Archive for August, 2009

CSI Opuwo

August 17, 2009

It’s finally happened – today I was helping police with their enquiries in Opuwo.

Previously on CSI Opuwo…

A few months ago a spate of burglaries took place in Opuwo which resulted in, among other things, a number of laptops being stolen.

Some of these were from the Peace Corps house and one was from the house of the Chief Accountant here in the hospital.

The police later raided an address and recovered numerous items including several laptops.

The Peace Corps, with their serial numbers all written down, were able to identify and reclaim theirs straight away. Unfortunately our accountant didn’t have a record of the serial number and when he inspected the laptop the username had been changed and his files deleted.

As such the police weren’t willing to return the laptop to him without proof of ownership.

In This Exciting Episode of CSI Opuwo…

Having been watching some quality crime-related stuff recently (Ronin, the Sopranos, the Wire and a few CSIs) I was naturally expecting to get issued with a gun (or two) and then take to the streets hunting for the perps before getting a confession from them at all costs.

Failing that at the very least my examination of the laptop should turn up some darker conspiracy, perhaps involving the Vatican or the President (“but it says here the date for the assassination is… my god… tomorrow morning at 9am”) whereupon I’d get a gun (or two) and then take to the streets squealing cars round corners, shouting into radio mikes and hunting for the perps before resolving the situation at all costs.

I would play by no rules but my own twisted ethics, barging aside all who stood in my way and corrupting those necessary to get to the sordid truth of the matter. Stopping at nothing. Stopped by no-one. A law unto myself.

Absolute worst case I figured that I’d get a gun (or two) and then take to the streets looking for clues and patterns in the tangle of evidence, rolling my way up the chain one perp at a time, fighting against my own departments inaction and the bureaucracy that always seems to work on the side of the bad guys, until finally nailing Mr Big with a stunning piece of courtroom double-cross.

Oh yeah.

Of course what actually happened was I went to the police station, discovered the laptop had no power, went back to the office to fetch a suitable power supply (luckily had one). Switched the laptop on. Logged in and immediately found the accountant’s surname in a folder.

“Good enough for me” said the Detective.

Case closed. Well rather 30 seconds of examination, 30 minutes of written statement and then case closed.

I did offer my services for any future computer forensics work they might need but I think in Opwuo this doesn’t arise very often.

On the Technical Side

If you’re not a tecchie you can stop reading now (unless you have already of course)

I got involved after the accountant and another chap from the hospital had already been to the police station to try and identify the laptop. I was told that his “files had been deleted” and the “username changed” so there was no obvious proof of ownership.

I prepared myself with a number of freely available (and seemingly quite good – in my trials they found all of my, ahem, cached and then deleted items).

At home obviously das Babylon would do it themselves and if I needed to do something similar would go about it very differently probably whipping the drive out and imaging or some such but TIN and I have no money or access to connection converters etc.

My plan was to fire up, first have a look at the user structure seeing if there was anything obvious, failing that run a deleted files recovery and poke around the registry with a search for the chaps name (no doubt endless pieces of software would be installed storing install locations and registered users in that black hole of sin).

On finally finding a suitable power supply and booting up I was met with a user called “C-Pax” or something bizarre which was password protected and a guest user.

Alas I thought I’m now going to have to hack Vista which though I’ve never done I’m sure is a google search away.

Tried the guest user and, unsurprisingly, can’t access C-Pax’s documents.

However sitting in C:\Users are two directories – one for the guest and one in the exact name of the accountant (user renaming obviously doesn’t change the user directory name).

Bosh. 30 seconds.

I was quite disappointed in a way, was looking forward to hacking my way into the admin account and then running file recovery utilities. I would, by law, have had to change the colour scheme so the terminals were green-on-black. Oh, I’d also have needed a wall of TFT monitors and been listening to thrash metal whilst typing simultaneously like a nutter on six keyboards.

So probably a bit of luck.

It does raise an interesting point though – password protection.

The accountant’s user had not been password protected. I would normally have said “you fool” but… consider this;

The laptop wasn’t stolen for his files or data. If his user had been password protected (along with no open admin account) then in all probability the thieves would have just reinstalled a fresh vista (with nice legit licence key from the bottom) or XP wiping the hard drive (much easier than hacking your way in and then going about renaming the account etc).

Because his account wasn’t locked it was easily accessed, files deleted and renamed.

Leaving the evidence behind that enabled it to be identified by the Opuwo Computer Forensic Investigation Team (me).

So I suppose he was kind of lucky for that.

Not as “lucky” as he would have been if he’d recorded the serial number or marked the laptop with a UV pen of course.

Advertisements

The Big City

August 13, 2009

This week I’ve been in Windhoek the capital of Namibia.

My time here has mainly consisted of driving around, screaming in sheer fear and horror at the four and five lane monstrosities, getting lost (many times over) and managing upwards of 20 minutes in a shopping mall before having to go and sit in a darkened room and recover from over-stimulation.

I’ve also been “orienting” myself at the Ministry of Health and Social Services head office so meeting and chatting with various IT bods. It’s good to see life is the same the world over, offices full of semi-functional kit only the technician knows the status of, servers that nobody dares reboot and having to take circuitous routes around the office avoiding certain hot spots where the inevitable shrill cry of “eyeee-teeee” will go out as users stampede complaining of “go slow”.

In between I have also been transporting various (much more senior than me) people here and there (getting lost many times over in the process) and calling into the VSO office (where I am now in a secluded corner leeching their internet).

It turns out here in the big city people don’t always greet each other walking along and you’re regarded as a bit strange if you stop and say “Hello, how are you?” to nearly everyone you pass on the street. Tsk these city folk.

Back to donkey carts and dust on Friday. I’m also looking forward to being back somewhere there the direction “the green house” really is enough as you can just climb the hill and look for a green house (small hint to my colleagues – in Windhoek it is not enough to just give me the colour of the house, I need turn-by-turn directions and ideally someone standing on the roof with a flare or signal rocket).

Did get a chance to see a couple of local vols though and catch up with my good friend H who is settling in nicely at Katatura and loving every minute (“What do you mean you can buy fruit every day? What witchcraft is this!”). We also (thanks to the Namibian approach to Health and Safety) climbed up onto the roof of Katatura Hospital last night and saw electric lights stretching to the horizon. Crazy.

Oh and also caught up with VSO staff and received a parcel from home – the very first one sent back in February, dated through customs this month – which I had given up on.

Some Pictures

August 7, 2009

Some random pictures to keep you occupied while I try to think of something to blog that’s not hugely depressing (HIV/AIDS related) or hugely scary (Swine Flu is HERE).

A Village Near Opuwo

A Village Near Opuwo

The "road" I Drove to Get to the Village Above

The "road" I Drove to Get to the Village Above

A Fire at Night in a Kunene Village About 60km From Opuwo

A Fire at Night in a Kunene Village About 60km From Opuwo

Sunset in Kunene... and a Donkey

Sunset in Kunene... and a Donkey

A Couple of Kids Outside the Etoto Clinic

A Couple of Kids Outside the Etoto Clinic

A Giraffe Near Outjo

A Giraffe Near Outjo