Windows 10 Default File List - first look

One of the first thing you should do in learning about a new operating system or identify patterns is to create a file list.  Try to focus on time stamps to identify what files were changed as part of the installation process.  Files might contain relevant information of the installation process, so make sure you document basic time information as you install the OS.  Those files should be a good starting point to  start your research.

Later on, you can use the hash values to eliminate some of the files that are not changed between reboots to further reduce files to research.

Practicing to look at files in this way can help you become someone who can find new features in new operating systems to help everyone learn about the new technologies implemented in new operating systems or applications.

Install file used, ( Windows10_TechnicalPreview_x64_EN-US_9926.iso )

Download files' metadata of default Windows 10 installation.
https://drive.google.com/file/d/0ByrtM1fcMgt6QkpkenZNNV9iMDA/view?usp=sharing

Timeline of install ( 2/28/2015 )

8:03 start install
8:04 click on "install now"
8:05 agree license
8:06 next at partition screen
8:13 restart
8:22 express setup
8:23 tried to login without email
8:25 entered hotmail email
8:26 entered verify email address ( yahoo )
8:29 done it again  ( mistyped the first one )
8:30 entered verification code 2005433
8:31 installing apps ( no interaction )
8:34 desktop
8:34 typed notepad and launched notepad app
6:36 ( time off ) typed regedit
8:37 changed time zone from Pacific to Central
8:39 turn off

Technology and Generations

What generation are you and how do you see other generations? Do you work with other generations; what do you think how they see you?
Baby Boomers: 1943 - 1960s
Generation X: 1960s - 1980s

Millennials or Generation Y: early 1980s - early 2000s
Generation Z: mid 2000s to present day


I'm a GenX. Somewhat computer dependent and a producer not necessarily a consumer. BBs have great skills in understanding technology at a deeper level, but ready to retire and reluctant to change old ways. They created today's technology, but capabilities were nothing by today's standards and they still "riding" that old, very detail oriented, but slow mentality. GenY is very technology dependent without desire to be producers. Live for today, have no plans, be successful, delay family establishment, and career oriented. GenY are great target for tech companies since make it pretty I'll buy it works well in business. Feels comfortable using technology and gets things done much quicker than other Gens using mobile technology, but lack of desire or need to understand what they are using or how it can be used against them. Great target for advertisers since they are connected 24/7. Want to make changes that effect many. No desire for details, but great multitaskers if focus is forced onto them. GenZ, technology natives do not need introduction to computers to get things done, they don't know how else to get things done. Health conscious, politically tuned out, socially impaired, and generally not interested in organized religious denominations.

  Share your thought and experience with other Generations.

How Computers Work - Turing Machine

 In the beginning, there was only a concept that eventually became the seed that started the modern area of computer science.  Alan Turing's hypothetical computer model is amazingly simple and elegant at the same time.  

This idea can be explained in simple terms of picking fruit in an orchard.  Your initial state ( Si ) is the entry point of your program where you start to make decisions.  You see a tree and decide to pick fruit from it, so you need to transition to state one ( S1 ) where you climb up on the tree to pick its fruit.  That is like starting a process and the fruit represents the commands in the process that you need to accomplish.  When you get to the end of the statements in that process, then you need to transition to another state to decide what to do next.  You have picked all the ripened fruit from the tree and any statement that you have processed, you changed its "flag" to show that it was picked and some you have not.  In any case, you climb off the tree and see if there are more trees to process ( S2), so you return to your initial state ( Si ) in order to start processing the next tree ( S1 ).  So, you climb on the next tree ( S1 ), you process it, and then you climb off ( S2 ).  You go back to the initial state ( Si ) and find out that there is no more tree to process, so you transition to the halt ( Sh ) state.  You are done with the work, so you can stop now instead of continuing aimlessly looking for trees to process.  You not allow for an infinite looping, but you realize when you are done.  That is the premise of computer science, the reliable problem solving in a finite amount of time.  It is like moving from the old testament to  the new testament;  moving from computing the result of an arithmetic operation to solving problems that humans are not capable of on paper. 

The hypothetical machine triggered a simple plan of designing a computer that stored things and did things with the stored information.  Te result of an operation could be stored back onto the computer to do something else with the results.  John Von Neumann started this "journey" with a simple sentence like this:

That simple idea later became the computer we know today.  You might be puzzled how computers can evaluate a complex arithmetic calculation, but when you analyze it, it is just a simple matter of pushing and popping values on and off a stack.  You can use the DC utility ( http://sourceforge.net/projects/unxutils/ ) to practice this type of simple calculations in a Windows environment. 

Your innovation starts by looking back to those who carved the path in front of you.  Don't ever underestimate the value of learning about history.  Deeper your understanding of technology, better your chance to innovate or improve and become a producer not just a consumer.

You can watch a video where I explain these concepts.

http://youtu.be/gUeyM28AZQQ

Also, take a look at the Fetch, Decode, Execute, Writeback cycle to learn even more about how computers are organize data as John Von Neumann designed it based on Alan Turing concept.

https://www.youtube.com/watch?v=zzxfGBzGa_c

ReadyNAS 104 and iSCSI

There are many talks about cloud storage and storing files remotely as a way to protect data from loss.  While it is a great way to use free services for this purpose, you might also need to think about learning about this technology as a learning environment.  It does not matter if you are an information technology, information assurance, digital forensics, cybersecurity, or computer science student, you will need an infrastructure where you can experiment and learn on your own.  Hardware prices and open source operating systems make the setup of this environment easy and cheap.

If you are in computer science and try to learn about programming, you might find it easier to learn about network based programming by setting up a web server and experimenting with HTML and JavaScript as a start.

It seems like every application that is written these days are based on web services or use web services as its interface.  Thus, it is in your interest to learn about network based programs and program execution.  You will also need to think about safeguarding the code you write and ensuring its availability as you are progressing with your studies. So, you might need to learn about server management and file sharing.

One of the lesser known file sharing technologies is iSCSI ( Internet Small Computer System Interface, an Internet Protocol (IP)-based storage networking standard ).  It typically use TCP ports 860 and 3260 and provides authentication for secure sessions.  It is based on the Target ( server ) and the iSCSI Initiator ( client ) model that is built into Microsoft Windows 7 and above or can be freely installed on XP machines for iSCSI support.

There is not much "talk" about this technology, so I wanted to bring this technology to light for those of you interested setting up a home based network environment.

Watch video on how to setup and use a ReadyNAS based system.
http://youtu.be/Ag3tfc2VSUA

 

Problem to Execution Methodology

Computer Science does not start by coding, but preparation and analysis in order to solve a problem at hand. That process requires many years of preparation and logical approach to solve problems. Thus, computer science is not as dependent on the programming language as most people think it is. Your first question about computer science should not be, "What language I should learn?", but how do I learn to solve mathematical problems. Problem solution starts with simplification, pattern recognition, and strong math background to create an algorithm that can solve the problem at hand in a finite amount of time and in a reliable way. Lately, we might also add the consideration of "securely" in order to solve problems in a way that is securely controlled.

                                                                   Methodology

                                      Problem                                           Logical thinking
                                           |
                                          V
                                     Analysis   <----------------              Simplification, experiments, pattern recognition                                                           |                                  |
                                          V                                 |
                              Algorithm Design  <----------- |              Math
                                           |                                  |
                                          V                                 |
                                      Coding  <-------------------|               Language ( security )
                                           |       <---------------- |   |
                                          V                             |   |
                                 Pre-processor                 |   |              Operating system  ( security )
                                           |                              |   |
                                          V                             |   |
                                    Compiler------ Error ---     |             Integrated Development Environment ( IDE )
                                           |                                  |
                                   (No Error)                          |              Syntax error depends on language used
                                           |                                  |
                                          V                                 |
                    Library --> Linker                              |             Operating system  ( security )
                                           |                                  |
                                          V                                 |
                                     Loader                              |             Operating system  ( security )
                                           |                                  |
                                          V                                 |
                                     Execution ------ Error ----              Run time error ( strong testing methodology )
                                           |                                                                    Input validation
                                   (No Error)                                        Logical errors hard to detect (test, test, test, ...)
                                           |                                                                        ( security )
                                          V
                                      Results                                                    Aesthetics and user friendliness
                                                                                                ( security -  displayed error messages )

In many cases, you will need to learn how to compile your code, but the Graphical User Interface ( GUI ) based IDE environments can divert your attention from how the process actually works.  I have created a video to help you understand the process of compiling code.  The video will also show you how to create libraries and DLLs and compile these static and dynamic libraries into your code.

http://youtu.be/7Gt5FJpEQvA

ROT13 in Powershell

Let see if someone would like to talk about this function. You can open your administrative command prompt and type powershell. Copy and paste the following function onto the powershell command line.

Function Rot_num([string]$str, $n)
{
$value=""
For ($index= 0;$index -lt $str.length;$index++){
$ch= [byte][char]($str.substring($index,1))
if ($ch-ge 97 -and $ch -le 109){$ch=$ch+ $n}
else {
if ($ch-ge 110 -and $ch -le 122){$ch=$ch- $n}
else {
if ($ch-ge 65 -and $ch -le 77){$ch=$ch+ $n}
else {
if ($ch-gt 78 -and $ch -le 90){$ch=$ch -$n}
}
}
}
$value=$value+ [char]$ch
}
Return $value
}

After you have pasted the function above, you can start using it to see how it works. Just type rot_num followed by a string and the number 13. Then you can do the same to decrypt the value by typing rot_num encrypted message and the number 13 again. It should decrypt the encrypted message.

PS C:\> Rot_num Hell0Urhere2014 13
             Uryy0Heurer2014
PS C:\> Rot_num Uryy0Heurer2014 13
             Hell0Urhere2014

So, talk about what this code does and what is ROT-13.

Certificates

In many case, students learn coding because it is in the computer science curriculum, but until graduate school. computer science is nothing else but coding without many real world applicable meaning of those skills.

Using learned skills take time and applying the skills learned in the classroom takes time or will it?  Programming languages evolved to a stage where traditional computer science classes should produce skills much quicker than even 10-15 years ago.  Languages like Scratch, Kodu, SmallBasic, ... can teach kids from age 6-7 to code code that used to take weeks to create.  Thus, we should be able to apply learned skills in much higher level by the time students reach college.

That requires learning the environment and terminology where the code will be placed, what we refer to as Information Technology ( I.T. ).  What is the point to let a programmer design a code that will be used in a network environment if the programmer have no idea what broadcast traffic is and the final code will broadcast so much that will bring the whole network to a halt.

Code can be performing the same function we talked about in the early stage of programming, but elevate the skills to include security concepts even at the simplest level.

Let see what we can do about understanding X509 certificates used in the Public Key Infrastructure ( PKI ) environment.

Generate a a public / private key certificate on your computer that can be used with Microsoft's Encrypting File Systems ( EFS ) to be the recovery agent.  Recovery Agents are used to help users get back to their files in case if the user forgets the password or if the user's certificate is lost or corrupted.  It might be considered the "back door", but for good purpose and need to know how to manage this configuration to provide security instead of vulnerability.

In forensic investigation, we also need to know how to use this process in order to recover user files for investigations and what are the consequences of resetting system passwords without actually finding the user's password.  Offline resetting user password will lose our ability to recover file content with the user's credentials, but we can still get to the user file content using the recovery agent credentials.

C:\>cipher /rc:\temp\recoveryAgent
Please type in the password to protect your .PFX file:
Please retype the password to confirm:


Your .CER file was created successfully.
Your .PFX file was created successfully.

At this point, we have a certificate that we can work with, but you might want to see how to use it in the operating system.

Type certmgr.msc and import the certificate.  Double click on the certificate to see its details.

So, can we see the same type of information by writing our own code?  We should be able to read the details of this certificate by using predefined libraries where we do not need to implement a class full of methods and dissect the structure in a "painful" way.  Technology can help and we can read teh certificate like we read any other simple text input file.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Security;
using System.Net;
using System.Security.Cryptography.X509Certificates;

namespace ReadCert
{
    class Program
    {
        static void Main(string[] args)
        {
            X509Certificate cert = X509Certificate.CreateFromCertFile("c:\\temp\\recoveryAgent.cer");
            System.Console.WriteLine("Serial Number: {0}", cert.GetSerialNumberString());
            System.Console.WriteLine("Effective Date: {0}", cert.GetEffectiveDateString());
            System.Console.WriteLine("Name: {0}", cert.GetName());
            System.Console.WriteLine("Public Key: {0}", cert.GetPublicKeyString());
            System.Console.WriteLine("Pblick Key Algorithm: {0}", cert.GetKeyAlgorithm());
            System.Console.WriteLine("Issuer: {0}", cert.GetIssuerName());
            System.Console.ReadLine();

        }
    }
}

The output will show something like this:

Serial Number: 1B982E5AE7996DB54A2539E549580EAF

Effective Date: 10/21/2014 7:41:40 AM

Name: CN=Zoltan, L=EFS, OU=EFS File Encryption Certificate

Public Key: 3082010A0282010100C8CB222A159660D559147EA174004766B619B1C6478897F6DF

79EE28C9A4BC26984009B915FDEE6669F27A3E56AD592CC22A3D89FEBA94A6BB778C6A9A804E1489C4F23B8903ADBB71364546500611606E8D5E8F9C9D8DA0F231C7696251BC24671A31F0DA562F63607032A1E9ED69E772059686EE128E8D6D303A0E1856748ED3B8CA9C17121D933810B0D274CD87AD066E710466A5657CE4946C7F14827E99F20634CE096867685134AB752770CFA0C5DDCC95BF20EBE9651D097BCD7A792CB38389FD0FEDC702F23EC2AA9B3AC8873EDF5E525241263CE7641881E5E052D681460EBE8F69C2887AA8DD6FC28A81602257F4139EC34C40173868DC240F6AC70203010001

Pblick Key Algorithm: 1.2.840.113549.1.1.1

Issuer: CN=Zoltan, L=EFS, OU=EFS File Encryption Certificate

You still have to understand what this means and how to use it, but it is much better conversation than writing the good old "Hello World" read from a text file.  Embrace technology and learn about I.T. with coding in mind not the traditional business based computer science based thinking to find the area of the pizza pie.