Skip to content

Instantly share code, notes, and snippets.

View atilaromero's full-sized avatar

Atila Romero atilaromero

20 followers · 0 following
View GitHub Profile
@atilaromero
atilaromero / JumpListIDs.csv
Created March 21, 2012 11:57
JumpList ids - from http://www.forensicswiki.org/wiki/List_of_Jump_List_IDs
We can make this file beautiful and searchable if this error is corrected: No commas found in this CSV file in line 0.
65009083bfa6a094 (app launched via XPMode) 8/22/2011 Win4n6 List Serv
469e4a7982cea4d4 ? (.job) 8/22/2011 Win4n6 List Serv
b0459de4674aab56 (.vmcx) 8/22/2011 Win4n6 List Serv
89b0d939f117f75c Adobe Acrobat 9 Pro Extended (32-bit) 8/22/2011 Microsoft Windows 7 Forum
26717493b25aa6e1 Adobe Dreamweaver CS5 (32-bit) 8/22/2011 Microsoft Windows 7 Forum
e2a593822e01aed3 Adobe Flash CS5 (32-bit) 8/22/2011 Microsoft Windows 7 Forum
c765823d986857ba Adobe Illustrator CS5 (32-bit) 8/22/2011 Microsoft Windows 7 Forum
84f066768a22cc4f Adobe Photoshop CS5 (64-bit) 8/22/2011 Microsoft Windows 7 Forum
44a398496acc926d Adobe Premiere Pro CS5 (64-bit) 8/22/2011 Microsoft Windows 7 Forum
23646679aaccfae0 Adobe Reader 9. 8/22/2011 Microsoft Windows 7 Forum
@atilaromero
atilaromero / mountmmls.sh
Last active November 15, 2018 13:16
mountmmls
mountmmls() {
mmls "${1}" | tail -n+7 | while read -ra i
do
[ ${i[1]} == ------- ] && continue
[ ${i[1]} == Meta ] && continue
echo mkdir -p vol${i[0]%:}
echo mount "${1}" vol${i[0]%:} -o ro,offset=$[${i[2]##+(0)} * 512],sizelimit=$[${i[4]##+(0)}*512]
done
}
@atilaromero
atilaromero / list bookmarks.sh
Created November 19, 2018 14:08
list bookmarks from places.sqlite (firefox)
sqlite3 places.sqlite 'SELECT b.url FROM moz_bookmarks AS a JOIN moz_places AS b ON a.fk = b.id'
@atilaromero
atilaromero / createVMDK.sh
Created November 19, 2018 14:13
Instantly create a vmdk file from a dd file.
VBoxManage internalcommands createrawvmdk -filename imagemHD.vmdk -rawdisk imagemHD.dd
@atilaromero
atilaromero / convert vbox image
Last active November 23, 2018 18:47
VBoxManage clonehd '{ff460fde-fac8-48b7-afbb-251ab0dc9342}' ff460fde-sdcard.dd --format RAW
@atilaromero
atilaromero / gist:5644bfb13c43ef3810118d2975a856e1
Created August 14, 2019 14:00
kubectl alpine
kubectl run -i --tty --rm alpine --image=alpine --restart=Never -- sh
@atilaromero
atilaromero / gist:f5695169724941d17e7ed99965c23dae
Created August 14, 2019 14:13
ip address in proc
cat /proc/net/fib_trie
@atilaromero
atilaromero / grep big file
Created August 14, 2019 18:33
stdbuf -i0 -o0 -e0 cat image.dd | tr '\000' '\n' | parallel --pipe --block 1G --recend '' grep -Fabf keywords.txt --label={#} -H | tee results.srch
@atilaromero
atilaromero / Disable automount using udev rules
Created August 20, 2019 19:50
# /etc/udev/rules.d/99-noautomount.rules
ENV{UDISKS_PRESENTATION_HIDE}="1"
ENV{UDISKS_PRESENTATION_NOPOLICY}="1"
ENV{UDISKS_AUTOMOUNT_HINT}="never"
ENV{UDISKS_SYSTEM_INTERNAL}="1"
ENV{UDISKS_IGNORE}="1"
@atilaromero
atilaromero / reset windows password
Created August 29, 2019 16:12
/Windows/System32/sethc.exe :StickKeys (press shift 5 times)
control userpasswords2
net user administrator /active:yes