to previously know about a concept. Deja News is being recorded all the time so let's say RIS comes along and I'm not paying attention. And a year later I decide oh I should have been paying attention. I want to see what RSS is doing. Deja News has a history that I can go back and I can backfill it. You can see this graph. The dates here is April 2002. I ran this graph two years ago. I was able to backfill it and figure out what was going on. The search engines, I have done pieces to do the same kind of analysis against the search engines, against Google, against Yahoo, a couple of the others, but they're very highly skewed to the present. You can recreate, you can make a crude approximation of the same data that you can get out of Deja News, but it's much less granular and it's just, you got to do a manipulation, it's really goofy. The search engines are very highly skewed to the present. You can't backfill data without doing a lot of analysis for more than 90 days or maybe a year. That's another key, using Deja News. Using some kind of pre-recorded data that had no knowledge of the fact that a trend was going on. Here's Easter Bunny, same thing. You can see every year, long comes Easter, people talk about Easter Bunny, right? The data is there, waiting to be pulled out. You just have to know how to do it. Here's Comdex. Now Comdex got canceled in 2004, right? Actually, this isn't my new graph. Comdex got canceled right here. If I had had this graph last year, like I did, is there any doubt in my mind that Comdex is going to get canceled? There's not a lot of doubt. It was a predictable event. The fact that it got canceled in 2005, same thing, a predictable event. You could have made money on it if you go into the bookies and said, I think Comdex is going to be canceled. Very clear trend starting right here. Each success of high is lower. Does anybody do technical analysis of stocks? This is a very, very similar analogy. Each success of high never reaches the previous high, so we're clearly in a downtrend. Now here's a graph. I went back later.  I went back and I retrofitted stuff on here and I did keyword searches against stock prices of the bubble. The green is the stock price of Siebel. The blue is the frequency word count out of Deja News at the same time period and what I did was I matched the amplitudes. You can see there's a, for Siebel there's a very tight correlation. I mean this is like a 90, you know, for the statistical people this is close to a 90% correlation. Now in this particular example the word count does lag the actuality, so maybe it doesn't help you so much, but that's not always the case. Let's take a look at Palladium. Now this is the one I really wish I had done in 2000. You can see clearly that there are rumors about Palladium's price spiking almost two years before it actually happens. Okay, right here. Although if you really want to get technical and start, drive it back you can say that maybe this was the peak, but that's still a year. A year before Platinum peaked it was, you could have figured out that there was a good chance that Platinum was going to spike. And also if you take a look that when Platinum collapses the key word told you that it was going to collapse before it happened almost a year ahead of time. That's money. There's money right there. There are large companies that are doing all this analysis right now.  I'm not really a large corporation guy, but there are guys in those corporations right now that are doing this and they understand all these concepts and they've been piling on to the internet over the last five years and what they've done is they've cut the margin of where you can make the money. The latency is shrinking over the last four or five years. This is a very high latency a year. That's amazing to me. If you look at some of the later graphs that happened two or three years later, the latency is shrunk to like three months, four months, things like that. Sometimes it's down to like a month. Here's another example. Applied materials. There was a latency. Applied materials was clearly in an uptrend years before the price spiked and the keyword count told you that it was collapsing before the stock collapsed by about a quarter and if you look right here you can see that now the latency has disappeared out of it. There's a latency here in 2000 and as we go along right about here now there's no latency anymore. That's an excellent question. I've got a couple of the graphs that will show that it's very hard to determine and that's where there really is. There is no money to be made in mechanical skills. You can't make money in those things, especially in a global market. You have to move into something that requires some kind of artistic ability and this particular mechanism right here does require a fair amount of interpretation and analysis that sometimes you're on. I mean it's just the way it goes. In the case of palladium there were rumors flowing out of Russia that they were having problems and that they weren't going to make deliveries. So in that case it was the lack of metal that drove the price spike. But you're absolutely right. There are cases where the rumor precedes and sometimes you know I'm not so sure that there isn't guys at some of the companies that are actually spiking the internet now in order to create a create a artificial demand in order to you know offload their stock or whatever it is. So that's something you got to be careful of. I didn't run Enron. I didn't I didn't have any interest in Enron. I just looked at the dot-com boom. But you're more than happy if you want the source code you're more than happy to run Enron. Okay J Builder. How many programmers do we have in here? How many J Builder programmers? Ah interesting. This is all very low. You guys are all assembly low-level right? What kind of what kind of languages do we have in here? Well J Builder that's okay. This is a graph of J Builder and it basically you can see an S curve right here. The inflection point is roughly right here and typically what you see at the inflection point your rate of change is infinite. As you're switching over from a rising to a falling rate of change there's a spike there of infinite demand theoretically. And you can see it reflected in this graph very clearly. There's a huge spike right at the time that J Builder is undergoing its inflection point. And by about this time right here you should have been out of J Builder and you should have been doing something else. Although it's only been in the past year that it finally came to fruition. So there was a lack time about two years before J Builder finally died off and and Borland had to admit it. No you have to you have to have a you have to have a a keyword that has uniqueness. Well you have to do qualifiers. You have to do qualifiers. And I've got a couple of the graphs in there further on where we'll see that like cold fusion. Cold fusion is a perfect one. I ran a graph on cold fusion because I saw an article on it and there there is some evidence to support that cold fusion is real. So I ran a graph and I got this really strange graph that didn't make any sense to me. And about three days later after I published it I found out oh right it's cold fusion the programming language.  So what I did for that graph was I added a new qualifier cold fusion physics. And that gave me a much better picture of what was really going on. So yeah there is you've got to be careful about keyword picks which I have a little bit later on. Delphi. Now this is a real life example of something that I did in my own life. I got into Delphi around 95. I did programming on it. I wrote the wave up. And about 98 it was clear to me that this peak was over and I needed to do something different. So right in here I started learning Java. I went to Sun's conference. I started learning a whole different ideology methodology of the way I did programs. And I switched over here and I missed I missed the crash. There's a lot of Delphi programs. Delphi is extremely good language. I like it a lot. It's the best thing I ever used. I can't make money in it anymore. And there's a lot of ex Delphi programmers that found that out the hard way. This for some reason I put this up and this is like the single most read graph on my site. The guys are just fanatical about scripting languages. It's very strange. Here you see Pearl. Very clear rise. Very clear fall. You should have got out of it right around here. Maybe. Maybe you should have. PHP. Same thing. Rises. Inflection points are roughly out here. Like it's not a true S-curve. It's not identical. But in real life that never happens because you get all kinds of variations. You just have to kind of estimate between peak and fall. And then Python and Ruby. Python from this doesn't show enough detail. But Python to me is the choice out of these four. If you were going to have to do a project right now. I would choose Python assuming I could fit it into the requirements of the project. I mean you always get languages that fit a certain set of things. And you can't just choose a language in order to boost your employability. You have to look at what you're doing for the customer. There's also a very interesting thing that happens in the past year. In that all scripting languages have suddenly got a high level of interest out of nowhere. And I don't know what drives that. Ymax. How many people know Ymax? Ymax is going to be big. I believe Ymax is going to be a big technology. Ymax basically replaces 802.11b with the same. Imagine 802.11b with a 30 mile range. And also I think you guys can correct me. I'm far from perfect. You can correct me if I'm wrong. But I believe that Ymax already has permission to be able to tap into cell phone networks. So you're going to see a huge amount of grass roots competition against the major wireless carriers from people setting up their own shops in Ymax. I can easily imagine someone getting a few million dollars of capital dumping a few Ymax things in the center of maybe 30 cities and just cutting the hell out of Verizon's market or Singular's market blogs. This is an interesting one. This is a little bit more. This is a question. This is a t-shirt question. Let's see pretty clearly here. This is the moving average. You got to do a moving average. There's too many spikes that happen on the internet. Too many word nuances. But basically by looking at a moving average you can get an idea. And we can see the blogs are clearly rising since 2002. And it was probably a good technology to get on around January 2004 which a lot of people did, right? Did anybody read the article that was in USA today or one of the major papers about two months ago where they said that 27 percent of the public does not know what a blog is. Did anybody read that? Now tie those two numbers together. I have an inflection graph here, right? It hasn't reached the peak point yet. I know it's an exponential function and I know that 27 percent of the people have not been exposed to the meme yet. What kind of thing can I derive from that? I can make a prediction from that. T-shirt. Anybody that can tell me gets a t-shirt. Anybody that makes a good guess gets a t-shirt. On the calculus path that's too much thought for me. I took what I needed from them and I threw the rest away. Anybody else down there? Black. Black shirt. It's going to peak within the next year. T-shirt. Yeah. Yeah, it's not going to be a big moneymaker. And what you'll see is you'll see a lot of, you'll see a lot of hysteria in the media over the next year and then that'll be it. It'll have peaked and it will be ramping down. That doesn't mean you can't make money in it. All it is is an indicator. There are technologies that have peaked that you can still make money in. I don't want to, I don't want to, I don't, that's one thing I don't want to tell you is that if it goes through an inflection point and it peaks that you can't make money in it anymore, it's an indicator that, it's a warning indicator that tells you you need to look at the surroundings, you need to look at your competition, you need to look at your skill set and make a knowledgeable decision about what you're going to do. You can make money in post, like J2EE. I don't know, probably nobody here's read my site. I put a controversial article out about three months ago that got a lot of Java people riled up which basically says that J2EE is about to go through its inflection point. That it's peaked out as a technology. I have no, I have no interest in moving on to another technology right now because I still make money in it and I'll probably write it for three or four more years. But if I were an entry-level person getting into the market, I don't think I would choose J2EE because there's already going to be a bunch of guys like me that have experience and knowledge that are going to compete against you and the market isn't expanding anymore. Now it's time for the halftime here. How many people think so far that this has been more interesting than you thought it would be? Ah, that's so gratifying. I mean I kind of took this as a lark. I sent in the, I sent in like a basic program, you know, basic speech. It's people that have looked on on the disk realize now that it's like about like one-third of what I'm doing right now. It was like a perfunctory effort and then I decided a couple days ago while I really need to do something serious on this. So that's nice. That's that's what was my aim was to get to have people interested and have some kind of value out of this presentation. Wi-Fi phone. How many people know Wi-Fi phone? That's another big one. It's going to be tied into Wi-Max I think. Okay, so we already talked about this. Infliction point tends to be at about the 50% saturation point. That's not always true. That's just a rule of thumb. It's very easy to get. We'll, and we'll look at another graph here later on where you get a quick ramp up, but the infrastructure is not in place to support a technology. There's two technologies that tried to go through inflection points. They tried to go through a growth phase and the support just wasn't there. One of them is Bluetooth. I was here two years ago and there was a lot of Bluetooth for, for a verb. There was a lot of Bluetooth hacking, things like that. So I went back and I did a, I did a graph on Bluetooth and I was surprised to see that Bluetooth tried to take off three or four years ago and it died out because there wasn't, there wasn't a critical mass to make it go. And then within the last two years it's picked up a lot. So a lot of times you'll see new technology sputter and try and start and then they'll die out because there's some missing factor there. Service-oriented architecture is another one. It came out around 2000, 2001, the buzzword, all that. And it tried to take off and it died. But for the past 17 or 18 months it's been rising steadily. It's now something that organizations either understand and feel that they need or there's, there's some critical component there that makes it viable. We already did the blogging. RSS feeds. This is very highly correlated to blogs. Same difference. By doing a search on, and you can see here I used a qualifier. RSS, RDF. I don't know if everybody can see that or not. People in back probably can't. So I used a qualified word here because RSS wasn't a good search. And now we're going to talk about the problems with this. The biggest single problem that I run into is that I'm part of the meme, right? How do I know to search for something? How do I know about RSS? I read it in an article. I'm part of the meme propagation and statistically I will learn about the meme at about the 50% mark which means I can't make any money in it. Right? So I got to figure out a way to track the meme before it gets to the 50% mark. I don't want to be like everybody else and be the average. So that's one problem with the methodology I'm using right now. What it requires is me to be reading articles all the time. I have to spend a lot of time trying to be at the forefront of technology when there are easier ways to do it. It is subject to manipulation, although not anywhere near as much as you would think. When you do a search off Deja News you're doing a search against hundreds of thousands and millions of people. It's very hard to inject a meme and create an artificial result I know because I've tried. It's not statistically rigorous. There's a lot of criticism from people that are mathematicians. I've heard a lot of criticism about it and it is kind of flaky. But it's worked well for me for 13 years. It's helped me make a lot of decisions where I could have easily gone off onto a bad path and ended up in another industry. Maybe that would be good, maybe that would be bad, but that's not the path I chose. It works very well for technical trends. It does not work as well for social trends. It doesn't work for things that have lifetimes of 20 years or 30 years. It works very well for a range of four to five years and we'll look at why in a few minutes. If I were going to if I were serious about using this as a technology to drive my company and make decisions with I would throw away the current methodology of using Deja News. I would start capturing RSS feeds and I would build my own database and that will allow me to capture trends as they happen in real time and I guarantee you that there's people out there right now that are doing it. I did it. I wrote a little piece about six months ago. It has some technical problems but they're easily you could easily get around them. You can if you spend enough time on it. I just I have a lot of the things to do but there is a lot of value to be done in applying this methodology to pulling down real-time RSS feeds, building a database and looking at rates of change that are happening in keywords. I believe there's a lot of value there. We already talked about skewing factor. One of the problems is you lose abstract relationships with the way you store the RSS. There's some things there but they can be gotten around. Okay so now we did we did the business process. We did a tactical implementation that gives us real decision-making tools. Now what we're going to do is we're going to push this back up into a strategic framework that will let us make decisions about more than just about what technology I choose and this I admit this is going to be kind of flaky. One of the big justifications for Moore's law. People like to quote Moore's law. Everybody knows Moore's law right? How many people don't know Moore's law? It's a trade-off. I can't let Moore's law go. It gets quoted a lot because it's used as a justification that the number of transitions will double every year so there will always be an IT industry that will continue booming and I would agree with that if there were no other factors. People have a finite amount of time and effort to spend on anything. Geeks, techno geeks don't like to they like technical things. They like trends.  They will spend time on things that they enjoy or things that they're forced to do. Other things they will throw away in favor of things that they enjoy or things that they're forced to do. And this is part of the reason why the Memminer works off of Deja News. People talk about things that they enjoy or that they're forced to do. For the average person they spend their time sleeping, working. I'm glad I got a laugh, that's good. Shopping, eating, having sex. The range of that variance is not a lot from person to person, on average. So if I want somebody to read the internet two hours a day and I get a certain level of growth now to double that I got to have them read the internet four hours a day it's not going to happen. They got other things they want to go do. They want to go eat, they want to go have sex, they want to go visit Las Vegas. So there is a fundamental limiting factor in the growth of the internet based on what people's time is. There's other factors on top of that but now for some people you do get a wide variance. For instance, but I don't think we're going to see a society that looks like this. Now we're going to look at Deja News again and what we're going to do is we're going to invert. What I was looking for was uniqueness right? What we're going to look for now is the ether of Deja News. We're going to look for the rate of growth of Deja News abstracted of all uniqueness. What I'm going to do is I'm going to use keywords that have no identifying ability that are used in anything anytime. This have one all them will other. That comes out of the top number three people that do like a crypto analysis ETAONRISHD right? That's what you do a frequency analysis to be able to crack codes that are not well done. Well you can do the same thing with keywords. The top what I did was I went through the top 100 keywords and I picked out ones that were fairly generic and then I did a search and you can see very clearly exponential growth in Deja News. This is one reason why the trend the mem minor works is because over any small period like from here to here it looks linear. Okay there's not skew being introduced by Deja News into the uniqueness of a meme. There's a little bit but not enough to matter. Okay so this is what the ether of Deja News looks like. The transport. If you do a really detailed search you can pick out events that cause excitement on the internet. JFA and these these are admittedly I guessed at them. I think I'm right on most of them. JFK crashed a lot of people can't see this but there's a spike right here. Y2K causes a spike. There's a spike here I didn't hunt down. Bush election 2000 that definitely caused a controversy. 9-11 causes a big spike. What's interesting about 9-11 is that if you do keyword searches on other terms you get spikes if you look for death around that time period you get a spike. If you look for peace you get a spike. What you don't get a spike in okay remember we're talking about people have finite bandwidth right. They're using more bandwidth to talk about 9-11. They're using more bandwidth to talk about death. They're using more bandwidth to talk about peace. What is being cut out of the equation to free up that bandwidth for those things. Can anybody give me an idea or a guess. It took me weeks to figure this out. No there's well there's a particular thing that it cuts into and I think it'll make sense to everybody once they hear. No. Work who said work. T-shirt. Work goes down and I remember 9-11 what did I do on 9-11. We all sat around talking we didn't do any work. Now here's the bad news. DJ News gets very flaky after 2004 and the years old. I got a couple theories about it. I have three theories about it. One is the shift of blogging clearly. But people were using DJ News for they now use blogging for. But that does not account for the rate of change that you see here. This is almost instantaneous. You see the running the moving average here. But the actual numbers it changes within like two months and I know that's not happening. Blogging is taking away chunks. Google changes their methodology. There's just search methodology. If I go back and I run a query two or three months later it changes. They're doing subtle shifts in the way they do things and it shows up. And I do think that there's some kind of air in the way that they're they're manipulating or accounting for things after 2004. But I think a lot of what you're seeing is the inflection point in the Internet itself. If you read enough articles you see a couple articles came up in the past year or two that talk about a slowing rate of growth in the Internet. I think that that's what you're seeing. I think you're seeing a slowing rate of growth in the Internet. And it will impact all the other industries that are associated with that. Mostly consumer related industries. Chip industry, business software. It won't affect niche markets so much. And it probably won't affect security very much. And now we're going to take a look at a couple of concepts. To make strategic decisions about how you're going to spend your resources. Very abstract concept. What caused the IT boom? If I were to create a market basket of all the items that create a cost of how I get information. Chips cost me money. People cost me money. I have to develop methodologies. There's a lot of communications costs. I could create a market basket of the cost of information. Assign it to a unit of information and I would be able to get a rough number that each unit of information cost me a certain amount of money. Now up until 2000 everybody was making money, right? That's because I have a price of information. I'm selling that information to somebody somewhere and I'm making a profit margin on it. As we get down to 2000, cost of information is not decreasing like it used to. And companies that are used to this curve, you know, they get into this mindset of seeing this, they overran it and they went into debt and they went out of business. Some companies veered off to the side and adapted and survived. But ultimately, if the cost of information stops falling, there are fundamental changes in the marketplace that companies are going to have to adapt to. And ultimately what you have to do, because market forces force you to adapt to a pricing model that the public sets or governments, you have to find some way to drop your cost of information. And that's why you see outsourcing over the last three or four years. Companies have to. They have no choice. Otherwise, they'll go out of business because there is a ceiling on what they can charge. That's a very strategic concept. It's not, it sets a stage. You can't do anything with it directly. It's not a tool. And this is another picture that shows you roughly the same thing from an economic standpoint. As a market matures, your marginal cost of processing stuff rises, your marginal return falls, you eventually reach a point where there's no profit margin as you pick off all the easy things. What that means is that there's money in hard things. And same difference. Now, this is a theory of my own just from watching the market. Watching the IT market for the last 10 or 15 years, the market rewarded diversity. As I created programs that did more and more stuff like Word. It does all the bells and whistles and stuff. I got a bigger and bigger share of the market and people bought my product. But once I reached the point, the inflection point, the inflection point punishes diversity and it rewards cost cutting. And that's the point that we're at right now for consumer related industries. Like I said, there are niche markets that don't get impacted this way right now. So from my standpoint, this is what I see. I see the upcycle of favoring diversity and everyone pursuing that and they get into a mindset over the last 20 years that diversity, diversity, diversity, I want to create a diverse product and get as much market share as possible. We've seen a fundamental change around 2000, which now punishes diversity and rewards cost. And most people's minds are still in this state. No, no, I don't know if I should go into this or not. There's, this is the single most read picture on my site. And it surprised me a little bit. In a nutshell, in a nutshell, diversity functions on context that are mismatched. If I had two clones and they had identical information sets, they know the exact same information and they've had the exact same experiences, their communications and teamwork will be perfect. There will be no miscommunications, correct? As those clones have different life experiences, their context will shift apart and there will be a set in the middle that they share, but there will be unique features that they each have and then you'll start getting miscommunications. If I wanted to cut my cost of information in teamwork or software development, what I would do is I would try to get contexts to be as matched as possible within a team framework. Like I said, this is very high level and there's some other things I played around with it, but I put it in there just to maybe get people thinking about ways that they could drive their teams or their software development towards a competitive methodology and what you have to focus on is reducing transaction costs internally in your organization. There's a couple of other things here. I'm sitting in a microbrewery and I realized, wow, microbreweries are a lot like the software industry in certain ways. The company that I work for right now basically resells IBM software, but what we do is we tweak it to a very minimum level, five or ten percent, and match it to that set of customers that are willing to deal with changing their business processes to map to what the software does. And that's a very, that's an efficient model that I think can last over time. I don't think a lot of custom, very customized software, it's going to have a very hard time surviving in business software over the next ten years. And we'll let that go. I'll go ahead and I'll take some questions. The question is, do I think that the difference between the dichotomy between diversity and cost cutting is driving some of the open source movement? I don't know. I don't, I've looked at the open source movement and I still honestly don't have an opinion about it one way or the other. I can't, I can't get a reading on it out of the graphs that I've run. I can't speak to it one way or the other. I haven't done any analysis of that, but I would say companies that are doing Six Sigma are probably, unless they're in, unless they're in like a financial industry, I think they're probably at a competitive disadvantage. I think they're producing quality that the market isn't going to reward. That's a guess off the top of my head. Yeah, you can use the search engines. You can get a lot of the same data out of Google. It comes out in a different format and you got to massage it and you got to work with it and it's very crude. It doesn't give you the same detail, but yeah, you can pull it out of other sources. I used to use Monster. I used to run queries against Monster. I used to use Dice. I used to use Miscellaneous Jobs News Group for people that remember that far back. Oh, I haven't done anything on security because that's not my field. One more. A lot of what you just saw, not in so much detail. There's more, there's more business here than I, than I have on my website because I haven't updated for a while. There's a lot more graphs that show you more detail in different industries like religion. I did some queries on religion, social trends, things like that. So you can get an idea of different things and actually I did mean to bring that up and I'm almost, I'm not out of time yet, but we can look at a couple of those real quick, or maybe not. There's no doubt in my mind after watching what's going on in the marketplace. There are very smart, there are a lot of people that are smarter than me. An MBA program teaches all the things. I haven't been through MBA. I did a little bit of an MBA, but they teach you these kind of concepts and there are guys out there that are applying them. I have no doubts. You can see it, you can see it in the way the information has been changing over the last five years. There's someone that's taken a chunk, they're taking a slice of the profit margin out of it. Let's see what can we look at? Oh, here's saving J2E. If you go through here you can see that J2E looks a lot like it's topping out. Yeah, these are good right here, Republicans. Does anybody care about the federal deficit? You bet people care whether the media tells you they care or not. It's being talked about a lot. Trade deficit. Does anybody care about the trade deficit? Media doesn't talk about it, but people are talking about it. You can get a lot of interesting information that runs counter to what the media is telling you. As a closing comment I'll tell you that when you see Alan Greenspan talking on TV, don't listen to his words anymore. Watch the beads of perspiration on his forehead. That's what matters. And that's it. I got two more t-shirts up here. Two more t-shirts if people want to nab them at a time. Do I have like two more minutes? Real meme, R-E-A-L-M-E-M-E. Yeah, yeah, that's what I'm doing right now. I'm going to run it. I got like a minute. It's a very simple program. Send me email and I'll send you the base to it. I'm not going to support it because it's got a couple bugs in it that I work around because I don't want to spend time on it, but we'll run one real quick here that might be funny. No, I think there's profit. I think ultimately what you're going to be driven into is, at least in the United States, I think you're going to be driven into niche markets. I mean, that in a single phrase. Niche markets that are supported by small industries that have high profit margins that are willing to pay for some level of customized software development. But that's going to be, that's a trend that's going to run over, I think, five to ten years. It's hard to say. I do think, for anybody that cares there, I do think J2E is peaked. And if I were in the market, I don't think I would put any effort into trying to learn J2E as an enterprise system. I think there's alternatives that are on the horizon. I think your time would be better spent in other things that are built upon the infrastructure of the existing S-curve that's already run. Okay. Like, oh, I was going to mention Newbridge, the Newbridge, the Newberry guys in there, the Newberry guys in there that are running that tracker, that wireless tracker. That's an example of a technology that's built on a foundation that's been built over the last ten years. That's the kind of thing I would look at. I look for it. I mean, I see it comes up in different places in different ways and it's just, it's intuitive. It's from seeing it so often. I know that it happens around 2004, 2005. I'm really sorry here. One more minute. Well, if I have a good net connection and I'm running it threaded, probably 20, 30 seconds. Yeah, I have done run RFID and that's all my sight. It's in an uptrend. It's in a pre-inflection state. It's definitely worth putting money into. That's a whole another session. That's a political session. Oh, I don't blame you. Anyway, here's Paris Hilton. She can see. She's still, she still got some life there. I'm surprised. I didn't expect it. Okay. Thank you.


So I don't want to waste your time at all. We've got about 60 slides and if we can get through those, I've got some additional materials. So I'm going to fill up this time. I'm very comfortable with this material. So please feel free to ask questions at any point, short questions, and it may take some effort to get my attention. But so if you stand up and wave your arms, I'd be happy to, you know, take your comments. And actually, I'd probably be more interested in those in these materials because I've already seen this. So I really would value your feedback. So anyway, what we want to get down to is internals of event logging on Vista. And there's some radical changes in both the component architecture and the encodings. And that's really what we want to talk about. And the process, we want to kind of put things in perspective. And all of this relates not just to forensics, but one of the central issues of doing forensics is interpreting. This is mostly static analysis, but interpreting what has gone on from the system from artifacts that you can recover. And that depends in large part on your ability to interpret the data. And so understanding how the system works and what the encodings mean is something that's shared with a lot of other disciplines. So this relates to a lot of, you know, all the other areas of security. And in the same way it borrows from all the knowledge that you might use in those other areas. So it's all tied together. So that's kind of, that's a little bit of perspective. I'm going to back up and give you an introduction now. This is my sponsor who paid my travel costs. They are a forensics and data recovery service company in Houston. So they also do technology consulting. And just so you know, this is not legal advice. We're not going to talk that much about the law here, but in case we do mention something about how the law applies. And we do do expert testimony, but this is not that. I want to recognize a couple of people who've helped us over the years. Cesar and MB5 of the ghetto hackers. All the guys from Houston, HTMapathy who are here. And have been going to DEF CON for years saying, man, when we get back to Houston, we're going to get together a team. And they're beginning to do that. DarkTangent for making this conference, which is the best among all the others, happened and Fednaughty who I really should be over at Capture the Flag with right now. And thanks to Geraldine Martis at ACS, who's been an excellent technical editor. Josh Pinnell at IOActive. And Matthew Geiger at CERT, who helped me decide to begin some of this research. And one of the guys with HTMapathy who isn't here this year because he's over in the Middle East. So we miss him and he misses us. And this doc has dedicated to him. So this stuff may be skewed slightly because of my perspective. And I tend to look at everything as research and development. My background is a PhD in EE. I was on the faculty of a medical school for a while. So I did research, went into industry.com boom with a security management company. And still want to keep my hand in the game in terms of understanding the field. And the way you do that is through services. So I'm doing forensics with applied cognitive solutions. Along the way, I've also written some free software. GNU graphics. I'm a contributing author to asterisk. I was on the free BSD core team and the X-Free 86 core team. So those are the kinds of things I do. So I look at a lot of these issues, problems as a question of understanding the mechanisms and writing new tools to automate the processes. So I want to talk for just a minute about how to catch up. We're going to talk about things that are not in print yet. But if you want to get a handle on these kinds of processes and tasks, this is the body of literature you might look at to try and get a handle on forensics and log forensics in particular. So one of the leading certification in the field is in case. And they have a study guide which will take you, it's probably the best book out there, although 10% of it is mostly errors. But it's the best book to teach you kind of a survey of all the kinds of tasks that you might do for static analysis of a hard drive. There are some newer books. The one on the bottom left is by Bunting as well, Mastering Windows Network Forensics and Investigation. And it talks more about Windows artifacts, all the different kinds of file formats that you might analyze. Still a newer book is Windows for Incident Recovery by Harlan Carvey. And it goes beyond these other tools because it uses Perl to add new capabilities to extracting data and automating things. So those two books are probably the most recent that you can find on this kind of work. Along with that, there's some more specific material on Windows event logging, but it's for older versions of the operating system. But it will tell you about things that are backward compatible and still valid on Vista. And finally, if you want to find out where the field is going, there's a really good journal that's three or four years old called Digital Investigation. So those are the materials you might look at to catch up on what's going on and what digital investigation get ahead. Stephen Bunting has a website where he's published some materials about recovering event logs. So there are various levels with which you might recover event log information, intact files in the file system, data carving, whole files, recovering fragments. And this is some of the most recent information on manual methods. I mentioned Harlan Carvey's books. He covers a lot of different artifacts that the other books don't cover and how to write scripts, mostly Perl, to parse the data and analyze it. And probably there's more about event logging in Bunting's book, Bunting's more recent book. But when they get to the question of log repair, so if you recover logs and they're not intact, they say there are no methods for doing the repair. And that's what this talk is about, understanding the encodings and figuring how to go farther with extracting the data and analyzing it. So we're kind of at the edge of what is published. And the new work, there's some new work that is coming out in Digital Investigation. In fact, I have a paper coming out in two weeks that is on Windows XP. And that's one of the reasons I'm not going to talk about XP today because I can't talk about it for another two weeks. And I'm not going to talk about automation either. So if you want to know about some automated methods to do what we're going to talk about, that paper is available. You can give me your email address or send me an email and I can send it to you. Okay, so back to our outline. We're going to talk about event log analysis from the perspective of a case study. And this is representative of the kinds of work that our company does for intellectual property disputes. And so this will provide us some motivation for what kind of questions we're trying to answer and what we're trying to get out of the analysis. And then as a part of that, that's going to motivate us to extend the capabilities or go beyond the limitations of the current tools and then at the end put it together and see how that impacts the kinds of answers we can come up with. So let's look at a typical process for an engagement. We can break it down into three phases in terms of how we interact with the customer. We do civil only. We're mostly dealing with corporations who demand a certain amount of control and estimates for work. So very often we'll begin the engagement with an estimate of work that tells them what kind of things that we know we can do without having any information about what's in the data in advance. So we'll provide a preliminary scope of work and it'll tell them what's feasible, what we know we can do with the tools, what we can do quickly, and generally it will provide them a preliminary report. And almost always in the preliminary report there are some surprises. You find out, you know, because there are so many levels of methods for recovery and varying amounts of effort that go with it, it depends on what you find in the data as to how much effort it's going to take to tie all the pieces together. So there are almost always surprises and the trick is to come up with ways to go from step two to a final report in a way that's going to be feasible. The final report should provide some kind of in-depth coverage. So you want to be able to say, well, there was one indication that X happened, but you want to also be able to say something about whether the rest of the 100 gigabytes or so or whatever of data for, say, an individual machine doesn't indicate that there aren't, it couldn't be explained in another way. So you want to have enough coverage that a single item indicates something clearly or not. And you may need to adapt the methods to do that. So typically you're going to be contacted by a corporate officer. Something bad has happened, business interference, possible contract violation, and very often what we deal with is proprietary information going out and being used by someone in violation of, you know, agreements. And very often it's former employees who had used that information as a part of their job, part of their role as what they did for the company. So it's not enough to show that they had the information. But you want to be able to distinguish whether someone took the information out in a specific kind of way at a specific time and discriminate between things that were part of their job and should have been and things that weren't. So the first task is to find a scope of work. What kinds of things can we identify where we could show outgoing file transfer? We can examine hard drives. That's the most typical thing we do. We can look for e-mail attachments, e-mail going out, uploads, file transfers, and there are various other kinds of things that you can do. Ways that the information could be transferred out. So let's consider a typical preliminary report. We look at the hard drive, and the client may have told us things to look for. They may have told us key words that would appear in their proprietary documents or information, names of products, names of services. So you look at a hard drive image. By golly, you see a name for a document that is exactly what they were looking for. It's proprietary information there, and it's got a decoll in. It looks like an external drive, not the system partition, but it's in an unallocated space. This means that at first glance, we may not know what this piece of data means other than the fact that it seems to appear referred to an external drive. Furthermore, there's some bad news. The reason it's in unallocated space is we find out that IT deleted their user profile after the employee left, and then they gave the laptop to a new employee, which kind of complicates forensics and terms of attributing this to the next person, differentiating between the next person that was in position of the laptop. And this was six months ago. I had it for six months. And then on top of that, they had reformatted. That's... And then they reinstalled. Okay? So this makes it really interesting. So what do we know? We've got in our preliminary report, we know we've got a document in unallocated space. So we look at the surrounding data, just as ASCII text or HEX, and it looks like a shortcut. Shortcuts have a certain structure and a certain signature at the beginning of the file that we can recognize. So it looks sort of like a shortcut. And shortcuts are useful because they contain a snapshot of the thing that they refer to. So they're kind of like a soft link. They point to something, but on Windows they also take a snapshot of time stamps. They take a snapshot of the volume label of the device that it refers to. They take a snapshot of the volume ID, serial number for the volume. So they've got a bunch of stuff that could be unique to whatever device held that document of interest. So here we know we've got something interesting. We've got kind of a lead on an indication that there may be something here that would be of use to the client. We want to identify outgoing file transfer. How do we do it? When we know that everything, the file system has been overwritten, the original file system has been overwritten. So some of the things that we can do, or we can data carve for various things that hold paths, file paths and time, like shortcuts. And then we can look for things that would have time stamps that might correlate with that. And there are a number of things that are going to contain a wealth of time stamps, things like event logs, the time stamp events, internet history, which is generated both by the browser and all kinds of applications. And we mentioned shortcuts. Okay, so now that we know, we know what we need to do. We need to recover all these kinds of information. And we know that it's not available through the file system. We're going to have to go carve it out. This gives us the motivation to understand the encodings and how the system works. Understanding the encodings that allows you to extract the data, understanding how the system works and allows you to interpret what you've extracted. So we want to know something about how these stores log events and how the logging system works and what the events mean. So the process for doing that can be, there's a bunch of process models in the literature, and this is one view of them that you might extract the data, extract records, extract fields from records, analyze them, and then reconstruct what was going on in terms of and interpret what those records mean. And we're going to look principally at the first part of this, where we recover logs and events, and then they may or may not be valid in terms of the tools being willing to read them. So we may have to deal with repairing or reconstituting the log files so that the tools will manipulate them and finally correlating all the information. So that's what we want to focus on. So we do so for the shortcut, and what do we get? This is actually just the first section of the shortcut, and it holds some standard pieces of information, including what we saw before, the path to this file. It stores the kind of media it was on, CD-ROM, a volume label that looks like a date, serial number, file size, creation dates, last write date, which are a time stamp of those values on the media. So we know more specifically here that it actually is a CD-ROM. So whatever this file, whatever was going on, this file was being looked at on a CD-ROM. And that's even, so that's a little further support for investigating this further if the client is interested in transfer of intellectual property. One of the ways that you might recover whole files are using data carving tools, and there are a number of tools out there. The most popular are commercial tools because the majority of people doing forensics are in law enforcement and they prefer commercial tools. So that's why I'm presenting a commercial tool. This is Datalifter, and it has a couple of hundred, two, three hundred signatures for standard formats in there. It does not have event logs. So if you want to carve event logs, you've got to go and get event logs and figure out what the header is. Put it in the dialogue here where it says edit file signature and give it a length. So those are the things that you need to do to figure and get the length. And one way to do that for event logs is to look at a couple of different logs in WinHex. So you pull them into WinHex and say synchronize and compare. That's the menu option. And what WinHex does is it takes two files and shows you the first one and highlights all the bytes that are different between the first and second. So all the black boxes you see here are the sections that are different between the two. And you can see the first line, there are no highlighted bytes. So that section of the file is the same. And we can use that as a signature. So this is the method that you can use to figure out what the signature is for a given file type. Just go grab a couple, load them into WinHex, do view and compare. So for XP log signatures, you see this byte sequence here. Things change on Vista. And in fact, it's a little bit easier to remember. The signature that Vista event logs start with is L file, which is event log file file padded with nulls. So 16 bytes L file. So you put that into data lifter, tell it a file size. On Vista, the logs are either going to be 64k or 1 megabyte plus 64k. So you use the latter. Do the data carving. Hang on. Do the data carving. And you may get a whole bunch of logs back from that. So if this machine has been in service for a number of years, say three years, even though Vista had been reinstalled, when we do, obviously Vista hasn't been out that long. But when we do this for XP, you may recover 100 logs. So because of the way the system, because of the way the system behaves in terms of when you clear logs or create a new log or defragmentation occurring, there are lots of ways in which a log, the system will move log files around and leave an old copy. So it's easy when you have a large disk that is underutilized in terms of capacity that you'll find lots of data. That is lots of old log data. So you might recover 100 logs and it's very common to have only one or two of them be intact to the extent that the tools will open and read them. So the question then becomes what do you do now that you know you have 100 of them? What do you do with the ones that appear that the tools refuse to open or view? And that's one of our motivations for looking at the internals. Vista changes everything. Now, one of the things that we can leverage in understanding how Vista works is the backward compatibility. So with each new revision, they're going to keep some things from the old. And that's going to happen up at this top layer where those green dots are between the DLLs, the libraries, and the application. So there's interfaces there that will continue to exist in the new version of the operating system. So there are things about the way XP worked that we can use to reason about how Vista works. And one source for understanding that is this book on event logging. Now, Vista changes a whole lot of things. So instead of three or four logs, depending on whether you've got IE7 installed, you've got more than 50 by default. And there's logs for individual services. So there's a whole wealth of logs there. And they're in a different location. System 32 WinEVT logs. And they have a new extension, EVTX. So we're going to talk about a little bit about why they did this. The new system is intended to solve a lot of performance issues. So they took the old event tracing for Windows components from 2003. And those are the engine for event logging on Vista. And they do buffering of events in the kernel, circular precues, and to get very high performance to do that. And it unifies logging for both the apps in the kernel, the drivers. There's a richer component architecture to this where you had an event log service and an application and a single log, like the application log if your application was logging. Now you have providers that may log to channels. They can create new channels dedicated to their service or application. And collectors that can control the flow of events from the channels to log files or remote log collections. So you can centralize logging with Vista as well. And some advantages. The other kinds of performance advantages that you have because it's buffered into the kernel, the performance impact is much lower. You can dynamically disable and enable this without rebooting, which is not possible on XP. And you can filter the events. So you've got lots of new capabilities. In terms of speed, whereas a couple of hundred events might bring XP to its knees, a couple hundred events per second might bring XP to its knees, you can log 20,000 or with transactions, 200,000 events per second and only use 5% of the CPU on Vista. And this is a big deal for forensics as well because it means that all of a sudden you can, applications and services can use the logs for new things. Because they can do so with the performance impact, they maybe begin to log lots of things that they haven't in the past. The framework is much more flexible because all the interfaces for drivers in the kernel and the applications are layers on top of a single new component, the event tracing for Windows. And it unifies all those interfaces. So from a programming perspective, understanding how things work, we want to do that so that we can interpret the events, interpret how the system behaves and be able to say, given an event and a few pieces of information, what they really mean and what they don't. So we want to understand how the logging service works. And this is the new API for logging events. If you have an application and you want to send events to the log, the application developer writes a schema and compiles it to be bundled with the application that describes the events. And at runtime, the application registers as its source. It creates a session and it sends those events for the schema that it's registered. And then we've got Vista has... There are very few tools for looking at these things, but the tools that are there have a bunch of new capabilities in terms of the new event viewer can filter and do a kind of sequel querying across events. And it can do so both locally and remotely. It can do so for live events as they're occurring or across multiple log files. Now, if you look at the MSDN documentation, it's going to describe everything as XML. And that's a wonderful thing because XML is neutral in a lot of ways. So this is the kind of structure for an individual event. And it's at the beginning going to have a bunch of standard properties for things like the name of the service, event IV IDs, level of severity, those kinds of things that are common with XP. And then a bunch of other stuff that is potentially an entire XML document specific to the application. And that's where things get interesting in that the application can define a document structure. And the log viewer or analysis software can filter that using XPath to access, you know, walk the tree and look for individual items. So how does the application define that? The application provides a manifest and that provides type information and the structure of the document that it's going to log events as. Providers of events also have a description that contains a unique GUID and a provider name. And it specifies the DLLs that contain some of this information. Just like you have message catalogs on XP, you have resource names and parameter file names for this additional type information on Vista. And a similar document to define the channel. So an application can define a dedicated channel for itself to log events to. And then a controller can say, well, I want everything for that channel either sent to a specific log file or selected parts of that subscribed to to be sent remotely for collection or centrally for collection. Templates define the shape of these documents that the log records are encoded as. So you have XML payload and the templates define the structure of that payload. So the manifest is going to define all the event attributes such as IT, version, keywords, tasks. It's going to reference a template that we talked about in the last slide and name channels. And one of the reasons for doing this is both that it can be used for all kinds of services and that you can use it in new ways. So the event logging is guaranteed now because the performance is impacted so low you can guarantee delivery of events. So a wireless driver can depend on the event logging to send messages to a service to manage networks or VPNs, things like that. And because of that, that will have a forensics impact in terms of having records of those kinds of things to use for event reconstruction. So we've got high performance tracing. The events can be forwarded to a collector's service or stored locally. They're buffered in the kernel. They can be delivered as they arrive or pushed to a remote machine. So let's look a little bit at the encodings, the internals. The documentation talks about this all as XML. The events... So we've got these XML record format for the specific events. Those are held in a section and you'll have in front of a section body a section header that says what size it is, what the manifest that you would use to decode it, and then descriptors for each of those sections, and then a record header that would hold standard attributes. So this is the encoding for a new encoding, and it's very different from XP where you have basically an array of strings or an array of data types, a single array of types. In the record header, you have these common attributes such as time stamp and severity. Again, the section descriptors tell you what source, what provider of the events, and the offset and lengths of the bodies, and then the header for each body is going to tell you the encoding for the body. One of the other advantages of this new architecture is that log size limits are removed as well. So on XP, you're limited to about 300 megabytes by the system, and at that size you have a severe performance impact, and that's for all of the logs combined. On Avista, the logging service memory maps only 64K of the log at a time, and that allows it to have much, you know, basically removes the limitation of the impact of mapping the whole file on XP. So if you want to recover logs and records on Avista, because it maps only 64K, you've got both the structure that you see signature at the beginning of the file, and there's an identical file structure for each of these what they call chunks, 64K sections that are memory mapped. And if you do the same thing with WinHacks that you do for the whole file, take two files, load them in at 64K, well, beyond the first 4K, if you look at 64K increments past that, you'll see a signature at the beginning of each 64K block. And you can potentially use this to recover individual fragments of log records. So even if you can't get the whole file, because these chunks are potentially standalone, the events are not going to cross a chunk, you can recover fragments of logs using this signature. So as I said before, the minimum size for the log files, I'm sorry, it's 64K plus 4K for the headers, so that would be 68K is the minimum size. So you're going to see a dozen or so, maybe 20 that are that size, and the rest of the logs are one megabyte plus 4, 1028. So if you're trying to data carve for them, the easiest thing to do is just give a specified size of 1028 to do the data carving. Now one of the surprising things about the documentation for this is that if you look at MSDN, you will get the impression that everything is XML. But if you go look at the encodings of the events, it's not XML. What they're using is a thing called binary XML, which is popular for cell phones, web browsers, and geographical databases. And it is a way to encode XML with very light weight and that you can put the binary XML in memory and walk it in memory. So it's a kind of serialization. It's got higher performance or lower performance impact both in space and time. It's very compact in terms of it uses string tables to store all the element names and tag names and attribute names. So it's compact because of that. And it can be 10 to 100 times faster to parse, in part because it can store binary data. So rather than having numbers represented as ASCII, you can represent them as binary. So if you've got heavy numeric data, you'll often get 100 times faster to parse. And that's important for doing the analysis because if you're looking at historical logs over a long period of time, the parsing will be the limiting factor, performance limiting factor. Okay, so how are they serialized? If you look at the binary XML standard, they have type values that precede individual numbers or strings. So a particular data item is going to be preceded by a type. If it's a variable length, it'll have a length following the type code. So a value here, we've got a num that gives us all the codes for the types and an integer number would be represented by F4 for the type and then 4 bytes for the value. Looking at strings, they'll be preceded by a length and a series of characters. If it's a string table that would be preceded by a type code that indicates it's a table. So these are the kinds of things that if you're recovering data from within an event, if you've got a fragment, this is the information that you would use to interpret the data. And finally, for the XML structure, each element is going to be in the tree structure of the document. Each element will be enclosed by a beginning tag which has a type code for the element and a reference to the string table that tells you the name of the tag and a closing type code that will tell you where the element ends. And there are no tools as it stands to do this in an automated fashion. So all this stuff, these are things that you can use manually, but you cannot yet, they're not tools yet to do recovery of even a fragment sort of repair files, and that's the area that I'm interested in. So if you do, so recovering these files, what kind of analysis can you do with them? These new XML events have rich information. Instead of a flat structure with an array of strings, you have a whole document that can be represented as a tree and you can do XPath filtering on the elements. You're going to have a lot of new kinds of information stored in the events and a lot more detail. And the tools now will do queries across multiple logs, so it's now easier with the native tools of the platform to analyze across a whole set of log files. And just about the only tool to do that at the moment is the native tool, the event viewer. And it has these new items to create a custom view or a filter to allow you to do queries on the logs. And you would do so by specifying XPath, which basically like a directory path, you'd be walking the tree of the document rather than the tree of a file system. So here we've got system slash provider, so that element of the tree equals CD burning service. So let's say we've recovered along with that shortcut, we've recovered a bunch of these files and we're going to filter them for that kind of event. What might we find? Well, here we've got a table with a series of just a few items from the records, the timestamp and the message that was associated with the event. And this is the kind of thing you would see if the native tools are used to burn a CD. So here we've got time, a message that says that the burning services started, messages that basically one minute intervals saying that the burning service is running, and then a final message that says that it's entered the stop test state. And this is consistent with this kind of pattern that distinguishes CD burning from the kind of pattern that you see when the system just starts up and starts services. So you'll see the service start when the system boots and you'll see messages about it starting, you know, for other reasons, but the message is saying that it's running at one minute intervals distinguishes this kind of pattern from others. And we can combine that with information in the timestamp. So we've got timestamps in the event log, timestamps in the shortcut, and we can correlate them. And we want to combine that with our understanding of how the system works to say something about what was going on. So we do that. We can look at the correlations and determine that a CD ROM was burned. We've got a SID in the application log associated with the events. And the timestamps on the events correlate with the timestamps. So we know the burning was occurring and the shortcut refers to the CD that was in the drive at the time it was being burned. We've got a SID in the event log. The shortcut holds a label for the CD that looks like a date and we've got a volume serial number. So we can use this to distinguish whether it was just possession of materials that should have been a part of the responsibilities of someone using the documents or transfer and that we can distinguish that it was CD burning that was occurring. And we can tell exactly what was burned, a document of interest. We know what size it was. We've got dates. We can tell if we had another source for this document, we might be able to correlate those dates and size and name to figure out if it was the same document. So we use information in this timestamp to do that. I mean in the shortcut to do that. Now there's one thing about these particular set of timestamps that's somewhat unique to Windows and that Windows, when you see a creation time that's later than the last write time, it means something different than on other platforms. So we've got a created time that's newer than the last write. How can that happen? Well that happens when you transfer files from one media to another. It gets created on the new media but the last time it was written is the last time it was modified. So Windows updates the created time with the time that it lands on the new media and the last time it was modified is preserved. So we can use that because we've got one of the timestamps that was preserved from the old media. We can go look back at various source media to see if we can identify that specific file and if we can find it we can say this file was transferred from this particular source. So by this we can do a couple things. We can distinguish whether or not it was transferred in terms of CD burning. We can distinguish maybe if we can find that file on another media file server, some external hard drive. We can tell where it came from relatively uniquely and that in addition to those timestamps we've got a volume serial neighbor which is unique to each volume. And we've got the timestamp and size to correlate with that individual file. So if all those things match for the file and the volume we can say something about where it was transferred from. Okay so that's basically it. If you want to know more about doing this on Windows XP there's an article coming out in digital investigation in a couple of weeks. I can't make it available till then but I'd be happy to send it to anyone that's interested. The journal allows authors to distribute electronic versions of the copies otherwise it's 30 bucks from their website or go to the library to get the journal. But I can send that and I would be happy to send that to anyone who's interested. I'll be talking about these kinds of things at a couple of other conferences and I would love to get a chance to chat with you if any of you will be at the George Mason University Forensics Training Symposium next week or at the Digital Forensics Research Workshop in two weeks. And lastly at the High Tech Crime Investigators Association International Conference at the end of the month in San Diego. So thanks very much for your patience. Appreciate it and I hope you found this valuable.


Okay, so there you are working at a computer with no GUI interface whether it's a Server that you hooked up a monitor to or you switch to one of your tty's by pressing control shift F control Alt Alt shift To This is one of those things I do without thinking as soon as I think of it I can't remember what the keys are Control Alt and F2 control F3 control F4 control Alt F5 control F6 Okay, I'm sure most of you are aware of that control Alt and your F keys will allow you to switch between virtual consoles Exiting out of your GUI interface and into a pure console experience to get back to your GUI desktop environment Usually it's F1 or F7 But once you're in this you're running, you know again without a GUI interface for whatever reason you're doing this Wouldn't it be nice? To have a mouse cursor good news You can and it's not that hard to do before I go any further I know a lot of you out there going but Chris why well? I tell you the main reason that I have this service installed is copying and pasting sometimes I am working at one of my virtual consoles and I output some information and said you know typing whether it's a URL or an IP address Something it's just easier to highlight and paste it and that's the main reason I have this installed But there may be other reasons the service that allows this is called GPM and on a Debian based system It's super easy to install to pseudo apt install GPM Obviously you type in your password once it's installed It should automatically start that service up and you now have a mouse cursor that can highlight And with a center mouse click it will paste whatever you highlighted now again I should have do this on Debian based system using after you can use whatever package manager You normally use and I'm sure it's just a simple on most other distributions although I haven't tried but again Debian Debian based systems So if you're on Debian Ubuntu Linux Mint MX Linux a lot of distros that would be how you do it and once it's up and running once it's installed should automatically start running if not just start the GPM service and now you have yourself a mouse cursor again It's not something that is used all the time, but does come in handy when you need it. So short video I hope you found it useful, and I hope that you have a great day. Please visit films by chris comm That's Chris the K link in the description also not something I normally do But I should start doing is thanking my patreon supporters, so go ahead and check them out their names I appreciate your support as always. I hope that you have a great day


Yo, you too. Welcome back to Kenny's TV. Today Epson equal tank 3760 unboxing and Conferring into a sublimation printer.  We've got a couple blue tapes right there. We're gonna Remove and I notice there's a compartment back there. You just squeeze it both fingers Pull it out and it's check inside to see if there's any blue tape in there. All right, there's none and just place the Back together more tape Where the scan is at and we're actually gonna lift up the scanner To look inside the printer a little closer to look at the blue tape And make sure that you remove that So that way whenever you be trying to run your printer don't cause no additional damages Just look around. I'm gonna take one more check. Looks good Check the paper tray, which is the very bottom tray And then there's another tray. That's where the printer. That's the paper that comes out Just plug in the power cord to the printer But we're not gonna turn on the printer It's gonna plug that in and we're gonna start with our sublimation ink and Here's the black one. Just take off the very top and you see that it's sealed and I use scissors You can use a blade knife razor Let's get that open. I pretty much took the majority of it off and twist back the top But I removed the top cap part So your sublimation ink will look like this and this is Cosmo ink by the way So I lift up the whole scanning part lift up the compartment and right there with the blue is that it's gonna We're gonna start with the black And as you can see right there it lines up with the black scion Magenta yellow that's where we're gonna be placing our ink and I found it easier By lifting all the blue tabs. We'll just drain out fill up the tank And it's gonna fast forward for all the rest of the colors. Then once you finish Close the blue tabs to the compartment. I'm just making sure that Actually closed Now we're gonna plug in the printer. We're gonna power it on right there to the screen right here for your language And you can actually slide this out right here and whatever language you prefer Press okay. We're gonna be using English and the process Processing then take a few minutes Not that long This is see the start here she took complete Installation which we are ready. That's okay. Talk about the ink. We already did the ink just hold down the question mark Confirm the tank so it's filled up Make sure you just press okay, and this is gonna take a 10-minute process for your Epson equal tank and that's fast forward And what I did is went ahead and make sure the paper is eight and a half by 11 So I open up the bottom tray Load it up eight and a half by 11 regular paper and Pretty much what this is gonna do a print head test and to get out of this screen, which I had a little bit trouble What you'll have to do is hit the up arrow key see I made a mistake there Went back Figure it out and what's a maintenance? Press okay, and right there is print head nozzle check press okay And press okay for print pull out your top tray And this is where the print is gonna come up taking a look at it real quick See the top left part of the paper Pretty much it's all side of line set for one looks good Thumbs up and I'll tell you on the screen if it's bad or not But this is a brand new printer should have no problems. So I press okay We'll go back to home with the general settings But excuse me. I want to settings Press okay Scroll down and I had to go to general settings and then went to network settings press okay and do the Wi-Fi setup and Since I'm wireless I picked the Wi-Fi recommended press okay, and then press okay to start setup Did you come to the Wi-Fi setup wizard? press okay And fast forward put in my information Press okay, but back to home, and you're done