Hexdump.exe

0 views
Skip to first unread message

Rita Seliba

unread,
Aug 5, 2024, 7:39:11 AM8/5/24
to cabarmitigs
Howeveron Windows, i couldn't found a good equivalent for hexdump. I'm using MinGW64, so basically i was looking for a hexdump.exe that i could simply add to my MinGW repo. I did found two of them, but none is the same as the linux one; they're just the same as hexdump -C

To install, just copy the file hexdump.exe to a folder on your Windows PATH, for example C:\Windows.You may need administrator permissions to copy the file.We recommend you set up a C:\Bin directory for files like this.


SOLUTION 3

o ntbackup to local linux backup server via SAMBA share

o schedule scp transfer to remote linux server

o remote linux server archives backup

o remote linux server creates redundant copies


Rischip, so let me get this straight, you have a script which runs hobocopy. Hobocopy then uses VSS to copy the data to a set location, rather than into a BKF file. You use 7-zip to make the tarball from within windows, and then you use rsync via ssh to transfer the files. Is that correct?


There should be no problem keeping the backup server on Linux.

Use NTBackup to do backups on windows, then 7-zip the .BKF file. Transfer to Linux box using Rsync over SSH. In order for Rsync to work you pretty much need to install CYGWIN on Windows. This should retain file permissions inside the .BKF file.


hexdump.exe binfile.bin 2>stderr.bin > binfile.out

}

The top of these two lines uses CYGWIN on Windows and generates 8 random characters. The custom program hexdump reads in the file and converts to 16 hexidecimal digits. Therefore creating a 64 bit random password.


About two years ago, I started using Windows DFS Replication (DFS-R, a replacement for FRS) to create synchronized replicas offsite. This works well; and if you are running Windows Server 2003 R2 or above, DFS-R does efficient block-level replication (prior to that release, it did file level replication). Because replication faithfully copies even corrupted files, you then create snapshots on the remote server, allowing rollback to several earlier copies.


Description: Hexdump.exe is not essential for Windows and will often cause problems. Hexdump.exe is located in a subfolder of the user's profile folder.Known file sizes on Windows 10/8/7/XP are 55,300 bytes (50% of all occurrences) or 36,868 bytes.

There is no information about the author of the file. The program is not visible. The file is not a Windows core file.Hexdump.exe is able to monitor applications.Therefore the technical security rating is 65% dangerous.


If hexdump.exe is located in the Windows folder for temporary files, the security rating is 56% dangerous. The file size is 55,300 bytes.The program has a visible window. There is no information about the author of the file. The program starts when Windows starts (see Registry key: Run, MACHINE\Run).It is not a Windows system file.Hexdump.exe is able to monitor applications.


Important: You should check the hexdump.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


The following programs have also been shown useful for a deeper analysis: ASecurity Task Manager examines the active hexdump process on your computer and clearly tells you what it is doing. Malwarebytes' well-known Banti-malware tool tells you if the hexdump.exe on your computer displays annoying ads, slowing it down. This type of unwanted adware program is not considered by some antivirus software to be a virus and is therefore not marked for cleanup.


A clean and tidy computer is the key requirement for avoiding PC trouble. This means running a scan for malware, cleaning your hard drive using 1cleanmgr and 2sfc /scannow, 3uninstalling programs that you no longer need, checking for Autostart programs (using 4msconfig) and enabling Windows' 5Automatic Update. Always remember to perform periodic backups, or at least to set restore points.


Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the 6resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the 7DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.


Maresware was originally developed for analysis of very large mainframe data files during the 1990's. Thats ancient history for millenials. It was then ported to the PC for forensic analysis. Written as clean 'C' code makes it very fast and efficient. Just find a file and download it. Some are encrypted which means call for the password.


All Maresware is command line driven, so brush up on your typing skills.

However, for those who know how to type, you may find many of the programs very useful.

Also: check out the alpha indexes at the bottom of each page.

If you find any broken links, or other problems (except spelling errors), let me know at: d...@dmares.com



One Liners describing each


Those items indicated without a link or "special request" require an email or phone callto acquire. Only becuase i haven't yet uploaded the binary.



MOST POPULAR FORENSIC PROCESSING

Compare Perform field comaprison on "FIXED, Mainframe compatable data", two files which are sorted on same field. Co-worker of hash.exe output.

Diskcat A command line (scripable) producing forensically sound file cataloging/listing process. (see list_it article below).

HASH A program to calculate various MD5, SHA of files. Plus a lot more. Produces forensically sound results. (See forensic hashing article below.)

Hashcmp Compares two files created with hash.exe to see which hashes match FileA to FileB

Hashdup Finds duplicate hash values in the output produced by hash.exe

MD5 Program to calculate the MD5 and SHA of files. Similar to hash.exe. Various output formats are possible.

Upcopy A forensically sound copy program. Certifiable for those wishing to take the time. See the forensic file copying article below.

RM and RMD: A program to remove and overwrite files.




These articles discuss the forensic needs and usefulness of programs that were tested to evaluate their forensic and evidentiary results.

The articles discuss various processes (ie: file listing, hashing, copying, zipping of evidence), and comparisons with as many as 40 comparable programs to test against some standard NTFSdata sets to see which ones pass or fail the forensic evidentiary tests. You will be surprised.


Inventory/Catalog files Creating an inventory of evidentiary files for evidence purposes, andreport production.

Forensic file copying Article tests over 40 "forensic" progams which claim to betrue evidentiary file copiers. HA HA.

Forensic Hashing Article tests over 30"forensic" hash programs which are recommended as forensically sound. (i have a bridge in Brooklyn for sale).

ZIP-IT for forensic retention Article test a few zipping programs which might be used to store evidentiarydata for posterity. Do they really store all the evidence?

ZIP_IT_TAKE2 Moretests for your zipping capabilities.

MATCH FILE HASHES Demonstrates hash matches using Maresware. Processes to find or eliminatenon-essential evidentiary files.

A HASH software buffet How-to use the various Maresware hash software. Contains some samplebatch file links.




These sample files and the software groups below all relate to the above mentioned articles:

Some of which are encrypted, so if you wish to use them, contact me for the passwords. d...@dmares.com



_50_FILES.exe Contains approx. 50 test files for catalog testing. (encrypted, call for password)

_BATCHES.exe Contains various batch files to be used with the demo files.

_DEMO_FILES.exe Contains about 1000 sample files used in the MARESWARE software test lecture. (encrypted, call for password)

_CATALOG_EVIDENCE.exe Suite of sample data files for use in testing some of your software. (encrypted, call for password).

_POWERPOINTS.exe Powerpoint lecture files. (encrypted, call for password)

_PRETEST.exe The pretest for the software test lecture.




In doing the research and software testing for the articles above, I downloaded various shareware, public domain, and other free software which I used in testing articles (above).

If you are interested in obtaining some of the software without having to search the internet for such software, you may wish to download those groups listed below.



Most of the software I used (except some which may be specifically licensed to me) in the testing articles above is included in those packages below.

You may wish to test your forensic capability using some of the above test data files provided and follow the processes outlined in the articles.

Download the test data above so your tests will have a similar environment that I used in my tests. Then compare your results with mine found in the articles.



Sizes shown are the size of the compressed executables. obviously they expand much larger.

_SOFTWARE_BIG.exe Large collection (about 1G) of software for you to put thru the tests. (encrypted, call for password)

_SOFTWARE_MIN.exe Minimal number (about 800 Meg) of software for you to put thru the tests. (encrypted, call for password)

_SOFTWARE_CATALOG.exe Collection (about 100 Meg) of file/cataloging/listing software to test. (encrypted, call for password)

_SOFTWARE_COPY.exe Collection (about 350 Meg) of forensic file copy software to test. (encrypted, call for password)

_SOFTWARE_HASH.exe Collection (about 460 Meg)of forensic file hashing software to test. (encrypted, call for password)




bates_no demo A zip file containing about 10 files for you to rename using the bates_no.exe program.

collate_demo.zip Sample files to learn about the the collate program.

compare_demo.zip Sample files to test the compare.exe program. Compare your hash outputs against NSRL known.

datevonv_tests.zip Contains sample files with various date formats to test your dateconversion software.

eml_proc_demo.zip Contains a few sample .eml file to test the eml_proc.exe program.

hash_demo.zip Zip file containing: 32 bit .exe, with sample files and a sample batch run.

hash_dup_demo.zip Contains a few sample hash file outputs to test the hash_dup.exe program.

hashcmp_demo.zip Contains a few sample hash file outputs to test the hashcmp.exe program.

LongFileName_FILES.7z.zip Sample long filename > 255 files to test your cataloging software on an NTFS file system.

md5_examples.zip A few sample files to check your md5 program calculations.

samples.zip About 8 files with sample keywords for various searching needs of meta-data.

test_icac.zip A crude script to catalog and then extract possible ICAC related files based on filenamesearches.

verticle_demo.zip Some sample data files with wide records that can be converted to multi-line records for reports.

x-ways_meta.zip Various (old) x-ways meta-data report outputs, with help on how to convert to a reasonable format for reports.

script to convert the x-ways copylog.html



3a8082e126
Reply all
Reply to author
Forward
0 new messages