Call for DOS scripting expert to fight fraud

[many a good man]

I need a batch file written in DOS (not WSH) that will display for all directories...

c:> dir /s *.*

...but ONLY for files that have values of 90 or less days for each of the following timefields:
* creation ( /t:c )
* last access ( /t:a )
* last written ( /t:w )

It should be able to be piped out to a textfile or to lpt1. Its OK if you just run the same command 3 times, once for each timefield and append each one to the output. No need to get fancy, the important thing is to be able to exclude all files touched longer than 90 days ago.

Please keep kicked for the late night crew. Ya never know what comes out at night!

[m0nkeyneck]

1. why a bat file?

[many a good man]

3. Because it contains more than one command

Whatever. Just need a script that'll work.

[m0nkeyneck]

5. the easy way..

start here

[Obviousman]

2. no clue what you're talking about

But I'll kick

[Eikon]

4. I can do it, but...

can these commands be shelled from Windows? If it has to be pure DOS I don't know If I can help. Otherwise I can make a nice front end for it in VB.

[many a good man]

7. Plain old DOS

As simple as it gets.

;-)

[libertypirate]

6. questions...

what version of DOS?

IBM DOS, MS DOS

and version number please, I need to look up what the commands can do and their output values.

Thanks

[many a good man]

8. v6.0 compatible

I think there was only one DOS starting at 6.0.

[MikeDuffy]

9. Doesn't DOS 6.0 only have a single date (creation/last update date)?

I used to fool around with DOS files using Norton Utilities, and I remember there only being a single date/time associated with any file (and which was stored in the 32-byte directory entry that was associated with every file). Starting with Win95 and Long File Names there arose more directory data that could be associated with each file (and I would have to look up the new data structure, etc which must have more room for the additional dates), but unless I am off base here (certainly possible) I am thinking more information is needed about a) exactly what operating system created the files and b) what operating system the BAT files will be run under.

Subsequent Edit info: See http://www.xxcopy.com/xxcopy15.htm for some additional info about Win95 and dates. I don't know if the problems noted with Win95's handling of dates exist with later OS's.

[electropop]

11. Yup, DOS files have only one date

This is what bothered me about it. Other than that, I could probably write this script, as I am so old I pre-date DOS in my computer experience. Is there any value to writing it for one-date operation?

[EuroObserver]

10. Maybe I can help

But DU doesn't let me send private mail yet.

You can email me: apb at dracnet dot es (I'll reply from a different address).

I used to program under DOS 20 years ago (London Stock Exchange 'big-bang' SEAQ, for example). Actually, for a job like this, I'd prefer to write a little program in C, DOS's dir command being so badly designed (and never improved by Gates). However, I have ideas, using batch commands, that may serve. If you give me the word, I even have here an old 386 PC that's still alive, and, I find, a set of original Microsoft DOS 6.0 installation disks - I'd be prepared to reformat this machine, install MSDOS 6.0 and develop and test what's required - if we have time.

There will be only one date field - indicating the last time a file was written (created or modified).

Anyway - details better shared privately...

I'll be close to the computer for the next several hours if you choose to contact me (17:30 GMT+1 here).

[You do not need that]

12. The T-parameters seem to apply only in Windows NT 3.1 shell...

" /T<[:> timefields] (NT3.1)
Time field used to display and sort:

* A Last Access
* C Create
* W Last Written (default)"

http://home.earthlink.net/~rlively/MANUALS/COMMANDS/D/DIR.HTM

[MarkusQ]

13. If you have access to a suspect machine DON'T PLAY WITH IT!

It's value as evidence depends on it not being tampered with, and careful documentation of the chain of custody (who had it, where they got it, etc., in detail, written down...)

The best thing for a crook would be for some amature to get to the evidence of their crimes before a trained professional does. Because odds are, it won't be evidence after they've "looked at it."

If you have something, get trained professional help NOW.

--MarkusQ

[many a good man]

14. New information

We have to assume we won't be allowed to write to the file system so it has to be able to be executed on a command line and output to a printer.

Operating system could be anything from DOS 6.0 running on a x386 to every version of Windows that has come out in the past 15 years.

Its OK to have more than one script. One script can be run in the DOS 6 environment on one machine, the other in Windows command shell on the other ones.

The important thing is to filter out the unwanted files, i.e., those not changed (or accessed or created, if possible) in the last 90 days. It must be piped out to a printer so we don't want to have to print out hundreds of pages. Since we can't save a file to the file system, I'm thinking we have no choice except to use DOS commands.

Thanks to everyone for their input....

[MikeDuffy]

15. Are you going to be able to use a floppy for input?

In particular where is the BAT file(s) that you want to execute to reside? If you cannot write to the file system's hard disk at all, and there is no floppy/etc for access to these BAT files, are you confined to keyboard input only (to create a temporary ram disk file space perhaps??) If you ARE allowed to insert a floppy for input, then might you also be allowed to write a redirected text file back to the floppy containing the desired directory information (rather than to a printer if you so choose)?

[trotsky]

16. If it's really DOS then it will use the FAT file system

which means you only have a "last modified" date, not accessed or created. Those additional specs are only available with the NTFS file system, which began with Windows NT.

[mulethree]

17. Lazy!

Kudos if someone gives you an answer. DOS Batch isn't like a shell scripting language. This is why there are thousands of utility programs to do this kind of stuff, because BAT can't. Of course there are also dozens of utility programs to change the date for a file as well.

Your dir /s has already missed every hidden file and every file under a hidden directory. Even if you got it to only print files within a specified date range, you could have missed a lot of files.

There are patches - unofficial ones - to 'fix' the command.com so that "/s" won't skip hidden stuff. Modern - Windows 'dir /s' walks into hidden dirs, though it doesn't list the hidden dirs. On some DOS's you can use dir, (DIR{comma}) to list the system and hidden files along with the rest.

Dir /ad - to list all the subdirs
Dir /ah /a-d - to list hidden files
Dir /O-D /p - to list the newest files first and pause after each screen

Now go through your subdirs, yes manually - through the entire directory tree, and repeat the above. Use screenprints or direct the whole session to a file on the floppy drive.

Or you could try to get them to copy the hard drive and give you the copy. This makes sure that you don't change anything on their original, but would also let you use better tools.

So what are you going to do with a list of directory and file names for recently touched files once you get it?

[EuroObserver]

18. Yes

You're right, mulethree. The old DOS world, and as transposed into the Win environment, was always a kludge (as is still Windows itself (offtopic but I'm moving towards open LINUX)). Speaking to you from a Dell with Win XP Pro, non-MS firewall + other measures.

In those old days I preferred to run DRDOS on systems under my control (however (offtopic), the monopolist won, up to now - we're working on the problem, at least here in Europe).

For a job like this, I'd prefer to write a little program in C, or even Assembler, to make sure.

I'm still waiting to hear whether we can expect to have read/write access to a floppy disk A: or B: or not.

Of course, any such program or script, and the intervention (read only on _their_ file system!) SHOULD be extremely carefully examined by all parties, analysed, scrutinised, monitored, documented, witnessed, before being run - and, I take for granted, would become part of the judicial record.

[salvorhardin]

19. My 2 cents

IF the machines have bootable CD drives, then get a copy of Knoppix (or your favorite Linux Live CD) and boot into that. That way you'll never have to worry about corrupting the file system on the DOS/Windows side. Then just write yourself a simple little perl (or even bash) script to do the job. That's what I'd do.
http://www.knoppix.org

In fact... the find command in Linux is exactly what you want. Very flexible. e.g.

find /path/to/windows-or-dos/partition -atime 90 > filelist.txt

would give you exactly those files modified in the last 90 days stored on your Knoppix temporary home directory as file filelist.txt.If you want to match to the beginning of the day 90 days ago and not just 90*24 hours, they you'd also specify -daystart as well. From there you can e-mail (using a webmail service and attaching the file) or copy the file to a floppy.

Here's the man page for find.
http://www.netadmintools.com/html/1find.man.html

Knoppix mounts the Windows partition as read-only by default so there'd be no chance of messing up the files on the harddrive.

[EuroObserver]

20. Probably won't have time or resources ($$$)

for this, no sé, but yes: that boot-linux from external medium option would be another (universal, except for the cd driver required) way to go.

¿Portable cd-drives connectable vía the serial port? ¿red herring?

I think we're looking for the quickest, simplest, but still most effective route - taking into account the age and diversity of the (I understand) MS systems in question.

[salvorhardin]

21. I don't understand what you mean about money

Knoppix is free.

As far as "drivers" go, there are none needed. If the computer supports booting off a CD, Knoppix will boot and there wouldn't even be any need to load the desktop environment so there's not even a problem with detecting old and out of date video hardware (which Knoppix does mostly transparently as well).

I don't know about CD drives connected by serial port.

[EuroObserver]

25. If the computer supports booting off a CD

It must have a CD driver previously installed.

[salvorhardin]

30. Sorry, no.

It has nothing to do with drivers. It has to do with the computer's BIOS and the CD hardware itself (has to be able to read El Torito standard: http://kb.indiana.edu/data/ancc.html?cust=023362.83043.131).

[lockdown]

22. Good suggestion

As mentioned, any analysis needs to be done in such a way that it can't modify the contents of the target drive, and a bootable Linux that runs in a ramdisk is the cheapest/easiest way imo. For instance, if you have full access to the drive, you could put it in another machine and use the Unix/Linux tool dd to create a full low level backup of the entire drive to another one, store the original and do all your work on the backup. I think that's a common technique in serious forensic analysis.

I'm no expert though and there is certainly more to it than that. If you think this drive could reveal some sort of evidence you need to bring in outside help who know how to do this stuff right. Which university was it that produced that detailed breakdown of Diebold flaws, maybe some help could be found in IT academic land?

[masaka___]

24. Knoppix is THE WAY

I just wanted to say that I think this is the way to go. It's way easier to do investigative work when not crippled by DOS's limitations.

[EuroObserver]

27. Right, but

"Operating system could be anything from DOS 6.0 running on a x386 to every version of Windows that has come out in the past 15 years."

And, I take it, the machine could also date from any time within that period.

And, I take it, we're talking about _many_ machines and little time.

[Alizaryn]

23. kick

[scottxyz]

26. Not sure how to do it just in DOS...

...but you might be able to combine Dos and textpad (free from textpad.com - it has grep) - or even excel.

Do this:

dir /s *.* /t:c >alldirs-created.txt
dir /s *.* /t:a >alldirs-accessed.txt
dir /s *.* /t:w >alldirs-written.txt

Yes, this gives you ALL the files - but then you can open these 3 files in textpad or excel and try sorting them on the column you want.

Might not be a bad thing to have the output for ALL files in a textfile - sort of shows your work. The final sorted results could be "saved as" to a different file.

[many a good man]

28. Both hands tied behind our backs

I have a feeling if that if we ever get the chance they'll make things as difficult for us as possible. Only if something fishy turns up would we probably ever get the chance to run heavy forensics against it.

Under my XP command shell, I think the best switches to use are as follows...

dir /s *.* /a /n /-c /o:-d /t:c > file1.txt

...followed by the same command but with the two other timefields. Be nice if we can find as many equivalents as possible of this command in the earlier DOS versions. If we can put it on a floppy we can later analyze it in Excel or anything else. It'd also be nice to look at the files themselves that were touched during a count using tpu or something to search for hidden characters.

Thanks everybody for your ideas and your insight. A couple of people are working on this. No idea when or if we'll ever get a chance to use it.

Q: Anybody got DOS 6.0 installation disks lying around?

[KnowerOfLogic]

29. I've got 6.2 if you want them. nt

[many a good man]

32. Already got 'em

Thanks for the offer but I just found out we're all set now. Got everything covered on the O/S side. Hopefully we'll have one of the scripts ready soon (6.0). If somebody can come up with a DOS script that runs in 2000/XP in the next two days we'll save time.

:toast:

[MikeDuffy]

33. Some BAT code that may(?) help you...

I'm unclear what you need now, but maybe you can salvage
something from the following.  Since I didn't know where the
invoked BAT files would be residing, you will need to alter
code to reflect their path location.  To test this I assumed
the two BAT files DIR1012A.BAT and DIR_Y_M1.BAT are in the
root directory of C:, and the following command is entered at
C:\> 
  DIR1012A.BAT TEST.PRN
which outputs all output to TEST.PRN (arbitrarily named, LPT1
might could be used in some circumstances).

DIR1012A.BAT contents:
  rem Display DIR1012A.BAT and its contents, output to %1
->    
  rem lpt1/filename:
  echo %0: > %1
  type %0 >> %1

  rem Display DIR_Y_M1.BAT and its contents, append to %1
->
  rem lpt1/filename:
  echo DIR_Y_M1.BAT: >> %1
  type DIR_Y_M1.BAT >> %1

  rem Display numbered directory list, append to %1 ->
  rem lpt1/filename:
  dir *.* /s /a /o:gn | find /n "Directory of"
>> %1

  rem Display 3 months changed file list, append to %1 ->
  rem lpt1/filename:
  call DIR_Y_M1.BAT 04 10 %1
  call DIR_Y_M1.BAT 04 11 %1
  call DIR_Y_M1.BAT 04 12 %1


DIR_Y_M1.BAT contents:
  rem Display numbered directory list of changed files for:
  rem %1 -> YR, %2 -> MO, append to %3 ->
lpt1/filename:
  dir *.* /s /a /o:gn | find /n "%2-01-%1" | find /v
" ." | find /v " .." >> %3
  dir *.* /s /a /o:gn | find /n "%2-02-%1" | find /v
" ." | find /v " .." >> %3
   ... etc (one line for each of the possible days of the
month) ...
  dir *.* /s /a /o:gn | find /n "%2-31-%1" | find /v
" ." | find /v " .." >> %3

I used the "/n" option of FIND and the
"/o:gn" option of DIR so that one could use the
attached line number to a changed file to locate what
subdirectory that file resides in.

Good luck!  

[MikeDuffy]

34. Revision of code

The following looks for "last change date" between
09-15-04 and 12-15-04 and outputs to TEST.PRN:
  C:\>  DIR0912A.BAT TEST.PRN

DIR0912A.BAT contents:
  rem Display DIR0912A.BAT and its contents, output to %1
->
  rem lpt1/filename:
  echo %0: > %1
  type %0 >> %1

  rem Display DIRYMDD1.BAT and its contents, append to %1
->
  rem lpt1/filename:
  echo DIRYMDD1.BAT: >> %1
  type DIRYMDD1.BAT >> %1

  rem Display numbered directory list, append to %1 ->
  rem lpt1/filename:
  dir *.* /s /a /o:gn | find /n "Directory of"
>> %1

  rem Display 3 months changed file list, append to %1 ->
  rem lpt1/filename:
  call DIRYMDD1.BAT 04 09 15 30 %1
  call DIRYMDD1.BAT 04 10 01 31 %1
  call DIRYMDD1.BAT 04 11 01 30 %1
  call DIRYMDD1.BAT 04 12 01 15 %1


DIRYMDD1.BAT contents:
  rem Display numbered directory list of changed files for:
  rem %1 -> YR,%2 -> MO,%3 -> Start DY,%4 -> End
DY, append to %5 ->
  rem lpt1/filename:
  goto B%3
:B01
  dir *.* /s /a /o:gn | find /n "%2-01-%1" | find
/v " ." | find /v " .." >> %5
  if %4 == 01 goto END
:B02
  dir *.* /s /a /o:gn | find /n "%2-02-%1" | find
/v " ." | find /v " .." >> %5
  if %4 == 02 goto END
   ... etc (three lines for each of the 31 possible days of
the
month) ...
:B31
  dir *.* /s /a /o:gn | find /n "%2-31-%1" | find
/v " ." | find /v " .." >> %5
  if %4 == 31 goto END
:END

Notes:
  1) Code should be good for DOS 6.0 and all Windows (tho not
tested for all).  Of course, all code needs to be tested
thouroughly, if possible.
  2) Code documents itself for audit purposes by displaying to
output.
  3) Code then displays directory structure w/ line numbers
which allows subdirectory of each changed file (also line
numbered) to be determined.
  4) Code allows (and requires) explicit specification of date
range(s) of interest.
  5) I personally always prefer viewing data in ascending time
sequence, so wrote the code to accomplish that.  Code can be
easily changed for presenting data in descending time
sequence.

[many a good man]

36. This is great!

:yourock:

Can't wait to have it tested. I just hope they'll let us use a floppy disk.

I can't believe the future of civilization hinges on a floppy disk...

[MikeDuffy]

37. Do you need to prepare for the continency of

a) no floppy, input only via keyboard and output via printer (and display monitor)?
b) what else?

[many a good man]

38. Hafta type it blindfolded and with one hand tied

Just kidding. I can't imagine anything more restrictive than a)...

[MikeDuffy]

41. My thoughts on this:

1) If a ram-disk drive (like D: or another letter) is already
created by the boot-up process AND they allow you to write a
small amount of data to it, you could conceivably create BAT
file(s) there from keyboard input so they could be invoked
from the DOS prompt.
2) If not 1), I don't know how to create a ram-disk drive w/o
changing C:\CONFIG.SYS to add a driver file (in DOS) or
whatever else (in Windows XX).  
3) If they allow you to write a small amount of data to the
hard drive (C:) (after all, I believe I recall the piping
operations create temporary files that are automatically
deleted after the piping operation finishes), you could create
BAT file(s) there from keyboard input so they could be invoked
from the DOS prompt.
4) BTW to create a file from keyboard input, a crude way which
depends on making no typos is entering at the DOS prompt:
  C:\> type con > X:\xxxxxxxx.BAT
  first line of code (enter)
  second line of code (enter)
   ...
  last line of code (enter)
  Ctrl-Z (enter) <-- signals end of console (keyboard)
input
5) Entering the previous BAT files is time consuming and
error-prone.  An alternative is to enter a command like

  C:\>dir *.* /s /a /o:gn | find /n "Directory
of" > lpt1

to get the numbered directory structure printed, and then for
each day you want to scan for is to enter a command like

  C:\>dir *.* /s /a /o:gn | find /n "mm-dd-04" |
find /v " ." | find /v " .." > lpt1

to get the numbered list of files (and directories) last
changed on that day (where mm is the 2-digit month and dd is
the 2-digit day).  (After entering a command, pressing the
right-arrow key re-enters what you just typed, allowing
alterations in the "mm" and/or "dd"
strings and entering the F3-key fills in the remainder of the
command w/o further change).

[MikeDuffy]

31. A: Yes to MS-DOS 6.0 (3.5 inch)

Where do you want them sent, if you still need them?

[many a good man]

35. Already have 6.0; need Windows 3.1 install disks

We've got a nice little test environment going here...
:thumbsup:

[MikeDuffy]

39. I have plenty of original (licensed) install disks, including Win3.1

If you still need a couple of Win 3.1 install disks, either PM me (I can't you) or post where to send them. Do you need any other disks or manuals?

[FULL_METAL_HAT]

40. How about a ton of boot disks, win31 & "Computer Crime Investigator's Tool

#1 -- One of my favorite spots:

http://bootdisk.org/

Bootdisks
DOS Boot Disks
Windows 98 Bootdisks
Windows Boot Disks
NT 4.0 Bootdisks Windows 2000 Bootdisks
XP Bootdisks
NTFS Bootdisk

All Disks Include Universal CDrom Drivers

DOS 5 Bootdisk
DOS 6 Bootdisk
DOS 6.21
DOS 6.22
Windows 95
Windows 95 B
Windows 98
Windows 98 Second Edition
Windows SE
Windows Me Windows 2000 And NT Setup Disk Sets
W2K Pro
W2K Server
W2K Advanced Server
NT4 Bootdisk
NT 3.51 Bootdisk
Windows XP Setup Disk Sets
Windows XP Bootdisks
DOS Bootdisks

---

#2 -- I'll have Windows 3.11 for you in about 20 mins if you need it :)

---

#3 -- Computer Crime Investigator's Toolkit
http://www.secinf.net/misc/Computer_Crime_Investigators_Toolkit.html

Maybe that can give you some good insights!


Wish I was there to help!! :^)

All the best,
FULL_METAL_HAT