Hello everyone, welcome to the next lecture on the course remote sensing principles and applications. In the last lecture, we discussed about the spectral characteristics of the system. In this lecture, we are going to discuss about the other two characteristics that is the temporal and radiometric characteristics of a remote sensing system. And also we are going to see little bit more deeper about the data characteristics of visc broom and push broom scanners. So when I first introduced you the characteristic of remote sensing system, I told four important resolutions spatial, spectral, temporal, radiometric. We covered in detail about spatial resolution and spectral resolution. Now we are moving on to temporal resolution. Temporal resolution in general indicates how frequently we can get data over a particular region of interest. Say for some applications like weather forecasting or reduction of hurricanes, we may be needing data once every 30 minutes. Data in the sense it may be images or any other form of remote sensing data. So the images may be required once every 30 minutes or 15 minutes. For certain applications like crop monitoring, we may need data once every week. For some other applications such as urban sprawl monitoring, mapping of urban growth for such applications, we may require maybe like one good quality image every year covering the turbine area and so on. So based on our needs, the frequency with which we will need the data will vary. Similarly, all remote sensing systems has an inbuilt characteristic of how frequently it can give the data and that is known as temporal resolution. So temporal resolution it is in general determined by the orbit in which the satellite is. Say for example, if the satellite is in geostationary orbit, it will be constantly looking at one particular region of the globe and hence will provide image once every 15 minutes or 30 minutes depending on the image collection characteristics. So in general, satellites in the geostationary orbits will have the highest temporal resolution. Mostly weather monitoring satellites will be launched in geostationary orbits or they as they are required to look at the same region continuously. Now satellites in the near polar orbit which revolves around the earth from north to south, the frequency with which we can get the data depends on the orbital height that is the height above which they are circulating the earth and also the swath width. We noted that swath width right, we came across the term swath width that is a total area in the across track direction covered by the satellite. These two will define the temporal frequency with which we will get the data. So this is given in this particular slide. So temporal resolution in general means how frequently we can get the data. For example, Landsat satellites provide data once every 16 days. So this is in near polar orbit. Similarly, satellites in the geostationary orbit such as INSAT 3D, Argos, these satellites give data once every say 30 minutes. So this is in geostationary. So now we will look at this particular point. I told you that for satellites in the near polar orbit, the temporal resolution is characterized by orbital parameters and FOV that is the swath width. So how these things will define that is let us like take two examples, one is Landsat, another is Modus. Both of them are in pretty similar orbital heights around like 700 kilometers. Say this is like Landsat 8 I will take. Both of them are in similar orbits around 700 kilometers above the earth but Landsat 8 or whatever previous lands are like 7 or 5 whatever the swath width is roughly around 185 kilometers. If you look at Modus that is also in like similar orbital height but it has a very wide scan angle. It can scan 55 degrees. So it has a wider FOV and it can collect data with a swath of 2300 kilometers approximately. For Landsat, the swath width is just 185 kilometers. Its FOV is if I remember correct it is something around like 15 degrees that is all. For Modus it is 55 degrees FOV and its swath width is 2300 kilometers. So what will happen is so the satellites when they revolve they will go like this. Say this is north this is south they will come like this. The next orbit may be somewhere here. Say when satellites rotate, earth is rotating from west to east satellite is rotating like this. So when satellite finishes one orbit earth would have moved to certain distance. Now the satellite would have would be like coming in over a different region. So like this it will start covering different parts of the globe. So that is given here. This is maybe orbit number 1, orbit number 2 may be here, orbit number 3 may be here and so on. So this there will be certain ground distance between these two orbits in the order of like few thousands of kilometers in the equator. Let us say the orbit is just 185 kilometers for Landsat. So this is just 185. This is 185. You can see from this particular schematic example that there exists a large gap between two orbital parts and the swath width covered. On the other hand for Modus the orbit will look more or less the same but due to its very wide swath like its swath is something of the order of like 2300 kilometers. So this is maybe swath width and for second orbit it can overlap with. So essentially due to its very wide swath width it will be able to cover the land mass or whatever feature on the earth surface almost up to its next orbit level. Say one orbit goes like this satellite. Let us imagine both of them are going parallely. Just for explanation sake I am telling. Let us say two orbits, two satellites are moving at certain distance from each other. Let us say. Now if this can image all the area and this sensor can image all the area without any gap see these two combined together can cover all the region between them without any gap means what will happen they will provide gapless data between them right. Similarly you can imagine when Modus goes from multiple orbits around earth due to its wider swath it can cover a large area of the globe in one go and hence every one day or every two days maximum it can cover the entire globe. So the temporal resolution or the or temporal frequency of Modus is 1 to 2 days. We will get we will get one image at least one savory 2 days in case of Modus because of its wide swath. On the other hand for landsat due to its very narrow swath width we will not get image as with that high frequency but we will get image only when the satellite overpasses the area. So only when the satellite goes around your region of interest it will acquire image because of its narrow FOV and smaller swath. But for Modus even if it is flying like this it can due to its wide scan angle it can scan regions that are far off from it it can cover the large region underneath. So if Modus is going like this it can scan like from a region far off on both its on its either sides landsat cannot scan like that. Landsat scan is restricted to a very small angle and it can swath width is just 185. So based on the orbital height and its FOV the angle of scan the temporal resolution of systems will vary. So based on our applications we may have to choose data from several satellites combined together for needing it. Say for example landsat has data only once every 16 days. So if we need any other data with such high resolution we may combine landsat with Sentinel-2 which provides you data once every 5 days or 10 days depending on whether you are using one satellite or two. So we can combine multiple satellites in order to get frequent data. Combining data from multiple satellites has its own issues but that is one way. But in general what I wanted to say is temporal resolution means how frequently we can get the data from a system and the temporal resolution of geostationary satellites is pretty high in the order of like few minutes 30 minutes 1 hour and so on and they have the highest temporal frequency. For satellites in the near polar orbit the temporal resolution is fixed by the orbital characteristics especially the orbital height, the path in which it goes all those things plus the scan angle FOV that will determine the temporal resolution. The next topic that we are going to cover is radiometric resolution. We already got introduced to this particular concept when we discussed how digital images are formed that is I told you that the incoming energy will be sampled and quantized. Quantized is converted to a integer number based on some scaling factor. So the range of integers numbers used it depends on how much quantization we give it to the system. Some system has 8 bit quantization so the dns can vary between 0 to 255. Some system has 10 bit quantization so the dns can vary between 0 to 1023 and so on. So the number of quantization or the number of bits you provide for every band of data for every pixel of data will determine how many different gray levels we can get. Maybe first we will see an example then we will come back to the theoretical concepts related to radiometric resolution. In this particular figure given in the slide we are having a same image with different different quantization levels that is for each pixel for representing the incoming signal in each pixel here we use 8 bit of memory. So 2 power 8 that is 0 to 255 values it can take. Here it is 6 bit so 2 power 6, here it is 1 bit so it is 2 power 1 just 2 levels and so on. So each image is the image of same area represented with different different quantization levels. Here we can see the number of different gray shades we can normally all digital images are nothing but different gray shades contain just different gray shades. So here the number of different gray shades we can see in the 8 bit quantization images pretty high.  As the number of quantization bit reduces the features the amount of information that we can get from the image goes down drastically. The number of gray levels that our eyes can see reduces a lot here actually it is just black and white only 2 levels either it is 0 no data or it is 1 that is black or white that is it. So here we have 4 different levels of data like this. So the number of gray shades contained in an image will be determined by the number of quantization bits we use. Higher the number of quantization bits the number of gray levels that we can see will increase. So the finer changes in the gray level we can see pretty clearly in the image.  So color image how do we get color image we get by mixing different gray shade images in different different bands that is we know the 3 primary colors blue, green and red. Each will have its own gray shade image let us say it will have all are quantized at 8 bit level 0 to 255, 0 to 255, 0 to 255. Based on the objects reflectance in these 3 bands say row blue, row green, row red the dn numbers will vary higher the reflectance higher the dn number. So when we produce a color image in our display systems we will assign the dn in blue to blue display. We will give different shades of blue now when the display system works to us similarly for green we will like display it in like different shades of green similarly red different shades of red all of these will combine together to give us a color image. This is like a true color image or a natural color image because we are using blue to blue green to green red to red in display system. In remote sensing it is also possible to form images with what is known as like false color like remote sensing we can take images in different bands NIR band SWIR band thermal band and so on. So thermal we can leave it we can talk about one is reflectance bands NIR SWIR and so on. So what we can do we can we cannot see NIR directly. So that image it will be different shades of gray we can give some color to it say red color different shades of red we can give and then data acquired in red band we can give different shades of green and so on. This is what is called false color composite. So basically all remote sensing images are essentially containing different shades of gray the color images produced by how we combine them and how we display them maybe we will just little bit look deeper into it in one later classes. But these different shades of gray how many shades of gray that we are using is going to determine the amount of details contained within an image how much fine details we are able to see ok. So this is a generic information about the number of quantization bits. But this does not actually indicate everything about the radiometric resolution. You know like if you look at the concept of resolution I told you it is whether are we able to clearly distinguish two features or clearly resolve two features. So spatial resolution means are we able to resolve two nearby features spatially. Spectral resolution means are we able to resolve two features spectrally by having like narrow by looking at narrow absorption bands or so on. Radiometric resolution means are we able to resolve two features using the radiance values that came in maybe like one road with like a tar coated and surrounded by a pavement with cement cover on top of it. They will have different shades of gray one will be black one will be little bit grayish in color. So just by looking at the reflectance by collecting data are we able to identify them as two different features. That is what is radiometric resolution just by looking at the radiance value recorded are we able to distinguish two features. In radiometric resolution one important aspect is the number of bits we use. So based on the number of quantization bits we will have many different gray levels in an image. As the number of quantization bit increases we will be able to see clearly the different features present that is one aspect. But the one more important aspect is how accurate our sensor is in collecting the data. That is all sensors will have certain level of noise being produced within the system. So no system is perfect that we know if the system itself will generate some level of noise within it which will cause some data to be created and stored within the system itself. Everything will be created by the system and stored by the system. Some noise will always be there. Let us say some signal is coming from the ground like from two different features are coming from the ground. Let us say the difference between them say I will take like two examples. Let us say one number is 102, one number is 100. These are these represent the spectral radiance of two different features. The difference between them is just 2 watt per meter square per micrometer per radian. Very small difference between them. Let us say the system has a noise level of let us say 3 watt per meter square just a rough example I am telling these may not be the real numbers or real values just to drive home the concept I am doing it. So the system itself has some noise which is more than the difference between these two features. So what will happen essentially there are like always high chance that these two numbers will be recorded as one same feature that is we will not be able to distinguish them. Let us say there is same signal but now the noise of the system is just 0.5. So in this case what will happen the noise of the system is quite low in comparison to the difference of radiance between these two features. And hence even when the noise is getting added whether in a positive direction or negative direction there are high chances that we will record the radiance from these two features as two different objects and based on the gray levels we use they may get a different DN altogether or okay. So the DN and the accuracy of the system how much noise it will produce or how fine it can deduct the difference between two signals both of them combined together will determine the radiometric resolution of a sensor. So one important concept to notice noise equivalent delta L that is noise equivalent differential radiance that is I said all system will have like a constant or not constant maybe like a varying noise level. So at different different radiance the noise level will vary. So if this any delta is L is pretty low that is what should be the difference in radiance level between two different features. So difference in radiance level between two different features to create a signal inside the system such that this will be more than the noise that is produced within a system. I repeat let us say two features are there they are having like some difference in radiance between them like in the example we just saw I said one feature has 102 another feature has 100. So the difference in radiance between them is two if the difference between them is more than the noise equivalent radiance due to the noise within the system it will produce its own radiance. If the difference between them is more than the noise within the system itself then these two will be identified as two different objects. But if the difference between them is lower than the noise within the system they will be treated as one different object because they are having very similar radiance values. So if the noise of the system is very low if it is any delta L is pretty low then objects with smaller differences in radiance can be imaged as two different features. If the any delta L if the noise in the system is high then objects or features with smaller differences in radiance may not be imaged as two different features they may be imaged as one different features. This is purely depends on the accuracy of the system that is the noise content of the system how accurately the system collects the data. Now let us combine this with the radiometric resolution or the number of quantization bits we use. So I said an example we will get back to this example 102 100 radiance value from two features let us say the noise is 0.5 watt per meter square per micrometer per stadium. So these two will be directed by the sensor as two different features that is fine but let us say I am just going to use a 2 bit quantization. So 2 power 2 4 levels 0 1 2 3 that is all I am going to use for my DN levels. If I use this kind of low gray levels low number of quantization bits there are high chances both of them will get the same DN values that is the sensor has recorded them as or deducted them as two different features the noise of the system is pretty low. So the two features are recorded or deducted as two different features fine but when the quantization happened because of poor quantization because of very low quantization bits given to the system these two may still get same DN and saved in the images one feature because having same DN means we will see them as just one same feature. I will just go back to this example. Now here just look at whatever the portion having white here everything appears white as with one particular DN value but here this block contains lot of finite and different features right but everything got stored here as one DN value because of the very low level of quantization we have used. So essentially the number of quantization will work in combination with the accuracy of the system in order to or which will finally decide our ability to distinguish different features by looking at the DN values. So there are two parts one is the accuracy of the director all the elements itself and second comes the quantization. Both of them combined together will give us the radiometric resolution or how accurate we will be able to identify two different features. Similar to any delta L radiance concept in thermal remote sensing we have a concept of any delta T how different the temperature of two objects should be in order for them to produce a radiance which will be higher than the noise inside the system itself noise equivalence delta T noise equivalence differential temperature. So these relate to the accuracy of data collection and the number of quantization bits will tell us how fine or how many gray levels we will use. So if we combine them both of them together the any delta L or any delta T they will determine the accuracy with which the data is being observed by the system and the number of quantization bits will determine with what precision we record the data. Even accuracy may be higher like again I am going to the same example, same data when expressed at different different lower values of quantization bits the amount of information we get from the image decreases or here we are decreasing the precision of the data. So these two effectively combined together the accuracy of data collection the any delta L or any delta T combined with the number of quantization bits will determine the radiometric resolution of the system how accurate we are able to distinguish two features radiometrically that is by looking at the radiance values itself. So just here again I am going to the same example here you are distinguishing two, three different tank-like structures in 8-bit quantization image and 6-bit quantization image but you are not able to distinguish it in say this 4-bit quantization 2-bit quantization image and 1-bit quantization image it is not visible this affect our ability to distinguish features. So till now we have covered all the 4 important characteristics of remote sensing system spatial, spectral, temporal and radiometric resolution of a system. But depending on the way the data is collected the data may have certain distortions or certain characteristics like distortions means I will be mostly talking about like geometric distortions like how accurate the position of each point on the ground is imaged perfectly. So based on the way we collect the image whether it is like a scanner or it is a push broom sensor or it is a normal photograph whatever the geometric accuracy of the ground points will vary. So now we will look at some characteristics of the data collected by these remote sensing sensors. First we are going to talk about the characteristics of data collected by visc broom scanner. First thing that will happen is visc broom scanner image collected by visc broom scanner will undergo what is known as a tangential scale distortion and resolution cell size variation. These two they are basically distortions these two are inherent in the data collected by visc broom scanners. What are these things? What is tangential scale distortion? I told you when visc broom scanning happens sensor will be moving satellite will be moving like this sensor or the scanner will be scanning like this in the across track direction and also I told you that at every given constant interval of time delta t the data coming in from the scanner will be sampled and it will be quantized that also we know. So the sampling time delta t is fixed. So collect data once every say 6 microseconds or 3 milliseconds based on like the scanner type let us say like the sample is collected every 6 microseconds. So as 6 microseconds elapses so sensor may start from here every 6 microseconds it will move continuously like this continuously will be collecting data from the ground but that data will be sampled every 6 microseconds producing that many pixels on the ground that concept we know that is what we came to know as GSI or GSD ground projected sample interval or ground projected sample distance. Now just think the time between two samples is fixed and the angular distance that is moved by the scanner within a given time interval is also fixed that is it will make small angle of delta theta for every delta t time that is given in this particular slide maybe you can have a look at this. So for every time interval of say delta t the scanner will move an angle of delta theta from this point it will keep on changing. This delta theta is fixed for a given delta t because as the scanner let us say the scanner starts from here after time delta t it would have come here it would have covered an angle of delta theta after another time of delta t it would have come here it would have come here again it would have covered the same angle delta theta. So the angular distance covered and the time taken for between each sample is fixed but now let us say the ground let us assume the ground is flat. Now the scanner is collecting data the ground is flat the angle with which finally it is being projected on the ground that is the the distance between the samples let us say because every delta t times every delta t seconds a sample is collected. So the ground distance covered within the delta t will became larger and larger as thus can angle increases the ground is flat the angle is fixed the delta t angle or the angular distance is fixed between which two samples are taken because of the flat ground the ground distance between two samples between will be keep on increasing. This is one thing that is the GSI will be keep on increasing as the scanner moves away from nadir. So if it is from here the GSI will be without what is basically fixed for the system as the scanner moves away from the nadir as it scans at an angle then the for the same sample time delta t the ground distance or the GSI will be keep on varying the GSI will be keep on increasing as the scanner is moving away from the nadir. Similar to GSI the GIFOV also will undergo some distortion that is I told you what GIFOV is GIFOV means what is the projection of a single detector element on the ground. So as the single detector element if it is looking at nadir it is okay if it is a circle it will be on the ground as a enlarge circle if it is a square it will be on the ground on as a enlarge square that is fine. But let us say this GIFOV is now looking at an angle away from nadir. So when you project it onto like a flat horizontal surface what will happen the circular detector element here will be projected on the ground as an ellipse because of a larger scan angle. So two things will happen first thing is the GIFOV increases as the scan angle increases similarly the GSI will also increase as the scan angle increases that is a circular GIFOV element as it moves away from this is the IFOV okay. IFOV is fixed for a system but as the scan angle goes away from nadir the same IFOV angle of the system will have a larger ground area coverage this is enlargement of GIFOV. Similarly I also told you that the sampling interval delta t is fixed for the same sampling interval the sensor would have covered larger ground distances between two samples. So these two concepts change in GIFOV and change in GSI or important characteristics of visc broom scanner. We will see little bit more in detail about these concepts in the next lecture. So as a summary in this lecture we have seen the concepts of temporal resolution, radiometric resolution and also started discussing about the data characteristics of visc broom scanner. Thank you very much.


On 24 May, on the island of Okinawa, a convoy is traveling to a practice area called Bolo Point to fire the Little John rocket. At the site, members of the battery prepare for the launching. A portable weather vane provides wind data. Final adjustments are made to fire the rocket out over the Pacific. A battery sergeant completes the final sighting, and the rocket is set on its way. In Grafenhauer, Germany, men of the 64th Armored Regiment, 3rd Infantry Division, take on ammunition during their annual firing at the Grafenhauer training area. With the required quotas of 105mm shells and machine gun ammo aboard, the M60 tank moves away from the supply point and out onto the range. Spotters are at their scopes as the M60 fires its 105mm gun from the first position. As other crews await their turn, machine guns are fired at a target moving across the range. When the firing ends, maintenance is performed to bring a long and successful day to a close. While the tanks are firing, Honest John rocket crews train with their equipment under simulated battle conditions. In preparation for an actual firing, a warhead is brought alongside the Honest John and mated to the rocket. This is delicate work which requires continuous training of the crews. Finally, it is completed. The Honest John is moved out from its concealment. It is elevated and adjusted to place it on target. Then, the rocket is fired, completing the training exercise. A number of long floating pier barges are being constructed by Japanese contractors at shipyards in Japan. These particular barges are being built on shipways. They are constructed so they may be floated into positions where needed for dock facilities permanent or temporary. This type A barge requires 10 steel tube casons for its 300 foot length. The 150 foot type B requires only six casons. This DeLong barge inspector has just looked at a watertight compartment. DeLong representatives inspect each pier barge before it leaves the shipyard. Here a type B barge is towed by a sea-going tug toward its destination. I'm Lieutenant Colonel Beecher. I'm the commanding officer of the 538th Engineer Construction Battalion. We're located at Camp Essayon Thailand. Our base camp is located approximately 45 kilometers south of Karat. In addition to building our camp after we arrived, we built a tank farm, 90,000 barrel installation in the Karat area. Our primary mission is the construction of the 140 kilometer extension through the Bangkok Bypass Road. Shown here on our map in red, it extends from Cabinbury to Karat. Here's our location, Camp Essayon, 45 kilometers south of Karat. The extension road will complete the major link in the landline of communication with the port under development of Sadahit of the Chotkin South Cabinbury Bangkok Bypass Road constructed over this past four year period by the 809th Engineer Battalion. The road will be constructed in two phases. Phase one is the construction of a military road. That is a road capable of carrying military traffic as soon as possible. Phase two is the improvement of this road to the standards of the civilian highway. The first project is underway at the present time, is approximately 40% complete, and the military road phase of the project is anticipated completion date, November 1966. In Bangkok, the first transportation barge company of the Royal Thai Army assembles for training, observing our Major Donald P. Molok, U.S. Advisor, and the Transportation Group Commander of the Royal Thai Army. The company of 200 men has 34 barges, which were constructed locally with United States funds. The vessels are single-engine, 48-foot craft, and 75-footers with twin screws. The unit receives help under the military aid program, but maintenance of the barges is at Royal Thai Army expense. The company is capable of operations up to a distance of 160 kilometers. The barges can meet ocean-going vessels in the lower river and take on cargo for movement directly up country. Since Central Thailand is served by a system of rivers and canals, water transportation has great importance. Many sections of the country are reached primarily by water, and this barge company can land troops and supplies in these otherwise inaccessible areas. During this training exercise in the Bangkok area, emphasis is being placed on communications. Since no radios are carried on the barges, signalmen using a modified code must maintain contact between the vessels. Well-trained and competent, the first Royal Transportation Barge Company represents the modern adaptation of an historic means of transportation in this land where waterways are a major key to successful military operations. At Panmunjom 26 May, the Communist Honor Guard goose steps in preparation for the arrival of Commissar Pakchonguk, the chief representative of North Korea. The show is partially for North Korean guided tours visiting the area. Inside the familiar accusations of neutral zone violations resume. A chart indicates the location of the alleged capture of U.S. weapons. The weapons are displayed outside for South Korean reporters. Many are Communist-made plus a few old U.S. items. Communist agitators attended in unusual numbers. When the U.S. 627th supply and services battalion moved into the fairgrounds in Santa Domingo last June, they found over 400 squatters. The problem of relocating them was given to U.S. Army Staff Sergeant Juan Ocasio of Puerto Rico. He transported some families back to their homes in the interior, but the others had nowhere to go. Ocasio found a vacant coral field nearby. He arranged to bring a few families at a time to this field. The battalion collected scrap lumber, crates, and other materials which were taken to the building site and distributed to the families there. And Ocasio followed the work closely. At first, any kind of shelter from the weather was erected, even houses of cardboard. The problem was to get someplace to stay until a better shelter could be built. Ocasio spent evenings and weekends planning streets and marking off building lots. Foundations for better houses were often started around the shacks themselves. A year after the project's start, shacks of all types continue to spring up in Ocasioville to meet the demand for immediate housing. Improvements are rapid as materials become available. As each shelter is completed, a family arrives to fill it. Simple as it may be, it is a real improvement over what they have known. Also, many of the people find employment in the battalion warehouses. The more ambitious with extra effort are able to make pleasant surroundings from their limited resources. Food provided by care and other sources is handled by soldiers who volunteer their free time to do the job. They break down large bags of cornmeal and flour to individual portions in paper sacks. Officers lending a hand include this army chaplain. Sergeant Ocasio passes out candy to the children. Sergeant Ocasio says, it is hard to believe that from 123 families, the town has grown to 279 homes. I don't know where they all come from. I spend most of my free time working with these people. I want to leave here knowing that they will have some of the common comforts needed for a happier life. 12,000 feet up in the Andes lies Bolivia's four-century-old capital, La Paz. In May, a badly needed bridge is being constructed through a municipal community action program known as Axion Communal. Advisors are a U.S. specialist from a canal zone civil affairs detachment and Bolivian army personnel. Up to 60% financing is furnished by Alliance for Progress. Eroding water runs across the road now. Assisted in preliminary engineering work by Bolivian soldiers, civilian workers have completed one side of the foundation of the two-lane bridge, and work continues on the remaining half. A community action official calls for weekend volunteers over a loudspeaker. Axion Communal is limited to La Paz and is engaged in 10 projects. It was begun in 1964, and all projects remain subject to the mayor's approval. It coordinates community councils in self-help programs such as hygiene, housing, and parks. The La Paz Rehabilitation Center receives volunteer assistance from American Army wives. Established in 1960 for physically handicapped children, the center now includes children crippled by congenital deformities and polio. The therapy room has a whirlpool bath, flexing bar, mirrors and practice steps, and an electro-therapy machine. Vocational training includes weaving and carpentry. The brace shop with equipment given by the World Rehabilitation Fund is run by one man trained in Mexico. A monthly community party is given by U.S. Army wife volunteers. At present is the center's founder and the brace maker, himself a victim of a crippling disease. Along with parties such as these, wives stage sales to raise funds in addition to money contributed directly and temporarily adopt some abandoned children to give them extra care. With the help of U.S. military group personnel, the center has placed a number of its children in American homes. Here, a six-year-old child leaves his last community party and heads for the airport to start a new life in faraway Santa Monica, California.


Recent studies have shown that all inside repair of meniscal ramp lesions can restore normal knee motion. But it has remained unclear how ramp lesion repairs affect ACL in C2 forces and bony contact forces. To remedy that, researchers from the University of Pittsburgh recently used a robotic system to examine these forces in intact knees, knees with ramp lesions, and knees with ramp lesion repairs. Their findings, reported in the November issue of the American Journal of Sports Medicine, suggest that the indications for ramp lesion repair may be limited. The team looked at nine knees from human cadavers, each tested using a 6 degree of freedom robotic system. The knees were continuously flexed from full extension to 90 degrees under five different loads, an anterior load, an external rotation torque, a combined anterior and compression load, and a combination of external or internal rotation torque and compression. The loads were applied to intact knees, knees with a surgically induced ramp lesion measuring 25 mm, and knees with ramp lesions repaired by the all-inside approach. All specimens had native intact ACL. Using the robotic testing system, the team measured the in-C2 forces in the ACL and bony contact forces in the medial and lateral compartments. Results showed that ramp lesions did not significantly affect knee biomechanics. In response to all loading conditions, intact knees and knees with ramp lesions showed no differences with respect to kinematics in-C2 forces in the ACL or bony contact forces. However, compared with intact knees, knees with ramp lesion repair did show significantly reduced anterior translation at flexion angles, ranging from full extension to 40 degrees in response to the all anterior load. Additionally, repaired knees showed significantly reduced in-C2 forces in the ACL at high flexion angles under the torque plus compression loading conditions. All together, these findings appear to challenge the benefits of all-inside repair of ramp lesions. But to be sure, more work is needed. Studying real knees under more practical conditions could help researchers better understand how ramp lesions truly affect the biomechanics of the knee.


But even eternity did do it. It's not even good to mix eternity with time. I mean the whole point is to really get clear that they don't. Because to echo eternity is just a long, long time. You know. You know. The echo says good. Think in terms of eternity. This just stretches all the time more. That's the way I am. So give me something. How else do you echo eternity? Well you can't. The miniature of eternity. The little snapshot of eternity is the holy instant. And that's why every time we come together to look at everything that's covering over the holy instant Jesus says now is the closest approximation of eternity that the world offers. You can get a little specter we just talked about in that thing. That's the closest approximation to eternity that the world offers. So we just keep looking. It can be to have sessions to even go through the thinking of this and to just to, as I say when I'm going through it, if there's anything that is not understandable or that needs a little more clarity, that's another time to raise the hand up. An example? Yeah. It doesn't have to be a major, major crisis before it hits your hand. And I think the iceberg analogy, why that's not helpful and why it's not accurate is that it doesn't, well I don't know if I can explain why, but I guess the other metaphor that you've used that does explain it better to me is the tree with the branches. Because that gives some connection to all of it. The trunk of the tree indicates that it's like a funnel. It's all leading to the same place. So whether I pick this belief or this belief or this belief of any of the branches, it's all leading to the same place. So it's not like, well, this is just one belief among millions. What's the, you know, what's the impact of that? It's like, well, it's leading to the same root cause. So pick anyone, pick one, pick ten. It doesn't matter. It's all going to the same place. So that, to me, is a much better way of seeing it because then it doesn't feel so overwhelming.  So, I mean, you know, to me, that's helpful in seeing that there's a connection between all of it. Whereas the iceberg just seems like, you know, there's no connection. It's just one over here, one over there, one over here. You still have a huge iceberg. What's the connection? Another way to think of it using a tree analogy would be, with the leaves and little twigs, you think of every little leaf as a private mind. That leaf, if you follow to the twig, if you follow to one branch, if you keep going, you'll follow just that route that it takes all the way down to the trunk. You know, that the trunk is the wrong mind. And you could think of all the branches and little twigs that go off seemingly separate things. There's just variations. Different variations in form. It's in form is where all the variations seem to take place. When you can really work it down, it's just one trunk or one belief. So that's good news. It's not like you, in that sense, it's not from a quantitative sense that you have to literally look at every leaf. Yeah, you can just take anyone and trace it down. It seems like the mind looks at as many of those branches as necessary to start seeing that every one of them goes back to that trunk. Yeah, it makes that connection. Until it generalizes in that way. So it's like once the mind sees that that's the case, then that kind of takes all what's left away with it. It takes care of the rest of all those other branches. The ones that felt sweep. Idea, and of course, the ability to miscreate. Oh, Frank Hammons, he placed a limit on your ability to miscreate. And that was the Atonement. The way that Jesus describes the Atonement, he says the Atonement was built in to the space-time belief. And the answer, the Atonement or the Holy Spirit was built into it.  I mean, once the safety device is put in place and it works for every leaf and every swig and every branch. You know, it's like every single possible scenario, no matter how dark and twisted and distorted the dream can be, there's the little safety device that's tucked away in there. And that's the Atonement. It's the stages of the development of trust. In the Teacher's Manual he says that there are 10 characteristics of God's teachers that reflect an advanced teacher and he starts off with trust, is number one in honesty and goes into tolerance and patience and different ones. But he says the characteristics rest on trust. They all rest on it. And he goes further and says that here's five or six stages that the Teacher of God must go through. And early on one of them will seem as if things are being taken away. You know, it can seem as if jobs are being taken away, people are being taken away, possessions are being taken away, skills are being taken away, it can seem as if teeth are being taken away, something that was an earlier issue he talked about. I thought you said Keith. That too. Keith is being taken away. It's a joy, that's true. It seems as if Keith is being taken away. I'm missing my husband. But it's like, what it really is is the mind is starting to see lack of value in the things of the world. So symbolically it's being represented as if things are being taken away. But that's just an interpretation. You know, there's no such thing really as being taken away. You have to really believe you have something before you can believe it's being taken away. And that's not the case. But to the deceived mind it believes it has lots of things. And when those things seem to be lost or taken away, then that's this interpretation of it. So those would be good to do just a review on some of Dave's stages of development of trust. We just did an Adrian, a fellow down there, Tom. When he came up here to this house to visit and go into things in his mind he thought he was like right about on level four. And we came over to talk about it and he just went over the first two with him. And that was it. And he went back and he started going over him and he went oh shucks. I'm just on the first I'm on the first one. I thought I read these before I thought I was on four. But you know it's that whole thing of and also when you read him he talked about periods of unsettling and the later anything after two was pretty advanced. Really. I mean in terms of the teacher of God, wouldn't you say? I think a lot of people read through them and say oh wow yeah sure. I've done this, this, this, this. I'm in between four and five or you know this, that and I think that's not always a parent. Do you want to take characteristics at levels? In the trust trust. And we could go over them sometime like I did with this fellow Tom about you know initially it really does seem to be more of a sorting out in terms of situations and behaviors because that's all the mind believes in. The deeper you go it's more of a sorting out of thoughts. But initially the mind thinks so much of situations events and behaviors that it really starts off as which of these situations is most helpful to me.


Boys and girls, today we are going to work on learning a new strategy to help us with our comprehension when we're reading. And we actually talked about this just a little bit yesterday. The one we're going to work on today is called Make and Adjust Predictions. And Jackson actually wrote this one for us. And when we are reading a book, one of the things that can help you with your comprehension and help you enjoy the book is if you are making predictions as you go before you read it. After you read it, is it a prediction? No. That's because you already know the answer. And what is a prediction? Who can tell me what a prediction is? Hayden, what's a prediction? A prediction is like if someone doesn't know something, you can predict what's going to happen. Yeah, it's kind of a guess, isn't it? Yeah. Yeah. Well, we are going to read a book. And this book is called An Extraordinary Egg. And in this book, we're going to make some predictions about what we think is going to happen. So here we go. If you can't see, you need to move where you can see, OK? An extraordinary egg. Now, when we look at the cover, what's on the cover? We got an alligator. What's this? An egg. And a frog. And we already know from the title, Extraordinary. That's a really great tune into an interesting word, isn't it? Yeah. That's an interesting word. So we're going to find out about extraordinary. On Pebble Island, there live three frogs, Marilyn, August, and one who was always somewhere else. So already, we can kind of make a prediction. Where do you think that third frog is? Leigh? In the bush. You think that third frog's in the bush. What about you? I think he's hopping around anywhere. Just hopping around anywhere. What about you? I think he's where the egg is, where the frog and I are. You think he's with the egg and the crocodile. OK, so let's save your thoughts. Let's see if we can check our predictions by reading the rest of the page. Now, were we able to figure out what was happening by reading on? Did it help you enjoy the story more by making guesses about what could happen? Those were your predictions.


And give a great round of applause to Sebastian Eschweiler. So, hi everyone. So, I want to talk about how I defeated not Petya's cryptography. Some might say that not Petya would be Ukraine's scourge. And for those of you who don't know what scourge means, this guy right here doesn't know either. Quick trivia quiz. Does anyone know what this movie is? What's the name of the movie? So, in the next scene, Johnny Depp enters. In the next scene comes Johnny Depp. A movie by Jim Jarmusch. A soundtrack by Neil Young. Dead Man. Right. Great. So, great movie. So, if you want to know what a scourge is, then you could watch the movie. So, let's begin with my talk. This is what actually the official Ukraine Twitter account tweeted some time ago at the end of June 2017. And there was an outbreak of a ransomware attack which was noticed mostly in Ukraine but also all over the world. So, millions of users and also companies, large companies were affected. And the damage went into the billions of dollars. So, the problem there is, I mean, this is not the everyday ransomware outbreak you will have. And I want to give you a short glimpse into the non-Petia Universe. And also how I decrypt all these stuff that actually was encrypted by the ransomware outbreak. So, first I want to begin my talk with a differentiation. I want to draw a demarcation line because all this non-Petia Universe, there's much sub-summarized under this whole label. And I really am just talking about a small fraction of this whole Universe. So, I will first distinguish between what my talk will be and what my talk will not be about. Next, I will describe non-Petia's cryptography and especially non-Petia's cryptographic failures which I then will be exploiting in the remainder of the talk and see how can the entire research get their vacation photos back. So, what was this whole thing? The outbreak started, as I said, in June 2017 and it started as a fake update or a malicious update from a software called Medoc. This is a text software, one of the two official text softwares in the Ukraine, so almost every company has it installed on text accounts on their computers. Many private persons have it installed. It was pushed and then side-loaded. This file proceeded that, was then downloaded to the computers and it comprises several parts. And some parts are more interesting than others. So, one component after like half an hour time, it would start encrypting the files depending on the access level. So, if there wasn't any access to infect the computer with this MBR factor, then it would just, based on the current user level, encrypt the files based on that current user. And like of a better name, I would call this Misha component. I know it's usually somewhat different, something different. However, this was the best name I could find there. So, it's basically just a final encryptor with AES. My talk will not go about this part, this file. The next very interesting component was the spreader part. It's basically based on the eternal blue, eternal romans exploits that had been leaked by the general romans exploits. My talk will not go about this as well. My whole different universe as well. What my talk will be about is the actual not-patient component. And this is an MBR cruiser and I will show you in the next slide what it's actually about. So, the user will see something like this upon reboot. So, if the access rights are granted, so if there is some local admin installed on the computer or the correct password could be guessed by some attack, and then this dropper, the proceed dat, would infect the dropper by overwriting the master boot record with a custom boot loader. And then reboot the system after a time, usually being about 10 minutes, and then the actual not-patient component would kick into action. This boot loader shows this check disk screen, and in the background would find and distract the files on the file system and it could hold this file. So, the main takeaways of this slide are that we are dealing with a 16-bit code here. So, we're in 16-bit real mode. So, this means no proper file system, no file system or 64-bit code. And there are no Windows APIs. So, debugging all this and analyzing this is a key. However, we have something on the plus side, we can say BIOS, you know, the basically output system and with that comes a range of interrupts very well-described and have a really nice interface and being able to debug all this and this was a plugin that had been developed by the authors. So, let's analyze a bit and check the cryptography and why that was really hard. I want to start with Salsa 20 and then talk about Salsa 20 and then compare the not-patient implementation. So, Salsa 20 is a power connection algorithm. There you have a plain text and you will have some kind of random number, pseudo-random, pseudo-random and the operations on the plain text and then what you get there are four different variables. There is the constant part which is obviously not variable and what we will see about that is obviously a very wonderful variable but we will take a look at it again. And then there is this really new thing, what's so new about Salsa 20 is when you would stream a Salsa 20 and you lose a few frames, then you can adjust this counter, so you can adjust the offset of the current so that you can adjust the distance in the current stream and then you can continue with the connection. It's a very good feature and the counter itself is 64-bit wide and the hash size down here which also creates a 64-bit hash of this input parameter and then turns it to the input parameter. If you want to have more details about Salsa then the person who found this cipher should be in the room. I guess you could ask him the details on what Salsa 20 is. That's a very, very appropriate cryptosciipher. And you probably shouldn't use IES. What's important is that at every call or every instance of NotPetya this connection there are these three variables or these three input parameters that are constant. NotPetya is the key, the connection, the nonce and the constant, the configuration. Then the counter would only change and the only thing that changes is the counter. That means the interesting question was what is the length of the key meaning the number of different outputs that would come from all of this hashing function and this is quite clear. The theory is quite clear. There are 64 bits, so 8 bytes times 64 output bytes, so about 2 high 70 of the periodicity. One difference about the actual implementation in NotPetya and the actual implementation of NotPetya in theory is that these constants were changed so that there is only one string where Invalid Sector ID, that means the number of invalid sectors would break the specification. And the first problem that I noticed at NotPetya was something like this one. I can skip this one because I think everybody sees it so who sees the fail? Not many hands. Okay, then I'll explain it to you. I was just kidding. I just made a mistake, of course. I didn't expect that someone would touch this. So remember that there are 16 bit codes. We have these left shift operations that move a register N bytes to the left and the register here is 16 bits. So it has only 16 digits, so to say. And it's now shifted to 16, so 10 hexes. This leads effectively to the register being set to zero. And even worse, down here an 8-bit register is shifted to 16 bits. This is something that you wouldn't expect from a proper crypto implementation. And I was really intrigued why that is. I actually asked myself, why does it make sense? Does it make sense in a source code? And the authors of NotPetya were the views? Or what's behind it? And I looked at the Salsa20 implementation. I just googled it and found a nice website where there was a Salsa20 implementation. And there you would see this code. So you see here what you see here is in the conversion of the Indianness. And there are these shifts of registers. And you see this guy here, you in fast 16. So it's relatively obvious a broken implementation. Not right now. You need to know some things more about this. There are two important facts that break this implementation. And the two facts are you need to compile this code for 16 bits. And you need to look out what Visual Studio and what Visual Studio specifies here. And if you actually look it up, that it's from the standard int.header file from Visual Studio and it shows that it's simply changed to an signed int. And this basic type in 16-bit code is a 16-bit register and suddenly everything makes sense. That was in a way a problem with that the authors didn't check if the code actually worked. So they didn't use test vectors. And the person who wrote this code made the mistake that they didn't check if it runs on 16-bit code. And here are two bugs of the NotPetia implementation from Salsa 20. And I want to explain both because they are both relatively important. So both revolve around the counter variable. Just remember that this is the only dynamic input. The input that actually changes from this Salsa 20 implementation. And the first mistake is that it's a sector, a sector number in the memory. And you have to know about the fixed plate. From BIOS it looks like a set of sectors. That's 512 bytes of a block. And they just come out. So if you read a sector number, you get 512 bytes of data. And this is obviously not the offset in the stream. And there is the jump in the stream. And here the same variable is used to close the data or to close the end. I think that it's not really recognizable for the Cypher implementer. But if you analyze it, it would look like this. So you have the keystream, the keystream of two different sectors that follow each other. And then it starts with FF, then goes on with D7 and so on. And the next sector has all the same bytes identical. That's a big problem. A big mistake. Because this Salsa 20 algorithm would then be converted from a one-time pad to a many-time pad. So that's the same key multiple times. If you pay a little less on code, then the second bug is this large keyword. So if we think about it, we're in 16-bit code. So the large keyword doesn't mean that a 64-bit is pushed, but it's only 32-bits. So it's actually only 32-bits of this large keyword. And both mistakes are a problem for this Salsa 20 implementation. So in this slide I took two hex-dumps and these hex-dumps were within this two-tile hex-dumps used for this key. So basically two snapshots. One right before the two snapshots, one before this Andean-ness conversion and right after the lower half. So you very much need to know how to convert the Andean-ness. And what you can see is that the different variables into these sectors, these constants that Petya uses, North Petya uses and the key is divided into two halves and what you can see here is these non-s and what really stands out is this amount of nulls. So the upper part of the 64-bit variable is not used, it's not even filled. So the first problem here is the first problem here and after the conversion of the Andean-ness, you can see that here not really an Andean-ness conversion is happening, but here bytes are nulled and the result is that this originally 64-bit variable would now suddenly be only 16-bit long. And I said I'm going to implement as key length and right now we have 16-bit bytes, so 16-bit times 64 bytes in key length so 26-bit key length, so 4 megabytes in the end instead of 2 high 70. That was a very interesting observation that I would have made here and that would lead to that you can connect together with this many timespad, so that the keys are used again, so it's very easy to break these keys here. To sum it up, we have a very, very short key stream that is often repeated. In every sector that we continue, there is only one byte further. So only 26-bits remain of this whole stream and as I said instead of a one-time pad, there is a many-time pad. I couldn't come around to implement a small joke here, so I didn't have the time to implement a short joke here. But I would say if someone does this implementation, then it's a larger 20 than the larger 20. Sorry. The main goal is to reconstruct a crypto-expert that's the only thing I know about plaintext. That's the only thing I know because it's so straightforward and for the rest of the talks I will show how I did it. Without further ado, we use the weaknesses and try to reconstruct the plaintext from a patya-inficient drive. The modus operandi from patya looks like this. Let's stop with the left-hand side of the slide and concentrate on the right-hand side. We leave the left-hand side and concentrate on the right for those of you who don't trust the details with NTFS. So don't worry. It's pretty simple. Every NTFS partition is called MasterFileTableMFT and it would contain some metadata to the files and if the file is small enough the actual content even fits the content of the files in this MFT. As I said, MFT is just very large. If it is a pointer, a data run that shows a cluster or a sector on the disk on the partition that actually contains the data. One of these MFT records is about 1 kB in size. Let's zoom out a bit and look at how this implementation in NorthPetia is used. NorthPetia actually iterates all these MFT records and then checks if this record shows a detail. If so, NorthPetia will close the first kilobyte and then the MFT. This implementation is good for different reasons. First, for efficiency it only makes sense to close the first kilobyte because a lot of interesting information is in this first kilobyte. For example, the data header compressed files have these very important components, wouldn't be able to work anymore because most of them would be able to use a header to recognize what kind of format it is. This MFT can be considered as a table of thoughts to know pointers to the files. You won't have any pointer to what you should work on. This is very elegant from the implementation point. And still very important. The MFT is also very important to recover that first and then check what I first tried to set the MFT and then whether I can continue with the solution of the files. The metadata seemed more important to me for the first one. I am a very visual person and here I took two disk dumps from one of my test disks in one of my test files. I added a clean system with Notepad here. And I took images from the test pad. On the left is the unalloyed version and on the right is the unalloyed version. I just clicked to get a picture of the unalloyed process. On the left you can see an indicator of how much of the data is actually differentiated how disk is more or less being encrypted. You can see that the entire hard disk has been closed at the bottom part here. At the bottom you can see that it is dark and the MFT might be a misconception. So my idea was something like this and we have two MFT files. We have an MFT and the unalloyed data. I wanted to analyze the MFT and extract the MFT from the MFT and after this analysis my goal was to use a little box here and actually decrypt that and then I was able to get the unalloyed MFT on the disk and then I was able to recognize the unalloyed files on the MFT and also unalloyed them. That was my first idea. Let's start with the MFT connection. A known plain text attack. A MFT looks from the perspective of the key stream something like this. On the left side we have 0, 1, 2, the data input and in the splits we have the actual key stream that was used to decrypt the input. What you remember is the function that the plain text decrypt with the key stream is just an XOR function. We have the key stream, the plain text and the only thing that happens is an XOR with which we can change. What you see here is for the first record we have very few key stream or sample bytes but if we move through the tables with the analyzes we will have more and more sample bytes that we can collect. That should give us more clear view of the key stream. The question is does the MFT hold enough plain text to start a known plain text attack? Let's go into the specification of the MFT. Every MFT has two information. The standard information a defined structure and an attribute list the second part. A dynamic structure that would be a bit more difficult to find the plain text. So I concentrated on the first part and the first part I quickly showed that the first part is the entry in this MFT and as you see it starts with a file and then some hex digits and on the bottom part of the slide I put my additional levels of different sample bytes I would have multiplied by the number of sample bits with the reliability of this plain text. So for the first record I have a pretty deep reliability of just one byte with these two bytes that are usually 500 bytes per sector normally you have 512 bytes for each sector the keystream goes for 2 bytes for the entry number 100 I have a security of 4 because I have 8 bytes at the beginning of each entry in fact the problem there was towards the end I would have many many I had many unknown entries because I had to focus on the first part of the headers that means at the end of the keystream I could not do any meaningful analysis so for every set I would calculate a histogram and check how many different bytes are in plain text in this position so I would need some kind of plain text attack so I have the plain text I have for this offset each entry this histogram and the question is how do I get many MFT entries so I asked a few colleagues who just gave me some MFT copies of their system the result of this search was pretty nice for all the first entries you can not do much for these entries there are very few samples but further in the data stream there is a dramatic change of this relatively deep security of 4 I could reach over 30 it's very nice and after doing science I came on this table for these two attack attempts for comparison of these two attacks let's start on the right and read it to the left for the first approach I have about 98% bytes with records and the nice approach is you have a unencrypted hard drive we have a unencrypted hard drive from which we can start after infection and then you let the infection process and then you can differentiate a differentiated base and can try different snapshots and all the stuff and there are different key values and you can test it all I could exactly pinpoint how many of these records were and find out how many bytes or how many records I could decrypt almost all of the bytes which is also quite nice is that we have zero false bytes of bytes which is not as nice as I could decrypt about 1-3% of the bytes this whole byte is about 4 megabytes and I could only reconstruct about 50 kilobytes or is it so? that was my next question so I drawn another nice diagram and this is the keystream that is the MFT in this keystream the keystream is only filled with the sample bytes and with about 2 megabytes and the question is are many files in this area in this area are there any files that I could use so I would check how many files I could decrypt and where the files are and the keystream is used in different keystreams using the whole byte sometimes more, sometimes less but actually the whole region is used in a perfect scenario in a perfect non-plain text scenario I could reconstruct everything but this is a problem here and I will solve this problem in the next part of this talk and I will show you how I could handle this problem think about that if the data system is decrypted by Lepetia then the data system looks like this we have the MFT we don't have data showers who show data so no nice data names and so on but with the first level the MFT looks really nice almost 100% of the entries we can reconstruct that means a lot of the metadata that we have we can use to decrypt the rest of the data and for files you would have the very first kilobyte the first kilobyte is decrypted and the rest of the data and the most data is bigger than a kilobyte the rest is actually not decrypted that means you have all the metadata that we can use and use as known clear text for the known play text attack and I have three approaches to handle this problem and the question I asked was what kind of data is there because I think you can easily recognize the data type you have the data extension and you can assume that is the data type and there are different types structured data and unstructured data I have imagined there are source text which I would call and I am doing a histogram which bytes are more likely or something like that to use a clear text attack and the second structured data I have chosen the same approach as with the MFT and then quickly see how many bytes per offset that is the end and the last approach is to use more of the data not just metadata but also data in the data and let's take a closer look as I said what I have here is only this small amount of data the rest of the data is not encrypted and also the data name the size of the data is not encrypted and what I do is I create a database of known data like Windows system data you might remember the background images and so on there is a lot of data that are available if you just search for it and basically we have three different differences between these to decide what is the correct clear text the correct size of the data name and the hash of the rest of the data if all of these three match then I would say that is the correct clear text and there are some collisions that means that is nothing that is very easy to do so the original idea the original idea is to analyze the MFT and then in order to to decide we have to change the database of known data and an additional level of analysis that goes into this box and then we are hopefully in the position to decide the data and then we will do some research and let's see if this would be a good approach for real data in the real world so let's do research first something to drink so what I did here is I have a data bank of known data and a whole lot of database installation of Windows data that was 340,000 data and then I built this histogram that I already talked about and prepared my test setup and these data were not part of my data bank that I talked about and then I infected this machine with NotPetia and tried to reconstruct the data and these are the results I did this with four different runs so I made it four times I tried the first run and then I made the three runs and it looked like if I had this generic histogram I could reconstruct only two data at least 8% were able to use this standard histogram with the over 90% and together almost all data could be solved so much about academia and the problem here is if you use this on the real world then it can lead to more problems there were a lot more things like for example installation of windows that were not very common or where a lot of updates were played and that was very challenging for me and there are a lot of programs that you can extract from a well-known source like .NET or Java installation especially the JDK that leads to 10,000 Quail Texts and that was really quite nice and that was actually quite practical the drawback there was there was so much data that you could collect that my first attempts failed because the large amount would result in the admins constantly giving me more that the admins had to give me more work in my VM and that ended up with 228 GB of RAM in my test VM and in the end the MFT the master file table gets bigger and to make a comparison of this prototype this test setup that I made at the end there was a MFT that was about 26 MB and real MFTs were at least 500 MB in the real world or could also get bigger in the Gigabyte area that means there was of course a lot more and with that you could reconstruct the full 4 MB of the power of the key and to summarize that that means the conclusion of not-pattern is possible what the data system that I looked at was having all these first bugs after these first mistakes were made I could reconstruct all the data and the chance is that the urlops photos can be reconstructed and that is the end of my talk to summarize that not-pattern has a few very fatal mistakes regarding the cryptography I would call this not-soul-signal not-soul-signal it might be possible to look into this expand key expand key expand key there are a lot of cryptographic problems that I didn't look at but I know that some of you are professors and that might be a nice homework for your students that you look at to analyze the cryptography and you should note that this whole not-pattern you should keep in mind that the cryptographic mistakes are not only in the not-pattern there are these clums every single version of the not-pattern all of these not-pattern that you may have picked up can be solved and the last point that I wanted to mention if ever you are really a treyana then you should lift the not-pattern in a cabinet and wait for a lecture like this one and then hope that someone will have these clums and then you will have your vacation pictures that would be all from me thank you for your attention thank you very much Sebastian now it's time for questions please queue up by the microphones time for questions please the microphones thank you very much for sharing your findings with us I'm from russia the largest harbor in europe and as you might know we were struck by petia the terminals went down for a couple of days a couple of hundred million millions of damage and your price is quite theoretically so now the practice if you were there in the summer with these findings would all the companies stop running again or would you have the data it's a practical approach we have a practical approach and we have some locations where we were able to help the customers it's a a very practical thing and I was trying to I wanted to this slide here to make it clear that I wanted to talk about the real world in this scenario and I looked at a lot of fests with not petia and I could see almost all fests that could not be fenced there were mistakes level 8 I know that I don't know thank you microphone 6 please thank you in the beginning you mentioned that basically the key was shortened 26 26 yeah from that point wasn't a brute force attack way faster and way more reliable no no no don't get me wrong I don't understand the length of the key stream was 2 to 26 so 4 megabytes so you won't be able to brute force that so do you get that so the number of bytes was 4 megabytes and you couldn't be able to brute force that yeah but you already mentioned at the beginning that you basically shortened it down to almost 2 to the power of 26 and I guess you quite calculated yes yes I understand the question but I think the point there you don't understand it doesn't matter the space the length of the key was 2 to 26 I'm not very good to transform that into a decimal representation 2 to the computer guys 2 to the 26 how many bits is that so again a lot so it's 4 megabytes of key length you couldn't just just brute force that because you would have each of 4 megabytes got that the key is not 2 to the 26 the key is not 2 to the 26 but the length of the key is 2 to the 26 got that the key space would be longer than the bible you know if you brute force the bible the text of the bible would give you enough time longer than the bible you couldn't just just brute force that you could just there's this theory with the afs and the writing machines but I think you just switch 2 numbers questions from the internet please does the MFT work the same for petia and not petia does the MFT work the same for petia and not petia the algorithm behind it is the same the cryptography differentiates in such a way the constant number different so this thing here that's different it's usually like expand key something something and here it's invalid sect ID it's in a way different but the encryption the bytecode the algorithm that's actually the same any more questions there's still questions then please give a great round of applause to sebastian then please give a big applause to sebastian and that will end