I was searched by one of my bosses early in the morning according to one of my colleague. Not even before i have arrived to work yet. As his room can see clearly who walks in and out of the office, i was called upon even before i had the chance to put my backpack on my workstation yet. It seems he has a problem with his computer. I've checked it out and it seems his processor was runnig at 100% and the memory usage keeps on increasing even though there were no programs running. He said that he needed the laptop to be ready before afternoon.
So okay then. Being a guy who likes to help out others, i stayed on figuring what could be the problem as it was not detected by the Anti Virus. According to a friend of mine, that laptop was recently fixed by the IT department. He said the IT department said the problem was because of the battery. Wait a minute ? Come again.
Now i've heard some stories but this isn't one of them. I know that if a laptop runs on battery the performance is somehow lower. But changing a battery because the CPU is utilised at 100%?? Where did the dude graduated from?
After carefully analysing, i finally found a process that was running within windows and utilising the memory like nobody's business. After researching it through Google, i finally found the cause. The culprint process was winmgmt.exe. Not to be confused with WinMgmt. Yup, the capital letters.
So after spending so much time, i decided to go commando to the registry editor deleting every single registry that had connection with the culprit. Copied and restored the original WinMgmt exe and dll file, the CPU was running at correct resources again. By then, the boss was still out of his room in a meeting so i left the laptop there.
Before going back home later that evening, i went back to the office again and asking him whether his laptop is okay? He said no and it still had problem. WTF? i went straightly to the computer and checking the memory and cpu usage right in front of him. And then he said, oh it's ok. That was it.
That was it? What ever happened to a simple thank you. I waisted half a day doing something that a whole department couldn't do and not even a simple thank you. Yeah thanks a lot dude. Be sure to look for me again when the lights, thumbrive or radio is not functioning well. Oh by the way, this was not part of my jobscope. I'm hurt.
Moral of the story:
1 - where's my thank you
2 - 100% cpu and memory utilisation is not caused by a problematic laptop battery.
Showing posts with label computer forensic. Show all posts
Showing posts with label computer forensic. Show all posts
Sunday, November 09, 2008
Tuesday, May 27, 2008
When backup fails
We've all heard in our workplace to always make backup. Always make copy of your files. You never know when your computer might crash. So here's the thing. Yes, a few people do make backups and copies of their files, and a few don't even bother. It's when their computer crashes when they start to go in panic mode.
Reminds me of the Limp Bizkit song Rollin, "Backup backup, tell me what' cha gonna do now"
The IT guy would then ask "Did you make a backup copy of those files anywhere?"
The client will then reply, " If i did would i be calling you"
The IT guy would then go "(in silent mode) !@$#@%%&$%^$ (This is when you wish you could use the fist of death)"
So the lesson learned so far is always create a backup. It can be in a form of CD, DVD, external drive, diskette and other sorts of media. But what happens when your backup fails???
As i was minding my own business today, my manager called me up to his room. He said that his USB thumbdrive when plugged in gives out the message " The disk is not formatted. Do you want to format it now. Yes / No". Lucky him for not falling to the trick by answering everything to Yes. Unfortunate for him, the thumbdrive was the backup of his work as the original source was already deleted from another thumbdrive. So this is the classic case of when your backup fails and you have no more primary source. Ironically, a colleage of mine just asked me yesterday on the same problem. So i guess it's a desease when thumbdrive fails one by one.
Lucky for him that i was in a good mood. Opened up EnCase and confirmed that it was gone. Looked up in Google and finally found a tool that might help. Downloaded in and walla, it does the job. The tool was called PhotoRec. It did recover thousands of files, but if you are one of those file naming freaks might get a little panic for a while. It recovers file but you will have to forget about those file names entry. It has it's formats of naming convention and being a technical guy, i wouldn't mide coz that's how the system goes and works. So lucky for my manager that a lot of his files were saved but good luck looking for the right ones as it returns thousands and thousands of files that you may not even know existed. But i recommend the tool. Thumbs up for PhotoRec.
Picture source: http://www.flickr.com/photos/xxoos-jal/1449102918/
Do you really think a hot dog can save you in your time of need?
Reminds me of the Limp Bizkit song Rollin, "Backup backup, tell me what' cha gonna do now"And the same old dialogues that often you hear is, "dammit, i should have made a backup of it."
The next step is they call the IT guys,
"hey, my computer / hard disk just crash. Is there a way that you can recover them. I have very important files on the disk. I need to do a presentation to the boss and those files contains valuable information. I stayed up all night preparing for them"
The next step is they call the IT guys,
"hey, my computer / hard disk just crash. Is there a way that you can recover them. I have very important files on the disk. I need to do a presentation to the boss and those files contains valuable information. I stayed up all night preparing for them"
The IT guy would then ask "Did you make a backup copy of those files anywhere?"
The client will then reply, " If i did would i be calling you"
The IT guy would then go "(in silent mode) !@$#@%%&$%^$ (This is when you wish you could use the fist of death)"
So the lesson learned so far is always create a backup. It can be in a form of CD, DVD, external drive, diskette and other sorts of media. But what happens when your backup fails???
As i was minding my own business today, my manager called me up to his room. He said that his USB thumbdrive when plugged in gives out the message " The disk is not formatted. Do you want to format it now. Yes / No". Lucky him for not falling to the trick by answering everything to Yes. Unfortunate for him, the thumbdrive was the backup of his work as the original source was already deleted from another thumbdrive. So this is the classic case of when your backup fails and you have no more primary source. Ironically, a colleage of mine just asked me yesterday on the same problem. So i guess it's a desease when thumbdrive fails one by one.
Lucky for him that i was in a good mood. Opened up EnCase and confirmed that it was gone. Looked up in Google and finally found a tool that might help. Downloaded in and walla, it does the job. The tool was called PhotoRec. It did recover thousands of files, but if you are one of those file naming freaks might get a little panic for a while. It recovers file but you will have to forget about those file names entry. It has it's formats of naming convention and being a technical guy, i wouldn't mide coz that's how the system goes and works. So lucky for my manager that a lot of his files were saved but good luck looking for the right ones as it returns thousands and thousands of files that you may not even know existed. But i recommend the tool. Thumbs up for PhotoRec.
Do you really think a hot dog can save you in your time of need?
The moral of the story, if you were planning to back up something, make sure the destination is a reliable source. Forget those cute small type usb thumbdrive as that was what caused my manager to be in trouble in the first place. If you were going to choose a thumbdrive, i would recommend a normal size thumbdrive as so far they have never failed me compared to the small cute looking ones that you usually hang together with your set of keys.
ps: I've got to backup my hard drive one of these days.
ps: I've got to backup my hard drive one of these days.
Tuesday, May 20, 2008
Where the heck is that partition?

As i reached my office today, a colleague of mine was smiling ear to ear when he saw me and said, "Aaaaa, Mr. rizman, my saviour"... I was like what the??? It seems that he had a broken external drive. It was never really broken mechanically but virtually. The master boot record and partition has been deleted thus in Windows says that it is an unallocated space. I am not really sure what he did but he must have done something to make the partition go away.
Reaching out for my dusty old EnCase manual, referring back to partition recovery, i finally managed to rebuild back his partition and Voillaaa, they were all in one piece. I have been practically involved in computer forensics and this is the first time i have come accrosed a drive with a deleted partition (excluding the class exercise). Who might have thought that these kind of problems came from your own colleague and not from the people outside of the organization.
With this accomplishment i felt productive again!!!
Friday, February 22, 2008
Microsoft Word's Maximum Page
Ever wondered how many pages you can type in a Microsoft Word pogram??? Then read on...
I was trying to dump or restore a mysql data into a database server. Unfortunately the data query file is 140MB and this xampp sql query thingy couldn't support the size. So, in an act of curiosity wanting to find out why the data is so huge, i attempted to open the sql file in Microsoft Word and left it running while i went for Friday prayers.
After i got back from prayers, i got this message from MS Word saying that my data has exceeded the Microsoft Word'c capacity. And the maximum page Microsoft Word can handle is......
I was trying to dump or restore a mysql data into a database server. Unfortunately the data query file is 140MB and this xampp sql query thingy couldn't support the size. So, in an act of curiosity wanting to find out why the data is so huge, i attempted to open the sql file in Microsoft Word and left it running while i went for Friday prayers.
After i got back from prayers, i got this message from MS Word saying that my data has exceeded the Microsoft Word'c capacity. And the maximum page Microsoft Word can handle is......
Subscribe to:
Posts (Atom)



