Coroner's Toolkit - For recovering deleted data in Linux/Nix systems

This tool is asome. I will do some R&D work on this and let you know how to recover deleted files and do computer forensic's on hacked system
comming soon...................!

Like the post? Please Subscribe to free RSS feed to get updates

Why we can create only up to 4 primary partations?

This is the question which pops in my mind that why not more than that 4 partations

here is the info how many partations we can create

actually in basic hard disk, we can create 4 partition(either primary or extended)

we can create maximum 4 primary
or 3 primary + 1 extended
or 2 primary + 1 extended
or 1 primary + 1 extended
not more then that? why and what is the reason?
The reason is because of a limitation of the MBR(Master Boot Record- the first sector of the harddisk.)
The MBR is only 512bytes of size, it is needed to store the primary boot loader, and the partition table. Typically, the area reserved for partition table is only 64 bytes. And the partition table entry for one partition is 16 bytes. So, 16x4=64. The space is over. so we cant create more than this

here are the sources for your reference

http://kbase.redhat.com/faq/docs/DOC-1653
http://en.wikipedia.org/wiki/Master_boot_record

Like the post? Please Subscribe to free RSS feed to get updates

lsof Command

Today I came across ISOF command in one interview, the interviewer of this interview is a tricky guy and a great Linux/nix guru. He asked me many questions which I can’t answer, in that lsof command is one. This command really impressed me and this is one of the most powerful command i ever come across till this point in Linux. So I did some research on this command and come across numerous examples for making network/system admin work bit more simple and meaning full.

So what is lsof command?

lsof is nothing but LiSt Open Files, which will show all the open files by

1.   a process in system.

2.   a user.

3.   a command.

4.   a network service.

5.   a regular file.

6.   a directory

7.   a block special file

8.   a character special file

9.   an executing text reference

10.        a library

11.        a stream or

12.        a network file (Internet socket, NFS file or UNIX domain socket.).

So where we will use this lsof command? In many situations such as when troubleshooting network related issues, file related issues and process related issue. 

USAGE1 : To see all the open files in system with out filtering which lists all open files belonging to all active processes. 

#lsof 

USAGE2 : Some times we will face an issue like, some service will not bind to a port and cannot start the service, this is due to some process already using that port(though the process died). So we have to see which process is using this port and kill that process. this will eliminate restarting the server. Suppose we want to start ftp server which will not starting due to above problem. 

#lsof -i TCP:ftp 

here -i is used to specify Internet 

USAGE3 : To see what files are opened when you execute a command 

#lsof -c httpd

here -c is for specifying command. 

USAGE4 : To see which file opened for a device 

#lsof /dev/hdc 

USAGE5 : To see which procces or user is accessing the file. 

#lsof -f filename 

Example: 
[root@v-test Script]# lsof -f passwd 

vim 14122 root 4u REG 253,0 12288 234655 /etc/.passwd.swp 

[root@v-test Script]# 

USAGE6 : To monitor network, what people are doing with what network services 

#watch lsof -i 

Note:watch is an excellent command to repeate a command execution on a regular interval please have a look in to my other blog post about this watch command.

USAGE7 : To see all open internet files 

#lsof -i -U 

USAGE8 : To see Ports either its TCP or UDP 

#lsof -i TCP:22 

For checking all the connection for ssh port 

#lsof -i UDP: 69 

This is for tftp connections to the machine. 

USAGE9:To watch all the actually by a user in live..?

#watch lsof –u username

A good link for learning more about lsof command link1 some sister commands for this command are pstree, ps and netstat 

NOTE : Some strange things I observed about this command is 

1.Till this point I know that to use any commands options we have to use - but for this command there are both + and - options too.

2.In linux every thing is considered as files even a network socket, hardware device for some examples.

Please comment your thoughts regarding this post:-). Please give us your feed back here

Like the post? Please Subscribe to free RSS feed to get updates