• Tutorial: How to remove/uninstall Gnome 3 in Ubuntu 11.04 (Natty Narwhal)

    31 May 2011 Author: Stefano Prenna
    23 Comments

    Natty

    Have you installed Gnome 3 from ppa:gnome3-team/gnome3 because you were tired of Unity or just because you wanted to test the new shell and this has broken your login? Are you now on the login screen but no graphic environment will ever work?

    Then you have to remove gnome 3 following the steps below:

    –         Press CTRL+ALT+F1 to access the terminal window and log in. At the prompt type following commands:

    –         sudo apt-get remove libgtk-3-common

    –         sudo apt-get install ppa-purge

    –         sudo ppa-purge ppa:gnome3-team/gnome3

    –         sudo apt-get dist-upgrade

    –         sudo apt-get install gnome-panel

    –         sudo apt-get install lightdm

    –         sudo shutdown –r now

    The pc will reboot and you should be able to use Unity/Classic login again.

    05/04/2013 *UPDATE* (thank you Anthony)!:

    If after the reboot the machine is not booting in Unity or Gnome3 and it’s just loading the terminal, maybe you’ll have to reconfigure lightdm to be the default login manager:

    –         sudo dpkg-reconfigure gdm

    You will see a window similar to this one (where you should then choose “lightdm”)

    gdm

     

     

     

     

     

     

     

     

    Good luck!

  • Tutorial: computer forensic analysis – how to recover lost or hidden data (on both Win/Ubuntu)

    19 May 2011 Author: Stefano Prenna
    No comment yet

    Magnifying Glass

    No matter what but if you work in the IT support business you will have to deal with user’s data. You will have some interesting tasks assigned like:

    1. Recover data from somebody else’s pc (Live Capture);
    2. Restore deleted data (Data reconstruction);
    3. Network Investigation;
    4. Wipe data.

    We need to remember that the machines we use in a corporate environment are property of the company which bought them. Even the data located on those machines are property of the same company. This means that you can receive some requests that look like something that should be done by a computer forensics expert.

    In this article I will list some of the most used freeware tools for both Windows and Linux to recover data from a forensic point of view.

    What we can recover?

    There are software available to recover almost every kind of file (images, music, video, documents like word, excel, etc).

    The basic idea is that every kind of file has one or more parts in common (like the header, just to give an example). This means that if we are looking for a specific kind of file we can use the right tool to not only undelete files, but to focus on the ones we really need and try to better recover the ones which have been partially overwritten.

    Headache

    From where we can recover?

    The options we have are basically two:

    1. Recover lost information from RAM (if the machine has not been turned off)
    2. Recover lost information from DISK (file has been deleted from OS)

    How do we recover?

    There are different toolsets, frameworks and even small freeware utilities available. Some of them are free others are quite expensive. I’ll put a small list here and I’ll try to cover each one of them in a different, specific article during the next days.

    Caine: www.caine-live.net/

    MDD: http://sourceforge.net/projects/mdd/

    The Volatility Framework: https://www.volatilesystems.com/default/volatility

    Windows Forensics Toolchest: http://www.foolmoon.net/security/wft/screenshots.html

    PTK: http://ptk.dflabs.com/

    Ocfa: http://sourceforge.net/apps/trac/ocfa