Hello i need some help

maurice19 · 12-21-2009, 02:56 PM

Hello am a student, i have a projet on unix forensic and anti-forensic tools. In the forensic tools i have found a method that is based on changing the inode of a file, but am not being able to change the inode, does anyone know how to change the inode or where can we find a C/C++ program to do that?

And another question plz where can we find the source code of the ext2 file system?

Thanks for ur answers.

markush · 12-21-2009, 03:11 PM

Quote:

Originally Posted by maurice19

...
And another question plz where can we find the source code of the ext2 file system?
...

Hello maurice19 and welcome to LQ,

google for "e2fsprogs".

Markus

maurice19 · 12-23-2009, 01:29 AM

markush i checked the e2fsprogs but i didn't find a special code, do u have any specific site where i can find it?

another question can we use debugfs to change the inode if yes what is the command to do that?

Thanks.

Nylex · 12-23-2009, 01:30 AM

Quote:

Originally Posted by maurice19

And another question plz where can we find the source code of the ext2 file system?

In the source for the Linux kernel? You can get it from www.kernel.org.

maurice19 · 12-23-2009, 01:36 AM

nylex can we modify the source code of the Linux kernel?

Nylex · 12-23-2009, 01:39 AM

Yes, you're allowed to do that under the terms of the GNU General Public License, which is the license that the kernel is released with.

maurice19 · 12-23-2009, 01:41 AM

you ever changed the inode of a file nylex?

Nylex · 12-23-2009, 01:42 AM

maurice19 · 12-23-2009, 01:44 AM

ok thank you hope i will be able to do it using the code of the ext2

maurice19 · 12-23-2009, 02:04 AM

Is this the code of the ext2 http://www.kernel.org/diff/diffview.....1-2.bz2;z=all with the patches or it is a patch only? excuse me because i really dont know what is the code or how it is made of.

Thanks

Nylex · 12-23-2009, 02:06 AM

Get the full source. Once you extract it, you'll find the code for ext2 in fs/ext2.

AwesomeMachine · 12-23-2009, 02:07 AM

Sleuthkit contains tools to change the inode of a file. But if you change the inode manually, the file is lost. The only way you can ever find it is to manually go to that inode and follow it.

maurice19 · 12-23-2009, 02:11 AM

Sleuthkit contains tools to change the inode of a file. But if you change the inode manually, the file is lost. The only way you can ever find it is to manually go to that inode and follow it.

1st Sleukhit is a forensic tool right? it is used to check if there is changes in the inode? How can we use it to change the inode what is the command if u have ever use it?

2nd where can we find the inode to go it then what u mean by follow it? thx

maurice19 · 12-23-2009, 12:25 PM

does anyone know how to use sleuthkit to change the inode? i have done many research but could not find the way