As a side note, I must say I was rather disappointed and surprised that there is apparently no *nix tool that will peform bitwise operations of the sort I seek. I thought the challenge would be finding a windows tool, not a Linux one. Eric :-----Original Message----- :From: plug-discuss-bounces@lists.plug.phoenix.az.us :[mailto:plug-discuss-bounces@lists.plug.phoenix.az.us] On Behalf Of evb :Sent: Sunday, March 11, 2007 8:20 AM :To: 'Main PLUG discussion list' :Subject: RE: OT: Bitshift, howto : :Hello CG, : :After my initial post, I found Cygnus hex editor. This tool :does what I want at the file level. Winhex does it too; I :just didn't want to buy the license. I've been very busy :since I first posted to the list. : :I'm going to try again with HW (trial) and also Winhex (trial) :to see if I :can modify at the sector level. Thanks for you help. : :Eric : ::-----Original Message----- ::From: plug-discuss-bounces@lists.plug.phoenix.az.us ::[mailto:plug-discuss-bounces@lists.plug.phoenix.az.us] On ::Behalf Of Carlos Macedo Gomes ::Sent: Wednesday, March 07, 2007 7:35 PM ::To: Main PLUG discussion list ::Subject: Re: OT: Bitshift, howto :: ::Hi Eric, :: ::I believe Hex Workshop [1] (a Windows based tool) will do :what :you want. It can handle file and sector circular :bitwise :shifts in either direction and has options for taking :into :account the data's Endian-ness. I'm not sure about :doing an :entire partition but since you can open an entire :drive w/ the :tool you may be able to do the shift. If you :have the ability :to write the partition to an image file :(e.g., using something :akin to DriveSpy's [2] SavePart :command) then you can bitshift :the image file and possibly :achieve your objective. :: ::Let me know if this helps or, if not, what alternatives you ::find as I'd be interested in the results. I do some digital ::forensics support at work (for a local Fortune 50) and teach ::cybercrime/digitalforensics at night. :: ::thanks, ::C.G. :: ::[1] http://www.bpsoft.com/ ::[2] http://www.digitalintelligence.com/software/disoftware.php :: ::On 3/7/07, evb wrote: ::> ::> Sorry for the OT post, but all my other avenues have :failed. Thus I :> am seeking out the advice of the technorati :on this list. ::> ::> I would like a tool(Linux or Windows) that would bitshift :all bits :> within a defined scope :(file/sector/partition/etc). Specifically, I :> would like a :tool that will perform the following operation :at the :file/sector level: ::> http://en.wikipedia.org/wiki/Circular_shift ::> ::> I already have a tool that will shift bits at the sector :level, but :> only if the data is on a floppy disk and only in :DOS; other :media and :> Oses are not supported. VMWare also :is not supported. ::(That tool is ::> called Anadisk; you can find a trial version here, fyi: ::> http://retro.icequake.net/dob/files/bleuge/anadisk.207/). ::> ::> The tool "Winhex" already has a simple feature (Edit > :Modify Data > :> Invert/XOR/RightShiftby1/LeftShiftby1) but :for various reasons I :> cannot use it. ::> ::> Any suggestions are appreciated. ::> ::> Eric Van Buskirk ::> Assistant City Prosecutor/CISSP ::> City of Phoenix ::> ::> --------------------------------------------------- ::> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us ::> To subscribe, unsubscribe, or to change you mail settings: ::> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss ::> :: :: ::-- ::powerofprimes@gmail.com ::Carlos Macedo Gomes ::_sic itur ad astra_ ::--------------------------------------------------- ::PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us ::To subscribe, unsubscribe, or to change you mail settings: ::http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss : :--------------------------------------------------- :PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us :To subscribe, unsubscribe, or to change you mail settings: :http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss --------------------------------------------------- PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us To subscribe, unsubscribe, or to change you mail settings: http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss