BTS

Issue1299

Title forensic
Priority bug Status resolved
Superseder Nosy List bwf, jimmy
Assigned To Topics

Created on 2014-04-02.02:18:13 by bwf, last changed 2014-04-04.17:48:31 by mika.

Messages
msg4778 (view) Author: jimmy Date: 2014-04-04.17:24:36
Thank you for your report.
Yes, you can do anything READ-ONLY. forensic just makes sure, that you can not 
WRITE anything.
msg4773 (view) Author: bwf Date: 2014-04-03.03:43:13
Well,
Thank you.
That did the trick,
I selected forensic - tabbed - entered "toram"
I now have a nice forensic system in ram mode.
Thank you.

However, am I supposed to be able , as a user, non root,
open up pcmanfm, drill down into any folder..... /proc/cmdline
then copy and paste it into leaf pad,
then copy and paste it into this e-mail?
Thanks,
Brian


Load to ram tab edit read only 
> initrd=/boot/grml32full/initrd.img boot=live 
live-media-path=/live/grml32-full/ bootid=grml32full201403 apm=power-off vga=791 
nomce read-only toram=grml32-full.squashfs  BOOT_IMAGE=/boot/grml32full/vmlinuz 
 
 
 
Forensic mode:   initrd=/boot/grml32full/initrd.img boot=live 
live-media-path=/live/grml32-full/ bootid=grml32full201403 apm=power-off nomce 
vga=791 forensic nofstab noraid nodmraid nolvm noautoconfig noswap 
raid=noautodetect read-only  BOOT_IMAGE=/boot/grml32full/vmlinuz 
 


Forensics toram
initrd=/boot/grml32full/initrd.img boot=live live-media-path=/live/grml32-full/ bootid=grml32full201403 apm=power-off nomce vga=791 forensic nofstab noraid nodmraid nolvm noautoconfig toram noswap raid=noautodetect read-only  BOOT_IMAGE=/boot/grml32full/vmlinuz 








---- Andreas Gredler <bts@bts.grml.org> wrote: 
> 
> Andreas Gredler <jimmy@grml.org> added the comment:
> 
> Please be a little more precise so that I can exactly reproduce your issue.
> So I need to exactly know which boot entry in the menu you select or what you 
> type in on the isolinux prompt. There is no --setro optione, which option did 
> you mean? read-only? You can also post the output of "cat /proc/cmdline" after 
> booting.
> Another way to load Grml into RAM and have the devices locked down is to select 
> the menu entry "Load to RAM", hit TAB and append the option "read-only" and 
> boot.
> 
> _____________________________________
> GRML issue tracker <bts@bts.grml.org>
> <http://bts.grml.org/grml/issue1299>
> _____________________________________
msg4772 (view) Author: jimmy Date: 2014-04-02.17:23:05
Please be a little more precise so that I can exactly reproduce your issue.
So I need to exactly know which boot entry in the menu you select or what you 
type in on the isolinux prompt. There is no --setro optione, which option did 
you mean? read-only? You can also post the output of "cat /proc/cmdline" after 
booting.
Another way to load Grml into RAM and have the devices locked down is to select 
the menu entry "Load to RAM", hit TAB and append the option "read-only" and 
boot.
msg4771 (view) Author: bwf Date: 2014-04-02.10:24:49
Hello Andreas,
Thank you for your quick response.
My objective is to run forensic in ram mode, because I have an old
computer.
That was not possible with the cheat codes.

When I did boot into ram with the --setro option, the system was Not
locked down, as it is in pure forensic.


Thank You Again,
Brian





On Wed, 02 Apr 2014 08:58:22 +0000
Andreas Gredler <bts@bts.grml.org> wrote:

> 
> Andreas Gredler <jimmy@grml.org> added the comment:
> 
> > At boot prompt I typed: grml2ram forensic
> > It will not do, only boots to forensic.
> 
> So what happened? Were the devices not ro? Did some tests and it
> worked. Grml was copied to RAM and the harddisk device was set to ro.
> 
> > In the left pane it showed all the ro drives, BUT in clicking on
> > any one of them, they mounted into that partition, and I was able
> > to fetch files.
> 
> Yes, forensic makes the devices ro (read-only) but you can mount them
> and read files. But you can not write! to the device.
> 
> greets Jimmy
> 
> ----------
> nosy: +jimmy
> priority:  -> bug
> status: unread -> chatting
> 
> _____________________________________
> GRML issue tracker <bts@bts.grml.org>
> <http://bts.grml.org/grml/issue1299>
> _____________________________________
msg4770 (view) Author: jimmy Date: 2014-04-02.08:58:22
> At boot prompt I typed: grml2ram forensic
> It will not do, only boots to forensic.

So what happened? Were the devices not ro? Did some tests and it worked. Grml 
was copied to RAM and the harddisk device was set to ro.

> In the left pane it showed all the ro drives, BUT in clicking on any one of
> them, they mounted into that partition, and I was able to fetch files.

Yes, forensic makes the devices ro (read-only) but you can mount them and read 
files. But you can not write! to the device.

greets Jimmy
msg4769 (view) Author: bwf Date: 2014-04-02.02:18:13
Don't know if this is a bug or just by design.

I would like to run grml2ram in forensics

At boot prompt I typed: grml2ram forensic

It will not do, only boots to forensic.

So I did, grml2ram

Later after a complete load up, before I started x I typed:
blockdev --setro /dev/sda

This was great!
ro for users and infiltraters of my system,
root access of the folders for me!

Until I started up iceweasel and tested if I could import my bookmarks.

In the left payne it showed all the ro drives, BUT in clicking on any one of them, they mounted into that partition, and I was able to fetch files.


Is this a bug?

Question, is there a better cheatcode to run forensics in ram?

Thank You!


Brian
History
Date User Action Args
2014-04-04 17:48:31mikasetstatus: chatting -> resolved
nosy: jimmy, bwf
2014-04-04 17:24:36jimmysetstatus: resolved -> chatting
nosy: jimmy, bwf
messages: + msg4778
2014-04-03 10:05:53mikasetstatus: chatting -> resolved
nosy: jimmy, bwf
2014-04-03 03:43:13bwfsetnosy: jimmy, bwf
messages: + msg4773
2014-04-02 17:23:05jimmysetnosy: jimmy, bwf
messages: + msg4772
2014-04-02 10:24:50bwfsetnosy: jimmy, bwf
messages: + msg4771
2014-04-02 08:58:22jimmysetstatus: unread -> chatting
nosy: + jimmy
messages: + msg4770
priority: bug
2014-04-02 02:18:13bwfcreate