Open Source Digital Forensics

http://www2.opensourceforensics.org/home

Looks like it would be a good resource for anyone needing to rescue a machine or investigate one.

cgroups per tty on Ubuntu 10.04

I had some problems following http://www.webupd8.org/2010/11/alternative-to-200-lines-kernel-patch.html on Ubuntu 10.04, even following the Ubuntu instructions.

I think the problem is that cgroup was already mounted at /cgroups with default options, and that refused to allow a second mount, or allow non-root users to write to it.

So I altered the mount in fstab from 'defaults' to 'cpu', and make the /etc/rc.local script just do the subdir creation:


mkdir -m 0777 /cgroup/user
echo "/usr/local/sbin/cgroup_clean" > /cgroup/release_agent

With similar changes to the /usr/local/sbin/cgroup_clean and .bashrc files.

Memory Info

How to find out physical memory information:

Windows

Use cpu-z from http://www.cpuid.com/cpuz.php

Linux

Use:

dmidecode | grep -1 DIMM

From http://fixunix.com/hardware/262119-how-get-physical-dimm-count-under-linux.html